| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| active-directory-b2c | Custom Email Mailjet | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/custom-email-mailjet.md | A verification display control is used to verify the email address with a verifi This example display control is configured to: 1. Collect the `email` address claim type from the user.-1. Wait for the user to provide the `verificationCode` claim type with the code sent to the user. -1. Return the `email` to the self-asserted technical profile that has a reference to this display control. 1. Using the `SendCode` action, generate an OTP code and send an email with the OTP code to the user. + +1. Wait for the user to provide the `verificationCode` claim type with the code sent to the user. +1. Return the `email` to the self-asserted technical profile that has a reference to this display control. Under content definitions, still within `<BuildingBlocks>`, add the following [DisplayControl](display-controls.md) of type [VerificationControl](display-control-verification.md) to your policy. |
| active-directory-b2c | Custom Email Sendgrid | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/custom-email-sendgrid.md | A verification display control is used to verify the email address with a verifi This example display control is configured to: 1. Collect the `email` address claim type from the user.+1. Using the `SendCode` action, generate an OTP code and send an email with the OTP code to the user. ++  + 1. Wait for the user to provide the `verificationCode` claim type with the code sent to the user. 1. Return the `email` back to the self-asserted technical profile that has a reference to this display control.-1. Using the `SendCode` action, generate an OTP code and send an email with the OTP code to the user. - Under content definitions, still within `<BuildingBlocks>`, add the following [DisplayControl](display-controls.md) of type [VerificationControl](display-control-verification.md) to your policy. |
| active-directory-b2c | Partner Asignio | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/partner-asignio.md | + + Title: Configure Azure Active Directory B2C with Asignio ++description: Configure Azure Active Directory B2C with Asignio for multi-factor authentication +++++++ Last updated : 04/20/2022++++zone_pivot_groups: b2c-policy-type +++# Configure Asignio with Azure Active Directory B2C for multi-factor authentication +++++In this sample article, learn how to integrate Azure Active Directory (Azure AD B2C) authentication with [Asignio](https://www.asignio.com/). Using this integration, organizations can provide passwordless, soft biometric, and multi-factor authentication (MFA) experience to their customers. Asignio's user friendly, web-based solution is available on any device, anytime, and anywhere. Asignio uses a combination of the patented Asignio Signature and live facial verification for user authentication. The changeable biometric signature eliminates passwords, fraud, phishing, and credential reuse through omni-channel authentication. ++## Prerequisites ++To get started, you'll need: ++- An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). ++- An [Azure AD B2C tenant](./tutorial-create-tenant.md) that's linked to your Azure subscription. ++- An Asignio Client ID and Client Secret that will be issued by [Asignio](https://www.asignio.com/). These tokens are obtained by registering your mobile or web applications with Asignio. +++- Complete the steps in the article [get started with custom policies in Azure Active Directory B2C](./tutorial-create-user-flows.md?pivots=b2c-custom-policy). +++## Scenario description ++This integration includes the following components: ++- **Azure AD B2C**: The authorization server, responsible for verifying the user's credentials. ++- **Web or mobile applications:** The web or mobile applications you wish to secure with Asignio MFA. ++- **Asignio web application:** Signature biometric collection on the user's touch device. ++The following architecture diagram shows the implementation. ++ ++| Step | Description | +|:--|:--| +| 1. | User opens Azure AD B2C's sign in page on their mobile or web application, and then signs in or signs up by entering their username.| +| 2. | Azure AD B2C redirects the user to Asignio using an OpenID Connect (OIDC) request. | +| 3. | The user is redirected to the Asignio web application to complete the biometric sign in. If the user hasn't registered their Asignio Signature, they can choose to use an SMS One-Time-Password (OTP) to authenticate the immediate request. Once authenticated, user will receive a registration link to finish creating their Asignio Signature. | +| 4. | The user authenticates via Asignio using their Asignio Signature and facial verification or voice and facial verification.| +|5. | The challenge response is then sent back to Asignio. | +| 6. | Asignio returns the OIDC response to Azure AD B2C sign in. | +| 7. | Azure AD B2C sends an authentication verification request to Asignio to confirm receipt of the authentication data. | +| 8. | The user is either granted or denied access to the application based on the authentication results. | ++## Step 1: Configure an application with Asignio ++Configuring an application with Asignio is accomplished through Asignio's Partner Administration site. Contact Asignio to request access to https://partner.asignio.com for your organization. Once you've obtained credentials, sign into Asignio Partner Administration and complete the following steps: ++1. Create a record for your Azure AD B2C application using your Azure AD B2C tenant. When Azure AD B2C is used with Asignio, Azure AD B2C manages your connected applications. All apps in your Azure portal are represented by a single application within Asignio. ++1. In the Asignio Partner Administration site, generate a Client ID and Client Secret. Once generated, store Client ID and Client Secret in a secure place, you'll need them later to configure Asignio as an Identity provider. Asignio doesn't store the Client Secret. ++1. Supply redirect URI. This is the URI in your site to which the user is returned after a successful authentication. The URI that should be provided to Asignio for your Azure B2C follows the pattern - `[https://<your-b2c-domain>.b2clogin.com/<your-b2c-domain>.onmicrosoft.com/oauth2/authresp]`. ++1. Upload a company logo. This logo is displayed to users on Asignio authentication when users sign into your site. ++## Step 2: Register a web application in Azure AD B2C ++Before your [applications](application-types.md) can interact with Azure AD B2C, they must be registered in a tenant that you manage. ++For testing purposes like this tutorial, you're registering `https://jwt.ms`, a Microsoft-owned web application that displays the decoded contents of a token (the contents of the token never leave your browser). ++Follow the steps mentioned in [this tutorial](tutorial-register-applications.md?tabs=app-reg-ga) to **register a web application** and **enable ID token implicit grant** for testing a user flow or custom policy. There's no need to create a Client Secret at this time. +++## Step 3: Configure Asignio as an identity provider in Azure AD B2C ++1. Sign in to the [Azure portal](https://portal.azure.com/#home) as the global administrator of your Azure AD B2C tenant. ++1. Make sure you're using the Azure Active Directory (Azure AD) tenant that contains your Azure subscription: ++ 1. In the Azure portal toolbar, select the **Directories + subscriptions** (:::image type="icon" source="./../active-directory/develop/media/common/portal-directory-subscription-filter.png" border="false":::) icon. + + 1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD directory in the **Directory name** list, and then select **Switch** button next to it. ++1. Select **All services** in the top-left corner of the Azure portal, search for and select **Azure AD B2C**. ++1. In the Azure portal, search for and select **Azure AD B2C**. ++1. In the left menu, select **Identity providers**. ++1. Select **New OpenID Connect Provider**. ++1. Select **Identity provider type** > **OpenID Connect**. ++1. Fill out the form to set up the Identity provider ++ | Property | Value | + |:--|:-| + |Name | Login with Asignio *(or a name of your choice)* + |Metadata URL | https://authorization.asignio.com/.well-known/openid-configuration| + | Client ID | enter the client ID that you previously generated in [step 1](#step-1-configure-an-application-with-asignio)| + |Client Secret | enter the Client secret that you previously generated in [step 1](#step-1-configure-an-application-with-asignio)| + | Scope | openid email profile | + | Response type | code | + | Response mode | query | + | Domain hint | https://asignio.com | ++1. Select **OK**. ++1. Select **Map this identity provider's claims**. ++1. Fill out the form to map the Identity provider: ++ | Property | Value | + |:--|:--| + |User ID | sub | + | Display Name | name | + | Given Name | given_name | + | Surname | family_name | + | Email | email | ++1. Select **Save**. ++## Step 4: Create a user flow policy ++1. In your Azure AD B2C tenant, under **Policies**, select **User flows**. ++1. Select **New user flow**. ++1. Select **Sign up and sign in** user flow type, select **Version Recommended** and then select **Create**. ++1. Enter a **Name** for your user flow such as `AsignioSignupSignin`. ++1. Under **Identity providers**: + + a. For **Local Accounts**, select **None** to disable email and password-based authentication. + + b. For **Custom identity providers**, select your newly created Asignio Identity provider such as **Login with Asignio**. ++1. Select **Create**. ++## Step 5: Test your user flow ++1. In your Azure AD B2C tenant, select **User flows**. ++1. Select the newly created user flow such as **AsignioSignupSignin**. ++1. For **Application**, select the web application that you previously registered in [step 2](#step-2-register-a-web-application-in-azure-ad-b2c). The **Reply URL** should show `https://jwt.ms`. ++1. Select the **Run user flow** button. Your browser should be redirected to the Asignio sign in page. ++1. A sign in screen will be shown; at the bottom should be a button to use **Asignio** authentication. ++1. If you already have an Asignio Signature, you'll be prompted to authenticate using it. If not, you'll be prompted to supply the phone number of your device to authenticate via SMS OTP and then receive a link to register your Asignio Signature. ++1. If the sign-in process is successful, your browser is redirected to https://jwt.ms, which displays the contents of the token returned by Azure AD B2C. ++++## Step 3: Create Asignio policy key ++Store the client secret that you previously generated in [step 1](#step-1-configure-an-application-with-asignio) in your Azure AD B2C tenant. ++1. Sign in to the [Azure portal](https://portal.azure.com/). ++1. Make sure you're using the directory that contains your Azure AD B2C tenant. Select the **Directories + subscriptions** icon in the portal toolbar. ++1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**. ++1. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**. ++1. On the Overview page, select **Identity Experience Framework**. ++1. Select **Policy Keys** and then select **Add**. ++1. For **Options**, choose `Manual`. ++1. Enter a **Name** for the policy key. For example, `AsignioClientSecret`. The prefix `B2C_1A_` is added automatically to the name of your key. ++1. In **Secret**, enter your client secret that you previously recorded. ++1. For **Key usage**, select `Signature`. ++1. Select **Create**. ++## Step 4: Configure Asignio as an Identity provider ++>[!TIP] +>You should have the Azure AD B2C policy configured at this point. If not, follow the [instructions](tutorial-create-user-flows.md?pivots=b2c-custom-policy#custom-policy-starter-pack) on how to set up your Azure AD B2C tenant and configure policies. ++To enable users to sign in using Asignio, you need to define Asignio as a claims provider that Azure AD B2C can communicate with through an endpoint. The endpoint provides a set of claims that are used by Azure AD B2C to verify a specific user has authenticated using digital ID available on their device, proving the userΓÇÖs identity. ++Use the following steps to add Asignio as a claims provider: ++1. Get the custom policy starter packs from GitHub, then update the XML files in the LocalAccounts starter pack with your Azure AD B2C tenant name: ++ 1. [Download the .zip file](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/archive/master.zip) or clone the repository: + ``` + git clone https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack + ``` + + 1. In all of the files in the **LocalAccounts** directory, replace the string `yourtenant` with the name of your Azure AD B2C tenant. For example, if the name of your B2C tenant is `contoso`, all instances of `yourtenant.onmicrosoft.com` become `contoso.onmicrosoft.com`. ++1. Open the `LocalAccounts/ TrustFrameworkExtensions.xml`. ++1. Find the **ClaimsProviders** element. If it doesn't exist, add it under the root element, `TrustFrameworkPolicy`. ++1. Add a new **ClaimsProvider** similar to the one shown below: ++ ```xml + <ClaimsProvider> + <Domain>contoso.com</Domain> + <DisplayName>Asignio</DisplayName> + <TechnicalProfiles> + <TechnicalProfile Id="Asignio-Oauth2"> + <DisplayName>Asignio</DisplayName> + <Description>Login with your Asignio account</Description> + <Protocol Name="OAuth2" /> + <Metadata> + <Item Key="ProviderName">authorization.asignio.com</Item> + <Item Key="authorization_endpoint">https://authorization.asignio.com/authorize</Item> + <Item Key="AccessTokenEndpoint">https://authorization.asignio.com/token</Item> + <Item Key="ClaimsEndpoint">https://authorization.asignio.com/userinfo</Item> + <Item Key="ClaimsEndpointAccessTokenName">access_token</Item> + <Item Key="BearerTokenTransmissionMethod">AuthorizationHeader</Item> + <Item Key="HttpBinding">POST</Item> + <Item Key="scope">openid profile email</Item> + <Item Key="UsePolicyInRedirectUri">0</Item> + <!-- Update the Client ID below to the Asignio Application ID --> + <Item Key="client_id">00000000-0000-0000-0000-000000000000</Item> + <Item Key="IncludeClaimResolvingInClaimsHandling">true</Item> +++ <!-- trying to add additional claim--> + <!--Insert b2c-extensions-app application ID here, for example: 11111111-1111-1111-1111-111111111111--> + <Item Key="11111111-1111-1111-1111-111111111111"></Item> + <!--Insert b2c-extensions-app application ObjectId here, for example: 22222222-2222-2222-2222-222222222222--> + <Item Key="22222222-2222-2222-2222-222222222222"></Item> + <!-- The key below allows you to specify each of the Azure AD tenants that can be used to sign in. Update the GUIDs below for each tenant. --> + <!--<Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/11111111-1111-1111-1111-111111111111</Item>--> + <!-- The commented key below specifies that users from any tenant can sign-in. Uncomment if you would like anyone with an Azure AD account to be able to sign in. --> + <Item Key="ValidTokenIssuerPrefixes">https://login.microsoftonline.com/</Item> + </Metadata> + <CryptographicKeys> + <Key Id="client_secret" StorageReferenceId="B2C_1A_AsignioSecret" /> + </CryptographicKeys> + <OutputClaims> + <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="sub" /> + <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" /> + <!-- <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" /> --> + <!-- <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" /> + <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" /> --> + <!-- <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" /> --> + <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" /> + <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" DefaultValue="https://authorization.asignio.com" /> + <OutputClaim ClaimTypeReferenceId="identityProviderAccessToken" PartnerClaimType="{oauth2:access_token}" /> + <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" /> + <OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" /> + <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" /> + <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" /> + </OutputClaims> + <OutputClaimsTransformations> + <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" /> + <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" /> + <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" /> + <OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId" /> + </OutputClaimsTransformations> + <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" /> + </TechnicalProfile> + </TechnicalProfiles> + </ClaimsProvider> + ``` ++1. Set **client_id** with the Asignio Application ID that you previously recorded in [step 1](#step-1-configure-an-application-with-asignio). ++1. Update **client_secret** section with the name of the policy key created in [step 3](#step-3-create-asignio-policy-key). For example, `B2C_1A_AsignioSecret`: ++ ```xml + <Key Id="client_secret" StorageReferenceId="B2C_1A_AsignioSecret" /> + ``` ++1. Save the changes. ++## Step 5: Add a user journey ++At this point, you've set up the identity provider, but it's not yet available in any of the sign in pages. If you've your own custom user journey continue to [step 7](#step-6-add-the-identity-provider-to-a-user-journey), otherwise, create a duplicate of an existing template user journey as follows: ++1. Open the `LocalAccounts/ TrustFrameworkBase.xml` file from the starter pack. ++1. Find and copy the entire contents of the **UserJourney** element that includes `Id=SignUpOrSignIn`. ++1. Open the `LocalAccounts/ TrustFrameworkExtensions.xml` and find the **UserJourneys** element. If the element doesn't exist, add one. ++1. Paste the entire content of the UserJourney element that you copied as a child of the UserJourneys element. ++1. Rename the `Id` of the user journey. For example, `Id=AsignioSUSI`. ++## Step 6: Add the identity provider to a user journey ++Now that you have a user journey, add the new identity provider to the user journey. ++1. Find the orchestration step element that includes `Type=CombinedSignInAndSignUp`, or `Type=ClaimsProviderSelection` in the user journey. It's usually the first orchestration step. The **ClaimsProviderSelections** element contains a list of identity providers that a user can sign in with. The order of the elements controls the order of the sign in buttons presented to the user. Add a **ClaimsProviderSelection** XML element. Set the value of **TargetClaimsExchangeId** to a friendly name, such as `AsignioExchange`. ++1. In the next orchestration step, add a **ClaimsExchange** element. Set the **Id** to the value of the target claims exchange ID. Update the value of **TechnicalProfileReferenceId** to the ID of the technical profile you created earlier while adding the claims provider, for example, `Asignio-Oauth2`. ++The following XML demonstrates orchestration steps of a user journey with the identity provider: ++```xml + <UserJourney Id="AsignioSUSI"> + <OrchestrationSteps> + <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin"> + <ClaimsProviderSelections> + <ClaimsProviderSelection TargetClaimsExchangeId="AsignioExchange" /> + <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" /> + </ClaimsProviderSelections> + <ClaimsExchanges> + <ClaimsExchange Id="LocalAccountSigninEmailExchange" TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" /> + </ClaimsExchanges> + </OrchestrationStep> + <!-- Check if the user has selected to sign in using one of the social providers --> + <OrchestrationStep Order="2" Type="ClaimsExchange"> + <Preconditions> + <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> + <Value>objectId</Value> + <Action>SkipThisOrchestrationStep</Action> + </Precondition> + </Preconditions> + <ClaimsExchanges> + <ClaimsExchange Id="AsignioExchange" TechnicalProfileReferenceId="Asignio-Oauth2" /> + <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" /> + </ClaimsExchanges> + </OrchestrationStep> + <OrchestrationStep Order="3" Type="ClaimsExchange"> + <Preconditions> + <Precondition Type="ClaimEquals" ExecuteActionsIf="true"> + <Value>authenticationSource</Value> + <Value>localAccountAuthentication</Value> + <Action>SkipThisOrchestrationStep</Action> + </Precondition> + </Preconditions> + <ClaimsExchanges> + <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" /> + </ClaimsExchanges> + </OrchestrationStep> + <!-- Show self-asserted page only if the directory does not have the user account already (i.e. we do not have an objectId). This can only happen when authentication happened using a social IDP. If local account was created or authentication done using ESTS in step 2, then an user account must exist in the directory by this time. --> + <OrchestrationStep Order="4" Type="ClaimsExchange"> + <Preconditions> + <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> + <Value>objectId</Value> + <Action>SkipThisOrchestrationStep</Action> + </Precondition> + </Preconditions> + <ClaimsExchanges> + <ClaimsExchange Id="SelfAsserted-Social" TechnicalProfileReferenceId="SelfAsserted-Social" /> + </ClaimsExchanges> + </OrchestrationStep> + <!-- This step reads any user attributes that we may not have received when authenticating using ESTS so they can be sent in the token. --> + <OrchestrationStep Order="5" Type="ClaimsExchange"> + <Preconditions> + <Precondition Type="ClaimEquals" ExecuteActionsIf="true"> + <Value>authenticationSource</Value> + <Value>socialIdpAuthentication</Value> + <Action>SkipThisOrchestrationStep</Action> + </Precondition> + </Preconditions> + <ClaimsExchanges> + <ClaimsExchange Id="AADUserReadWithObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" /> + </ClaimsExchanges> + </OrchestrationStep> + <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no attributes to collect from the user. So, in that case, create the user in the directory if one does not already exist (verified using objectId which would be set from the last step if account was created in the directory. --> + <OrchestrationStep Order="6" Type="ClaimsExchange"> + <Preconditions> + <Precondition Type="ClaimsExist" ExecuteActionsIf="true"> + <Value>objectId</Value> + <Action>SkipThisOrchestrationStep</Action> + </Precondition> + </Preconditions> + <ClaimsExchanges> + <ClaimsExchange Id="AADUserWrite" TechnicalProfileReferenceId="AAD-UserWriteUsingAlternativeSecurityId" /> + </ClaimsExchanges> + </OrchestrationStep> + <OrchestrationStep Order="7" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" /> + </OrchestrationSteps> + <ClientDefinition ReferenceId="DefaultWeb" /> + </UserJourney> +``` ++Learn more about [User Journeys](custom-policy-overview.md#user-journeys). ++## Step 7: Configure the relying party policy ++The relying party policy, for example [SignUpSignIn.xml](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/main/LocalAccounts/SignUpOrSignin.xml), specifies the user journey which Azure AD B2C will execute. Find the **DefaultUserJourney** element within relying party. Update the **ReferenceId** to match the user journey ID, in which you added the identity provider. ++In the following example, for the `AsignioSUSI` user journey, the **ReferenceId** is set to `AsignioSUSI`: ++```xml + <RelyingParty> + <DefaultUserJourney ReferenceId="AsignioSUSI" /> + <TechnicalProfile Id="PolicyProfile"> + <DisplayName>PolicyProfile</DisplayName> + <Protocol Name="OpenIdConnect" /> + <OutputClaims> + <OutputClaim ClaimTypeReferenceId="displayName" /> + <OutputClaim ClaimTypeReferenceId="givenName" /> + <OutputClaim ClaimTypeReferenceId="surname" /> + <OutputClaim ClaimTypeReferenceId="email" /> + <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/> + <OutputClaim ClaimTypeReferenceId="identityProvider" /> + <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" /> + <OutputClaim ClaimTypeReferenceId="correlationId" DefaultValue="{Context:CorrelationId}" /> + </OutputClaims> + <SubjectNamingInfo ClaimType="sub" /> + </TechnicalProfile> + </RelyingParty> ++``` ++## Step 8: Upload the custom policy ++1. Sign in to the [Azure portal](https://portal.azure.com/#home). ++1. Make sure you're using the directory that contains your Azure AD B2C tenant: ++ a. Select the **Directories + subscriptions** icon in the portal toolbar. ++ b. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select **Switch**. ++1. In the [Azure portal](https://portal.azure.com/#home), search for and select **Azure AD B2C**. ++1. Under Policies, select **Identity Experience Framework**. ++1. Select **Upload Custom Policy**, and then upload the two policy files that you changed, in the following order: the extension policy, for example `TrustFrameworkExtensions.xml`, then the relying party policy, such as `SignUpOrSignin.xml`. ++## Step 9: Test your custom policy ++1. In your Azure AD B2C tenant blade, and under **Policies**, select **Identity Experience Framework**. ++1. Under **Custom policies**, select **AsignioSUSI**. ++1. For **Application**, select the web application that you previously registered as part of this article's prerequisites. The **Reply URL** should show `https://jwt.ms`. ++1. Select **Run now**. Your browser should be redirected to the Asignio sign in page. ++1. A sign in screen will be shown; at the bottom should be a button to use **Asignio** authentication. ++1. If you already have an Asignio Signature, you'll be prompted to authenticate with your Asignio Signature. If not, you'll be prompted to supply the phone number of your device to authenticate via SMS OTP and then receive a link to register your Asignio Signature. ++1. If the sign-in process is successful, your browser is redirected to https://jwt.ms, which displays the contents of the token returned by Azure AD B2C. +++## Next steps ++For additional information, review the following articles: ++- [Azure AD B2C docs](solution-articles.md) ++- [Ask your question on Stackoverflow](https://stackoverflow.com/questions/tagged/azure-ad-b2c) ++- [Azure AD B2C Samples](https://stackoverflow.com/questions/tagged/azure-ad-b2c) ++- [Azure AD B2C YouTube training playlist](https://www.youtube.com/playlist?list=PL3ZTgFEc7LyuJ8YRSGXBUVItCPnQz3YX0) ++- [Custom policies in Azure AD B2C](custom-policy-overview.md) ++- [Get started with custom policies in Azure AD B2C](tutorial-create-user-flows.md?pivots=b2c-custom-policy) |
| active-directory-b2c | Partner Azure Web Application Firewall | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/partner-azure-web-application-firewall.md | + + Title: Tutorial to configure Azure Active Directory B2C with Azure Web Application Firewall ++description: Tutorial to configure Azure Active Directory B2C with Azure Web application firewall to protect your applications from malicious attacks ++++++++ Last updated : 08/17/2021+++++# Tutorial: Configure Azure Web Application Firewall with Azure Active Directory B2C ++In this sample tutorial, learn how to enable [Azure Web Application Firewall (WAF)](https://azure.microsoft.com/services/web-application-firewall/#overview) solution for Azure Active Directory (AD) B2C tenant with custom domain. Azure WAF provides centralized protection of your web applications from common exploits and vulnerabilities. ++>[!NOTE] +>This feature is in public preview. ++## Prerequisites ++To get started, you'll need: ++- An Azure subscription ΓÇô If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). ++- [An Azure AD B2C tenant](tutorial-create-tenant.md) ΓÇô The authorization server, responsible for verifying the userΓÇÖs credentials using the custom policies defined in the tenant. It's also known as the identity provider. ++- [Azure Front Door (AFD)](../frontdoor/index.yml) ΓÇô Responsible for enabling custom domains for Azure AD B2C tenant. ++- [Azure WAF](https://azure.microsoft.com/services/web-application-firewall/#overview) ΓÇô Manages all traffic that is sent to the authorization server. ++## Azure AD B2C setup ++To use custom domains in Azure AD B2C, it's required to use custom domain feature provided by AFD. Learn how to [enable Azure AD B2C custom domains](./custom-domain.md?pivots=b2c-user-flow). ++After custom domain for Azure AD B2C is successfully configured using AFD, [test the custom domain](./custom-domain.md?pivots=b2c-custom-policy#test-your-custom-domain) before proceeding further. ++## Onboard with Azure WAF ++To enable Azure WAF, configure a WAF policy and associate that policy to the AFD for protection. ++### Create a WAF policy ++Create a basic WAF policy with managed Default Rule Set (DRS) in the [Azure portal](https://portal.azure.com). ++1. Go to the [Azure portal](https://portal.azure.com). Select **Create a resource** and then search for Azure WAF. Select **Azure Web Application Firewall (WAF)** > **Create**. ++2. Go to the **Create a WAF policy** page, select the **Basics** tab. Enter the following information, accept the defaults for the remaining settings. ++| Value | Description | +|:--|:-| +| Policy for | Global WAF (Front Door)| +| Front Door SKU | Select between Basic, Standard, or Premium SKU | +|Subscription | Select your Front Door subscription name | +| Resource group | Select your Front Door resource group name | +| Policy name | Enter a unique name for your WAF policy | +| Policy state | Set as Enabled | +| Policy mode | Set as Detection | ++3. Select **Review + create** ++4. Go to the **Association** tab of the Create a WAF policy page, select + **Associate a Front Door profile**, enter the following settings ++| Value | Description | +|:-|:| +| Front Door | Select your Front Door name associated with Azure AD B2C custom domain | +| Domains | Select the Azure AD B2C custom domains you want to associate the WAF policy to| ++5. Select **Add**. ++6. Select **Review + create**, then select **Create**. ++### Change policy mode from detection to prevention ++When a WAF policy is created, by default the policy is in Detection mode. In Detection mode, WAF doesn't block any requests, instead, requests matching the WAF rules are logged in the WAF logs. For more information about WAF logging, see [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md). ++The sample query shows all the requests that were blocked by the WAF policy in the past 24 hours. The details include, rule name, request data, action taken by the policy, and the policy mode. ++ ++ ++It's recommended that you let the WAF capture requests in Detection mode. Review the WAF logs to determine if there are any rules in the policy that are causing false positive results. Then after [exclude the WAF rules based on the WAF logs](../web-application-firewall/afds/waf-front-door-exclusion.md#define-exclusion-based-on-web-application-firewall-logs). ++To see WAF in action, use Switch to prevention mode to change from Detection to Prevention mode. All requests that match the rules defined in the Default Rule Set (DRS) are blocked and logged in the WAF logs. ++ ++In case you want to switch back to the detection mode, you can do so by using Switch to detection mode option. ++ ++## Next steps ++- [Azure WAF monitoring and logging](../web-application-firewall/afds/waf-front-door-monitor.md) ++- [WAF with Front Door service exclusion lists](../web-application-firewall/afds/waf-front-door-exclusion.md) |
| active-directory-b2c | Partner Gallery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/partner-gallery.md | Microsoft partners with the following ISVs for MFA and Passwordless authenticati | ISV partner | Description and integration walkthroughs | |:-|:--|-| solution BindID is a passwordless authentication service that uses strong FIDO2 biometric authentication for a reliable omni-channel authentication experience, which ensures a smooth login experience for customers across every device and channel eliminating fraud, phishing, and credential reuse. | +|  is a passwordless, soft biometric, and MFA solution. Asignio uses a combination of the patented Asignio Signature and live facial verification for user authentication. The changeable biometric signature eliminates passwords, fraud, phishing, and credential reuse through omni-channel authentication. | |  is a passwordless authentication and tokenless MFA solution, which provides real-time consent-based services and protects customers against identity-centric cyber-attacks such as password stuffing, phishing, and man-in-the-middle attacks. | |  is a passwordless authentication provider, which provides decentralized identity platform that eliminates passwords, shared secrets, and friction. | |  is a passwordless authentication provider, which replaces passwords with public key encryptions eliminating fraud, phishing, and credential reuse. | Microsoft partners with the following ISVs for MFA and Passwordless authenticati | is a passwordless authentication provider that provides authentication in the form of a facial biometric scan and eliminates fraud, phishing, and credential reuse. |  enables passwordless authentication and provides a mobile-first, fully branded end-user experience with Nevis Access app for strong customer authentication and to comply with PSD2 transaction requirements. | |  provides passwordless authentication and enables FIDO certified multifactor authentication such as FIDO UAF, FIDO U2F, WebAuthn, and FIDO2 for mobile and web applications. Using Nok Nok customers can improve their security posture while balancing user experience.+| solution BindID is a passwordless authentication service that uses strong FIDO2 biometric authentication for a reliable omni-channel authentication experience, which ensures a smooth login experience for customers across every device and channel eliminating fraud, phishing, and credential reuse. | |  integration helps you sign in securely and enables passwordless authentication, MFA, and digital license scanning. | |  provides multiple solutions to enable MFA through SMS one-time password (OTP), time-based one-time password (TOTP), and push notifications, and to comply with SCA requirements for PSD2. | |  enables strong customer authentication by analyzing a userΓÇÖs typing pattern. It helps companies enable a silent MFA and comply with SCA requirements for PSD2. | Microsoft partners with the following ISVs for Web Application Firewall (WAF). | ISV partner | Description and integration walkthroughs | |:-|:--| |  allows fine grained manipulation of traffic to protect and secure your identity infrastructure against malicious attacks. |+|  provides centralized protection of your web applications from common exploits and vulnerabilities. |  is a WAF provider that helps organizations protect against malicious attacks that aim to exploit vulnerabilities such as SQLi, and XSS. | |
| active-directory-b2c | Tutorial Register Applications | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/tutorial-register-applications.md | If you register this app and configure it with [https://jwt.ms/](https://jwt.ms/ 1. In the left menu, under **Manage**, select **Authentication**. -1. Under **Implicit grant and hybrid flows**, select both the **Access tokens (used for implicit flows)** and **D tokens (used for implicit and hybrid flows)** check boxes. +1. Under **Implicit grant and hybrid flows**, select both the **Access tokens (used for implicit flows)** and **ID tokens (used for implicit and hybrid flows)** check boxes. 1. Select **Save**. |
| active-directory | Fido2 Compatibility | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/fido2-compatibility.md | Azure Active Directory allows [FIDO2 security keys](./concept-authentication-pas This table shows support for authenticating Azure Active Directory (Azure AD) and Microsoft Accounts (MSA). Microsoft accounts are created by consumers for services such as Xbox, Skype, or Outlook.com. Supported device types include **USB**, near-field communication (**NFC**), and bluetooth low energy (**BLE**). -| OS | Chrome | Chrome | Chrome | Edge | Edge | Edge | Firefox | Firefox | Firefox | -|::|::|::|::|::|::|::|::|::|::| -| | USB | NFC | BLE | USB | NFC | BLE | USB | NFC | BLE | -| **Windows** | ![Chrome supports USB on Windows for AAD accounts.][y] | ![Chrome supports NFC on Windows for AAD accounts.][y] | ![Chrome supports BLE on Windows for AAD accounts.][y] | ![Edge supports USB on Windows for AAD accounts.][y] | ![Edge supports NFC on Windows for AAD accounts.][y] | ![Edge supports BLE on Windows for AAD accounts.][y] | ![Firefox supports USB on Windows for AAD accounts.][y] | ![Firefox supports NFC on Windows for AAD accounts.][y] | ![Firefox supports BLE on Windows for AAD accounts.][y] | -| **MacOS** | ![Chrome supports USB on MacOS for AAD accounts.][y] | ![Chrome does not support NFC on MacOS for AAD accounts.][n] | ![Chrome does not support BLE on MacOS for AAD accounts.][n] | ![Edge supports USB on MacOS for AAD accounts.][y] | ![Edge does not support NFC on MacOS for AAD accounts.][n] | ![Edge does not support BLE on MacOS for AAD accounts.][n] | ![Firefox supports USB on MacOS for AAD accounts.][y] | ![Firefox does not support NFC on MacOS for AAD accounts.][n] | ![Firefox does not support BLE on MacOS for AAD accounts.][n] | -| **ChromeOS** | ![Chrome supports USB on ChromeOS for AAD accounts.][y] | ![Chrome supports NFC on ChromeOS for AAD accounts.][n] | ![Chrome supports BLE on ChromeOS for AAD accounts.][n] | ![Edge supports USB on ChromeOS for AAD accounts.][n] | ![Edge supports NFC on ChromeOS for AAD accounts.][n] | ![Edge supports BLE on ChromeOS for AAD accounts.][n] | ![Firefox supports USB on ChromeOS for AAD accounts.][n] | ![Firefox supports NFC on ChromeOS for AAD accounts.][n] | ![Firefox supports BLE on ChromeOS for AAD accounts.][n] | -| **Linux** | ![Chrome supports USB on Linux for AAD accounts.][y] | ![Chrome does not support NFC on Linux for AAD accounts.][n] | ![Chrome does not support BLE on Linux for AAD accounts.][n] | ![Edge does not support USB on Linux for AAD accounts.][n] | ![Edge does not support NFC on Linux for AAD accounts.][n] | ![Edge does not support BLE on Linux for AAD accounts.][n] | ![Firefox does not support USB on Linux for AAD accounts.][n] | ![Firefox does not support NFC on Linux for AAD accounts.][n] | ![Firefox does not support BLE on Linux for AAD accounts.][n] | +| OS | Chrome | Chrome | Chrome | Edge | Edge | Edge | Firefox | Firefox | Firefox | Safari | Safari | Safari +|::|::|::|::|::|::|::|::|::|::|::|::|::| +| | USB | NFC | BLE | USB | NFC | BLE | USB | NFC | BLE | USB | NFC | BLE | +| **Windows** | ![Chrome supports USB on Windows for Azure AD accounts.][y] | ![Chrome supports NFC on Windows for Azure AD accounts.][y] | ![Chrome supports BLE on Windows for Azure AD accounts.][y] | ![Edge supports USB on Windows for Azure AD accounts.][y] | ![Edge supports NFC on Windows for Azure AD accounts.][y] | ![Edge supports BLE on Windows for Azure AD accounts.][y] | ![Firefox supports USB on Windows for Azure AD accounts.][y] | ![Firefox supports NFC on Windows for Azure AD accounts.][y] | ![Firefox supports BLE on Windows for Azure AD accounts.][y] | ![Safari supports USB on Windows for Azure AD accounts.][n] | ![Safari supports NFC on Windows for Azure AD accounts.][n] | ![Safari supports BLE on Windows for Azure AD accounts.][n] | +| **macOS** | ![Chrome supports USB on macOS for Azure AD accounts.][y] | ![Chrome supports NFC on macOS for Azure AD accounts.][n] | ![Chrome supports BLE on macOS for Azure AD accounts.][n] | ![Edge supports USB on macOS for Azure AD accounts.][y] | ![Edge supports NFC on macOS for Azure AD accounts.][n] | ![Edge supports BLE on macOS for Azure AD accounts.][n] | ![Firefox supports USB on macOS for Azure AD accounts.][y] | ![Firefox supports NFC on macOS for Azure AD accounts.][n] | ![Firefox supports BLE on macOS for Azure AD accounts.][n] | ![Safari supports USB on macOS for Azure AD accounts.][y] | ![Safari supports NFC on macOS for Azure AD accounts.][n] | ![Safari supports BLE on macOS for Azure AD accounts.][n] | +| **ChromeOS** | ![Chrome supports USB on ChromeOS for Azure AD accounts.][y] | ![Chrome supports NFC on ChromeOS for Azure AD accounts.][n] | ![Chrome supports BLE on ChromeOS for Azure AD accounts.][n] | ![Edge supports USB on ChromeOS for Azure AD accounts.][n] | ![Edge supports NFC on ChromeOS for Azure AD accounts.][n] | ![Edge supports BLE on ChromeOS for Azure AD accounts.][n] | ![Firefox supports USB on ChromeOS for Azure AD accounts.][n] | ![Firefox supports NFC on ChromeOS for Azure AD accounts.][n] | ![Firefox supports BLE on ChromeOS for Azure AD accounts.][n] | ![Safari supports USB on ChromeOS for Azure AD accounts.][n] | ![Safari supports NFC on ChromeOS for Azure AD accounts.][n] | ![Safari supports BLE on ChromeOS for Azure AD accounts.][n] | +| **Linux** | ![Chrome supports USB on Linux for Azure AD accounts.][y] | ![Chrome supports NFC on Linux for Azure AD accounts.][n] | ![Chrome supports BLE on Linux for Azure AD accounts.][n] | ![Edge supports USB on Linux for Azure AD accounts.][n] | ![Edge supports NFC on Linux for Azure AD accounts.][n] | ![Edge supports BLE on Linux for Azure AD accounts.][n] | ![Firefox supports USB on Linux for Azure AD accounts.][n] | ![Firefox supports NFC on Linux for Azure AD accounts.][n] | ![Firefox supports BLE on Linux for Azure AD accounts.][n] | ![Safari supports USB on Linux for Azure AD accounts.][n] | ![Safari supports NFC on Linux for Azure AD accounts.][n] | ![Safari supports BLE on Linux for Azure AD accounts.][n] | +| **iOS** | ![Chrome supports USB on iOS for Azure AD accounts.][n] | ![Chrome supports NFC on iOS for Azure AD accounts.][n] | ![Chrome supports BLE on iOS for Azure AD accounts.][n] | ![Edge supports USB on iOS for Azure AD accounts.][n] | ![Edge supports NFC on Linux for Azure AD accounts.][n] | ![Edge supports BLE on Linux for Azure AD accounts.][n] | ![Firefox supports USB on Linux for Azure AD accounts.][n] | ![Firefox supports NFC on iOS for Azure AD accounts.][n] | ![Firefox supports BLE on iOS for Azure AD accounts.][n] | ![Safari supports USB on iOS for Azure AD accounts.][n] | ![Safari supports NFC on iOS for Azure AD accounts.][n] | ![Safari supports BLE on iOS for Azure AD accounts.][n] | +| **Android** | ![Chrome supports USB on Android for Azure AD accounts.][n] | ![Chrome supports NFC on Android for Azure AD accounts.][n] | ![Chrome supports BLE on Android for Azure AD accounts.][n] | ![Edge supports USB on Android for Azure AD accounts.][n] | ![Edge supports NFC on Android for Azure AD accounts.][n] | ![Edge supports BLE on Android for Azure AD accounts.][n] | ![Firefox supports USB on Android for Azure AD accounts.][n] | ![Firefox supports NFC on Android for Azure AD accounts.][n] | ![Firefox supports BLE on Android for Azure AD accounts.][n] | ![Safari supports USB on Android for Azure AD accounts.][n] | ![Safari supports NFC on Android for Azure AD accounts.][n] | ![Safari supports BLE on Android for Azure AD accounts.][n] | The following operating system and browser combinations are not supported, but f | Operating system | Browser | | - | - |-| iOS | Safari, Brave | -| macOS | Safari | +| iOS | Safari | | Android | Chrome | ## Minimum browser version |
| active-directory | How To Mfa Number Match | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/how-to-mfa-number-match.md | To enable number matching in the Azure AD portal, complete the following steps: 1. Select the **Authentication mode**, and then for **Require number matching (Preview)**, click **Enable**, and then click **Done**. + +>[!NOTE] +>[Least privilege role in Azure Active Directory - Multi-factor Authentication](https://docs.microsoft.com/azure/active-directory/roles/delegate-by-task#multi-factor-authentication) ## Next steps |
| active-directory | Howto Authentication Methods Activity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-authentication-methods-activity.md | The following roles have the required permissions: - Reports Reader - Security Reader - Global Reader+- Application Administrator +- Cloud Application Administrator - Security Operator - Security Administrator - Global Administrator |
| active-directory | Concept Conditional Access Cloud Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/conditional-access/concept-conditional-access-cloud-apps.md | Administrators can assign a Conditional Access policy to the following cloud app - [Azure Data Explorer](/azure/data-explorer/security-conditional-access) - Azure Event Hubs - Azure Service Bus-- [Azure SQL Database and Azure Synapse Analytics](../../azure-sql/database/conditional-access-configure.md)+- [Azure SQL Database and Azure Synapse Analytics](/azure/azure-sql/database/conditional-access-configure) - Common Data Service - Microsoft Application Insights Analytics - [Microsoft Azure Information Protection](/azure/information-protection/faqs#i-see-azure-information-protection-is-listed-as-an-available-cloud-app-for-conditional-accesshow-does-this-work) The Microsoft Azure Management application includes multiple services. - Azure Data Factory portal - Azure Event Hubs - Azure Service Bus- - [Azure SQL Database](../../azure-sql/database/conditional-access-configure.md) + - [Azure SQL Database](/azure/azure-sql/database/conditional-access-configure) - SQL Managed Instance - Azure Synapse - Visual Studio subscriptions administrator portal |
| active-directory | Single Sign Out Saml Protocol | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/single-sign-out-saml-protocol.md | The following diagram shows the workflow of the Azure AD single sign-out process  +> [!NOTE] +> Per section 3.7 of the [SAML 2.0 core specification](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf), there can be multiple participants (other applications) in a session besides your application. If one of the other participants sends a `LogoutRequest` to Microsoft identity platform (the session authority), then Microsoft identity platform will send a `LogoutRequest` back to all the session participants except the participant which sent the initial `LogoutRequest`. Additionally, if one of the other participants happened to initiate sign-out at the same time, there would be a race to see which `LogoutRequest` reaches Microsoft identity platform first. As a result, an application should always be prepared to handle a `LogoutRequest`. + ## LogoutRequest The cloud service sends a `LogoutRequest` message to Azure AD to indicate that a session has been terminated. The following excerpt shows a sample `LogoutRequest` element. |
| active-directory | Recover From Deletions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/recover-from-deletions.md | + + Title: Recover from deletions in Azure Active Directory +description: Learn how to recover from unintended deletions. +++++++ Last updated : 04/20/2022+++++++# Recover from deletions ++This article addresses recovering from soft and hard deletions in your Azure AD tenant. If you havenΓÇÖt already done so, we recommend first reading the [Recoverability best practices article](recoverability-overview.md) for foundational knowledge. ++## Monitor for deletions ++The [Azure AD Audit Log](../reports-monitoring/concept-audit-logs.md) contains information on all delete operations performed in your tenant. We recommend that you export these logs to a security information and event management (SIEM) tool such as [Microsoft Sentinel](../../sentinel/overview.md). You can also use Microsoft Graph to audit changes and build a custom solution to monitor differences over time. For more information on finding deleted items using Microsoft Graph, see [List deleted items - Microsoft Graph v1.0. ](/graph/api/directory-deleteditems-list?view=graph-rest-1.0&tabs=http) ++### Audit log ++The Audit Log always records a ΓÇ£Delete <object>ΓÇ¥ event when an object in the tenant is removed from an active state by either a soft or hard deletion. ++[](./media/recoverability/delete-audit-log.png#lightbox) ++++A delete event for applications, users, and Microsoft 365 Groups is a soft delete. For any other object type, it's a hard delete. Track the occurrence of hard-delete events by comparing ΓÇ£Delete <object>ΓÇ¥ events with the type of object that has been deleted, noting those that do not support soft-delete. In addition, note "Hard Delete <object>" events. +++| Object type | Activity in log| Result | +| - | - | - | +| Application| Delete application| Soft deleted | +| Application| Hard delete application| Hard deleted | +| User| Delete user| Soft deleted | +| User| Hard delete user| Hard deleted | +| Microsoft 365 Group| Delete group| Soft deleted | +| Microsoft 365 Group| Hard delete group| Hard deleted | +| All other objects| Delete ΓÇ£objectTypeΓÇ¥| Hard deleted | +++> [!NOTE] +> The audit log does not distinguish the group type of a deleted group. Only Microsoft 365 Groups are soft-deleted. If you see a Delete group entry, it may be the soft delete of a M365 group, or the hard delete of another type of group. **It is therefore important that your documentation of your known good state include the group type for each group in your organization**. To learn more about documenting your known good state, see [Recoverability best practices](recoverability-overview.md). +### Monitor support tickets ++A sudden increase in support tickets regarding access to a specific object may indicate that there has been a deletion. Because some objects have dependencies, deletion of a group used to access an application, an application itself, or a Conditional Access policy targeting an application can all cause broad sudden impact. If you see a trend like this, check to ensure that none of the objects required for access have been deleted. ++## Soft deletions ++When objects such as users, Microsoft 365 groups, or application registrations are ΓÇ£soft deleted,ΓÇ¥ they enter a suspended state in which they aren't available for use by other services. In this state, items retain their properties and can be restored for 30 days. After 30 days, objects in the soft-deleted state are permanently or ΓÇ£hardΓÇ¥ deleted. ++> [!NOTE] +> Objects cannot be restored from a hard-deleted state. They must be recreated and reconfigured. + +### When soft deletes occur ++It's important to understand why object deletions occur in your environment to prepare for them. This section outlines frequent scenarios for soft deletion by object class. Keep in mind there may be scenarios your organization sees which are unique to your organization so a discovery process is key to preparation. ++### Users ++Users enter the soft delete state anytime the user object is deleted by using the Azure portal, Microsoft Graph, or PowerShell. ++The most frequent scenarios for user deletion are: ++* An administrator intentionally deletes a user in the Azure AD portal in response to a request, or as part of routine user maintenance. ++* An automation script in Microsoft Graph or PowerShell triggers the deletion. For example, you may have a script that removes users who haven't signed in for a specified time period. ++* A user is moved out of scope for synchronization with Azure Active Directory (Azure AD) connect. ++* A user is removed in an HR system and is deprovisioned via an automated workflow. ++### Microsoft 365 Groups ++The most frequent scenarios for Microsoft 365 Groups being deleted are: ++* An administrator intentionally deletes the group, for example in response to a support request. ++* An automation script in Microsoft Graph or PowerShell triggers the deletion. For example, you may have a script that deletes groups that haven't been accessed or attested to by the group owner for a specific period of time. ++* Non-adminsΓÇÖ unintentional deletion of a group they own. ++++### Application objects and service principals ++The most frequent scenarios for application deletion are: ++* An administrator intentionally deletes the application, for example in response to a support request. ++* An automation script in Microsoft Graph or PowerShell triggers the deletion. For example, you may want a process for deleting abandoned applications that are no longer used or managed. In general, create an offboarding process for applications rather than scripting to avoid unintentional deletions. ++### Properties maintained with soft delete +++| Object type| Important properties maintained | +| - | - | +| Users (including external users)| **All properties maintained**, including ObjectID, group memberships, roles, licenses, application assignments. | +| Microsoft 365 Groups| **All properties maintained**, including ObjectID, group memberships, licenses, application assignments | +| Application Registration| **All properties maintained.** (See additional information following this table.) | +++++When you delete an application, the application registration by default enters the soft-delete state. To understand the relationship between application registrations and service principals, see [Apps & service principals in Azure AD - Microsoft identity platform](../develop/app-objects-and-service-principals.md). ++++## Recover from soft deletion ++You can restore soft deleted items in the Azure portal or with Microsoft Graph. ++### Users ++You can see soft-deleted users in the Azure portal on the Users ΓÇô Deleted users page. ++ ++For details on restoring users, see the following documentation: ++* See [Restore or permanently remove recently deleted user](active-directory-users-restore.md) for restoring in the Azure portal. ++* See [Restore deleted item ΓÇô Microsoft Graph v1.0](%20/graph/api/directory-deleteditems-restore?view=graph-rest-1.0&tabs=http) for restoring with Microsoft Graph. ++### Groups ++You can see soft-deleted Microsoft 365 (Microsoft 365) Groups in the Azure portal in the Groups ΓÇô Deleted groups screen. ++ +++For details on restoring soft deleted Microsoft 365 Groups, see the following documentation: ++* To restore from the Azure portal, see [Restore a deleted Microsoft 365 group. ](../enterprise-users/groups-restore-deleted.md) ++* To restore by using Microsoft Graph, see [Restore deleted item ΓÇô Microsoft Graph v1.0](/graph/api/directory-deleteditems-restore?view=graph-rest-1.0&tabs=http). ++### Applications ++Applications have two objects, the application registration and the service principle. For more information on the differences between the registration and the service principal, see [Apps & service principals in Azure AD.](/develop/app-objects-and-service-principals.md) ++To restore an application from the Azure portal, select App registrations, then deleted applications. Select the application registration to restore, and then select Restore app registration. ++[](./media/recoverability/deletion-restore-application.png#lightbox) + +## Hard deletions ++A ΓÇ£hard deletionΓÇ¥ is the permanent removal of an object from your Azure Active Directory (Azure AD) tenant. Objects that don't support soft delete are removed in this way. Similarly, soft deleted objects are hard deleted once the deletion time is 30 days ago. The only object types that support a soft delete are: ++* Users ++* Microsoft 365 Groups ++* Application registration ++> [!IMPORTANT] +> All other item types are hard deleted. When an item is hard deleted it cannot be restored: it must be recreated. Neither administrators nor Microsoft can restore hard deleted items. It's important to prepare for this situation by ensuring that you have processes and documentation to minimize potential disruption from a hard delete. +For information on preparing for and documenting current states, see [Recoverability best practices](recoverability-overview.md). ++### When hard deletes usually occur ++Hard deletes most often occur in the following circumstances. ++Moving from soft to hard delete ++* A soft-deleted object wasn't restored within 30 days. ++* An administrator intentionally deletes an object in the soft delete state ++Directly hard deleted ++* The object type deleted doesn't support soft delete. ++* An administrator chooses to permanently delete an item by using the portal, typically in response to a request. ++* An automation script triggers the deletion of the object by using Microsoft Graph or PowerShell. Use of an automation script to clean up stale objects isn't uncommon. Microsoft recommends a robust off-boarding process for objects in your tenant to avoid mistakes that may result in mass-deletion of critical objects. ++## Recover from hard deletion ++Hard deleted items must be recreated and reconfigured. It's best to avoid unwanted hard deletions. ++### Review soft-deleted objects ++Ensure you have a process to frequently review items in the soft delete state and restore them if appropriate. To do so, you should: ++* Frequently [list deleted items](/graph/api/directory-deleteditems-list?view=graph-rest-1.0&tabs=http). ++* Ensure that you have specific criteria for what should be restored. ++* Ensure that you have specific roles or users assigned to evaluating and restoring items as appropriate. ++* Develop and test a continuity management plan. For more information, see [Considerations for your Enterprise Business Continuity Management Plan. ](/compliance/assurance/assurance-developing-your-ebcm-plan) +++For more information on avoiding unwanted deletions, see the following topics in the [Recoverability best practices](recoverability-overview.md) article. ++* Business continuity and disaster planning ++* Document known good states ++* Monitoring and data retention |
| active-directory | Recover From Misconfigurations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/recover-from-misconfigurations.md | + + Title: Recover from misconfigurations in Azure Active Directory +description: Learn how to recover from misconfigurations. +++++++ Last updated : 04/20/2022+++++++# Recover from misconfiguration ++Configuration settings in Azure Active Directory (Azure AD) can affect any resource in the Azure AD tenant through targeted or tenant-wide management actions. ++## What is configuration? ++Configurations are any changes in Azure AD that alter the behavior or capabilities of an Azure AD service or feature. For example, when you configure a Conditional Access policy you alter who can access the targeted applications and under what circumstances. ++It's important to understand the configuration items that are important to your organization. The following configurations have a high impact on your security posture. ++### Tenant wide configurations ++* **External identities**: Global administrators for the tenant identify and control the external identities that can be provisioned in the tenant. ++ * Whether to allow external identities in the tenant. ++ * From which domain(s) external identities can be added. ++ * Whether users can invite users from other tenants. ++* **Named Locations**: Global administrators can create named locations, which can then be used to ++ * Block sign-ins from specific locations. ++ * Trigger conditional access policies such as MFA. ++* **Allowed authentication methods**: Global administrators set the authentication methods allowed for the tenant. ++* **Self-service options**. Global Administrators set self-service options such as self-service-password reset and create Office 365 groups at the tenant level. ++The implementation of some tenant-wide configurations can be scoped, provided they aren't overridden by global administration policies. For example: ++* If the tenant is configured to allow external identities, a resource administrator can still exclude those identities from accessing a resource. ++* If the tenant is configured to allow personal device registration, a resource administrator can exclude those devices from accessing specific resources. ++* If named locations are configured, a resource administrator can configure policies either allowing or excluding access from those locations. ++### Conditional Access configurations ++Conditional Access policies are access control configurations that bring together signals to make decisions and enforce organizational policies. ++ ++++To learn more about Conditional Access policies, see [What is Conditional Access in Azure Active Directory?](../conditional-access/overview.md) ++> [!NOTE] +> While configuration alters the behavior or capabilities of an object or policy, not all changes to an object are configuration. You can change the data or attributes associated with an item, such as changing a userΓÇÖs address, without affecting the capabilities of that user object. +## What is misconfiguration ++A misconfiguration is a configuration of a resource or policy that diverges from your organizational policies or plans and causes unintended or unwanted consequences. ++A misconfiguration of tenant-wide settings or Conditional Access policies can seriously affect your security and the public image of your organization by: ++* Changing how administrators, tenant users, and external users interact with resources in your tenant. ++ * Unnecessarily limiting access to resources. ++ * Loosening access controls on sensitive resources. ++* Changing the ability of your users to interact with other tenants, and external users to interact with your tenant. ++* Causing denial of service, for example by not allowing customers to access their accounts. ++* Breaking dependencies among data, systems, and applications resulting in business process failures. ++### When does misconfiguration occur? ++Misconfiguration is most likely to occur when: ++* A mistake is made during ad-hoc changes. ++* A mistake is made as a result of troubleshooting exercises. ++* Malicious intent by a bad actor. ++## Prevent misconfiguration ++It's critical that alterations to the intended configuration of an Azure AD tenant are subject to robust change management processes, including: ++* Documenting the change, including prior state and intended post-change state. ++* Using Privileged Identity Management (PIM) to ensure that administrators with intent to change must deliberately escalate their privileges to do so. To learn more about PIM, see [What is Privileged Identity Management?](../privileged-identity-management/pim-configure.md) ++* Using a strong approval workflow for changes, for example, requiring [approval of PIM escalation of privileges](../privileged-identity-management/azure-ad-pim-approval-workflow.md). ++++## Monitor for configuration changes ++While you want to prevent misconfiguration, you can't set the bar for changes so high that it impacts administratorsΓÇÖ ability to perform their work efficiently. ++Closely monitor for configuration changes by watching for the following operations in your [Azure AD Audit log](../reports-monitoring/concept-audit-logs.md). ++* Add ++* Create ++* Update ++* Set ++* Delete ++The following table includes informative entries in the Audit Log you can look for. ++### Conditional Access and authentication method configuration changes ++Conditional Access policies are created on the Conditional Access page in the Azure portal. Changes to policies are made in the Conditional Access policy details page for the policy. ++| Service filter| Activities| Potential impacts | +| - | - | - | +| Conditional Access| Add, Update, or Delete Conditional Access policy| User access is granted or blocked when it shouldnΓÇÖt be. | +| Conditional Access| Add, Update, or Delete Named location| Network locations consumed by CA Policy aren't configured as intended, creating gaps in CA Policy conditions. | +| Authentication Method| Update Authentication methods policy| Users can use weaker authentication methods or are blocked from a method they should use | +++### User and password reset configuration changes ++User settings changes are made in the Azure AD portal User settings page. Password Reset changes are made on the Password reset page. Changes made on these pages are captured in the audit log as detailed in the following table. ++| Service filter| Activities| Potential impacts | +| - | - | - | +| Core Directory| Update company settings| Users may or may not be able to register applications, contrary to intent. | +| Core Directory| Set company information| Users may or may not be able to access the Azure AD administration portal contrary to intent. <br>Sign-in pages donΓÇÖt represent the company brand with potential damage to reputation | +| Core Directory| **Activity**: Updated service principal<br>**Target**: 0365 LinkedIn connection| Users may/may not be able to connect their Azure AD account with LinkedIn contrary to intent. | +| Self-service group Management| Update Myapps feature value| Users may/may not be able to use user features contrary to intent. | +| Self-service group Management| Update ConvergedUXV2 feature value| Users may/may not be able to use user features contrary to intent. | +| Self-service group Management| Update MyStaff feature value| Users may/may not be able to use user features contrary to intent. | +| Core directory| **Activity**: Update service principal<br>**Target**: Microsoft password reset service| Users are able/unable to reset their password contrary to intent. <br>Users are required/not required to register for SSPR contrary to intent.<br> Users can reset their password using methods that are unapproved, for example by using security questions. | ++++### External identities configuration changes ++You can make changes to these settings on the External identities or External collaboration settings pages in the Azure AD portal. ++| Service filter| Activities| Potential impacts | +| - | - | - | +| Core Directory| Add, update, or delete a partner to cross-tenant access setting| Users have outbound access to tenants that should be blocked.<br>Users from external tenants who should be blocked have inbound access | +| B2C| Create or delete identity provider| Identity providers for users who should be able to collaborate are missing, blocking access for those users. | +| Core directory| Set directory feature on tenant| External users have greater/less visibility of directory objects than intended.<br>External users may/may not invite other external users to your tenant contrary to intent. | +| Core Directory| Set federation settings on domain| External user invitations may/may not be sent to users in other tenants contrary to intent. | +| AuthorizationPolicy| Update authorization policy| External user invitations may/may not be sent to users in other tenants contrary to intent. | +| Core Directory| Update Policy| External user invitations may/may not be sent to users in other tenants contrary to intent. | +++++### Custom role and mobility definition configuration changes +++| Service filter| Activities / portal| Potential impacts | +| - |- | -| +| Core Directory| Add role definition| Custom role scope is narrower or broader than intended | +| PIM| Update role setting| Custom role scope is narrower or broader than intended | +| Core Directory| Update role definition| Custom role scope is narrower or broader than intended | +| Core Directory| Delete role definition| Custom role are missing | +| Core Directory| Add delegated permission grant| Mobile Device Management (MDM) and/or Mobile Application Management (MAM) configuration is missing or misconfigured leading to the failure of device or application management | ++### Audit log detail view ++Selecting some audit entries in the Audit Log will provide you with details on the old and new configuration values. For example, for Conditional Access policy configuration changes you can see the information in the following screenshot. ++ +++## Use workbooks to track changes ++There are several Azure Monitor workbooks that can help you to monitor configuration changes. ++[The Sensitive Operations Report workbook](../reports-monitoring/workbook-sensitive-operations-report.md) can help identify suspicious application and service principal activity that may indicate a compromise, including: ++* Modified application or service principal credentials or authentication methods ++* New permissions granted to service principals ++* Directory role and group membership updates for service principals ++* Modified federation settings ++The [Cross-tenant access activity workbook ](../reports-monitoring/workbook-cross-tenant-access-activity.md)can help you monitor which applications in external tenants your users are accessing, and which applications I your tenant external users are accessing. Use this workbook to look for anomalous changes in either inbound or outbound application access across tenants. ++## Next steps ++For foundational information on recoverability, see [Recoverability best practices](recoverability-overview.md) ++for information on recovering from deletions, see [Recover from deletions](recover-from-deletions.md) |
| active-directory | Recoverability Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/recoverability-overview.md | + + Title: Recoverability best practices in Azure Active Directory +description: Learn the best practices for increasing recoverability. +++++++ Last updated : 04/20/2022+++++++# Recoverability best practices +++Unintended deletions and misconfigurations will happen to your tenant. To minimize the impact of these unintended events, you must prepare for their occurrence. ++Recoverability is the preparatory processes and functionality that enable you to return your services to a prior functioning state after an unintended change. Unintended changes include the soft- or hard-deletion or misconfiguration of applications, groups, users, policies, and other objects in your Azure Active Directory (Azure AD) tenant. ++Recoverability helps your organization be more resilient. Resilience while related, is different. Resilience is the ability to endure disruption to system components and recover with minimal impact to your business, users, customers, and operations. For more information about making your systems more resilient, see [Building resilient identity and access management with Azure Active Directory](resilience-overview.md). ++This article describes the best practices in preparing for deletions and misconfigurations to minimize the unintended consequences to your organizationΓÇÖs business. ++## Deletions and misconfigurations ++Deletions and misconfigurations have different impacts on your tenant. ++### Deletions ++The impact of deletions depends on the object type. ++Users, Microsoft 365 (Microsoft 365) Groups, and applications can be ΓÇ£soft deleted.ΓÇ¥ Soft deleted items are sent to the Azure AD recycle bin. While in the recycle bin, items are not available for use. However, they retain all their properties, and can be restored via a Microsoft Graph API call, or in the Azure AD portal. Items in the soft delete state that aren't restored within 30 days, are permanently or ΓÇ£hard deleted.ΓÇ¥ ++ ++> [!IMPORTANT] +> All other object types are hard deleted immediately when selected for deletion. When an object is hard deleted, it cannot be recovered. It must be recreated and reconfigured. +For more information on deletions and how to recover from them, see [Recover from deletions](recover-from-deletions.md). ++### Misconfigurations ++Configurations are any changes in Azure AD that alter the behavior or capabilities of an Azure AD service or feature. For example, when you configure a Conditional Access policy you alter who can access the targeted applications and under what circumstances. Tenant-wide configurations affect your entire tenant. Configurations of specific objects or services affect only that object and its dependencies. ++For more information on misconfigurations and how to recover from them, see [Recover from misconfigurations](recover-from-misconfigurations.md). ++## Shared responsibility ++Recoverability is a shared responsibility between Microsoft as your cloud service provider, and your organization. ++ +++You can use the tools and services that Microsoft provides to prepare for deletions and misconfigurations. ++## Business continuity and disaster planning ++Restoring a hard deleted or misconfigured item is a resource-intensive process. You can minimize the resources needed by planning ahead. Consider having a specific team of admins in charge of restorations. ++### Test your restoration process ++You should rehearse your restoration process for different object types, and the communication that will go out as a result. Be sure to do rehearse with test objects, ideally in a test tenant. ++Testing your plan can help you to determine the following: ++- Validity and completeness of your object state documentation. ++- Typical time to resolution. ++- Appropriate communications and their audiences. ++- Expected successes and potential challenges. ++### Create the communication process ++Create a process of pre-defined communications to make others aware of the issue and timelines for restoration. Include the following in your restoration communication plan. ++- The types of communications to go out. Consider creating pre-defined templates. ++- Stakeholders to receive communications. Include the following as applicable: ++ - impacted business owners. ++ - operational admins who will perform recovery. ++ - Business and technical approvers. ++ - Impacted users. ++- Define the events that trigger communications, such as ++ - Initial deletion ++ - Impact assessment ++ - Time to resolution ++ - Restoration ++## Document known good states ++Document the state of your tenant and its objects regularly so that in the event of a hard delete or misconfiguration you have a road map to recovery. The following tools can help you in documenting your current state. ++- The [Microsoft Graph APIs](https://docs.microsoft.com/graph/overview?view=graph-rest-1.0) can be used to export the current state of many Azure AD configurations. ++- You can use the [Azure AD Exporter](https://github.com/microsoft/azureadexporter) to regularly export your configuration settings. ++- The [Microsoft 365 desired state configuration](https://github.com/microsoft/Microsoft365DSC/wiki/What-is-Microsoft365DSC) module is a module of the PowerShell Desired State Configuration framework. It can be used to export the configurations for reference, and application of the prior state of many settings. ++- The [Conditional Access APIs](https://github.com/Azure-Samples/azure-ad-conditional-access-apis) can be used to manage your Conditional Access policies as code. ++++### Commonly used Microsoft Graph APIs ++The Microsoft Graph APIs can be used to export the current state of many Azure AD configurations. The APIs cover most scenarios where reference material about the prior state, or the ability to apply that state from an exported copy, could become vital to keep your business running. ++Graph APIs are highly customizable based on your organizational needs. To implement a solution for backups or reference material requires developers to engineer code to query for, store, and display the data. Many implementations use online code repositories as part of this functionality. ++### Useful APIS for recovery +++| Resource types| Reference links | +| - | - | +| Users, groups, and other directory objects| [directoryObject API](/graph/api/resources/directoryObject?view=graph-rest-1.0) | +| Directory roles| [directoryRole API](/graph/api/resources/directoryrole?view=graph-rest-1.0) | +| Conditional Access policies| [Conditional Access policy API](/graph/api/resources/conditionalaccesspolicy?view=graph-rest-1.0) | +| Devices| [devices API](/graph/api/resources/device?view=graph-rest-1.0) | +| Domains| [domains API](/graph/api/domain-list?view=graph-rest-1.0&tabs=http) | +| Administrative Units| [administrativeUnit API)](/graph/api/resources/administrativeunit?view=graph-rest-1.0) | +| Deleted Items*| [deletedItems API](/graph/api/resources/directory?view=graph-rest-1.0) | +++Securely store these configuration exports with access provided to a limited number of admins. ++The [Azure AD Exporter](https://github.com/microsoft/azureadexporter) can provide most of the documentation you'll need. ++- Verify that you've implemented the desired configuration. +- Use the exporter to capture current configurations. +- Review the export, understand the settings for your tenant that aren't exported, and manually document them. +- Store the output in a secure location with limited access. +++> [!NOTE] +> Settings in the legacy MFA portal, for Application Proxy and federation settings may not be exported with the Azure AD Exporter, or with the Graph API. +The [Microsoft 365 desired state configuration](https://github.com/microsoft/Microsoft365DSC/wiki/What-is-Microsoft365DSC) module uses Microsoft Graph and PowerShell to retrieve the state of many of the configurations in Azure AD. This information can be used as reference information or, by using PowerShell Desired State Configuration scripting, to reapply a known-good state. ++ Use [Conditional Access Graph APIs](https://github.com/Azure-Samples/azure-ad-conditional-access-apis) to manage policies like code. Automate approvals to promote policies from preproduction environments, backup and restore, monitor change, and plan ahead for emergencies. ++### Map the dependencies among objects. ++The deletion of some objects can cause a ripple effect due to dependencies. For example, deletion of a security group used for application assignment would result in users who were members of that group being unable to access the applications to which the group was assigned. ++#### Common dependencies +++| Object Type| Potential Dependencies | +| - | - | +| Application object| Service Principal (Enterprise Application). <br>Groups assigned to the application. <br>Conditional Access Policies affecting the application. | +| Service principals| Application object | +| Conditional Access Policies| Users assigned to the policy.<br>Groups assigned to the policy.<br>Service Principal (Enterprise Application) targeted by the policy. | +| Groups other than Microsoft 365 Groups| Users assigned to the group.<br>Conditional access policies to which the group is assigned.<br>Applications to which the group is assigned access. | ++## Monitoring and data retention ++The [Azure AD Audit Log](../reports-monitoring/concept-audit-logs.md) contains information on all delete and configuration operations performed in your tenant. We recommend that you export these logs to a security information and event management (SIEM) tool such as [Microsoft Sentinel](../../sentinel/overview.md). You can also use Microsoft Graph to audit changes, and build a custom solution to monitor differences over time. For more information on finding deleted items using Microsoft Graph, see [List deleted items - Microsoft Graph v1.0 ](/graph/api/directory-deleteditems-list?view=graph-rest-1.0&tabs=http) ++### Audit logs ++The Audit Log always records a ΓÇ£Delete <object>ΓÇ¥ event when an object in the tenant is removed from an active state (either from active to soft-deleted or active to hard-deleted). +++A Delete event for applications, users, and Microsoft 365 Groups is a soft delete. For any other object type it's a hard delete. ++| | Activity in log| Result | +| - | - | - | +| Application| Delete application| Soft deleted | +| Application| Hard delete application| Hard deleted | +| User| Delete user| Soft deleted | +| User| Hard delete user| Hard deleted | +| Microsoft 365 Groups| Delete group| Soft deleted | +| Microsoft 365 Group| Hard delete group| Hard deleted | +| All other objects| Delete ΓÇ£objectTypeΓÇ¥| Hard deleted | ++> [!NOTE] +> The audit log does not distinguish the group type of a deleted group. Only Microsoft 365 Groups are soft-deleted. If you see a Delete group entry, it may be the soft delete of a M365 group, or the hard delete of another type of group. It is therefore important that your documentation of your known good state include the group type for each group in your organization. ++For information on monitoring configuration changes, see [Recover from misconfigurations](recover-from-misconfigurations.md). ++### Use workbooks to track configuration changes ++There are several Azure Monitor workbooks that can help you to monitor configuration changes. ++[The Sensitive Operations Report workbook](../reports-monitoring/workbook-sensitive-operations-report.md) can help identify suspicious application and service principal activity that may indicate a compromise, including: ++- Modified application or service principal credentials or authentication methods +- New permissions granted to service principals +- Directory role and group membership updates for service principals +- Modified federation settings +++The [Cross-tenant access activity workbook ](../reports-monitoring/workbook-cross-tenant-access-activity.md)can help you monitor which applications in external tenants your users are accessing, and which applications I your tenant external users are accessing. Use this workbook to look for anomalous changes in either inbound or outbound application access across tenants. ++## Operational security ++Preventing unwanted changes is far less difficult than needing to recreate and reconfigure objects. Include the following in your change management processes to minimize accidents: ++- Use a least privilege model. Ensure that each member of your team has the least privileges necessary to complete their usual tasks and require a process to escalate privileges for more unusual tasks. ++- Administrative control of an object enables configuration and deletion. Use Read Only admin roles, for example the Global Reader role, for any tasks that do not require operations to create, update, or delete (CRUD). When CRUD operations are required, use object specific roles when possible. For example, User Administrators can delete only users, and Application Administrators can delete only applications. Use these more limited roles whenever possible, instead of a Global Administrator role, which can delete anything, including the tenant. ++- [Use Privileged Identity Management (PIM)](../privileged-identity-management/pim-configure.md). PIM enables just-in-time escalation of privileges to perform tasks like hard deletion. You can configure PIM to have notifications and or approvals for the privilege escalation. +++## Next steps ++[Recover from deletions](recover-from-deletions.md) ++[Recover from misconfigurations](recover-from-misconfigurations.md) |
| active-directory | Managed Identities Status | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/managed-identities-azure-resources/managed-identities-status.md | The following Azure services support managed identities for Azure resources: | Azure Service Fabric | [Using Managed identities for Azure with Service Fabric](../../service-fabric/concepts-managed-identity.md) | | Azure SignalR Service | [Managed identities for Azure SignalR Service](../../azure-signalr/howto-use-managed-identity.md) | | Azure Spring Cloud | [How to enable system-assigned managed identity for Azure Spring Cloud application](../../spring-cloud/how-to-enable-system-assigned-managed-identity.md) |-| Azure SQL | [Azure SQL Transparent Data Encryption with customer-managed key](../../azure-sql/database/transparent-data-encryption-byok-overview.md) | -| Azure SQL Managed Instance | [Azure SQL Transparent Data Encryption with customer-managed key](../../azure-sql/database/transparent-data-encryption-byok-overview.md) | +| Azure SQL | [Azure SQL Transparent Data Encryption with customer-managed key](/azure/azure-sql/database/transparent-data-encryption-byok-overview) | +| Azure SQL Managed Instance | [Azure SQL Transparent Data Encryption with customer-managed key](/azure/azure-sql/database/transparent-data-encryption-byok-overview) | | Azure Stack Edge | [Manage Azure Stack Edge secrets using Azure Key Vault](../../databox-online/azure-stack-edge-gpu-activation-key-vault.md#recover-managed-identity-access) | Azure Static Web Apps | [Securing authentication secrets in Azure Key Vault](../../static-web-apps/key-vault-secrets.md) | Azure Stream Analytics | [Authenticate Stream Analytics to Azure Data Lake Storage Gen1 using managed identities](../../stream-analytics/stream-analytics-managed-identities-adls.md) | |
| active-directory | Services Azure Active Directory Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/managed-identities-azure-resources/services-azure-active-directory-support.md | The following services support Azure AD authentication. New services are added t | Azure Service Fabric | [Set up Azure Active Directory for client authentication](../../service-fabric/service-fabric-cluster-creation-setup-aad.md) | | Azure Service Bus | [Service Bus authentication and authorization](../../service-bus-messaging/service-bus-authentication-and-authorization.md) | Azure SignalR Service | [Authorize access with Azure Active Directory for Azure SignalR Service](../../azure-signalr/signalr-concept-authorize-azure-active-directory.md) |-| Azure SQL | [Use Azure Active Directory authentication](../../azure-sql/database/authentication-aad-overview.md) | -| Azure SQL Managed Instance | [What is Azure SQL Managed Instance?](../../azure-sql/managed-instance/sql-managed-instance-paas-overview.md#azure-active-directory-integration) | +| Azure SQL | [Use Azure Active Directory authentication](/azure/azure-sql/database/authentication-aad-overview) | +| Azure SQL Managed Instance | [What is Azure SQL Managed Instance?](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview#azure-active-directory-integration) | | Azure Static Web Apps | [Authentication and authorization for Azure Static Web Apps](../../static-web-apps/authentication-authorization.md?tabs=invitations) | Azure Storage | [Authorize access to blobs using Azure Active Directory](../../storage/blobs/authorize-access-azure-active-directory.md) | | Azure Virtual Machines | [Secure and use policies on virtual machines in Azure](../devices/howto-vm-sign-in-azure-ad-windows.md) | |
| active-directory | Tutorial Windows Vm Access Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql.md | This tutorial shows you how to use a system-assigned identity for a Windows virt ## Grant access -To grant your VM access to a database in Azure SQL Database, you can use an existing [logical SQL server](../../azure-sql/database/logical-servers.md) or create a new one. To create a new server and database using the Azure portal, follow this [Azure SQL quickstart](../../azure-sql/database/single-database-create-quickstart.md). There are also quickstarts that use the Azure CLI and Azure PowerShell in the [Azure SQL documentation](/azure/sql-database/). +To grant your VM access to a database in Azure SQL Database, you can use an existing [logical SQL server](/azure/azure-sql/database/logical-servers) or create a new one. To create a new server and database using the Azure portal, follow this [Azure SQL quickstart](/azure/azure-sql/database/single-database-create-quickstart). There are also quickstarts that use the Azure CLI and Azure PowerShell in the [Azure SQL documentation](/azure/sql-database/). There are two steps to granting your VM access to a database: There are two steps to granting your VM access to a database: ### Enable Azure AD authentication -**To [configure Azure AD authentication](../../azure-sql/database/authentication-aad-configure.md):** +**To [configure Azure AD authentication](/azure/azure-sql/database/authentication-aad-configure):** 1. In the Azure portal, select **SQL servers** from the left-hand navigation. 2. Click the SQL server to be enabled for Azure AD authentication. There are two steps to granting your VM access to a database: This section shows how to create a contained user in the database that represents the VM's system assigned identity. For this step, you need [Microsoft SQL Server Management Studio](/sql/ssms/download-sql-server-management-studio-ssms) (SSMS). Before beginning, it may also be helpful to review the following articles for background on Azure AD integration: -- [Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](../../azure-sql/database/authentication-mfa-ssms-overview.md)-- [Configure and manage Azure Active Directory authentication with SQL Database or Azure Synapse Analytics](../../azure-sql/database/authentication-aad-configure.md)+- [Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](/azure/azure-sql/database/authentication-mfa-ssms-overview) +- [Configure and manage Azure Active Directory authentication with SQL Database or Azure Synapse Analytics](/azure/azure-sql/database/authentication-aad-configure) SQL DB requires unique Azure AD display names. With this, the Azure AD accounts such as users, groups and Service Principals (applications), and VM names enabled for managed identity must be uniquely defined in AAD regarding their display names. SQL DB checks the Azure AD display name during T-SQL creation of such users and if it is not unique, the command fails requesting to provide a unique Azure AD display name for a given account. Examine the value of `$DataSet.Tables[0]` to view the results of the query. In this tutorial, you learned how to use a system-assigned managed identity to access Azure SQL Database. To learn more about Azure SQL Database see: > [!div class="nextstepaction"]-> [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md) +> [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) |
| advisor | Advisor Performance Recommendations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/advisor/advisor-performance-recommendations.md | Azure Advisor provides a consistent, consolidated view of recommendations for al > [!NOTE] > Before you can get recommendations, your database needs to be in use for about a week, and within that week there needs to be some consistent activity. SQL Database Advisor can optimize more easily for consistent query patterns than for random bursts of activity. -For more information, see [SQL Database Advisor](../azure-sql/database/database-advisor-implement-performance-recommendations.md). +For more information, see [SQL Database Advisor](/azure/azure-sql/database/database-advisor-implement-performance-recommendations). ## Upgrade your Storage client library to the latest version for better reliability and performance |
| advisor | Advisor Reference Operational Excellence Recommendations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/advisor/advisor-reference-operational-excellence-recommendations.md | Learn more about [Network Security Group - NSGFlowLogsenableTA (Enable Traffic A Full mode installs the SQL IaaS Agent to the VM to deliver full functionality. Use it for managing a SQL Server VM with a single instance. There is no cost associated with using the full manageability mode. System administrator permissions are required. Note that installing or upgrading to full mode is an online operation, there is no restart required. -Learn more about [SQL virtual machine - UpgradeToFullMode (SQL IaaS Agent should be installed in full mode)](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md?tabs=azure-powershell). +Learn more about [SQL virtual machine - UpgradeToFullMode (SQL IaaS Agent should be installed in full mode)](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management?tabs=azure-powershell). ## Storage |
| aks | Howto Deploy Java Liberty App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/aks/howto-deploy-java-liberty-app.md | aks-nodepool1-xxxxxxxx-yyyyyyyyyy Ready agent 76s v1.18.10 The steps in this section guide you through creating an Azure SQL Database single database for use with your app. If your application doesn't require a database, you can skip this section. -1. Create a single database in Azure SQL Database by following the steps in: [Quickstart: Create an Azure SQL Database single database](../azure-sql/database/single-database-create-quickstart.md). Return to this document after creating and configuring the database server. +1. Create a single database in Azure SQL Database by following the steps in: [Quickstart: Create an Azure SQL Database single database](/azure/azure-sql/database/single-database-create-quickstart). Return to this document after creating and configuring the database server. > [!NOTE] > > * At the **Basics** step, write down **Database name**, ***Server name**.database.windows.net*, **Server admin login** and **Password**. |
| analysis-services | Analysis Services Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/analysis-services/analysis-services-manage.md | To get all the latest features, and the smoothest experience when connecting to **Active Directory Password Authentication** to use an organizational account. For example, when connecting from a non-domain joined computer. - **Active Directory - Universal with MFA support** to use [non-interactive or multi-factor authentication](../azure-sql/database/authentication-mfa-ssms-overview.md). + **Active Directory - Universal with MFA support** to use [non-interactive or multi-factor authentication](/azure/azure-sql/database/authentication-mfa-ssms-overview).  |
| analysis-services | Analysis Services Tutorial Roles | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/analysis-services/tutorials/analysis-services-tutorial-roles.md | For the remaining tasks, you use SSMS to connect to and manage your server.  > [!TIP]- > Choosing Active Directory Universal with MFA Support is recommended. This type of authentication type supports [non-interactive and multi-factor authentication](../../azure-sql/database/authentication-mfa-ssms-overview.md). + > Choosing Active Directory Universal with MFA Support is recommended. This type of authentication type supports [non-interactive and multi-factor authentication](/azure/azure-sql/database/authentication-mfa-ssms-overview). 3. In **Object Explorer**, expand to see server objects. Right-click to see server properties. |
| app-service | App Service Sql Asp Github Actions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/app-service-sql-asp-github-actions.md | -Learn how to set up a GitHub Actions workflow to deploy a ASP.NET Core application with an [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) backend. When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database. You'll first use an [ARM template](../azure-resource-manager/templates/overview.md) to create resources. +Learn how to set up a GitHub Actions workflow to deploy a ASP.NET Core application with an [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) backend. When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database. You'll first use an [ARM template](../azure-resource-manager/templates/overview.md) to create resources. This tutorial does not use containers. If you want to deploy to a containerized ASP.NET Core application, see [Use GitHub Actions to deploy to App Service for Containers and connect to a database](app-service-sql-github-actions.md). |
| app-service | App Service Sql Github Actions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/app-service-sql-github-actions.md | -This tutorial walks you through setting up a GitHub Actions workflow to deploy a containerized ASP.NET Core application with an [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) backend. When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database. You'll first create Azure resources with an [ARM template](../azure-resource-manager/templates/overview.md) GitHub Actions workflow. +This tutorial walks you through setting up a GitHub Actions workflow to deploy a containerized ASP.NET Core application with an [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) backend. When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database. You'll first create Azure resources with an [ARM template](../azure-resource-manager/templates/overview.md) GitHub Actions workflow. In this tutorial, you learn how to: |
| app-service | App Service Web Tutorial Dotnet Sqldatabase | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/app-service-web-tutorial-dotnet-sqldatabase.md | -[Azure App Service](overview.md) provides a highly scalable, self-patching web hosting service. This tutorial shows you how to deploy a data-driven ASP.NET app in App Service and connect it to [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md). When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database. +[Azure App Service](overview.md) provides a highly scalable, self-patching web hosting service. This tutorial shows you how to deploy a data-driven ASP.NET app in App Service and connect it to [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview). When you're finished, you have an ASP.NET app running in Azure and connected to SQL Database.  You can keep the generated web app name, or change it to another unique name (va #### Create a server and database -Before creating a database, you need a [logical SQL server](../azure-sql/database/logical-servers.md). A logical SQL server is a logical construct that contains a group of databases managed as a group. +Before creating a database, you need a [logical SQL server](/azure/azure-sql/database/logical-servers). A logical SQL server is a logical construct that contains a group of databases managed as a group. 1. In the **Publish** dialog, scroll down to the **Service Dependencies** section. Next to **SQL Server Database**, click **Configure**. |
| app-service | Configure Common | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/configure-common.md | Here, you can configure some common settings for the app. Some settings require - **Stack settings**: The software stack to run the app, including the language and SDK versions. - For Linux apps and custom containers, you can select the language runtime version and set an optional **Startup command** or a startup command file. + For Linux apps, you can select the language runtime version and set an optional **Startup command** or a startup command file.  |
| app-service | Configure Custom Container | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/configure-custom-container.md | The following lists show supported and unsupported Docker Compose configuration - secrets (ignored) - ports other than 80 and 8080 (ignored) +#### Syntax Limitations ++- the "version x.x" always needs to be the first yaml statement in the file +- the ports section must use quoted numbers +- the image > volume section must be quoted and cannot have a permissions definitions +- the volumes section must not have an empty curly brace after the volume name + > [!NOTE] > Any other options not explicitly called out are ignored in Public Preview. |
| app-service | App Service App Service Environment Network Configuration Expressroute | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/environment/app-service-app-service-environment-network-configuration-expressroute.md | App Service Environment requires the following network connectivity settings to * Outbound network connectivity to the Azure Files service on port 445. -* Outbound network connectivity to Azure SQL Database endpoints that are located in the same region as App Service Environment. SQL Database endpoints resolve under the database.windows.net domain, which requires open access to ports 1433, 11000-11999, and 14000-14999. For details about SQL Database V12 port usage, see [Ports beyond 1433 for ADO.NET 4.5](../../azure-sql/database/adonet-v12-develop-direct-route-ports.md). +* Outbound network connectivity to Azure SQL Database endpoints that are located in the same region as App Service Environment. SQL Database endpoints resolve under the database.windows.net domain, which requires open access to ports 1433, 11000-11999, and 14000-14999. For details about SQL Database V12 port usage, see [Ports beyond 1433 for ADO.NET 4.5](/azure/azure-sql/database/adonet-v12-develop-direct-route-ports). * Outbound network connectivity to the Azure management-plane endpoints (both Azure classic deployment model and Azure Resource Manager endpoints). Connectivity to these endpoints includes the management.core.windows.net and management.azure.com domains. |
| app-service | Manage Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/manage-backup.md | Run backups the same way you would normally do it, [manually](#create-a-manual-b After you have made one or more backups for your app, the backups are visible on the **Containers** page of your storage account, and your app. In the storage account, each backup consists of a`.zip` file that contains the backup data and an `.xml` file that contains a manifest of the `.zip` file contents. You can unzip and browse these files if you want to access your backups without actually performing an app restore. -The database backup for the app is stored in the root of the .zip file. For SQL Database, this is a BACPAC file (no file extension) and can be imported. To create a database in Azure SQL Database based on the BACPAC export, see [Import a BACPAC file to create a database in Azure SQL Database](../azure-sql/database/database-import.md). +The database backup for the app is stored in the root of the .zip file. For SQL Database, this is a BACPAC file (no file extension) and can be imported. To create a database in Azure SQL Database based on the BACPAC export, see [Import a BACPAC file to create a database in Azure SQL Database](/azure/azure-sql/database/database-import). > [!WARNING] > Altering any of the files in your **websitebackups** container can cause the backup to become invalid and therefore non-restorable. |
| app-service | Manage Scale Up | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/manage-scale-up.md | If your app depends on other services, such as Azure SQL Database or Azure Stora  - To scale up the related resource, see the documentation for the specific resource type. For example, to scale up a single SQL Database, see [Scale single database resources in Azure SQL Database](../azure-sql/database/single-database-scale.md). To scale up a Azure Database for MySQL resource, see [Scale MySQL resources](../mysql/concepts-pricing-tiers.md#scale-resources). + To scale up the related resource, see the documentation for the specific resource type. For example, to scale up a single SQL Database, see [Scale single database resources in Azure SQL Database](/azure/azure-sql/database/single-database-scale). To scale up a Azure Database for MySQL resource, see [Scale MySQL resources](../mysql/concepts-pricing-tiers.md#scale-resources). <a name="OtherFeatures"></a> <a name="devfeatures"></a> |
| app-service | Quickstart Arm Template Uiex | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/quickstart-arm-template-uiex.md | When no longer needed, [delete the resource group](../azure-resource-manager/man - [ASP.NET Core with SQL Database](tutorial-dotnetcore-sqldb-app.md) - [Python with Postgres](tutorial-python-postgresql-app.md) - [PHP with MySQL](tutorial-php-mysql-app.md)-- [Connect to Azure SQL database with Java](../azure-sql/database/connect-query-java.md?toc=%2fazure%2fjava%2ftoc.json)+- [Connect to Azure SQL database with Java](/azure/azure-sql/database/connect-query-java?toc=%2fazure%2fjava%2ftoc.json) |
| app-service | Quickstart Arm Template | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/quickstart-arm-template.md | When no longer needed, [delete the resource group](../azure-resource-manager/man > [PHP with MySQL](tutorial-php-mysql-app.md) > [!div class="nextstepaction"]-> [Connect to Azure SQL database with Java](../azure-sql/database/connect-query-java.md?toc=%2fazure%2fjava%2ftoc.json) +> [Connect to Azure SQL database with Java](/azure/azure-sql/database/connect-query-java?toc=%2fazure%2fjava%2ftoc.json) > [!div class="nextstepaction"] > [Map custom domain](app-service-web-tutorial-custom-domain.md) |
| app-service | Scenario Secure App Access Microsoft Graph As User | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/scenario-secure-app-access-microsoft-graph-as-user.md | Title: Tutorial - Web app accesses Microsoft Graph as the user | Azure -description: In this tutorial, you learn how to access data in Microsoft Graph for a signed-in user. + Title: Tutorial - .NET Web app accesses Microsoft Graph as the user | Azure +description: In this tutorial, you learn how to access data in Microsoft Graph for a signed-in user from a .NET web app. +ms.devlang: csharp #Customer intent: As an application developer, I want to learn how to access data in Microsoft Graph for a signed-in user. -# Tutorial: Access Microsoft Graph from a secured app as the user +# Tutorial: Access Microsoft Graph from a secured .NET app as the user -Learn how to access Microsoft Graph from a web app running on Azure App Service. --You want to add access to Microsoft Graph from your web app and perform some action as the signed-in user. This section describes how to grant delegated permissions to the web app and get the signed-in user's profile information from Azure Active Directory (Azure AD). --In this tutorial, you learn how to: --> [!div class="checklist"] -> -> * Grant delegated permissions to a web app. -> * Call Microsoft Graph from a web app for a signed-in user. ---## Prerequisites --* A web application running on Azure App Service that has the [App Service authentication/authorization module enabled](scenario-secure-app-authentication-app-service.md). --## Grant front-end access to call Microsoft Graph --Now that you've enabled authentication and authorization on your web app, the web app is registered with the Microsoft identity platform and is backed by an Azure AD application. In this step, you give the web app permissions to access Microsoft Graph for the user. (Technically, you give the web app's Azure AD application the permissions to access the Microsoft Graph Azure AD application for the user.) --In the [Azure portal](https://portal.azure.com) menu, select **Azure Active Directory** or search for and select **Azure Active Directory** from any page. --Select **App registrations** > **Owned applications** > **View all applications in this directory**. Select your web app name, and then select **API permissions**. --Select **Add a permission**, and then select Microsoft APIs and Microsoft Graph. --Select **Delegated permissions**, and then select **User.Read** from the list. Select **Add permissions**. --## Configure App Service to return a usable access token --The web app now has the required permissions to access Microsoft Graph as the signed-in user. In this step, you configure App Service authentication and authorization to give you a usable access token for accessing Microsoft Graph. For this step, you need to add the User.Read scope for the downstream service (Microsoft Graph): `https://graph.microsoft.com/User.Read`. --> [!IMPORTANT] -> If you don't configure App Service to return a usable access token, you receive a ```CompactToken parsing failed with error code: 80049217``` error when you call Microsoft Graph APIs in your code. --# [Azure Resource Explorer](#tab/azure-resource-explorer) -Go to [Azure Resource Explorer](https://resources.azure.com/) and using the resource tree, locate your web app. The resource URL should be similar to `https://resources.azure.com/subscriptions/subscriptionId/resourceGroups/SecureWebApp/providers/Microsoft.Web/sites/SecureWebApp20200915115914`. --The Azure Resource Explorer is now opened with your web app selected in the resource tree. At the top of the page, select **Read/Write** to enable editing of your Azure resources. --In the left browser, drill down to **config** > **authsettingsV2**. --In the **authsettingsV2** view, select **Edit**. Find the **login** section of **identityProviders** -> **azureActiveDirectory** and add the following **loginParameters** settings: `"loginParameters":[ "response_type=code id_token","scope=openid offline_access profile https://graph.microsoft.com/User.Read" ]` . --```json -"identityProviders": { - "azureActiveDirectory": { - "enabled": true, - "login": { - "loginParameters":[ - "response_type=code id_token", - "scope=openid offline_access profile https://graph.microsoft.com/User.Read" - ] - } - } - } -}, -``` --Save your settings by selecting **PUT**. This setting can take several minutes to take effect. Your web app is now configured to access Microsoft Graph with a proper access token. If you don't, Microsoft Graph returns an error saying that the format of the compact token is incorrect. --# [Azure CLI](#tab/azure-cli) --Use the Azure CLI to call the App Service Web App REST APIs to [get](/rest/api/appservice/web-apps/get-auth-settings) and [update](/rest/api/appservice/web-apps/update-auth-settings) the auth configuration settings so your web app can call Microsoft Graph. Open a command window and login to Azure CLI: --```azurecli -az login -``` --Get your existing 'config/authsettingsv2ΓÇÖ settings and save to a local *authsettings.json* file. --```azurecli -az rest --method GET --url '/subscriptions/{SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Web/sites/{WEBAPP_NAME}/config/authsettingsv2/list?api-version=2020-06-01' > authsettings.json -``` --Open the authsettings.json file using your preferred text editor. Find the **login** section of **identityProviders** -> **azureActiveDirectory** and add the following **loginParameters** settings: `"loginParameters":[ "response_type=code id_token","scope=openid offline_access profile https://graph.microsoft.com/User.Read" ]` . --```json -"identityProviders": { - "azureActiveDirectory": { - "enabled": true, - "login": { - "loginParameters":[ - "response_type=code id_token", - "scope=openid offline_access profile https://graph.microsoft.com/User.Read" - ] - } - } - } -}, -``` --Save your changes to the *authsettings.json* file and upload the local settings to your web app: --```azurecli -az rest --method PUT --url '/subscriptions/{SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Web/sites/{WEBAPP_NAME}/config/authsettingsv2?api-version=2020-06-01' --body @./authsettings.json -``` ---## Call Microsoft Graph +## Call Microsoft Graph with .NET Your web app now has the required permissions and also adds Microsoft Graph's client ID to the login parameters. -# [C#](#tab/programming-language-csharp) Using the [Microsoft.Identity.Web library](https://github.com/AzureAD/microsoft-identity-web/), the web app gets an access token for authentication with Microsoft Graph. In version 1.2.0 and later, the Microsoft.Identity.Web library integrates with and can run alongside the App Service authentication/authorization module. Microsoft.Identity.Web detects that the web app is hosted in App Service and gets the access token from the App Service authentication/authorization module. The access token is then passed along to authenticated requests with the Microsoft Graph API. To see this code as part of a sample application, see the: public class Startup } ``` -### Index.cshtml.cs +### Call Microsoft Graph on behalf of the user The following example shows how to call Microsoft Graph as the signed-in user and get some user information. The ```GraphServiceClient``` object is injected into the controller, and authentication has been configured for you by the Microsoft.Identity.Web library. ```csharp+// Index.cshtml.cs using System.Threading.Tasks; using Microsoft.AspNetCore.Mvc.RazorPages; using Microsoft.Graph; public class IndexModel : PageModel } ``` -# [Node.js](#tab/programming-language-nodejs) --The web app gets the user's access token from the incoming requests header, which is then passed down to Microsoft Graph client to make an authenticated request to the `/me` endpoint. --To see this code as part of a sample application, see *graphController.js* in the [sample on GitHub](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/tree/main/2-WebApp-graphapi-on-behalf). --```nodejs -const graphHelper = require('../utils/graphHelper'); --// Some code omitted for brevity. --exports.getProfilePage = async(req, res, next) => { -- try { - const graphClient = graphHelper.getAuthenticatedClient(req.session.protectedResources["graphAPI"].accessToken); -- const profile = await graphClient - .api('/me') - .get(); -- res.render('profile', { isAuthenticated: req.session.isAuthenticated, profile: profile, appServiceName: appServiceName }); - } catch (error) { - next(error); - } -} -``` --To query Microsoft Graph, use the [Microsoft Graph JavaScript SDK](https://github.com/microsoftgraph/msgraph-sdk-javascript). The code for this is located in [utils/graphHelper.js](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/2-WebApp-graphapi-on-behalf/utils/graphHelper.js): --```nodejs -const graph = require('@microsoft/microsoft-graph-client'); --// Some code omitted for brevity. --getAuthenticatedClient = (accessToken) => { - // Initialize Graph client - const client = graph.Client.init({ - // Use the provided access token to authenticate requests - authProvider: (done) => { - done(null, accessToken); - } - }); -- return client; -} -``` ---## Clean up resources --If you're finished with this tutorial and no longer need the web app or associated resources, [clean up the resources you created](scenario-secure-app-clean-up-resources.md). --## Next steps --In this tutorial, you learned how to: --> [!div class="checklist"] -> -> * Grant delegated permissions to a web app. -> * Call Microsoft Graph from a web app for a signed-in user. -> [!div class="nextstepaction"] -> [App service accesses Microsoft Graph as the app](scenario-secure-app-access-microsoft-graph-as-app.md) |
| app-service | Scenario Secure App Access Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/scenario-secure-app-access-storage.md | static public async Task UploadBlob(string accountName, string containerName, st [!INCLUDE [tutorial-clean-up-steps](./includes/tutorial-cleanup.md)] |
| app-service | Scenario Secure App Authentication App Service As User | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/scenario-secure-app-authentication-app-service-as-user.md | + + Title: Tutorial - Add user authentication to a web app on Azure App Service | Azure +description: In this tutorial, you learn how to enable user authentication and authorization for a web app running on Azure App Service. Limit access to the web app to users in your organizationΓÇï. +++++++ Last updated : 02/25/2022++++#Customer intent: As an application developer, enable authentication and authorization for a web app running on Azure App Service. +++# Tutorial: Add user authentication to your web app running on Azure App Service +++## Connect to backend services as user ++User authentication can begin with authenticating the user to your app service as described in the previous section. +++Once the app service has the authenticated identity, your system needs to **connect to backend services as the user**: ++* A database example is a SQL database which imposes its own security for that identity on tables + +* A storage example is Blob Storage which imposes its own security for that identity on containers and blobs ++* A user needs access to Microsoft Graph to access their own email. +++> [!div class="nextstepaction"] +> [App service accesses Graph](scenario-secure-app-authentication-app-service-as-user.md) |
| app-service | Scenario Secure App Authentication App Service | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/scenario-secure-app-authentication-app-service.md | Title: Tutorial - Add authentication to a web app on Azure App Service | Azure -description: In this tutorial, you learn how to enable authentication and authorization for a web app running on Azure App Service. Limit access to the web app to users in your organizationΓÇï. + Title: Tutorial - Add app authentication to a web app on Azure App Service | Azure +description: In this tutorial, you learn how to enable app authentication and authorization for a web app running on Azure App Service. Limit access to the web app to users in your organizationΓÇï. -# Tutorial: Add authentication to your web app running on Azure App Service +# Tutorial: Add app authentication to your web app running on Azure App Service -Learn how to enable authentication for your web app running on Azure App Service and limit access to users in your organization. --App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code in your web app. Using the App Service authentication/authorization module isn't required, but helps simplify authentication and authorization for your app. This article shows how to secure your web app with the App Service authentication/authorization module by using Azure Active Directory (Azure AD) as the identity provider. --The authentication/authorization module is enabled and configured through the Azure portal and app settings. No SDKs, specific languages, or changes to application code are required.ΓÇï A variety of identity providers are supported, which includes Azure AD, Microsoft Account, Facebook, Google, and TwitterΓÇïΓÇï. When the authentication/authorization module is enabled, every incoming HTTP request passes through it before being handled by app code.ΓÇïΓÇï To learn more, see [Authentication and authorization in Azure App Service](overview-authentication-authorization.md). --In this tutorial, you learn how to: --> [!div class="checklist"] -> -> * Configure authentication for the web app. -> * Limit access to the web app to users in your organization. ---## Create and publish a web app on App Service --For this tutorial, you need a web app deployed to App Service. You can use an existing web app, or you can follow the [ASP.NET Core quickstart](quickstart-dotnetcore.md) to create and publish a new web app to App Service. --Whether you use an existing web app or create a new one, take note of the web app name and the name of the resource group that the web app is deployed to. You need these names throughout this tutorial. --## Configure authentication and authorization --You now have a web app running on App Service. Next, you enable authentication and authorization for the web app. You use Azure AD as the identity provider. For more information, see [Configure Azure AD authentication for your App Service application](configure-authentication-provider-aad.md). --In the [Azure portal](https://portal.azure.com) menu, select **Resource groups**, or search for and select **Resource groups** from any page. --In **Resource groups**, find and select your resource group. In **Overview**, select your app's management page. -+## Connect to backend services as app -On your app's left menu, select **Authentication**, and then click **Add identity provider**. +User authentication can begin with authenticating the user to your app service as described in the previous section. -In the **Add an identity provider** page, select **Microsoft** as the **Identity provider** to sign in Microsoft and Azure AD identities. --For **App registration** > **App registration type**, select **Create new app registration**. --For **App registration** > **Supported account types**, select **Current tenant-single tenant**. --In the **App Service authentication settings** section, leave **Authentication** set to **Require authentication** and **Unauthenticated requests** set to **HTTP 302 Found redirect: recommended for websites**. --At the bottom of the **Add an identity provider** page, click **Add** to enable authentication for your web app. ---You now have an app that's secured by the App Service authentication and authorization. --> [!NOTE] -> To allow accounts from other tenants, change the 'Issuer URL' to 'https://login.microsoftonline.com/common/v2.0' by editing your 'Identity Provider' from the 'Authentication' blade. -> --## Verify limited access to the web app --When you enabled the App Service authentication/authorization module, an app registration was created in your Azure AD tenant. The app registration has the same display name as your web app. To check the settings, select **Azure Active Directory** from the portal menu, and select **App registrations**. Select the app registration that was created. In the overview, verify that **Supported account types** is set to **My organization only**. ---To verify that access to your app is limited to users in your organization, start a browser in incognito or private mode and go to `https://<app-name>.azurewebsites.net`. You should be directed to a secured sign-in page, verifying that unauthenticated users aren't allowed access to the site. Sign in as a user in your organization to gain access to the site. You can also start up a new browser and try to sign in by using a personal account to verify that users outside the organization don't have access. --## Clean up resources -If you're finished with this tutorial and no longer need the web app or associated resources, [clean up the resources you created](scenario-secure-app-clean-up-resources.md). +Once the app service has the authenticated identity, your system needs to **connect to backend services as the app**: -## Next steps +* Use [managed identity](tutorial-connect-overview.md#connect-to-azure-services-with-managed-identity). If managed identity isn't available, then use [Key Vault](tutorial-connect-overview.md#connect-to-key-vault-with-managed-identity). -In this tutorial, you learned how to: +* The user identity doesn't need to flow further. Any additional security to reach backend services is handled with the app service's identity. -> [!div class="checklist"] -> -> * Configure authentication for the web app. -> * Limit access to the web app to users in your organization. > [!div class="nextstepaction"] > [App service accesses storage](scenario-secure-app-access-storage.md) |
| app-service | Scenario Secure App Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/scenario-secure-app-overview.md | This tutorial describes a common application scenario (for example, an employee - [Configure authentication for a web app](scenario-secure-app-authentication-app-service.md) and limit access to users in your organization. See A in the diagram. - [Securely access the Azure data plane](scenario-secure-app-access-storage.md) (Azure Storage, Azure SQL Database, Azure Key Vault, or other services) from the web application using managed identities to get non-user data. See B in the diagram. - Access data in Microsoft Graph [for the signed-in user](scenario-secure-app-access-microsoft-graph-as-user.md) to get user data, or [for the web application](scenario-secure-app-access-microsoft-graph-as-app.md) using managed identities to get non-user data. See C in the diagram.-- [Clean up the resources](scenario-secure-app-clean-up-resources.md) you created for this tutorial. :::image type="content" source="./media/scenario-secure-app-overview/web-app.svg" alt-text="Diagram that shows application scenarios in Microsoft identity platform." border="false"::: |
| app-service | Security Recommendations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/security-recommendations.md | This article contains security recommendations for Azure App Service. Implementi | Recommendation | Comments | |-|-|-|Use Microsoft Defender for Cloud's Microsoft Defender for App Service | [Microsoft Defender for App Service](../security-center/defender-for-app-service-introduction.md) is natively integrated with Azure App Service. Defender for Cloud assesses the resources covered by your App Service plan and generates security recommendations based on its findings. Use the detailed instructions in [these recommendations]()../security-center/recommendations-reference.md#appservices-recommendations) to harden your App Service resources. Microsoft Defender for Cloud also provides threat protection and can detect a multitude of threats covering almost the complete list of MITRE ATT&CK tactics from pre-attack to command and control. For a full list of the Azure App Service alerts, see [Microsoft Defender for App Service alerts](../security-center/alerts-reference.md#alerts-azureappserv).| +|Use Microsoft Defender for Cloud's Microsoft Defender for App Service | [Microsoft Defender for App Service](../security-center/defender-for-app-service-introduction.md) is natively integrated with Azure App Service. Defender for Cloud assesses the resources covered by your App Service plan and generates security recommendations based on its findings. Use the detailed instructions in [these recommendations](../security-center/recommendations-reference.md#appservices-recommendations) to harden your App Service resources. Microsoft Defender for Cloud also provides threat protection and can detect a multitude of threats covering almost the complete list of MITRE ATT&CK tactics from pre-attack to command and control. For a full list of the Azure App Service alerts, see [Microsoft Defender for App Service alerts](../security-center/alerts-reference.md#alerts-azureappserv).| ## Next steps |
| app-service | Troubleshoot Intermittent Outbound Connection Errors | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/troubleshoot-intermittent-outbound-connection-errors.md | Although PHP does not support connection pooling, you can try using persistent d ### Additional guidance specific to App Service: * A [load test](/azure/devops/test/load-test/app-service-web-app-performance-test) should simulate real world data in a steady feeding speed. Testing apps and functions under real world stress can identify and resolve SNAT port exhaustion issues ahead of time.-* Ensure that the back-end services can return responses quickly. For troubleshooting performance issues with Azure SQL Database, review [Troubleshoot Azure SQL Database performance issues with Intelligent Insights](../azure-sql/database/intelligent-insights-troubleshoot-performance.md#recommended-troubleshooting-flow). +* Ensure that the back-end services can return responses quickly. For troubleshooting performance issues with Azure SQL Database, review [Troubleshoot Azure SQL Database performance issues with Intelligent Insights](/azure/azure-sql/database/intelligent-insights-troubleshoot-performance#recommended-troubleshooting-flow). * Scale out the App Service plan to more instances. For more information on scaling, see [Scale an app in Azure App Service](./manage-scale-up.md). Each worker instance in an app service plan is allocated a number of SNAT ports. If you spread your usage across more instances, you might get the SNAT port usage per instance below the recommended limit of 100 outbound connections, per unique remote endpoint. * Consider moving to [App Service Environment (ASE)](./environment/using-an-ase.md), where you are allotted a single outbound IP address, and the limits for connections and SNAT ports are much higher. In an ASE, the number of SNAT ports per instance is based on the [Azure load balancer preallocation table](../load-balancer/load-balancer-outbound-connections.md#snatporttable) - so for example an ASE with 1-50 worker instances has 1024 preallocated ports per instance, while an ASE with 51-100 worker instances has 512 preallocated ports per instance. |
| app-service | Tutorial Connect App Access Microsoft Graph As App Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/tutorial-connect-app-access-microsoft-graph-as-app-javascript.md | -## Call Microsoft Graph +## Call Microsoft Graph with Node.js ++Your web app now has the required permissions and also adds Microsoft Graph's client ID to the login parameters. The `DefaultAzureCredential` class from [@azure/identity](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/README.md) package is used to get a token credential for your code to authorize requests to Azure Storage. Create an instance of the `DefaultAzureCredential` class, which uses the managed identity to fetch tokens and attach them to the service client. The following code example gets the authenticated token credential and uses it to create a service client object, which gets the users in the group. -To see this code as part of a sample application, see the: * [sample on GitHub](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/tree/main/3-WebApp-graphapi-managed-identity). +To see this code as part of a sample application, see the: +* [sample on GitHub](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/tree/main/3-WebApp-graphapi-managed-identity). ++> [!NOTE] +> The [@azure/identity](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/README.md) package isn't required in your web app for basic authentication/authorization or to authenticate requests with Microsoft Graph. It's possible to [securely call downstream APIs](tutorial-auth-aad.md#call-api-securely-from-server-code) with only the App Service authentication/authorization module enabled. +> +> However, the App Service authentication/authorization is designed for more basic authentication scenarios. For more complex scenarios (handling custom claims, for example), you need the [@azure/identity](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/README.md) package. There's a little more setup and configuration work in the beginning, but the `@azure/identity` package can run alongside the App Service authentication/authorization module. Later, when your web app needs to handle more complex scenarios, you can disable the App Service authentication/authorization module and `@azure/identity` will already be a part of your app. ++### Install client library packages ++Install the [@azure/identity](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/README.md) and the [@microsoft/microsoft-graph-client](https://www.npmjs.com/package/@microsoft/microsoft-graph-client?activeTab=readme) packages in your project with npm. ++```bash +npm install @azure/identity @microsoft/microsoft-graph-client +``` ++### Configure authentication information ++Create an object to hold the [authentication settings](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/3-WebApp-graphapi-managed-identity/app.js): ++```javascript +// partial code in app.js +const appSettings = { + appCredentials: { + clientId: process.env.WEBSITE_AUTH_CLIENT_ID, // Enter the client Id here, + tenantId: "common", // Enter the tenant info here, + clientSecret: process.env.MICROSOFT_PROVIDER_AUTHENTICATION_SECRET // Enter the client secret here, + }, + authRoutes: { + redirect: "/.auth/login/aad/callback", // Enter the redirect URI here + error: "/error", // enter the relative path to error handling route + unauthorized: "/unauthorized" // enter the relative path to unauthorized route + }, +} +``` ++### Call Microsoft Graph on behalf of the app ++The following code shows how to call [Microsoft Graph controller](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/2-WebApp-graphapi-on-behalf/controllers/graphController.js) as the app and get some user information. ++```javascript +// graphController.js -```nodejs const graphHelper = require('../utils/graphHelper'); const { DefaultAzureCredential } = require("@azure/identity"); exports.getUsersPage = async(req, res, next) => { const defaultAzureCredential = new DefaultAzureCredential(); try {+ // get app's access token scoped to Microsoft Graph const tokenResponse = await defaultAzureCredential.getToken("https://graph.microsoft.com/.default"); + // use token to create Graph client const graphClient = graphHelper.getAuthenticatedClient(tokenResponse.token); + // return profiles of users in Graph const users = await graphClient .api('/users') .get(); exports.getUsersPage = async(req, res, next) => { } ``` -To query Microsoft Graph, the sample uses the [Microsoft Graph JavaScript SDK](https://github.com/microsoftgraph/msgraph-sdk-javascript). The code for this is located in [utils/graphHelper.js](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/3-WebApp-graphapi-managed-identity/controllers/graphController.js) of the full sample: +The previous code relies on the following [getAuthenticatedClient](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/3-WebApp-graphapi-managed-identity/utils/graphHelper.js) function to return Microsoft Graph client. ++```javascript +// utils/graphHelper.js ++const graph = require('@microsoft/microsoft-graph-client'); -```nodejs getAuthenticatedClient = (accessToken) => { // Initialize Graph client const client = graph.Client.init({ getAuthenticatedClient = (accessToken) => { return client; } ```-+ [!INCLUDE [tutorial-clean-up-steps](./includes/tutorial-cleanup.md)] |
| app-service | Tutorial Connect App Access Microsoft Graph As User Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/tutorial-connect-app-access-microsoft-graph-as-user-javascript.md | + + Title: Tutorial - Web app accesses Microsoft Graph as the user | Azure +description: In this tutorial, you learn how to access data in Microsoft Graph for a signed-in user. +++++++ Last updated : 03/08/2022+++ms.devlang: csharp ++#Customer intent: As an application developer, I want to learn how to access data in Microsoft Graph for a signed-in user. +++# Tutorial: Access Microsoft Graph from a secured JavaScript app as the user +++## Call Microsoft Graph from Node.js ++Your web app now has the required permissions and also adds Microsoft Graph's client ID to the login parameters. ++To see this code as part of a sample application, see the: +* [Sample on GitHub](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/tree/main/2-WebApp-graphapi-on-behalf). ++### Install client library packages ++Install the [@azure/identity](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/README.md) and the [@microsoft/microsoft-graph-client](https://www.npmjs.com/package/@microsoft/microsoft-graph-client?activeTab=readme) packages in your project with npm. ++```bash +npm install @microsoft/microsoft-graph-client +``` ++### Configure authentication information ++Create an object to hold the [authentication settings](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/2-WebApp-graphapi-on-behalf/app.js): ++```javascript +// partial code in app.js +const appSettings = { + appCredentials: { + clientId: process.env.WEBSITE_AUTH_CLIENT_ID, // Enter the client Id here, + tenantId: "common", // Enter the tenant info here, + clientSecret: process.env.MICROSOFT_PROVIDER_AUTHENTICATION_SECRET // Enter the client secret here, + }, + authRoutes: { + redirect: "/.auth/login/aad/callback", // Enter the redirect URI here + error: "/error", // enter the relative path to error handling route + unauthorized: "/unauthorized" // enter the relative path to unauthorized route + }, + protectedResources: { + graphAPI: { + endpoint: "https://graph.microsoft.com/v1.0/me", // resource endpoint + scopes: ["User.Read"] // resource scopes + }, + }, +} +``` ++### Call Microsoft Graph on behalf of the user ++The following code shows how to call [Microsoft Graph controller](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/2-WebApp-graphapi-on-behalf/controllers/graphController.js) as the app and get some user information. ++```javascript +// controllers/graphController.js ++// get the name of the app service instance from environment variables +const appServiceName = process.env.WEBSITE_SITE_NAME; ++const graphHelper = require('../utils/graphHelper'); ++exports.getProfilePage = async(req, res, next) => { ++ try { + // get user's access token scoped to Microsoft Graph from session + // use token to create Graph client + const graphClient = graphHelper.getAuthenticatedClient(req.session.protectedResources["graphAPI"].accessToken); ++ // return user's profile + const profile = await graphClient + .api('/me') + .get(); ++ res.render('profile', { isAuthenticated: req.session.isAuthenticated, profile: profile, appServiceName: appServiceName }); + } catch (error) { + next(error); + } +} +``` ++The previous code relies on the following [getAuthenticatedClient](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/blob/main/2-WebApp-graphapi-on-behalf/utils/graphHelper.js) function to return Microsoft Graph client. ++```javascript +// utils/graphHelper.js ++const graph = require('@microsoft/microsoft-graph-client'); ++getAuthenticatedClient = (accessToken) => { + // Initialize Graph client + const client = graph.Client.init({ + // Use the provided access token to authenticate requests + authProvider: (done) => { + done(null, accessToken); + } + }); ++ return client; +} +``` ++ |
| app-service | Tutorial Connect Msi Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/tutorial-connect-msi-sql-database.md | This article continues where you left off in either one of the following tutoria If you haven't already, follow one of the two tutorials first. Alternatively, you can adapt the steps for your own .NET app with SQL Database. -To debug your app using SQL Database as the back end, make sure that you've allowed client connection from your computer. If not, add the client IP by following the steps at [Manage server-level IP firewall rules using the Azure portal](../azure-sql/database/firewall-configure.md#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). +To debug your app using SQL Database as the back end, make sure that you've allowed client connection from your computer. If not, add the client IP by following the steps at [Manage server-level IP firewall rules using the Azure portal](/azure/azure-sql/database/firewall-configure#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). Prepare your environment for the Azure CLI. Prepare your environment for the Azure CLI. ## 1. Grant database access to Azure AD user -First, enable Azure Active Directory authentication to SQL Database by assigning an Azure AD user as the admin of the server. This user is different from the Microsoft account you used to sign up for your Azure subscription. It must be a user that you created, imported, synced, or invited into Azure AD. For more information on allowed Azure AD users, see [Azure AD features and limitations in SQL Database](../azure-sql/database/authentication-aad-overview.md#azure-ad-features-and-limitations). +First, enable Azure Active Directory authentication to SQL Database by assigning an Azure AD user as the admin of the server. This user is different from the Microsoft account you used to sign up for your Azure subscription. It must be a user that you created, imported, synced, or invited into Azure AD. For more information on allowed Azure AD users, see [Azure AD features and limitations in SQL Database](/azure/azure-sql/database/authentication-aad-overview#azure-ad-features-and-limitations). 1. If your Azure AD tenant doesn't have a user yet, create one by following the steps at [Add or delete users using Azure Active Directory](../active-directory/fundamentals/add-users-azure-active-directory.md). First, enable Azure Active Directory authentication to SQL Database by assigning az sql server ad-admin create --resource-group myResourceGroup --server-name <server-name> --display-name ADMIN --object-id $azureaduser ``` -For more information on adding an Active Directory admin, see [Provision an Azure Active Directory administrator for your server](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-managed-instance) +For more information on adding an Active Directory admin, see [Provision an Azure Active Directory administrator for your server](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-managed-instance) ## 2. Set up your dev environment |
| applied-ai-services | Concept Read | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/applied-ai-services/form-recognizer/concept-read.md | The following resources are supported by Form Recognizer v3.0: ## Data extraction -| **Read model** | **Text Extraction** | **[Language detection](language-support.md#detected-languages-by-read)** | +| **Read model** | **Text Extraction** | **[Language detection](language-support.md#detected-languages-read-api)** | | | | | prebuilt-read | Γ£ô |Γ£ô | Read API extracts text from documents and images with multiple text angles and c ### Language detection (v3.0 preview) -Read API in v3.0 preview 2 adds [language detection](language-support.md#detected-languages-by-read) as a new feature for text lines. Read will predict the language at the text line level along with the confidence score. +Read API in v3.0 preview 2 adds [language detection](language-support.md#detected-languages-read-api) as a new feature for text lines. Read will predict the language at the text line level along with the confidence score. ### Handwritten classification for text lines (Latin only) |
| applied-ai-services | Language Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/applied-ai-services/form-recognizer/language-support.md | -## Read, Layout, and Custom form (template) model +## Read, layout, and custom form (template) model --The following lists include the currently GA languages in the the 2.1 version and new ones in the most recent 3.0 preview. These languages are supported by Read, Layout, and Custom form (template) model features. +The following lists include the currently GA languages in for the v2.1 version and the most recent v3.0 preview. These languages are supported by Read, Layout, and Custom form (template) model features. > [!NOTE] > **Language code optional** The following lists include the currently GA languages in the the 2.1 version an To use the preview languages, refer to the [v3.0 REST API migration guide](/rest/api/medi). -### Handwritten languages +### Handwritten languages (preview and GA) -The following table lists the handwritten languages. +The following table lists the supported languages for extracting handwritten texts. |Language| Language code (optional) | Language| Language code (optional) | |:--|:-:|:--|:-:| The following table lists the handwritten languages. ### Print languages (preview) -This section lists the supported languages in the latest preview. +This section lists the supported languages for extracting printed texts in the latest preview. |Language| Code (optional) |Language| Code (optional) | |:--|:-:|:--|:-:|-|Angika (Devanagiri) | `anp`|Lakota | `lkt` +|Angika (Devanagari) | `anp`|Lakota | `lkt` |Arabic | `ar`|Latin | `la`-|Awadhi-Hindi (Devanagiri) | `awa`|Lithuanian | `lt` +|Awadhi-Hindi (Devanagari) | `awa`|Lithuanian | `lt` |Azerbaijani (Latin) | `az`|Lower Sorbian | `dsb` |Bagheli | `bfy`|Lule Sami | `smj`-|Belarusian (Cyrillic) | `be`, `be-cyrl`|Mahasu Pahari (Devanagiri) | `bfz` +|Belarusian (Cyrillic) | `be`, `be-cyrl`|Mahasu Pahari (Devanagari) | `bfz` |Belarusian (Latin) | `be`, `be-latn`|Maltese | `mt`-|Bhojpuri-Hindi (Devanagiri) | `bho`|Malto (Devanagiri) | `kmj` -|Bodo (Devanagiri) | `brx`|Maori | `mi` +|Bhojpuri-Hindi (Devanagari) | `bho`|Malto (Devanagari) | `kmj` +|Bodo (Devanagari) | `brx`|Maori | `mi` |Bosnian (Latin) | `bs`|Marathi | `mr` |Brajbha | `bra`|Mongolian (Cyrillic) | `mn` |Bulgarian | `bg`|Montenegrin (Cyrillic) | `cnr-cyrl` |Bundeli | `bns`|Montenegrin (Latin) | `cnr-latn` |Buryat (Cyrillic) | `bua`|Nepali | `ne` |Chamling | `rab`|Niuean | `niu`-|Chhattisgarhi (Devanagiri)| `hne`|Nogay | `nog` +|Chhattisgarhi (Devanagari)| `hne`|Nogay | `nog` |Croatian | `hr`|Northern Sami (Latin) | `sme` |Dari | `prs`|Ossetic | `os`-|Dhimal (Devanagiri) | `dhi`|Pashto | `ps` -|Dogri (Devanagiri) | `doi`|Persian | `fa` +|Dhimal (Devanagari) | `dhi`|Pashto | `ps` +|Dogri (Devanagari) | `doi`|Persian | `fa` |Erzya (Cyrillic) | `myv`|Punjabi (Arabic) | `pa` |Faroese | `fo`|Ripuarian | `ksh` |Gagauz (Latin) | `gag`|Romanian | `ro`-|Gondi (Devanagiri) | `gon`|Russian | `ru` -|Gurung (Devanagiri) | `gvr`|Sadri (Devanagiri) | `sck` -|Halbi (Devanagiri) | `hlb`|Samoan (Latin) | `sm` +|Gondi (Devanagari) | `gon`|Russian | `ru` +|Gurung (Devanagari) | `gvr`|Sadri (Devanagari) | `sck` +|Halbi (Devanagari) | `hlb`|Samoan (Latin) | `sm` |Haryanvi | `bgc`|Sanskrit (Devanagari) | `sa` |Hawaiian | `haw`|Santali(Devanagiri) | `sat` |Hindi | `hi`|Serbian (Latin) | `sr`, `sr-latn`-|Ho(Devanagiri) | `hoc`|Sherpa (Devanagiri) | `xsr` -|Icelandic | `is`|Sirmauri (Devanagiri) | `srx` +|Ho(Devanagiri) | `hoc`|Sherpa (Devanagari) | `xsr` +|Icelandic | `is`|Sirmauri (Devanagari) | `srx` |Inari Sami | `smn`|Skolt Sami | `sms`-|Jaunsari (Devanagiri) | `Jns`|Slovak | `sk` -|Kangri (Devanagiri) | `xnr`|Somali (Arabic) | `so` +|Jaunsari (Devanagari) | `Jns`|Slovak | `sk` +|Kangri (Devanagari) | `xnr`|Somali (Arabic) | `so` |Karachay-Balkar | `krc`|Southern Sami | `sma` |Kara-Kalpak (Cyrillic) | `kaa-cyrl`|Tajik (Cyrillic) | `tg` |Kazakh (Cyrillic) | `kk-cyrl`|Thangmi | `thf` This section lists the supported languages in the latest preview. |Kosraean | `kos`|Uyghur (Arabic) | `ug` |Kumyk (Cyrillic) | `kum`|Uzbek (Arabic) | `uz-arab` |Kurdish (Arabic) | `ku-arab`|Uzbek (Cyrillic) | `uz-cyrl`-|Kurukh (Devanagiri) | `kru`|Welsh | `cy` +|Kurukh (Devanagari) | `kru`|Welsh | `cy` |Kyrgyz (Cyrillic) | `ky` ### Print languages (GA) -This section lists the supported languages in the latest GA version. +This section lists the supported languages for extracting printed texts in the latest GA version. |Language| Code (optional) |Language| Code (optional) | |:--|:-:|:--|:-:| Language| Locale code | |:--|:-:| |English (United States)|en-us| -## Detected languages by Read +## Detected languages: Read API The [Read API](concept-read.md) supports language detection for the following languages: +> [!NOTE] +> **Language detection** +> +> Form Recognizer read model can _detect_ a wide range of languages, variants, dialects, and some regional/cultural languages and return a language code. +> +> This section lists the languages that can be detected using the Read API. To determine if text can also be _extracted_ for a given language, see [handwritten](#handwritten-languages-preview-and-ga), [print preview](#print-languages-preview), and [print GA](#print-languages-ga) language extraction lists (above). + | Language | Code | |||-| Afrikaans | `af` | -| Albanian | `sq` | -| Amharic | `am` | +| Afrikaans | `af` | +| Albanian | `sq` | +| Amharic | `am` | | Arabic | `ar` |-| Armenian | `hy` | -| Assamese | `as` | -| Azerbaijani | `az` | -| Basque | `eu` | -| Belarusian | `be` | -| Bengali | `bn` | -| Bosnian | `bs` | -| Bulgarian | `bg` | -| Burmese | `my` | -| Catalan | `ca` | -| Central Khmer | `km` | -| Chinese | `zh` | -| Chinese Simplified | `zh_chs` | -| Chinese Traditional | `zh_cht` | +| Armenian | `hy` | +| Assamese | `as` | +| Azerbaijani | `az` | +| Basque | `eu` | +| Belarusian | `be` | +| Bengali | `bn` | +| Bosnian | `bs` | +| Bulgarian | `bg` | +| Burmese | `my` | +| Catalan | `ca` | +| Central Khmer | `km` | +| Chinese | `zh` | +| Chinese Simplified | `zh_chs` | +| Chinese Traditional | `zh_cht` | | Corsican | `co` |-| Croatian | `hr` | +| Croatian | `hr` | | Czech | `cs` |-| Danish | `da` | +| Danish | `da` | | Dari | `prs` |-| Divehi | `dv` | -| Dutch | `nl` | +| Divehi | `dv` | +| Dutch | `nl` | | English | `en` |-| Esperanto | `eo` | -| Estonian | `et` | -| Fijian | `fj` | -| Finnish | `fi` | -| French | `fr` | +| Esperanto | `eo` | +| Estonian | `et` | +| Fijian | `fj` | +| Finnish | `fi` | +| French | `fr` | | Galician | `gl` |-| Georgian | `ka` | +| Georgian | `ka` | | German | `de` |-| Greek | `el` | -| Gujarati | `gu` | -| Haitian | `ht` | -| Hausa | `ha` | -| Hebrew | `he` | -| Hindi | `hi` | -| Hmong Daw | `mww` | -| Hungarian | `hu` | +| Greek | `el` | +| Gujarati | `gu` | +| Haitian | `ht` | +| Hausa | `ha` | +| Hebrew | `he` | +| Hindi | `hi` | +| Hmong Daw | `mww` | +| Hungarian | `hu` | | Icelandic | `is` |-| Igbo | `ig` | +| Igbo | `ig` | | Indonesian | `id` |-| Inuktitut | `iu` | -| Irish | `ga` | -| Italian | `it` | -| Japanese | `ja` | -| Javanese | `jv` | -| Kannada | `kn` | -| Kazakh | `kk` | -| Kinyarwanda | `rw` | -| Kirghiz | `ky` | -| Korean | `ko` | -| Kurdish | `ku` | -| Lao | `lo` | -| Latin | `la` | -| Latvian | `lv` | -| Lithuanian | `lt` | -| Luxembourgish | `lb` | -| Macedonian | `mk` | -| Malagasy | `mg` | -| Malay | `ms` | -| Malayalam | `ml` | -| Maltese | `mt` | -| Maori | `mi` | -| Marathi | `mr` | -| Mongolian | `mn` | -| Nepali | `ne` | -| Norwegian | `no` | -| Norwegian Nynorsk | `nn` | -| Oriya | `or` | -| Pasht | `ps` | -| Persian | `fa` | -| Polish | `pl` | -| Portuguese | `pt` | -| Punjabi | `pa` | -| Queretaro Otomi | `otq` | -| Romanian | `ro` | -| Russian | `ru` | -| Samoan | `sm` | -| Serbian | `sr` | -| Shona | `sn` | -| Sindhi | `sd` | -| Sinhala | `si` | -| Slovak | `sk` | -| Slovenian | `sl` | -| Somali | `so` | -| Spanish | `es` | -| Sundanese | `su` | -| Swahili | `sw` | +| Inuktitut | `iu` | +| Irish | `ga` | +| Italian | `it` | +| Japanese | `ja` | +| Javanese | `jv` | +| Kannada | `kn` | +| Kazakh | `kk` | +| Kinyarwanda | `rw` | +| Kirghiz | `ky` | +| Korean | `ko` | +| Kurdish | `ku` | +| Lao | `lo` | +| Latin | `la` | +| Latvian | `lv` | +| Lithuanian | `lt` | +| Luxembourgish | `lb` | +| Macedonian | `mk` | +| Malagasy | `mg` | +| Malay | `ms` | +| Malayalam | `ml` | +| Maltese | `mt` | +| Maori | `mi` | +| Marathi | `mr` | +| Mongolian | `mn` | +| Nepali | `ne` | +| Norwegian | `no` | +| Norwegian Nynorsk | `nn` | +| Oriya | `or` | +| Pasht | `ps` | +| Persian | `fa` | +| Polish | `pl` | +| Portuguese | `pt` | +| Punjabi | `pa` | +| Queretaro Otomi | `otq` | +| Romanian | `ro` | +| Russian | `ru` | +| Samoan | `sm` | +| Serbian | `sr` | +| Shona | `sn` | +| Sindhi | `sd` | +| Sinhala | `si` | +| Slovak | `sk` | +| Slovenian | `sl` | +| Somali | `so` | +| Spanish | `es` | +| Sundanese | `su` | +| Swahili | `sw` | | Swedish | `sv` |-| Tagalog | `tl` | -| Tahitian | `ty` | -| Tajik | `tg` | -| Tamil | `ta` | -| Tatar | `tt` | -| Telugu | `te` | -| Thai | `th` | +| Tagalog | `tl` | +| Tahitian | `ty` | +| Tajik | `tg` | +| Tamil | `ta` | +| Tatar | `tt` | +| Telugu | `te` | +| Thai | `th` | | Tibetan | `bo` |-| Tigrinya | `ti` | -| Tongan | `to` | -| Turkish | `tr` | -| Turkmen | `tk` | -| Ukrainian | `uk` | -| Urdu | `ur` | -| Uzbek | `uz` | -| Vietnamese | `vi` | -| Welsh | `cy` | -| Xhosa | `xh` | -| Yiddish | `yi` | -| Yoruba | `yo` | -| Yucatec Maya | `yua` | -| Zulu | `zu` | +| Tigrinya | `ti` | +| Tongan | `to` | +| Turkish | `tr` | +| Turkmen | `tk` | +| Ukrainian | `uk` | +| Urdu | `ur` | +| Uzbek | `uz` | +| Vietnamese | `vi` | +| Welsh | `cy` | +| Xhosa | `xh` | +| Yiddish | `yi` | +| Yoruba | `yo` | +| Yucatec Maya | `yua` | +| Zulu | `zu` | |
| automation | Automation Hrw Run Runbooks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/automation-hrw-run-runbooks.md | When you author a runbook to run on a Hybrid Runbook Worker, you should edit and ## Plan for Azure services protected by firewall -Enabling the Azure Firewall on [Azure Storage](../storage/common/storage-network-security.md), [Azure Key Vault](../key-vault/general/network-security.md), or [Azure SQL](../azure-sql/database/firewall-configure.md) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../virtual-network/virtual-network-service-endpoints-overview.md). +Enabling the Azure Firewall on [Azure Storage](../storage/common/storage-network-security.md), [Azure Key Vault](../key-vault/general/network-security.md), or [Azure SQL](/azure/azure-sql/database/firewall-configure) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../virtual-network/virtual-network-service-endpoints-overview.md). ## Plan runbook job behavior Follow the next steps to use a managed identity for Azure resources on a Hybrid 1. Replace it with `$AzureContext = (Connect-AzAccount -Identity -AccountId <ClientId>).context`, and 1. Enter the Client ID. +>[!NOTE] +>By default, the Azure contexts are saved for use between PowerShell sessions. It is possible that when a previous runbook on the Hybrid Runbook Worker has been authenticated with Azure, that context persists to the disk in the System PowerShell profile, as per [Azure contexts and sign-in credentials | Microsoft Docs](/powershell/azure/context-persistence?view=azps-7.3.2). +For instance, a runbook with `Get-AzVM` can return all the VMs in the subscription with no call to `Connect-AzAccount`, and the user would be able to access Azure resources without having to authenticate within that runbook. You can disable context autosave in Azure PowerShell, as detailed [here](/powershell/azure/context-persistence?view=azps-7.3.2#save-azure-contexts-across-powershell-sessions). ++ ### Use runbook authentication with Run As account Instead of having your runbook provide its own authentication to local resources, you can specify a Run As account for a Hybrid Runbook Worker group. To specify a Run As account, you must define a [credential asset](./shared-resources/credentials.md) that has access to local resources. These resources include certificate stores and all runbooks run under these credentials on a Hybrid Runbook Worker in the group. |
| automation | Automation Managing Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/automation-managing-data.md | The Automation geo-replication service isn't accessible directly to external cus * To learn more about secure assets in Azure Automation, see [Encryption of secure assets in Azure Automation](automation-secure-asset-encryption.md). -* To find out more about geo-replication, see [Creating and using active geo-replication](../azure-sql/database/active-geo-replication-overview.md). +* To find out more about geo-replication, see [Creating and using active geo-replication](/azure/azure-sql/database/active-geo-replication-overview). |
| automation | Automation Runbook Execution | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/automation-runbook-execution.md | When runbooks are designed to authenticate and run against resources in Azure, t You can also use a [Hybrid Runbook Worker](automation-hybrid-runbook-worker.md) to run runbooks directly on the computer that hosts the role and against local resources in the environment. Azure Automation stores and manages runbooks and then delivers them to one or more assigned computers. -Enabling the Azure Firewall on [Azure Storage](../storage/common/storage-network-security.md), [Azure Key Vault](../key-vault/general/network-security.md), or [Azure SQL](../azure-sql/database/firewall-configure.md) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../virtual-network/virtual-network-service-endpoints-overview.md). +Enabling the Azure Firewall on [Azure Storage](../storage/common/storage-network-security.md), [Azure Key Vault](../key-vault/general/network-security.md), or [Azure SQL](/azure/azure-sql/database/firewall-configure) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../virtual-network/virtual-network-service-endpoints-overview.md). >[!NOTE] >To run on a Linux Hybrid Runbook Worker, your scripts must be signed and the worker configured accordingly. Alternatively, [signature validation must be turned off](automation-linux-hrw-install.md#turn-off-signature-validation). |
| automation | Enable Managed Identity For Automation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/enable-managed-identity-for-automation.md | print(response.text) ### Using system-assigned managed identity to Access SQL Database -For details on provisioning access to an Azure SQL database, see [Provision Azure AD admin (SQL Database)](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database). +For details on provisioning access to an Azure SQL database, see [Provision Azure AD admin (SQL Database)](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database). ```powershell $queryParameter = "?resource=https://database.windows.net/" |
| automation | Runbooks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/troubleshoot/runbooks.md | When you receive errors during runbook execution in Azure Automation, you can us ## Scenario: Access blocked to Azure Storage, or Azure Key Vault, or Azure SQL -This scenario uses [Azure Storage](../../storage/common/storage-network-security.md) as an example; however, the information is equally applicable to [Azure Key Vault](../../key-vault/general/network-security.md) and [Azure SQL](../../azure-sql/database/firewall-configure.md). +This scenario uses [Azure Storage](../../storage/common/storage-network-security.md) as an example; however, the information is equally applicable to [Azure Key Vault](../../key-vault/general/network-security.md) and [Azure SQL](/azure/azure-sql/database/firewall-configure). ### Issue The Azure Firewall on Azure Storage is enabled. ### Resolution -Enabling the Azure Firewall on [Azure Storage](../../storage/common/storage-network-security.md), [Azure Key Vault](../../key-vault/general/network-security.md), or [Azure SQL](../../azure-sql/database/firewall-configure.md) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../../virtual-network/virtual-network-service-endpoints-overview.md). +Enabling the Azure Firewall on [Azure Storage](../../storage/common/storage-network-security.md), [Azure Key Vault](../../key-vault/general/network-security.md), or [Azure SQL](/azure/azure-sql/database/firewall-configure) blocks access from Azure Automation runbooks for those services. Access will be blocked even when the firewall exception to allow trusted Microsoft services is enabled, as Automation is not a part of the trusted services list. With an enabled firewall, access can only be made by using a Hybrid Runbook Worker and a [virtual network service endpoint](../../virtual-network/virtual-network-service-endpoints-overview.md). ## <a name="runbook-fails-no-permission"></a>Scenario: Runbook fails with a No permission or Forbidden 403 error |
| availability-zones | Az Region | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/availability-zones/az-region.md | In the Product Catalog, always-available services are listed as "non-regional" s | [Azure ExpressRoute](../expressroute/designing-for-high-availability-with-expressroute.md) |  | | [Azure Public IP](../virtual-network/ip-services/public-ip-addresses.md) |   | | [Azure Site Recovery](../site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery.md) |  |-| [Azure SQL](../azure-sql/database/high-availability-sla.md) |  | +| [Azure SQL](/azure/azure-sql/database/high-availability-sla) |  | | [Azure Event Hubs](../event-hubs/event-hubs-geo-dr.md#availability-zones) |  | | [Azure Key Vault](../key-vault/general/disaster-recovery-guidance.md) |  | | [Azure Load Balancer](../load-balancer/load-balancer-standard-availability-zones.md) |   | In the Product Catalog, always-available services are listed as "non-regional" s | [Azure Private Link](../private-link/private-link-overview.md) |  | | [Azure Route Server](../route-server/route-server-faq.md) |  | | Azure Stream Analytics |  |-| [SQL Server on Azure Virtual Machines](../azure-sql/database/high-availability-sla.md) |  | +| [SQL Server on Azure Virtual Machines](/azure/azure-sql/database/high-availability-sla) |  | | Azure Storage:ΓÇ»[Files Storage](../storage/files/storage-files-planning.md) |  | | [Azure Virtual WAN](../virtual-wan/virtual-wan-faq.md#how-are-availability-zones-and-resiliency-handled-in-virtual-wan) |  | | [Azure Web Application Firewall](../firewall/deploy-availability-zone-powershell.md) |  | |
| azure-arc | Managed Instance Features | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/data/managed-instance-features.md | Azure Arc-enabled SQL Managed Instance share a common code base with the latest - Language features - [Control of flow language keywords](/sql/t-sql/language-elements/control-of-flow), [Cursors](/sql/t-sql/language-elements/cursors-transact-sql), [Data types](/sql/t-sql/data-types/data-types-transact-sql), [DML statements](/sql/t-sql/queries/queries), [Predicates](/sql/t-sql/queries/predicates), [Sequence numbers](/sql/relational-databases/sequence-numbers/sequence-numbers), [Stored procedures](/sql/relational-databases/stored-procedures/stored-procedures-database-engine), and [Variables](/sql/t-sql/language-elements/variables-transact-sql). - Database features - [Automatic tuning (plan forcing)](/sql/relational-databases/automatic-tuning/automatic-tuning), [Change tracking](/sql/relational-databases/track-changes/about-change-tracking-sql-server), [Database collation](/sql/relational-databases/collations/set-or-change-the-database-collation), [Contained databases](/sql/relational-databases/databases/contained-databases), [Contained users](/sql/relational-databases/security/contained-database-users-making-your-database-portable), [Data compression](/sql/relational-databases/data-compression/data-compression), [Database configuration settings](/sql/t-sql/statements/alter-database-scoped-configuration-transact-sql), [Online index operations](/sql/relational-databases/indexes/perform-index-operations-online), [Partitioning](/sql/relational-databases/partitions/partitioned-tables-and-indexes), and [Temporal tables](/sql/relational-databases/tables/temporal-tables) ([see getting started guide](/sql/relational-databases/tables/getting-started-with-system-versioned-temporal-tables)).-- Security features - [Application roles](/sql/relational-databases/security/authentication-access/application-roles), [Dynamic data masking](/sql/relational-databases/security/dynamic-data-masking) ([Get started with SQL Database dynamic data masking with the Azure portal](../../azure-sql/database/dynamic-data-masking-configure-portal.md)), [Row Level Security](/sql/relational-databases/security/row-level-security)+- Security features - [Application roles](/sql/relational-databases/security/authentication-access/application-roles), [Dynamic data masking](/sql/relational-databases/security/dynamic-data-masking) ([Get started with SQL Database dynamic data masking with the Azure portal](/azure/azure-sql/database/dynamic-data-masking-configure-portal)), [Row Level Security](/sql/relational-databases/security/row-level-security) - Multi-model capabilities - [Graph processing](/sql/relational-databases/graphs/sql-graph-overview), [JSON data](/sql/relational-databases/json/json-data-sql-server), [OPENXML](/sql/t-sql/functions/openxml-transact-sql), [Spatial](/sql/relational-databases/spatial/spatial-data-sql-server), [OPENJSON](/sql/t-sql/functions/openjson-transact-sql), and [XML indexes](/sql/t-sql/statements/create-xml-index-transact-sql). |
| azure-arc | Reserved Capacity Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/data/reserved-capacity-overview.md | The vCore reservation discount is applied automatically to the number of managed To learn about service tiers for Azure Arc-enabled SQL Managed Instance, see [Azure Arc-enabled SQL Managed Instance service tiers](service-tiers.md). -- For information on Azure SQL Managed Instance service tiers for the vCore model, see [Azure SQL Managed Instance - Compute Hardware in the vCore Service Tier](../../azure-sql/managed-instance/service-tiers-managed-instance-vcore.md)+- For information on Azure SQL Managed Instance service tiers for the vCore model, see [Azure SQL Managed Instance - Compute Hardware in the vCore Service Tier](/azure/azure-sql/managed-instance/service-tiers-managed-instance-vcore) To learn how to manage the capacity reservation, see [manage reserved capacity](../../cost-management-billing/reservations/manage-reserved-vm-instance.md). |
| azure-arc | Service Tiers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/data/service-tiers.md | -As part of of the family of Azure SQL products, Azure Arc-enabled SQL Managed Instance is available in two [vCore](../../azure-sql/database/service-tiers-vcore.md) service tiers. +As part of of the family of Azure SQL products, Azure Arc-enabled SQL Managed Instance is available in two [vCore](/azure/azure-sql/database/service-tiers-vcore) service tiers. - **General purpose** is a budget-friendly tier designed for most workloads with common performance and availability features. - **Business critical** tier is designed for performance-sensitive workloads with higher availability features. |
| azure-arc | Tutorial Arc Enabled Open Service Mesh | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/kubernetes/tutorial-arc-enabled-open-service-mesh.md | InsightsMetrics | where t.app == "namespace1" ``` +### Navigating the OSM dashboard +1. Access your Arc connected Kubernetes cluster using this [link](https://aka.ms/azmon/osmux). +2. Go to Azure Monitor and navigate to the Reports tab to access the OSM workbook. +3. Select the time-range & namespace to scope your services. ++[  ](media/tutorial-arc-enabled-open-service-mesh/osm-workbook.jpg#lightbox) + #### Requests tab - This tab provides you the summary of all the http requests sent via service to service in OSM. Yes, all components of Azure Arc-enabled OSM are deployed on availability zones ## Next steps > **Just want to try things out?** -> Get started quickly with an [Azure Arc Jumpstart](https://aka.ms/arc-jumpstart-osm) scenario using Cluster API. +> Get started quickly with an [Azure Arc Jumpstart](https://aka.ms/arc-jumpstart-osm) scenario using Cluster API. |
| azure-australia | Gateway Ingress Traffic | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-australia/gateway-ingress-traffic.md | A PaaS firewall is a network access control capability that can be applied to ce |Resource | Link| |||-|Azure SQL Database and Azure Synapse Analytics IP firewall rules | [https://docs.microsoft.com/azure/sql-database/sql-database-firewall-configure](../azure-sql/database/firewall-configure.md)| +|Azure SQL Database and Azure Synapse Analytics IP firewall rules | [https://docs.microsoft.com/azure/sql-database/sql-database-firewall-configure](/azure/azure-sql/database/firewall-configure)| |Storage Network Security | [https://docs.microsoft.com/azure/storage/common/storage-network-security](../storage/common/storage-network-security.md)| | Depending on the PaaS capability and its purpose, using network controls to rest |Resource | Link| |||-|Controlling and granting database access to SQL Database and Azure Synapse Analytics | [https://docs.microsoft.com/azure/sql-database/sql-database-manage-logins](../azure-sql/database/logins-create-manage.md)| +|Controlling and granting database access to SQL Database and Azure Synapse Analytics | [https://docs.microsoft.com/azure/sql-database/sql-database-manage-logins](/azure/azure-sql/database/logins-create-manage)| |Authorization for the Azure Storage Services | [https://docs.microsoft.com/rest/api/storageservices/authorization-for-the-Azure-Storage-Services](/rest/api/storageservices/authorization-for-the-Azure-Storage-Services)| | |
| azure-functions | Durable Functions Storage Providers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/durable/durable-functions-storage-providers.md | You can learn more about the technical details of the Netherite storage provider ## <a name="mssql"></a>Microsoft SQL Server (MSSQL) (preview) -The Microsoft SQL Server (MSSQL) storage provider persists all state into a Microsoft SQL Server database. It's compatible with both on-premise and cloud-hosted deployments of SQL Server, including [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md). +The Microsoft SQL Server (MSSQL) storage provider persists all state into a Microsoft SQL Server database. It's compatible with both on-premise and cloud-hosted deployments of SQL Server, including [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview). The key benefits of the MSSQL storage provider include: |
| azure-functions | Functions App Settings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-app-settings.md | The file path to the function app code and configuration in an event-driven scal ||| |WEBSITE_CONTENTSHARE|`functionapp091999e2`| -Only used when deploying to a Windows or Linux Premium plan or to a Windows Consumption plan. Not supported for Linux Consumption plans or Windows or Linux Dedicated plans. Changing or removing this setting may cause your function app to not start. To learn more, see [this troubleshooting article](functions-recover-storage-account.md#storage-account-application-settings-were-deleted). +Only used when deploying to a Windows or Linux Premium plan or to a Windows Consumption plan. Not supported for Linux Consumption plans or Windows or Linux Dedicated plans. When you change the setting, ensure the value is lowercased. Changing or removing this setting may cause your function app to not start. To learn more, see [this troubleshooting article](functions-recover-storage-account.md#storage-account-application-settings-were-deleted). When using an Azure Resource Manager template to create a function app during deployment, don't include WEBSITE_CONTENTSHARE in the template. This slot setting is generated during deployment. To learn more, see [Automate resource deployment for your function app](functions-infrastructure-as-code.md?tabs=windows#create-a-function-app). |
| azure-functions | Functions Bindings Azure Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-bindings-azure-sql.md | ms.devlang: csharp # Azure SQL bindings for Azure Functions overview (preview) -This set of articles explains how to work with [Azure SQL](../azure-sql/index.yml) bindings in Azure Functions. Azure Functions supports input and output bindings for the Azure SQL and SQL Server products. +This set of articles explains how to work with [Azure SQL](/azure/azure-sql/index) bindings in Azure Functions. Azure Functions supports input and output bindings for the Azure SQL and SQL Server products. | Action | Type | ||| |
| azure-functions | Functions Cli Samples | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-cli-samples.md | The following table includes links to bash scripts for Azure Functions that use | Continuous deployment | Description| ||| | [Deploy from GitHub](scripts/functions-cli-create-function-app-github-continuous.md) | Create a function app that deploys from a GitHub repository. |-| [Deploy from Azure DevOps](scripts/functions-cli-create-function-app-vsts-continuous.md) | Create a function app that deploys from an Azure DevOps repository. | |
| azure-functions | Functions Identity Access Azure Sql With Managed Identity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-identity-access-azure-sql-with-managed-identity.md | An overview of the steps you'll take: ## Grant database access to Azure AD user -First enable Azure AD authentication to SQL database by assigning an Azure AD user as the Active Directory admin of the server. This user is different from the Microsoft account you used to sign up for your Azure subscription. It must be a user that you created, imported, synced, or invited into Azure AD. For more information on allowed Azure AD users, see [Azure AD features and limitations in SQL database](../azure-sql/database/authentication-aad-overview.md#azure-ad-features-and-limitations). +First enable Azure AD authentication to SQL database by assigning an Azure AD user as the Active Directory admin of the server. This user is different from the Microsoft account you used to sign up for your Azure subscription. It must be a user that you created, imported, synced, or invited into Azure AD. For more information on allowed Azure AD users, see [Azure AD features and limitations in SQL database](/azure/azure-sql/database/authentication-aad-overview#azure-ad-features-and-limitations). -Enabling Azure AD authentication can be completed via the Azure portal, PowerShell, or Azure CLI. Directions for Azure CLI are below and information completing this via Azure portal and PowerShell is available in the [Azure SQL documentation on Azure AD authentication](../azure-sql/database/authentication-aad-configure.md). +Enabling Azure AD authentication can be completed via the Azure portal, PowerShell, or Azure CLI. Directions for Azure CLI are below and information completing this via Azure portal and PowerShell is available in the [Azure SQL documentation on Azure AD authentication](/azure/azure-sql/database/authentication-aad-configure). 1. If your Azure AD tenant doesn't have a user yet, create one by following the steps at [Add or delete users using Azure Active Directory](../active-directory/fundamentals/add-users-azure-active-directory.md). Enabling Azure AD authentication can be completed via the Azure portal, PowerShe az sql server ad-admin create --resource-group myResourceGroup --server-name <server-name> --display-name ADMIN --object-id $azureaduser ``` -For more information on adding an Active Directory admin, see [Provision an Azure Active Directory administrator for your server](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database) +For more information on adding an Active Directory admin, see [Provision an Azure Active Directory administrator for your server](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) |
| azure-functions | Functions Scenario Database Table Cleanup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-scenario-database-table-cleanup.md | ms.devlang: csharp # Use Azure Functions to connect to an Azure SQL Database -This article shows you how to use Azure Functions to create a scheduled job that connects to an Azure SQL Database or Azure SQL Managed Instance. The function code cleans up rows in a table in the database. The new C# function is created based on a pre-defined timer trigger template in Visual Studio 2019. To support this scenario, you must also set a database connection string as an app setting in the function app. For Azure SQL Managed Instance you need to [enable public endpoint](../azure-sql/managed-instance/public-endpoint-configure.md) to be able to connect from Azure Functions. This scenario uses a bulk operation against the database. +This article shows you how to use Azure Functions to create a scheduled job that connects to an Azure SQL Database or Azure SQL Managed Instance. The function code cleans up rows in a table in the database. The new C# function is created based on a pre-defined timer trigger template in Visual Studio 2019. To support this scenario, you must also set a database connection string as an app setting in the function app. For Azure SQL Managed Instance you need to [enable public endpoint](/azure/azure-sql/managed-instance/public-endpoint-configure) to be able to connect from Azure Functions. This scenario uses a bulk operation against the database. If this is your first experience working with C# Functions, you should read the [Azure Functions C# developer reference](functions-dotnet-class-library.md). If this is your first experience working with C# Functions, you should read the + Complete the steps in the article [Create your first function using Visual Studio](functions-create-your-first-function-visual-studio.md) to create a local function app that targets version 2.x or a later version of the runtime. You must also have published your project to a function app in Azure. -+ This article demonstrates a Transact-SQL command that executes a bulk cleanup operation in the **SalesOrderHeader** table in the AdventureWorksLT sample database. To create the AdventureWorksLT sample database, complete the steps in the article [Create a database in Azure SQL Database using the Azure portal](../azure-sql/database/single-database-create-quickstart.md). ++ This article demonstrates a Transact-SQL command that executes a bulk cleanup operation in the **SalesOrderHeader** table in the AdventureWorksLT sample database. To create the AdventureWorksLT sample database, complete the steps in the article [Create a database in Azure SQL Database using the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). -+ You must add a [server-level firewall rule](../azure-sql/database/firewall-create-server-level-portal-quickstart.md) for the public IP address of the computer you use for this quickstart. This rule is required to be able access the SQL Database instance from your local computer. ++ You must add a [server-level firewall rule](/azure/azure-sql/database/firewall-create-server-level-portal-quickstart) for the public IP address of the computer you use for this quickstart. This rule is required to be able access the SQL Database instance from your local computer. ## Get connection information -You need to get the connection string for the database you created when you completed [Create a database in Azure SQL Database using the Azure portal](../azure-sql/database/single-database-create-quickstart.md). +You need to get the connection string for the database you created when you completed [Create a database in Azure SQL Database using the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). 1. Sign in to the [Azure portal](https://portal.azure.com/). |
| azure-functions | Functions Scenario Database Table Cleanup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-glossary-cloud-terminology.md | See [Azure Regions](./availability-zones/cross-region-replication-azure.md) ## geo-replication The process of automatically replicating content such as blobs, tables, and queues within a regional pair. -See [Active Geo-Replication for Azure SQL Database](./azure-sql/database/auto-failover-group-overview.md) +See [Active Geo-Replication for Azure SQL Database](/azure/azure-sql/database/auto-failover-group-overview) <!-- The meaning of "geo" in this term seems to be different than the meaning provided in the "geo" entry --> ## image |
| azure-government | Azure Secure Isolation Guidance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/azure-secure-isolation-guidance.md | When a managed HSM is created, the requestor also provides a list of data plane > [!IMPORTANT] > Unlike with key vaults, granting your users management plane access to a managed HSM doesn't grant them any access to data plane to access keys or data plane role assignments managed HSM local RBAC. This isolation is implemented by design to prevent inadvertent expansion of privileges affecting access to keys stored in managed HSMs. -As mentioned previously, managed HSM supports [importing keys generated](../key-vault/managed-hsm/hsm-protected-keys-byok.md) in your on-premises HSMs, ensuring the keys never leave the HSM protection boundary, also known as *bring your own key (BYOK)* scenario. Managed HSM supports integration with Azure services such as [Azure Storage](../storage/common/customer-managed-keys-overview.md), [Azure SQL Database](../azure-sql/database/transparent-data-encryption-byok-overview.md), [Azure Information Protection](/azure/information-protection/byok-price-restrictions), and others. +As mentioned previously, managed HSM supports [importing keys generated](../key-vault/managed-hsm/hsm-protected-keys-byok.md) in your on-premises HSMs, ensuring the keys never leave the HSM protection boundary, also known as *bring your own key (BYOK)* scenario. Managed HSM supports integration with Azure services such as [Azure Storage](../storage/common/customer-managed-keys-overview.md), [Azure SQL Database](/azure/azure-sql/database/transparent-data-encryption-byok-overview), [Azure Information Protection](/azure/information-protection/byok-price-restrictions), and others. Managed HSM enables you to use the established Azure Key Vault API and management interfaces. You can use the same application development and deployment patterns for all your applications irrespective of the key management solution: multi-tenant vault or single-tenant managed HSM. You can enable IPsec in addition to MACsec on your ExpressRoute Direct ports, as **Figure 11.** VPN and ExpressRoute encryption for data in transit #### Traffic across Microsoft global network backbone-Azure services such as Storage and SQL Database can be configured for geo-replication to help ensure durability and high availability especially for disaster recovery scenarios. Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md) (GRS) and paired regions are also recommended when configuring active [geo-replication](../azure-sql/database/active-geo-replication-overview.md) for Azure SQL Database. Paired regions are located within the same geography; however, network traffic isn't guaranteed to always follow the same path from one Azure region to another. To provide the reliability needed for the Azure cloud, Microsoft has many physical networking paths with automatic routing around failures for optimal reliability. +Azure services such as Storage and SQL Database can be configured for geo-replication to help ensure durability and high availability especially for disaster recovery scenarios. Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md) (GRS) and paired regions are also recommended when configuring active [geo-replication](/azure/azure-sql/database/active-geo-replication-overview) for Azure SQL Database. Paired regions are located within the same geography; however, network traffic isn't guaranteed to always follow the same path from one Azure region to another. To provide the reliability needed for the Azure cloud, Microsoft has many physical networking paths with automatic routing around failures for optimal reliability. Moreover, all Azure traffic traveling within a region or between regions is [encrypted by Microsoft using MACsec](../security/fundamentals/encryption-overview.md#data-link-layer-encryption-in-azure), which relies on AES-128 block cipher for encryption. This traffic stays entirely within the Microsoft [global network backbone](../networking/microsoft-global-network.md) and never enters the public Internet. The backbone is one of the largest in the world with more than 250,000 km of lit fiber optic and undersea cable systems. > [!IMPORTANT]-> You should review Azure **[best practices](../security/fundamentals/data-encryption-best-practices.md#protect-data-in-transit)** for the protection of data in transit to help ensure that all data in transit is encrypted. For key Azure PaaS storage services (for example, Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics), data encryption in transit is **[enforced by default](../azure-sql/database/security-overview.md#information-protection-and-encryption)**. +> You should review Azure **[best practices](../security/fundamentals/data-encryption-best-practices.md#protect-data-in-transit)** for the protection of data in transit to help ensure that all data in transit is encrypted. For key Azure PaaS storage services (for example, Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics), data encryption in transit is **[enforced by default](/azure/azure-sql/database/security-overview#information-protection-and-encryption)**. ### Third-party network virtual appliances Azure provides you with many features to help you achieve your security and isolation goals, including [Microsoft Defender for Cloud](../defender-for-cloud/defender-for-cloud-introduction.md), [Azure Monitor](../azure-monitor/overview.md), [Azure Firewall](../firewall/overview.md), [VPN Gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md), [network security groups](../virtual-network/network-security-groups-overview.md), [Application Gateway](../application-gateway/overview.md), [Azure DDoS Protection](../ddos-protection/ddos-protection-overview.md), [Network Watcher](../network-watcher/network-watcher-monitoring-overview.md), [Microsoft Sentinel](../sentinel/overview.md), and [Azure Policy](../governance/policy/overview.md). In addition to the built-in capabilities that Azure provides, you can use third-party [network virtual appliances](https://azure.microsoft.com/solutions/network-appliances/) to accommodate your specific network isolation requirements while at the same time applying existing in-house skills. Azure supports many appliances, including offerings from F5, Palo Alto Networks, Cisco, Check Point, Barracuda, Citrix, Fortinet, and many others. Network appliances support network functionality and services in the form of VMs in your virtual networks and deployments. |
| azure-government | Compare Azure Government Global Azure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/compare-azure-government-global-azure.md | The following Azure Database for PostgreSQL **features are not currently availab - Advanced Threat Protection - Backup with long-term retention -### [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) +### [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) The following Azure SQL Managed Instance **features are not currently available** in Azure Government: |
| azure-government | Azure Services In Fedramp Auditscope | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/compliance/azure-services-in-fedramp-auditscope.md | This article provides a detailed list of Azure, Dynamics 365, Microsoft 365, and | [SignalR Service](../../azure-signalr/index.yml) | ✅ | ✅ | | [Site Recovery](../../site-recovery/index.yml) | ✅ | ✅ | | [Spring Cloud](../../spring-cloud/index.yml) | ✅ | ✅ |-| [SQL Database](../../azure-sql/database/sql-database-paas-overview.md) | ✅ | ✅ | +| [SQL Database](/azure/azure-sql/database/sql-database-paas-overview) | ✅ | ✅ | | [SQL Server Registry](/sql/sql-server/end-of-support/sql-server-extended-security-updates) | ✅ | ✅ | | [SQL Server Stretch Database](../../sql-server-stretch-database/index.yml) | ✅ | ✅ | | [Storage: Archive](../../storage/blobs/access-tiers-overview.md) | ✅ | ✅ | This article provides a detailed list of Azure, Dynamics 365, Microsoft 365, and | [Service Health](../../service-health/index.yml) | ✅ | ✅ | ✅ | ✅ | | | [SignalR Service](../../azure-signalr/index.yml) | ✅ | ✅ | ✅ | ✅ | | | [Site Recovery](../../site-recovery/index.yml) | ✅ | ✅ | ✅ | ✅ | |-| [SQL Database](../../azure-sql/database/sql-database-paas-overview.md) | ✅ | ✅ | ✅ | ✅ | ✅ | +| [SQL Database](/azure/azure-sql/database/sql-database-paas-overview) | ✅ | ✅ | ✅ | ✅ | ✅ | | [SQL Server Stretch Database](../../sql-server-stretch-database/index.yml) | ✅ | ✅ | ✅ | ✅ | | | [Storage: Archive](../../storage/blobs/access-tiers-overview.md) | ✅ | ✅ | ✅ | ✅ | | | [Storage: Blobs](../../storage/blobs/index.yml) (incl. [Azure Data Lake Storage Gen2](../../storage/blobs/data-lake-storage-introduction.md)) | ✅ | ✅ | ✅ | ✅ | ✅ | |
| azure-government | Documentation Government Connect Ssms | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-connect-ssms.md | If you don't have an Azure Government subscription, create a [free account](http Before you connect to Azure Government from SSMS, you must set up an Azure SQL Server firewall rule to allow your local IP address to access your computer that's running SQL Server. -Follow these steps to [Manage firewall rules by using the Azure portal](../azure-sql/database/firewall-configure.md#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). +Follow these steps to [Manage firewall rules by using the Azure portal](/azure/azure-sql/database/firewall-configure#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). ## Specify Azure Government as the environment to connect |
| azure-government | Documentation Government Impact Level 5 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-impact-level-5.md | For Analytics services availability in Azure Government, see [Products available ### [Azure Synapse Analytics](../synapse-analytics/index.yml) -- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption](../azure-sql/database/transparent-data-encryption-byok-overview.md). The instructions to enable this configuration for Azure Synapse Analytics are the same as the instructions to do so for Azure SQL Database.+- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption](/azure/azure-sql/database/transparent-data-encryption-byok-overview). The instructions to enable this configuration for Azure Synapse Analytics are the same as the instructions to do so for Azure SQL Database. ### [Data Factory](../data-factory/index.yml) Azure Healthcare APIs supports Impact Level 5 workloads in Azure Government with - Configure encryption at rest of content in Azure Healthcare APIs [using customer-managed keys in Azure Key Vault](../healthcare-apis/azure-api-for-fhir/customer-managed-key.md) -### [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) +### [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) -- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption with customer-managed key](../azure-sql/database/transparent-data-encryption-byok-overview.md).+- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption with customer-managed key](/azure/azure-sql/database/transparent-data-encryption-byok-overview). ### [SQL Server Stretch Database](../sql-server-stretch-database/index.yml) -- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption with customer-managed key](../azure-sql/database/transparent-data-encryption-byok-overview.md).+- Add transparent data encryption with customer-managed keys via Azure Key Vault. For more information, see [Azure SQL transparent data encryption with customer-managed key](/azure/azure-sql/database/transparent-data-encryption-byok-overview). ## Hybrid |
| azure-government | Documentation Government Overview Itar | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-overview-itar.md | Azure provides many options for [encrypting data in transit](../security/fundame Azure provides extensive options for [encrypting data at rest](../security/fundamentals/encryption-atrest.md) to help you safeguard your data and meet your compliance needs using both Microsoft-managed encryption keys and customer-managed encryption keys. This process relies on multiple encryption keys and services such as Azure Key Vault and Azure Active Directory to ensure secure key access and centralized key management. For more information about Azure Storage encryption and Azure Disk encryption, see [Data encryption at rest](./azure-secure-isolation-guidance.md#data-encryption-at-rest). -Azure SQL Database provides [transparent data encryption](../azure-sql/database/transparent-data-encryption-tde-overview.md) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](../azure-sql/database/transparent-data-encryption-byok-overview.md) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key rotation, permissions, deleting keys, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](../azure-sql/database/always-encrypted-azure-key-vault-configure.md) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data and can view it and those users who manage the data but should have no access. +Azure SQL Database provides [transparent data encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](/azure/azure-sql/database/transparent-data-encryption-byok-overview) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key rotation, permissions, deleting keys, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data and can view it and those users who manage the data but should have no access. ## Restrictions on insider access |
| azure-government | Documentation Government Overview Jps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-overview-jps.md | Azure provides many options for [encrypting data in transit](../security/fundame Azure provides extensive options for [encrypting data at rest](../security/fundamentals/encryption-atrest.md) to help you safeguard your data and meet your compliance needs using both Microsoft-managed encryption keys and customer-managed encryption keys. This process relies on multiple encryption keys and services such as Azure Key Vault and Azure Active Directory to ensure secure key access and centralized key management. For more information about Azure Storage encryption and Azure Disk encryption, see [Data encryption at rest](./azure-secure-isolation-guidance.md#data-encryption-at-rest). -Azure SQL Database provides [transparent data encryption](../azure-sql/database/transparent-data-encryption-tde-overview.md) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](../azure-sql/database/transparent-data-encryption-byok-overview.md) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key rotation, permissions, deleting keys, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](../azure-sql/database/always-encrypted-azure-key-vault-configure.md) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data (and can view it) and those users who manage the data (but should have no access). +Azure SQL Database provides [transparent data encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](/azure/azure-sql/database/transparent-data-encryption-byok-overview) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key rotation, permissions, deleting keys, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data (and can view it) and those users who manage the data (but should have no access). ### Data encryption in use |
| azure-government | Documentation Government Overview Wwps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-overview-wwps.md | Your data in an Azure Storage account is [always replicated](../storage/common/s Data in an Azure Storage account is always replicated three times in the primary region. Azure Storage provides LRS and ZRS redundancy options for replicating data in the primary region. For applications requiring high availability, you can choose geo-replication to a secondary region that is hundreds of kilometers away from the primary region. Azure Storage offers GRS and GZRS options for copying data to a secondary region. More options are available to you for configuring read access (RA) to the secondary region (RA-GRS and RA-GZRS), as explained in [Read access to data in the secondary region](../storage/common/storage-redundancy.md#read-access-to-data-in-the-secondary-region). -Azure Storage redundancy options can have implications on data residency as Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md#geo-redundant-storage) (GRS). For example, if you're concerned about geo-replication across regions that span country boundaries, you may want to choose LRS or ZRS to keep Azure Storage data at rest within the geographic boundaries of the country in which the primary region is located. Similarly, [geo replication for Azure SQL Database](../azure-sql/database/active-geo-replication-overview.md) can be obtained by configuring asynchronous replication of transactions to any region in the world, although it's recommended that paired regions be used for this purpose as well. If you need to keep relational data inside the geographic boundaries of your country/region, you shouldn't configure Azure SQL Database asynchronous replication to a region outside that country. +Azure Storage redundancy options can have implications on data residency as Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md#geo-redundant-storage) (GRS). For example, if you're concerned about geo-replication across regions that span country boundaries, you may want to choose LRS or ZRS to keep Azure Storage data at rest within the geographic boundaries of the country in which the primary region is located. Similarly, [geo replication for Azure SQL Database](/azure/azure-sql/database/active-geo-replication-overview) can be obtained by configuring asynchronous replication of transactions to any region in the world, although it's recommended that paired regions be used for this purpose as well. If you need to keep relational data inside the geographic boundaries of your country/region, you shouldn't configure Azure SQL Database asynchronous replication to a region outside that country. As described on the [data location page](https://azure.microsoft.com/global-infrastructure/data-residency/), most Azure **regional** services honor the data at rest commitment to ensure that your data remains within the geographic boundary where the corresponding service is deployed. A handful of exceptions to this rule are noted on the data location page. You should review these exceptions to determine if the type of data stored outside your chosen deployment Geography meets your needs. Most customers will connect to Azure over the Internet, and the precise routing #### *Traffic across Microsoft global network backbone* -As described in *[Data at rest](#data-at-rest)* section, Azure services such as Storage and SQL Database can be configured for geo-replication to help ensure durability and high availability especially for disaster recovery scenarios. Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md#geo-redundant-storage) (GRS), and paired regions are also recommended when configuring active [geo-replication](../azure-sql/database/active-geo-replication-overview.md) for Azure SQL Database. Paired regions are located within the same Geography. +As described in *[Data at rest](#data-at-rest)* section, Azure services such as Storage and SQL Database can be configured for geo-replication to help ensure durability and high availability especially for disaster recovery scenarios. Azure relies on [paired regions](../availability-zones/cross-region-replication-azure.md) to deliver [geo-redundant storage](../storage/common/storage-redundancy.md#geo-redundant-storage) (GRS), and paired regions are also recommended when configuring active [geo-replication](/azure/azure-sql/database/active-geo-replication-overview) for Azure SQL Database. Paired regions are located within the same Geography. Inter-region traffic is encrypted using [Media Access Control Security](https://1.ieee802.org/security/802-1ae/) (MACsec), which protects network traffic at the data link layer (Layer 2 of the networking stack) and relies on AES-128 block cipher for encryption. This traffic stays entirely within the Microsoft [global network backbone](../networking/microsoft-global-network.md) and never enters the public Internet. The backbone is one of the largest in the world with more than 200,000 km of lit fiber optic and undersea cable systems. However, network traffic isn't guaranteed to always follow the same path from one Azure region to another. To provide the reliability needed for the Azure cloud, Microsoft has many physical networking paths with automatic routing around congestion or failures for optimal reliability. Therefore, Microsoft can't guarantee that network traffic traversing between Azure regions will always be confined to the corresponding Geography. In networking infrastructure disruptions, Microsoft can reroute the encrypted network traffic across its private backbone to ensure service availability and best possible performance. Azure provides many options for [encrypting data in transit](../security/fundame Azure provides extensive options for [encrypting data at rest](../security/fundamentals/encryption-atrest.md) to help you safeguard your data and meet your compliance needs using both Microsoft-managed encryption keys and customer-managed encryption keys. This process relies on multiple encryption keys and services such as Azure Key Vault and Azure Active Directory to ensure secure key access and centralized key management. For more information about Azure Storage encryption and Azure Disk encryption, see [Data encryption at rest](./azure-secure-isolation-guidance.md#data-encryption-at-rest). -Azure SQL Database provides [transparent data encryption](../azure-sql/database/transparent-data-encryption-tde-overview.md) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](../azure-sql/database/transparent-data-encryption-byok-overview.md) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key permissions, rotation, deletion, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](../azure-sql/database/always-encrypted-azure-key-vault-configure.md) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data (and can view it) and those users who manage the data (but should have no access). +Azure SQL Database provides [transparent data encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) (TDE) at rest by [default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/). TDE performs real-time encryption and decryption operations on the data and log files. Database Encryption Key (DEK) is a symmetric key stored in the database boot record for availability during recovery. It's secured via a certificate stored in the master database of the server or an asymmetric key called TDE Protector stored under your control in [Azure Key Vault](../key-vault/general/security-features.md). Key Vault supports [bring your own key](/azure/azure-sql/database/transparent-data-encryption-byok-overview) (BYOK), which enables you to store the TDE Protector in Key Vault and control key management tasks including key permissions, rotation, deletion, enabling auditing/reporting on all TDE Protectors, and so on. The key can be generated by the Key Vault, imported, or [transferred to the Key Vault from an on-premises HSM device](../key-vault/keys/hsm-protected-keys.md). You can also use the [Always Encrypted](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure) feature of Azure SQL Database, which is designed specifically to help protect sensitive data by allowing you to encrypt data inside your applications and [never reveal the encryption keys to the database engine](/sql/relational-databases/security/encryption/always-encrypted-database-engine). In this manner, Always Encrypted provides separation between those users who own the data (and can view it) and those users who manage the data (but should have no access). ### Data encryption in use This section addresses common customer questions related to Azure public, privat - **Microsoft network security:** What network controls and security does Microsoft use? Can my requirements be considered? **Answer:** For insight into Azure infrastructure protection, you should review Azure [network architecture](../security/fundamentals/infrastructure-network.md), Azure [production network](../security/fundamentals/production-network.md), and Azure [infrastructure monitoring](../security/fundamentals/infrastructure-monitoring.md). If you're deploying Azure applications, you should review Azure [network security overview](../security/fundamentals/network-overview.md) and [network security best practices](../security/fundamentals/network-best-practices.md). To provide feedback or requirements, contact your Microsoft account representative. - **Customer separation:** How does Microsoft logically or physically separate customers within its cloud environment? Is there an option for my organization to ensure complete physical separation? **Answer:** Azure uses [logical isolation](./azure-secure-isolation-guidance.md) to separate your applications and data from other customers. This approach provides the scale and economic benefits of multi-tenant cloud services while rigorously enforcing controls designed to keep your data and applications off limits to other customers. There's also an option to enforce physical compute isolation via [Azure Dedicated Host](https://azure.microsoft.com/services/virtual-machines/dedicated-host/), which provides physical servers that can host one or more Azure VMs and are dedicated to one Azure subscription. You can provision dedicated hosts within a region, availability zone, and fault domain. You can then place VMs directly into provisioned hosts using whatever configuration best meets your needs. Dedicated Host provides hardware isolation at the physical server level, enabling you to place your Azure VMs on an isolated and dedicated physical server that runs only your organizationΓÇÖs workloads to meet corporate compliance requirements.-- **Data encryption at rest and in transit:** Does Microsoft enforce data encryption by default? Does Microsoft support customer-managed encryption keys? **Answer:** Yes, many Azure services, including Azure Storage and Azure SQL Database, encrypt data by default and support customer-managed keys. Azure [Storage encryption for data at rest](../storage/common/storage-service-encryption.md) ensures that data is automatically encrypted before persisting it to Azure Storage and decrypted before retrieval. You can use [your own encryption keys](../storage/common/customer-managed-keys-configure-key-vault.md) for Azure Storage encryption at rest and manage your keys in Azure Key Vault. Storage encryption is enabled by default for all new and existing storage accounts and it can't be disabled. When provisioning storage accounts, you can enforce ΓÇ£[secure transfer required](../storage/common/storage-require-secure-transfer.md)ΓÇ¥ option, which allows access only from secure connections. This option is enabled by default when creating a storage account in the Azure portal. Azure SQL Database enforces [data encryption in transit](../azure-sql/database/security-overview.md#information-protection-and-encryption) by default and provides [transparent data encryption](../azure-sql/database/transparent-data-encryption-tde-overview.md) (TDE) at rest [by default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/) allowing you to use Azure Key Vault and *[bring your own key](../azure-sql/database/transparent-data-encryption-byok-overview.md)* (BYOK) functionality to control key management tasks including key permissions, rotation, deletion, and so on. +- **Data encryption at rest and in transit:** Does Microsoft enforce data encryption by default? Does Microsoft support customer-managed encryption keys? **Answer:** Yes, many Azure services, including Azure Storage and Azure SQL Database, encrypt data by default and support customer-managed keys. Azure [Storage encryption for data at rest](../storage/common/storage-service-encryption.md) ensures that data is automatically encrypted before persisting it to Azure Storage and decrypted before retrieval. You can use [your own encryption keys](../storage/common/customer-managed-keys-configure-key-vault.md) for Azure Storage encryption at rest and manage your keys in Azure Key Vault. Storage encryption is enabled by default for all new and existing storage accounts and it can't be disabled. When provisioning storage accounts, you can enforce ΓÇ£[secure transfer required](../storage/common/storage-require-secure-transfer.md)ΓÇ¥ option, which allows access only from secure connections. This option is enabled by default when creating a storage account in the Azure portal. Azure SQL Database enforces [data encryption in transit](/azure/azure-sql/database/security-overview#information-protection-and-encryption) by default and provides [transparent data encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) (TDE) at rest [by default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/) allowing you to use Azure Key Vault and *[bring your own key](/azure/azure-sql/database/transparent-data-encryption-byok-overview)* (BYOK) functionality to control key management tasks including key permissions, rotation, deletion, and so on. - **Data encryption during processing:** Can Microsoft protect my data while it's being processed in memory? **Answer:** Yes, [Azure confidential computing](../confidential-computing/index.yml) supports two different technologies for data encryption while in use. First, you can use VMs based on Intel Xeon processors with [Intel Software Guard Extensions](https://software.intel.com/sgx) (Intel SGX) technology. With this approach, data is protected inside a hardware-based trusted execution environment (TEE, also known as enclave), which is created by securing a portion of the processor and memory. Only authorized code is permitted to run and to access data, so application code and data are protected against viewing and modification from outside of TEE. Second, you can use VMs based on AMD EPYC 7003 series CPUs for lift and shift scenarios without requiring any application code changes. These AMD EPYC CPUs make it possible to encrypt your entire virtual machine at runtime. The encryption keys used for VM encryption are generated and safeguarded by a dedicated secure processor on the EPYC CPU and can't be extracted by any external means. - **FIPS 140 validation:** Does Microsoft offer FIPS 140 Level 3 validated hardware security modules (HSMs) in Azure? If so, can I store AES-256 symmetric encryption keys in these HSMs? **Answer:** Azure Key Vault [Managed HSM](../key-vault/managed-hsm/overview.md) provides a fully managed, highly available, single-tenant HSM as a service that uses [FIPS 140 Level 3 validated HSMs](/azure/compliance/offerings/offering-fips-140-2). Each Managed HSM instance is bound to a separate security domain controlled by you and isolated cryptographically from instances belonging to other customers. With Managed HSMs, support is available for AES 128-bit and 256-bit symmetric keys. - **Customer provided cryptography:** Can I use my own cryptography or encryption hardware? **Answer:** Yes, you can use your own HSMs deployed on-premises with your own crypto algorithms. However, if you expect to use customer-managed keys for services integrated with [Azure Key Vault](https://azure.microsoft.com/services/key-vault/) (for example, Azure Storage, SQL Database, Disk encryption, and others), then you must use hardware security modules (HSMs) and [cryptography supported by Azure Key Vault](../key-vault/keys/about-keys.md). |
| azure-monitor | Agents Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agents-overview.md | The following tables provide a quick comparison of the telemetry agents for Wind ### Windows agents | | Azure Monitor agent | Diagnostics<br>extension (WAD) | Log Analytics<br>agent | Dependency<br>agent |-|:|:|:|:|:| -| **Environments supported** | Azure<br>Other cloud (Azure Arc)<br>On-premises (Azure Arc) | Azure | Azure<br>Other cloud<br>On-premises | Azure<br>Other cloud<br>On-premises | +|:|:-|:|:|:| +| **Environments supported** | Azure<br>Other cloud (Azure Arc)<br>On-premises (Azure Arc)<br>[Windows Client OS (preview)](./azure-monitor-agent-windows-client.md) | Azure | Azure<br>Other cloud<br>On-premises | Azure<br>Other cloud<br>On-premises | | **Agent requirements** | None | None | None | Requires Log Analytics agent |-| **Data collected** | Event Logs<br>Performance | Event Logs<br>ETW events<br>Performance<br>File based logs<br>IIS logs<br>.NET app logs<br>Crash dumps<br>Agent diagnostics logs | Event Logs<br>Performance<br>File based logs<br>IIS logs<br>Insights and solutions<br>Other services | Process dependencies<br>Network connection metrics | +| **Data collected** | Event Logs<br>Performance<br>File based logs (preview)<br> | Event Logs<br>ETW events<br>Performance<br>File based logs<br>IIS logs<br>.NET app logs<br>Crash dumps<br>Agent diagnostics logs | Event Logs<br>Performance<br>File based logs<br>IIS logs<br>Insights and solutions<br>Other services | Process dependencies<br>Network connection metrics | | **Data sent to** | Azure Monitor Logs<br>Azure Monitor Metrics<sup>1</sup> | Azure Storage<br>Azure Monitor Metrics<br>Event Hub | Azure Monitor Logs | Azure Monitor Logs<br>(through Log Analytics agent) |-| **Services and**<br>**features**<br>**supported** | Log Analytics<br>Metrics explorer | Metrics explorer | VM insights<br>Log Analytics<br>Azure Automation<br>Microsoft Defender for Cloud<br>Microsoft Sentinel | VM insights<br>Service Map | +| **Services and**<br>**features**<br>**supported** | Log Analytics<br>Metrics explorer<br>Microsoft Sentinel ([view scope](./azure-monitor-agent-overview.md#supported-services-and-features)) | Metrics explorer | VM insights<br>Log Analytics<br>Azure Automation<br>Microsoft Defender for Cloud<br>Microsoft Sentinel | VM insights<br>Service Map | ### Linux agents | | Azure Monitor agent | Diagnostics<br>extension (LAD) | Telegraf<br>agent | Log Analytics<br>agent | Dependency<br>agent |-|:|:|:|:|:|:| +|:|:-|:|:|:|:| | **Environments supported** | Azure<br>Other cloud (Azure Arc)<br>On-premises (Azure Arc) | Azure | Azure<br>Other cloud<br>On-premises | Azure<br>Other cloud<br>On-premises | Azure<br>Other cloud<br>On-premises | | **Agent requirements** | None | None | None | None | Requires Log Analytics agent |-| **Data collected** | Syslog<br>Performance | Syslog<br>Performance | Performance | Syslog<br>Performance| Process dependencies<br>Network connection metrics | +| **Data collected** | Syslog<br>Performance<br>File based logs (preview)<br> | Syslog<br>Performance | Performance | Syslog<br>Performance| Process dependencies<br>Network connection metrics | | **Data sent to** | Azure Monitor Logs<br>Azure Monitor Metrics<sup>1</sup> | Azure Storage<br>Event Hub | Azure Monitor Metrics | Azure Monitor Logs | Azure Monitor Logs<br>(through Log Analytics agent) |-| **Services and**<br>**features**<br>**supported** | Log Analytics<br>Metrics explorer | | Metrics explorer | VM insights<br>Log Analytics<br>Azure Automation<br>Microsoft Defender for Cloud<br>Microsoft Sentinel | VM insights<br>Service Map | +| **Services and**<br>**features**<br>**supported** | Log Analytics<br>Metrics explorer<br>Microsoft Sentinel ([view scope](./azure-monitor-agent-overview.md#supported-services-and-features)) | | Metrics explorer | VM insights<br>Log Analytics<br>Azure Automation<br>Microsoft Defender for Cloud<br>Microsoft Sentinel | VM insights<br>Service Map | <sup>1</sup> [Click here](../essentials/metrics-custom-overview.md#quotas-and-limits) to review other limitations of using Azure Monitor Metrics. On Linux, using Azure Monitor Metrics as the only destination is supported in v.1.10.9.0 or higher. When compared with the legacy agents, the Azure Monitor Agent has [these limitat ## Log Analytics agent +> [!WARNING] +> The Log Analytics agents are on a deprecation path and will no longer be supported after August 31, 2024. + The legacy [Log Analytics agent](./log-analytics-agent.md) collects monitoring data from the guest operating system and workloads of virtual machines in Azure, other cloud providers, and on-premises machines. It sends data to a Log Analytics workspace. The Log Analytics agent is the same agent used by System Center Operations Manager, and you can multihome agent computers to communicate with your management group and Azure Monitor simultaneously. This agent is also required by certain insights in Azure Monitor and other services in Azure. > [!NOTE] The following tables list the operating systems that are supported by the Azure | Windows Server 2008 R2 SP1 | X | X | X | X | | Windows Server 2008 R2 | | | | X | | Windows Server 2008 SP2 | | X | | |-| Windows 10 Enterprise<br>(including multi-session) and Pro<br>(Server scenarios only<sup>1</sup>) | X | X | X | X | +| Windows 11 client OS | X<sup>2</sup> | | | | +| Windows 10 1803 (RS4) and higher | X<sup>2</sup> | | | | +| Windows 10 Enterprise<br>(including multi-session) and Pro<br>(Server scenarios only<sup>1</sup>) | X | X | X | X | | Windows 8 Enterprise and Pro<br>(Server scenarios only<sup>1</sup>) | | X | X | | | Windows 7 SP1<br>(Server scenarios only<sup>1</sup>) | | X | X | | | Azure Stack HCI | | X | | | <sup>1</sup> Running the OS on server hardware, i.e. machines that are always connected, always turned on, and not running other workloads (PC, office, browser, etc.)-+<sup>2</sup> Using the Azure Monitor agent [client installer (preview)](./azure-monitor-agent-windows-client.md) ### Linux | Operating system | Azure Monitor agent <sup>1</sup> | Log Analytics agent <sup>1</sup> | Dependency agent | Diagnostics extension <sup>2</sup>| |
| azure-monitor | Alerts Resource Move | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-resource-move.md | This article describes why existing [alert rules](./alerts-overview.md) and [ale ## Why the problem exists -Alert rules and alert processing rules reference other Azure resources. Examples include [Azure VMs](../../site-recovery/azure-to-azure-tutorial-migrate.md), [Azure SQL](../../azure-sql/database/move-resources-across-regions.md), and [Azure Storage](../../storage/common/storage-account-move.md). When you move the resources those rules refer to, the rules are likely to stop working correctly because they can't find the resources they reference. +Alert rules and alert processing rules reference other Azure resources. Examples include [Azure VMs](../../site-recovery/azure-to-azure-tutorial-migrate.md), [Azure SQL](/azure/azure-sql/database/move-resources-across-regions), and [Azure Storage](../../storage/common/storage-account-move.md). When you move the resources those rules refer to, the rules are likely to stop working correctly because they can't find the resources they reference. There are two main reasons why your rules might stop working after moving the target resources: |
| azure-monitor | Distributed Tracing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/distributed-tracing.md | The Application Insights agents and/or SDKs for .NET, .NET Core, Java, Node.js, * [.NET Core](asp-net-core.md) * [Java](./java-in-process-agent.md) * [Node.js](../app/nodejs.md)-* [JavaScript](./javascript.md) +* [JavaScript](./javascript.md#enable-correlation) * [Python](opencensus-python.md) With the proper Application Insights SDK installed and configured, tracing information is automatically collected for popular frameworks, libraries, and technologies by SDK dependency auto-collectors. The full list of supported technologies is available in [the Dependency auto-collection documentation](./auto-collect-dependencies.md). |
| azure-monitor | Javascript Angular Plugin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/javascript-angular-plugin.md | import { ApplicationinsightsAngularpluginErrorService } from '@microsoft/applica export class AppModule { } ``` +## Enable Correlation ++Correlation generates and sends data that enables distributed tracing and powers the [application map](../app/app-map.md), [end-to-end transaction view](../app/app-map.md#go-to-details), and other diagnostic tools. ++In JavaScript correlation is turned off by default in order to minimize the telemetry we send by default. To enable correlation please reference [JavaScript client-side correlation documentation](./javascript.md#enable-correlation). ++### Route tracking ++The Angular Plugin automatically tracks route changes and collects other Angular specific telemetry. ++> [!NOTE] +> `enableAutoRouteTracking` should be set to `false` if it set to true then when the route changes duplicate PageViews may be sent. ++### PageView ++If a custom `PageView` duration is not provided, `PageView` duration defaults to a value of 0. + ## Next steps - To learn more about the JavaScript SDK, see the [Application Insights JavaScript SDK documentation](javascript.md) |
| azure-monitor | Javascript Click Analytics Plugin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/javascript-click-analytics-plugin.md | var appInsights = new Microsoft.ApplicationInsights.ApplicationInsights({ appInsights.loadAppInsights(); ``` +## Enable Correlation ++Correlation generates and sends data that enables distributed tracing and powers the [application map](../app/app-map.md), [end-to-end transaction view](../app/app-map.md#go-to-details), and other diagnostic tools. ++In JavaScript correlation is turned off by default in order to minimize the telemetry we send by default. To enable correlation please reference [JavaScript client-side correlation documentation](./javascript.md#enable-correlation). + ## Sample app [Simple web app with Click Analytics Auto-collection Plugin enabled](https://go.microsoft.com/fwlink/?linkid=2152871). |
| azure-monitor | Javascript React Native Plugin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/javascript-react-native-plugin.md | appInsights.loadAppInsights(); ``` +## Enable Correlation ++Correlation generates and sends data that enables distributed tracing and powers the [application map](../app/app-map.md), [end-to-end transaction view](../app/app-map.md#go-to-details), and other diagnostic tools. ++In JavaScript correlation is turned off by default in order to minimize the telemetry we send by default. To enable correlation please reference [JavaScript client-side correlation documentation](./javascript.md#enable-correlation). ++### PageView ++If a custom `PageView` duration is not provided, `PageView` duration defaults to a value of 0. + ## Next steps - To learn more about the JavaScript SDK, see the [Application Insights JavaScript SDK documentation](javascript.md). |
| azure-monitor | Javascript React Plugin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/javascript-react-plugin.md | const App = () => { The `AppInsightsErrorBoundary` requires two props to be passed to it, the `ReactPlugin` instance created for the application and a component to be rendered when an error occurs. When an unhandled error occurs, `trackException` is called with the information provided to the Error Boundary and the `onError` component is displayed. +## Enable Correlation ++Correlation generates and sends data that enables distributed tracing and powers the [application map](../app/app-map.md), [end-to-end transaction view](../app/app-map.md#go-to-details), and other diagnostic tools. ++In JavaScript correlation is turned off by default in order to minimize the telemetry we send by default. To enable correlation please reference [JavaScript client-side correlation documentation](./javascript.md#enable-correlation). ++### Route tracking ++The React Plugin automatically tracks route changes and collects other React specific telemetry. ++> [!NOTE] +> `enableAutoRouteTracking` should be set to `false` if it set to true then when the route changes duplicate PageViews may be sent. ++For `react-router v6` or other scenarios where router history is not exposed, you can add `enableAutoRouteTracking: true` to your [setup configuration](#basic-usage). ++### PageView ++If a custom `PageView` duration is not provided, `PageView` duration defaults to a value of 0. + ## Sample app Check out the [Application Insights React demo](https://github.com/Azure-Samples/application-insights-react-demo). |
| azure-monitor | Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/app/javascript.md | By setting `autoTrackPageVisitTime: true`, the time in milliseconds a user spend Correlation generates and sends data that enables distributed tracing and powers the [application map](../app/app-map.md), [end-to-end transaction view](../app/app-map.md#go-to-details), and other diagnostic tools. -The following example shows all possible configurations required to enable correlation, with scenario-specific notes below: +In JavaScript correlation is turned off by default in order to minimize the telemetry we send by default. The following examples show standard configuration options for enabling correlation. ++The following sample code shows the configurations required to enable correlation: ++# [Snippet](#tab/snippet) ```javascript // excerpt of the config section of the JavaScript SDK snippet with correlation // between client-side AJAX and server requests enabled. cfg: { // Application Insights Configuration+ instrumentationKey: "YOUR_INSTRUMENTATION_KEY_GOES_HERE" connectionString: "Copy connection string from Application Insights Resource Overview"- disableFetchTracking: false, enableCorsCorrelation: true, enableRequestHeaderTracking: true, enableResponseHeaderTracking: true,- correlationHeaderExcludedDomains: ['myapp.azurewebsites.net', '*.queue.core.windows.net'] + correlationHeaderExcludedDomains: ['*.queue.core.windows.net'] /* ...Other Configuration Options... */ }}); </script>- ``` -If any of your third-party servers that the client communicates with canΓÇÖt accept the `Request-Id` and `Request-Context` headers, and you canΓÇÖt update their configuration, then you'll need to put them into an exclude list via the `correlationHeaderExcludedDomains` configuration property. This property supports wildcards. +# [NPM](#tab/npm) -The server-side needs to be able to accept connections with those headers present. Depending on the `Access-Control-Allow-Headers` configuration on the server-side it's often necessary to extend the server-side list by manually adding `Request-Id` and `Request-Context`. +```javascript +// excerpt of the config section of the JavaScript SDK snippet with correlation +// between client-side AJAX and server requests enabled. +const appInsights = new ApplicationInsights({ config: { // Application Insights Configuration + instrumentationKey: 'YOUR_INSTRUMENTATION_KEY_GOES_HERE' + connectionString: "Copy connection string from Application Insights Resource Overview" + enableCorsCorrelation: true, + enableRequestHeaderTracking: true, + enableResponseHeaderTracking: true, + correlationHeaderExcludedDomains: ['*.queue.core.windows.net'] + /* ...Other Configuration Options... */ +} }); +``` -Access-Control-Allow-Headers: `Request-Id`, `Request-Context`, `<your header>` + > [!NOTE]-> If you are using OpenTelemtry or Application Insights SDKs released in 2020 or later, we recommend using [WC3 TraceContext](https://www.w3.org/TR/trace-context/). See configuration guidance [here](../app/correlation.md#enable-w3c-distributed-tracing-support-for-web-apps). +> There are two distributed tracing modes/protocols - AI (Classic) and [W3C TraceContext](https://www.w3.org/TR/trace-context/) (New). In version 2.6.0 and later, they are _both_ enabled by default. For older versions, users need to [explicitly opt-in to WC3 mode](../app/correlation.md#enable-w3c-distributed-tracing-support-for-web-apps). -## Single Page Applications +### Route tracking By default, this SDK will **not** handle state-based route changing that occurs in single page applications. To enable automatic route change tracking for your single page application, you can add `enableAutoRouteTracking: true` to your setup configuration. -Currently, we offer a separate [React plugin](javascript-react-plugin.md), which you can initialize with this SDK. It will also accomplish route change tracking for you, and collect other React specific telemetry. -> [!NOTE] -> Use `enableAutoRouteTracking: true` only if you are **not** using the React plugin. Both are capable of sending new PageViews when the route changes. If both are enabled, duplicate PageViews may be sent. +### Single Page Applications ++For Single Page Applications, please reference plugin documentation for plugin specific guidance. ++| Plugins | +|| +| [React](javascript-react-plugin.md#enable-correlation)| +| [React Native](javascript-react-native-plugin.md#enable-correlation)| +| [Angular](javascript-angular-plugin.md#enable-correlation)| +| [Click Analytics Auto-collection](javascript-click-analytics-plugin.md#enable-correlation)| ++### Advanced Correlation ++When a page is first loading and the SDK has not fully initialized, we are unable to generate the Operation ID for the first request. As a result, distributed tracing is incomplete until the SDK fully initializes. +To remedy this problem, you can include dynamic JavaScript on the returned HTML page and the SDK will use a callback function during initialization to retroactively pull the Operation ID from the serverside and populate the clientside with it. ++# [Snippet](#tab/snippet) ++Here's a sample of how to create a dynamic JS using Razor: ++```C# +<script> +!function(T,l,y){<removed snippet code>,{ + src: "https://js.monitor.azure.com/scripts/b/ai.2.min.js", // The SDK URL Source + onInit: function(appInsights) { + var serverId = "@this.Context.GetRequestTelemetry().Context.Operation.Id"; + appInsights.context.telemetryContext.parentID = serverId; + }, + cfg: { // Application Insights Configuration + instrumentationKey: "YOUR_INSTRUMENTATION_KEY_GOES_HERE" + }}); +</script> +``` +# [NPM](#tab/npm) ++```js +import { ApplicationInsights } from '@microsoft/applicationinsights-web' +const appInsights = new ApplicationInsights({ config: { + instrumentationKey: 'YOUR_INSTRUMENTATION_KEY_GOES_HERE' + /* ...Other Configuration Options... */ +} }); +appInsights.context.telemetryContext.parentID = serverId; +appInsights.loadAppInsights(); +``` ++When using a npm based configuration, a location must be determined to store the Operation ID (generally global) to enable access for the SDK initialization bundle to `appInsights.context.telemetryContext.parentID` so it can populate it before the first page view event is sent. ++ ++> [!CAUTION] +>The application UX is not yet optimized to show these "first hop" advanced distributed tracing scenarios. However, the data will be available in the requests table for query and diagnostics. ## Extensions The Application Insights JavaScript SDK is open-source to view the source code o For the latest updates and bug fixes, [consult the release notes](./release-notes.md). +## Troubleshooting ++### I am getting an error message of Failed to get Request-Context correlation header as it may be not included in the response or not accessible ++The `correlationHeaderExcludedDomains` configuration property is an exclude list that disables correlation headers for specific domains, this is useful for when including those headers would cause the request to fail or not be sent due to third-party server configuration. This property supports wildcards. +An example would be `*.queue.core.windows.net`, as seen in the code sample above. +Adding the application domain to this property should be avoided as it stops the SDK from including the required distributed tracing `Request-Id`, `Request-Context` and `traceparent` headers as part of the request. ++### I'm not sure how to update my third-party server configuration ++The server-side needs to be able to accept connections with those headers present. Depending on the `Access-Control-Allow-Headers` configuration on the server-side it's often necessary to extend the server-side list by manually adding `Request-Id`, `Request-Context` and `traceparent` (W3C distributed header). ++Access-Control-Allow-Headers: `Request-Id`, `traceparent`, `Request-Context`, `<your header>` ++### I am receiving duplicate telemetry data from the Application Insights JavaScript SDK ++If the SDK reports correlation recursively enable the configuration setting of `excludeRequestFromAutoTrackingPatterns` to exclude the duplicate data, this can occur when using connection strings. The syntax for the configuration setting is `excludeRequestFromAutoTrackingPatterns: [<endpointUrl>]`. + ## <a name="next"></a> Next steps * [Track usage](usage-overview.md) * [Custom events and metrics](api-custom-events-metrics.md) |
| azure-monitor | Resource Logs Categories | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/essentials/resource-logs-categories.md | In addition, there might be costs to export some categories of resource logs to Following is a list of the types of logs available for each resource type. -Some categories might be supported only for specific types of resources. See the resource-specific documentation if you feel you're missing a resource. For example, Microsoft.Sql/servers/databases categories aren't available for all types of databases. For more information, see [information on SQL Database diagnostic logging](../../azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure.md). +Some categories might be supported only for specific types of resources. See the resource-specific documentation if you feel you're missing a resource. For example, Microsoft.Sql/servers/databases categories aren't available for all types of databases. For more information, see [information on SQL Database diagnostic logging](/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure). If you think something is missing, you can open a GitHub comment at the bottom of this article. |
| azure-monitor | Resource Logs Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/essentials/resource-logs-schema.md | The schema for resource logs varies depending on the resource and log category. | Azure Power BI Embedded | [Logging for Power BI Embedded in Azure](/power-bi/developer/azure-pbie-diag-logs) | | Recovery Services | [Data model for Azure Backup](../../backup/backup-azure-reports-data-model.md)| | Azure Service Bus |[Azure Service Bus logs](../../service-bus-messaging/service-bus-diagnostic-logs.md) |-| Azure SQL Database | [Azure SQL Database logging](../../azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure.md) | +| Azure SQL Database | [Azure SQL Database logging](/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure) | | Azure Storage | [Blobs](../../storage/blobs/monitor-blob-storage-reference.md#resource-logs-preview), [Files](../../storage/files/storage-files-monitoring-reference.md#resource-logs-preview), [Queues](../../storage/queues/monitor-queue-storage-reference.md#resource-logs-preview), [Tables](../../storage/tables/monitor-table-storage-reference.md#resource-logs-preview) | | Azure Stream Analytics |[Job logs](../../stream-analytics/stream-analytics-job-diagnostic-logs.md) | | Azure Traffic Manager | [Traffic Manager log schema](../../traffic-manager/traffic-manager-diagnostic-logs.md) | |
| azure-monitor | Azure Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/insights/azure-sql.md | -> Azure SQL Analytics (preview) is an integration with Azure Monitor, where many monitoring solutions are no longer in active development. For more monitoring options, see [Monitoring and performance tuning in Azure SQL Database and Azure SQL Managed Instance](../../azure-sql/database/monitor-tune-overview.md). +> Azure SQL Analytics (preview) is an integration with Azure Monitor, where many monitoring solutions are no longer in active development. For more monitoring options, see [Monitoring and performance tuning in Azure SQL Database and Azure SQL Managed Instance](/azure/azure-sql/database/monitor-tune-overview). Azure SQL Analytics (preview) is an advanced cloud monitoring solution for monitoring performance of all of your Azure SQL databases at scale and across multiple subscriptions in a single view. Azure SQL Analytics collects and visualizes key performance metrics with built-in intelligence for performance troubleshooting. Use the process described in [Add Azure Monitor solutions from the Solutions Gal Once you have created Azure SQL Analytics solution in your workspace, you need to **configure each** resource that you want to monitor to stream its diagnostics telemetry to Azure SQL Analytics. Follow detailed instructions on this page: -- Enable Azure Diagnostics for your database to [stream diagnostics telemetry to Azure SQL Analytics](../../azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure.md).+- Enable Azure Diagnostics for your database to [stream diagnostics telemetry to Azure SQL Analytics](/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure). The above page also provides instructions on enabling support for monitoring multiple Azure subscriptions from a single Azure SQL Analytics workspace as a single pane of glass. Selecting the SQL Managed Instance view, shows details on the instance utilizati ### Intelligent Insights report -Azure SQL Database [Intelligent Insights](../../azure-sql/database/intelligent-insights-overview.md) lets you know what is happening with performance of all Azure SQL databases. All Intelligent Insights collected can be visualized and accessed through the Insights perspective. +Azure SQL Database [Intelligent Insights](/azure/azure-sql/database/intelligent-insights-overview) lets you know what is happening with performance of all Azure SQL databases. All Intelligent Insights collected can be visualized and accessed through the Insights perspective.  Once the new role is created, assign this role to each user that you need to gra ## Analyze data and create alerts -Data analysis in Azure SQL Analytics is based on [Log Analytics language](../logs/get-started-queries.md) for your custom querying and reporting. Find description of the available data collected from database resource for custom querying in [metrics and logs available](../../azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure.md#metrics-and-logs-available). +Data analysis in Azure SQL Analytics is based on [Log Analytics language](../logs/get-started-queries.md) for your custom querying and reporting. Find description of the available data collected from database resource for custom querying in [metrics and logs available](/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure#metrics-and-logs-available). Automated alerting in Azure SQL Analytics is based on writing a Log Analytics query that triggers an alert upon a condition met. Find below several examples on Log Analytics queries upon which alerting can be set up in Azure SQL Analytics. |
| azure-monitor | Sql Insights Enable | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/insights/sql-insights-enable.md | The instructions below cover the process per type of SQL that you can monitor. T > [!NOTE] > SQL Insights (preview) does not support the following Azure SQL Database scenarios: > - **Elastic pools**: Metrics cannot be gathered for elastic pools. Metrics cannot be gathered for databases within elastic pools.-> - **Low service tiers**: Metrics cannot be gathered for databases on Basic, S0, S1, and S2 [service tiers](../../azure-sql/database/resource-limits-dtu-single-databases.md) +> - **Low service tiers**: Metrics cannot be gathered for databases on Basic, S0, S1, and S2 [service tiers](/azure/azure-sql/database/resource-limits-dtu-single-databases) > > SQL Insights (preview) has limited support for the following Azure SQL Database scenarios:-> - **Serverless tier**: Metrics can be gathered for databases using the [serverless compute tier](../../azure-sql/database/serverless-tier-overview.md). However, the process of gathering metrics will reset the auto-pause delay timer, preventing the database from entering an auto-paused state. +> - **Serverless tier**: Metrics can be gathered for databases using the [serverless compute tier](/azure/azure-sql/database/serverless-tier-overview). However, the process of gathering metrics will reset the auto-pause delay timer, preventing the database from entering an auto-paused state. -Connect to an Azure SQL database with [SQL Server Management Studio](../../azure-sql/database/connect-query-ssms.md), [Query Editor (preview)](../../azure-sql/database/connect-query-portal.md) in the Azure portal, or any other SQL client tool. +Connect to an Azure SQL database with [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms), [Query Editor (preview)](/azure/azure-sql/database/connect-query-portal) in the Azure portal, or any other SQL client tool. Run the following script to create a user with the required permissions. Replace *user* with a username and *mystrongpassword* with a strong password. order by username ``` ### Azure SQL Managed Instance-Connect to your Azure SQL Managed Instance using [SQL Server Management Studio](../../azure-sql/database/connect-query-ssms.md) or a similar tool, and execute the following script to create the monitoring user with the permissions needed. Replace *user* with a username and *mystrongpassword* with a strong password. +Connect to your Azure SQL Managed Instance using [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms) or a similar tool, and execute the following script to create the monitoring user with the permissions needed. Replace *user* with a username and *mystrongpassword* with a strong password. ```sql GO ``` ### SQL Server-Connect to SQL Server on your Azure virtual machine and use [SQL Server Management Studio](../../azure-sql/database/connect-query-ssms.md) or a similar tool to run the following script to create the monitoring user with the permissions needed. Replace *user* with a username and *mystrongpassword* with a strong password. +Connect to SQL Server on your Azure virtual machine and use [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms) or a similar tool to run the following script to create the monitoring user with the permissions needed. Replace *user* with a username and *mystrongpassword* with a strong password. ```sql USE master; Each type of SQL offers methods for your monitoring virtual machine to securely SQL Insights supports accessing your Azure SQL Database via its public endpoint as well as from its virtual network. -For access via the public endpoint, you would add a rule under the **Firewall settings** page and the [IP firewall settings](../../azure-sql/database/network-access-controls-overview.md#ip-firewall-rules) section. For specifying access from a virtual network, you can set [virtual network firewall rules](../../azure-sql/database/network-access-controls-overview.md#virtual-network-firewall-rules) and set the [service tags required by the Azure Monitor agent](../agents/azure-monitor-agent-overview.md#networking). [This article](../../azure-sql/database/network-access-controls-overview.md#ip-vs-virtual-network-firewall-rules) describes the differences between these two types of firewall rules. +For access via the public endpoint, you would add a rule under the **Firewall settings** page and the [IP firewall settings](/azure/azure-sql/database/network-access-controls-overview#ip-firewall-rules) section. For specifying access from a virtual network, you can set [virtual network firewall rules](/azure/azure-sql/database/network-access-controls-overview#virtual-network-firewall-rules) and set the [service tags required by the Azure Monitor agent](../agents/azure-monitor-agent-overview.md#networking). [This article](/azure/azure-sql/database/network-access-controls-overview#ip-vs-virtual-network-firewall-rules) describes the differences between these two types of firewall rules. :::image type="content" source="media/sql-insights-enable/set-server-firewall.png" alt-text="Set server firewall" lightbox="media/sql-insights-enable/set-server-firewall.png"::: For access via the public endpoint, you would add a rule under the **Firewall se ### Azure SQL Managed Instance -If your monitoring virtual machine will be in the same VNet as your SQL MI resources, then see [Connect inside the same VNet](../../azure-sql/managed-instance/connect-application-instance.md#connect-inside-the-same-vnet). If your monitoring virtual machine will be in the different VNet than your SQL MI resources, then see [Connect inside a different VNet](../../azure-sql/managed-instance/connect-application-instance.md#connect-inside-a-different-vnet). +If your monitoring virtual machine will be in the same VNet as your SQL MI resources, then see [Connect inside the same VNet](/azure/azure-sql/managed-instance/connect-application-instance#connect-inside-the-same-vnet). If your monitoring virtual machine will be in the different VNet than your SQL MI resources, then see [Connect inside a different VNet](/azure/azure-sql/managed-instance/connect-application-instance#connect-inside-a-different-vnet). ### SQL Server -If your monitoring virtual machine is in the same VNet as your SQL virtual machine resources, then see [Connect to SQL Server within a virtual network](../../azure-sql/virtual-machines/windows/ways-to-connect-to-sql.md#connect-to-sql-server-within-a-virtual-network). If your monitoring virtual machine will be in the different VNet than your SQL virtual machine resources, then see [Connect to SQL Server over the internet](../../azure-sql/virtual-machines/windows/ways-to-connect-to-sql.md#connect-to-sql-server-over-the-internet). +If your monitoring virtual machine is in the same VNet as your SQL virtual machine resources, then see [Connect to SQL Server within a virtual network](/azure/azure-sql/virtual-machines/windows/ways-to-connect-to-sql#connect-to-sql-server-within-a-virtual-network). If your monitoring virtual machine will be in the different VNet than your SQL virtual machine resources, then see [Connect to SQL Server over the internet](/azure/azure-sql/virtual-machines/windows/ways-to-connect-to-sql#connect-to-sql-server-over-the-internet). ## Store monitoring password in Key Vault As a security best practice, we strongly recommend that you store your SQL user (login) passwords in a Key Vault, rather than entering them directly into your monitoring profile connection strings. The connection string specifies the login name that SQL Insights (preview) shoul The connections string will vary for each type of SQL resource: #### Azure SQL Database-TCP connections from the monitoring machine to the IP address and port used by the database must be allowed by any firewalls or [network security groups](../../virtual-network/network-security-groups-overview.md) (NSGs) that may exist on the network path. For details on IP addresses and ports, see [Azure SQL Database connectivity architecture](../../azure-sql/database/connectivity-architecture.md). +TCP connections from the monitoring machine to the IP address and port used by the database must be allowed by any firewalls or [network security groups](../../virtual-network/network-security-groups-overview.md) (NSGs) that may exist on the network path. For details on IP addresses and ports, see [Azure SQL Database connectivity architecture](/azure/azure-sql/database/connectivity-architecture). Enter the connection string in the form: Get the details from the **Connection strings** menu item for the database. To monitor a readable secondary, append `;ApplicationIntent=ReadOnly` to the connection string. SQL Insights supports monitoring a single secondary. The collected data will be tagged to reflect primary or secondary. #### Azure SQL Managed Instance-TCP connections from the monitoring machine to the IP address and port used by the managed instance must be allowed by any firewalls or [network security groups](../../virtual-network/network-security-groups-overview.md) (NSGs) that may exist on the network path. For details on IP addresses and ports, see [Azure SQL Managed Instance connection types](../../azure-sql/managed-instance/connection-types-overview.md). +TCP connections from the monitoring machine to the IP address and port used by the managed instance must be allowed by any firewalls or [network security groups](../../virtual-network/network-security-groups-overview.md) (NSGs) that may exist on the network path. For details on IP addresses and ports, see [Azure SQL Managed Instance connection types](/azure/azure-sql/managed-instance/connection-types-overview). Enter the connection string in the form: Enter the connection string in the form: "Server= mysqlserver.<dns_zone>.database.windows.net;Port=1433;User Id=$username;Password=$password;" ] ```-Get the details from the **Connection strings** menu item for the managed instance. If using managed instance [public endpoint](../../azure-sql/managed-instance/public-endpoint-configure.md), replace port 1433 with 3342. +Get the details from the **Connection strings** menu item for the managed instance. If using managed instance [public endpoint](/azure/azure-sql/managed-instance/public-endpoint-configure), replace port 1433 with 3342. :::image type="content" source="media/sql-insights-enable/connection-string-sql-managed-instance.png" alt-text="SQL Managed Instance connection string" lightbox="media/sql-insights-enable/connection-string-sql-managed-instance.png"::: |
| azure-monitor | Sql Insights Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/insights/sql-insights-overview.md | Last updated 04/14/2022 # Monitor your SQL deployments with SQL Insights (preview) -SQL Insights (preview) is a comprehensive solution for monitoring any product in the [Azure SQL family](../../azure-sql/index.yml). SQL Insights uses [dynamic management views](../../azure-sql/database/monitoring-with-dmvs.md) to expose the data that you need to monitor health, diagnose problems, and tune performance. +SQL Insights (preview) is a comprehensive solution for monitoring any product in the [Azure SQL family](/azure/azure-sql/index). SQL Insights uses [dynamic management views](/azure/azure-sql/database/monitoring-with-dmvs) to expose the data that you need to monitor health, diagnose problems, and tune performance. SQL Insights performs all monitoring remotely. Monitoring agents on dedicated virtual machines connect to your SQL resources and remotely gather data. The gathered data is stored in [Azure Monitor Logs](../logs/data-platform-logs.md) to enable easy aggregation, filtering, and trend analysis. You can view the collected data from the SQL Insights [workbook template](../visualize/workbooks-overview.md), or you can delve directly into the data by using [log queries](../logs/get-started-queries.md).-The following diagram details the steps taken by information from the database engine and Azure resource logs, and how they can be surfaced. For a more detailed diagram of Azure SQL logging, see [Monitoring and diagnostic telemetry](../../azure-sql/database/monitor-tune-overview.md#monitoring-and-diagnostic-telemetry). +The following diagram details the steps taken by information from the database engine and Azure resource logs, and how they can be surfaced. For a more detailed diagram of Azure SQL logging, see [Monitoring and diagnostic telemetry](/azure/azure-sql/database/monitor-tune-overview.md#monitoring-and-diagnostic-telemetry). :::image type="content" source="media/sql-insights/azure-sql-insights-horizontal-analytics.svg" alt-text="Diagram showing how database engine information and resource logs are surfaced through AzureDiagnostics and Log Analytics."::: SQL Insights (preview) supports the following versions of SQL Server: SQL Insights (preview) supports SQL Server running in the following environments: - Azure SQL Database - Azure SQL Managed Instance-- SQL Server on Azure Virtual Machines (SQL Server running on virtual machines registered with the [SQL virtual machine](../../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md) provider)-- Azure VMs (SQL Server running on virtual machines not registered with the [SQL virtual machine](../../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md) provider)+- SQL Server on Azure Virtual Machines (SQL Server running on virtual machines registered with the [SQL virtual machine](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm) provider) +- Azure VMs (SQL Server running on virtual machines not registered with the [SQL virtual machine](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm) provider) SQL Insights (preview) has no support or has limited support for the following: - **Non-Azure instances**: SQL Server running on virtual machines outside Azure is not supported. - **Azure SQL Database elastic pools**: Metrics can't be gathered for elastic pools or for databases within elastic pools.-- **Azure SQL Database low service tiers**: Metrics can't be gathered for databases on Basic, S0, S1, and S2 [service tiers](../../azure-sql/database/resource-limits-dtu-single-databases.md).+- **Azure SQL Database low service tiers**: Metrics can't be gathered for databases on Basic, S0, S1, and S2 [service tiers](/azure/azure-sql/database/resource-limits-dtu-single-databases). - **Azure SQL Database serverless tier**: Metrics can be gathered for databases through the serverless compute tier. However, the process of gathering metrics will reset the auto-pause delay timer, preventing the database from entering an auto-paused state. - **Secondary replicas**: Metrics can be gathered for only a single secondary replica per database. If a database has more than one secondary replica, only one can be monitored.-- **Authentication with Azure Active Directory**: The only supported method of [authentication](../../azure-sql/database/logins-create-manage.md#authentication-and-authorization) for monitoring is SQL authentication. For SQL Server on Azure Virtual Machines, authentication through Active Directory on a custom domain controller is not supported. +- **Authentication with Azure Active Directory**: The only supported method of [authentication](/azure/azure-sql/database/logins-create-manage#authentication-and-authorization) for monitoring is SQL authentication. For SQL Server on Azure Virtual Machines, authentication through Active Directory on a custom domain controller is not supported. ## Regional availability The tables have the following columns: ## Next steps - For frequently asked questions about SQL Insights (preview), see [Frequently asked questions](../faq.yml).-- [Monitoring and performance tuning in Azure SQL Database and Azure SQL Managed Instance](../../azure-sql/database/monitor-tune-overview.md)+- [Monitoring and performance tuning in Azure SQL Database and Azure SQL Managed Instance](/azure/azure-sql/database/monitor-tune-overview) |
| azure-monitor | Tutorial Custom Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/logs/tutorial-custom-logs.md | Instead of directly configuring the schema of the table, the portal allows you t ```kusto source | extend TimeGenerated = todatetime(Time)- | parse RawData.value with + | parse RawData with ClientIP:string ' ' * ' ' * Following is sample data that you can use for the tutorial. Alternatively, you c - [Complete a similar tutorial using the Azure portal.](tutorial-custom-logs-api.md) - [Read more about custom logs.](custom-logs-overview.md)-- [Learn more about writing transformation queries](../essentials/data-collection-rule-transformations.md)+- [Learn more about writing transformation queries](../essentials/data-collection-rule-transformations.md) |
| azure-monitor | Monitor Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/monitor-reference.md | The following table lists Azure services and the data they collect into Azure Mo | [Service Fabric](../service-fabric/index.yml) | Microsoft.ServiceFabric | No | No | [Service Fabric](../service-fabric/index.yml) | Agent required to monitor guest operating system and workflows.| | [Azure SignalR Service](../azure-signalr/index.yml) | Microsoft.SignalRService/SignalR | [**Yes**](./essentials/metrics-supported.md#microsoftsignalrservicesignalr) | [**Yes**](./essentials/resource-logs-categories.md#microsoftsignalrservicesignalr) | | | | [Azure SignalR Service](../azure-signalr/index.yml) | Microsoft.SignalRService/WebPubSub | [**Yes**](./essentials/metrics-supported.md#microsoftsignalrservicewebpubsub) | [**Yes**](./essentials/resource-logs-categories.md#microsoftsignalrservicewebpubsub) | | |- | [Azure SQL Managed Instance](../azure-sql/database/monitoring-tuning-index.yml) | Microsoft.Sql/managedInstances | [**Yes**](./essentials/metrics-supported.md#microsoftsqlmanagedinstances) | [**Yes**](./essentials/resource-logs-categories.md#microsoftsqlmanagedinstances) | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | - | [Azure SQL Database](../azure-sql/database/index.yml) | Microsoft.Sql/servers/databases | [**Yes**](./essentials/metrics-supported.md#microsoftsqlserversdatabases) | No | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | - | [Azure SQL Database](../azure-sql/database/index.yml) | Microsoft.Sql/servers/elasticpools | [**Yes**](./essentials/metrics-supported.md#microsoftsqlserverselasticpools) | No | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | + | [Azure SQL Managed Instance](/azure/azure-sql/database/monitoring-tuning-index) | Microsoft.Sql/managedInstances | [**Yes**](./essentials/metrics-supported.md#microsoftsqlmanagedinstances) | [**Yes**](./essentials/resource-logs-categories.md#microsoftsqlmanagedinstances) | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | + | [Azure SQL Database](/azure/azure-sql/database/index) | Microsoft.Sql/servers/databases | [**Yes**](./essentials/metrics-supported.md#microsoftsqlserversdatabases) | No | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | + | [Azure SQL Database](/azure/azure-sql/database/index) | Microsoft.Sql/servers/elasticpools | [**Yes**](./essentials/metrics-supported.md#microsoftsqlserverselasticpools) | No | [Azure SQL Insights (preview)](./insights/sql-insights-overview.md) | | | [Azure Storage](../storage/index.yml) | Microsoft.Storage/storageAccounts | [**Yes**](./essentials/metrics-supported.md#microsoftstoragestorageaccounts) | No | [Azure Storage Insights](/azure/azure-monitor/insights/storage-insights-overview) | | | [Azure Storage Blobs](../storage/blobs/index.yml) | Microsoft.Storage/storageAccounts/blobServices | [**Yes**](./essentials/metrics-supported.md#microsoftstoragestorageaccountsblobservices) | [**Yes**](./essentials/resource-logs-categories.md#microsoftstoragestorageaccountsblobservices) | [Azure Storage Insights](/azure/azure-monitor/insights/storage-insights-overview) | | | [Azure Storage Files](../storage/files/index.yml) | Microsoft.Storage/storageAccounts/fileServices | [**Yes**](./essentials/metrics-supported.md#microsoftstoragestorageaccountsfileservices) | [**Yes**](./essentials/resource-logs-categories.md#microsoftstoragestorageaccountsfileservices) | [Azure Storage Insights](/azure/azure-monitor/insights/storage-insights-overview) | | |
| azure-resource-manager | Azure Services Resource Providers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/azure-services-resource-providers.md | The resources providers that are marked with **- registered** are registered by | Microsoft.SignalRService | [Azure SignalR Service](../../azure-signalr/index.yml) | | Microsoft.SoftwarePlan | License | | Microsoft.Solutions | [Azure Managed Applications](../managed-applications/index.yml) |-| Microsoft.Sql | [Azure SQL Database](../../azure-sql/database/index.yml)<br /> [Azure SQL Managed Instance](../../azure-sql/managed-instance/index.yml) <br />[Azure Synapse Analytics](/azure/sql-data-warehouse/) | -| Microsoft.SqlVirtualMachine | [SQL Server on Azure Virtual Machines](../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md) | +| Microsoft.Sql | [Azure SQL Database](/azure/azure-sql/database/index)<br /> [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/index) <br />[Azure Synapse Analytics](/azure/sql-data-warehouse/) | +| Microsoft.SqlVirtualMachine | [SQL Server on Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview) | | Microsoft.Storage | [Storage](../../storage/index.yml) | | Microsoft.StorageCache | [Azure HPC Cache](../../hpc-cache/index.yml) | | Microsoft.StorageSync | [Storage](../../storage/index.yml) | |
| azure-resource-manager | Azure Subscription Service Limits | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/azure-subscription-service-limits.md | The latest values for Microsoft Purview quotas can be found in the [Microsoft Pu ## SQL Database limits -For SQL Database limits, see [SQL Database resource limits for single databases](../../azure-sql/database/resource-limits-vcore-single-databases.md), [SQL Database resource limits for elastic pools and pooled databases](../../azure-sql/database/resource-limits-vcore-elastic-pools.md), and [SQL Database resource limits for SQL Managed Instance](../../azure-sql/managed-instance/resource-limits.md). +For SQL Database limits, see [SQL Database resource limits for single databases](/azure/azure-sql/database/resource-limits-vcore-single-databases), [SQL Database resource limits for elastic pools and pooled databases](/azure/azure-sql/database/resource-limits-vcore-elastic-pools), and [SQL Database resource limits for SQL Managed Instance](/azure/azure-sql/managed-instance/resource-limits). The maximum number of private endpoints per Azure SQL Database logical server is 250. |
| azure-resource-manager | Move Support Resources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/move-support-resources.md | Jump to a resource provider namespace: > | - | -- | - | -- | > | instancepools | No | No | No | > | locations | Yes | Yes | No |-> | managedinstances | No | No | Yes <br/><br/> [Learn more](../../azure-sql/database/move-resources-across-regions.md) about moving managed instances across regions. | +> | managedinstances | No | No | Yes <br/><br/> [Learn more](/azure/azure-sql/database/move-resources-across-regions) about moving managed instances across regions. | > | managedinstances / databases | No | No | Yes | > | servers | Yes | Yes |Yes |-> | servers / databases | Yes | Yes | Yes <br/><br/> [Learn more](../../azure-sql/database/move-resources-across-regions.md) about moving databases across regions.<br/><br/> [Learn more](../../resource-mover/tutorial-move-region-sql.md) about using Azure Resource Mover to move Azure SQL databases. | +> | servers / databases | Yes | Yes | Yes <br/><br/> [Learn more](/azure/azure-sql/database/move-resources-across-regions) about moving databases across regions.<br/><br/> [Learn more](../../resource-mover/tutorial-move-region-sql.md) about using Azure Resource Mover to move Azure SQL databases. | > | servers / databases / backuplongtermretentionpolicies | Yes | Yes | No |-> | servers / elasticpools | Yes | Yes | Yes <br/><br/> [Learn more](../../azure-sql/database/move-resources-across-regions.md) about moving elastic pools across regions.<br/><br/> [Learn more](../../resource-mover/tutorial-move-region-sql.md) about using Azure Resource Mover to move Azure SQL elastic pools. | +> | servers / elasticpools | Yes | Yes | Yes <br/><br/> [Learn more](/azure/azure-sql/database/move-resources-across-regions) about moving elastic pools across regions.<br/><br/> [Learn more](../../resource-mover/tutorial-move-region-sql.md) about using Azure Resource Mover to move Azure SQL elastic pools. | > | servers / jobaccounts | Yes | Yes | No | > | servers / jobagents | Yes | Yes | No | > | virtualclusters | No | No | No | |
| azure-resource-manager | Resource Name Rules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/resource-name-rules.md | In the following tables, the term alphanumeric refers to: > | /clusters / databases / dataConnections | database | 1-40 | Alphanumerics, hyphens, spaces, and periods. | > | /clusters / databases / eventhubconnections | database | 1-40 | Alphanumerics, hyphens, spaces, and periods. | +## Microsoft.LabServices ++> [!div class="mx-tableFixed"] +> | Entity | Scope | Length | Valid Characters | +> | | | | | +> | labplans | resource group | 1-100 | Alphanumerics, hyphens, periods, and underscores.<br><br>Start with letter and end with alphanumeric. | +> | labs | resource group | 1-100 | Alphanumerics, hyphens, periods, and underscores.<br><br>Start with letter and end with alphanumeric. | + ## Microsoft.Logic > [!div class="mx-tableFixed"] |
| azure-resource-manager | Template Tutorial Deploy Sql Extensions Bacpac | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/templates/template-tutorial-deploy-sql-extensions-bacpac.md | -In this tutorial, you create a template to deploy a [logical SQL server](../../azure-sql/database/logical-servers.md) and a single database and import a BACPAC file. For information about how to deploy Azure virtual machine extensions by using ARM templates, see [Tutorial: Deploy virtual machine extensions with ARM templates](./template-tutorial-deploy-vm-extensions.md). +In this tutorial, you create a template to deploy a [logical SQL server](/azure/azure-sql/database/logical-servers) and a single database and import a BACPAC file. For information about how to deploy Azure virtual machine extensions by using ARM templates, see [Tutorial: Deploy virtual machine extensions with ARM templates](./template-tutorial-deploy-vm-extensions.md). This tutorial covers the following tasks: To complete this article, you need: ## Prepare a BACPAC file -A BACPAC file is shared in [GitHub](https://github.com/Azure/azure-docs-json-samples/raw/master/tutorial-sql-extension/SQLDatabaseExtension.bacpac). To create your own, see [Export a database from Azure SQL Database to a BACPAC file](../../azure-sql/database/database-export.md). If you choose to publish the file to your own location, you must update the template later in the tutorial. +A BACPAC file is shared in [GitHub](https://github.com/Azure/azure-docs-json-samples/raw/master/tutorial-sql-extension/SQLDatabaseExtension.bacpac). To create your own, see [Export a database from Azure SQL Database to a BACPAC file](/azure/azure-sql/database/database-export). If you choose to publish the file to your own location, you must update the template later in the tutorial. The BACPAC file must be stored in an Azure Storage account before it can be imported with an ARM template. The following PowerShell script prepares the BACPAC file with these steps: Use the project name and location that were used when you prepared the BACPAC fi ## Verify the deployment -To access the server from your client computer, you need to add a firewall rule. Your client's IP address and the IP address that's used to connect to the server might be different because of network address translation (NAT). For more information, see [Create and manage IP firewall rules](../../azure-sql/database/firewall-configure.md#create-and-manage-ip-firewall-rules). +To access the server from your client computer, you need to add a firewall rule. Your client's IP address and the IP address that's used to connect to the server might be different because of network address translation (NAT). For more information, see [Create and manage IP firewall rules](/azure/azure-sql/database/firewall-configure#create-and-manage-ip-firewall-rules). For example, when you sign in to **Query editor** a message is displayed that the IP address isn't allowed. The address is different from your client's IP address because of NAT. Select the message's link to add a firewall rule for the IP address. When you're finished, you can delete the IP address from the server's **Firewalls and virtual networks** settings. |
| azure-sql-edge | Configure Replication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql-edge/configure-replication.md | You can configure an instance of Azure SQL Edge as the push subscriber for one-w - The instance of Azure SQL Edge must be a push subscriber for a publisher. - The publisher and the distributor can be either:- - An instance of SQL Server running on-premises, or an instance of SQL Server running in an Azure virtual machine. For more information, see [SQL Server on Azure Virtual Machines overview](../azure-sql/virtual-machines/index.yml). SQL Server instances must be using a version later than SQL Server 2016. + - An instance of SQL Server running on-premises, or an instance of SQL Server running in an Azure virtual machine. For more information, see [SQL Server on Azure Virtual Machines overview](/azure/azure-sql/virtual-machines/index). SQL Server instances must be using a version later than SQL Server 2016. - An instance of Azure SQL Managed Instance. SQL Managed Instance can host publisher, distributor, and subscriber databases. For more information, see [Replication with SQL Database Managed Instance](/azure/sql-database/replication-with-sql-database-managed-instance/). - The distribution database and the replication agents can't be placed on an instance of Azure SQL Edge. |
| azure-sql-edge | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql-edge/overview.md | Last updated 05/19/2020 Azure SQL Edge is an optimized relational database engine geared for IoT and IoT Edge deployments. It provides capabilities to create a high-performance data storage and processing layer for IoT applications and solutions. Azure SQL Edge provides capabilities to stream, process, and analyze relational and non-relational such as JSON, graph and time-series data, which makes it the right choice for a variety of modern IoT applications. -Azure SQL Edge is built on the latest versions of the [SQL Server Database Engine](/sql/sql-server/sql-server-technical-documentation), which provides industry-leading performance, security and query processing capabilities. Since Azure SQL Edge is built on the same engine as [SQL Server](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL](../azure-sql/index.yml), it provides the same Transact-SQL (T-SQL) programming surface area that makes development of applications or solutions easier and faster, and makes application portability between IoT Edge devices, data centers and the cloud straight forward. +Azure SQL Edge is built on the latest versions of the [SQL Server Database Engine](/sql/sql-server/sql-server-technical-documentation), which provides industry-leading performance, security and query processing capabilities. Since Azure SQL Edge is built on the same engine as [SQL Server](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL](/azure/azure-sql/index), it provides the same Transact-SQL (T-SQL) programming surface area that makes development of applications or solutions easier and faster, and makes application portability between IoT Edge devices, data centers and the cloud straight forward. What is Azure SQL Edge video on Channel 9: > [!VIDEO https://docs.microsoft.com/shows/Data-Exposed/What-is-Azure-SQL-Edge/player] |
| azure-sql-edge | Security Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql-edge/security-overview.md | Authentication is the process of proving the user is who they claim to be. Azure ### Authorization -Authorization refers to the permissions assigned to a user within a database in Azure SQL Edge, and determines what the user is allowed to do. Permissions are controlled by adding user accounts to [database roles](/sql/relational-databases/security/authentication-access/database-level-roles) and assigning database-level permissions to those roles or by granting the user certain [object-level permissions](/sql/relational-databases/security/permissions-database-engine). For more information, see [Logins and users](../azure-sql/database/logins-create-manage.md). +Authorization refers to the permissions assigned to a user within a database in Azure SQL Edge, and determines what the user is allowed to do. Permissions are controlled by adding user accounts to [database roles](/sql/relational-databases/security/authentication-access/database-level-roles) and assigning database-level permissions to those roles or by granting the user certain [object-level permissions](/sql/relational-databases/security/permissions-database-engine). For more information, see [Logins and users](/azure/azure-sql/database/logins-create-manage). As a best practice, create custom roles when needed. Add users to the role with the least privileges required to do their job function. Do not assign permissions directly to users. The server admin account is a member of the built-in db_owner role, which has extensive permissions and should only be granted to few users with administrative duties. For applications, use the [EXECUTE AS](/sql/t-sql/statements/execute-as-clause-transact-sql) to specify the execution context of the called module or use [Application Roles](/sql/relational-databases/security/authentication-access/application-roles) with limited permissions. This practice ensures that the application that connects to the database has the least privileges needed by the application. Following these best practices also fosters separation of duties. |
| azure-sql-edge | Tutorial Sync Data Sync | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql-edge/tutorial-sync-data-sync.md | Last updated 05/19/2020 # Tutorial: Sync data from SQL Edge to Azure SQL Database by using SQL Data Sync -In this tutorial, you'll learn how to use an Azure SQL Data Sync *sync group* to incrementally sync data from Azure SQL Edge to Azure SQL Database. SQL Data Sync is a service built on Azure SQL Database that lets you synchronize the data you select bi-directionally across multiple databases in Azure SQL Database and SQL Server instances. For more information on SQL Data Sync, see [Azure SQL Data Sync](../azure-sql/database/sql-data-sync-data-sql-server-sql-database.md). +In this tutorial, you'll learn how to use an Azure SQL Data Sync *sync group* to incrementally sync data from Azure SQL Edge to Azure SQL Database. SQL Data Sync is a service built on Azure SQL Database that lets you synchronize the data you select bi-directionally across multiple databases in Azure SQL Database and SQL Server instances. For more information on SQL Data Sync, see [Azure SQL Data Sync](/azure/azure-sql/database/sql-data-sync-data-sql-server-sql-database). Because SQL Edge is built on the latest versions of the [SQL Server Database Engine](/sql/sql-server/sql-server-technical-documentation/), any data synchronization mechanism that's applicable to a SQL Server instance can also be used to sync data to or from a SQL Edge instance running on an edge device. ## Prerequisites -This tutorial requires a Windows computer configured with the [Data Sync Agent for Azure SQL Data Sync](../azure-sql/database/sql-data-sync-agent-overview.md). +This tutorial requires a Windows computer configured with the [Data Sync Agent for Azure SQL Data Sync](/azure/azure-sql/database/sql-data-sync-agent-overview). ## Before you begin -* Create a database in Azure SQL Database. For information on how to create a database by using the Azure portal, see [Create a single database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md?tabs=azure-portal). +* Create a database in Azure SQL Database. For information on how to create a database by using the Azure portal, see [Create a single database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart?tabs=azure-portal). * Create the tables and other necessary objects in your Azure SQL Database deployment. * Create the necessary tables and objects in your Azure SQL Edge deployment. For more information, see [Using SQL Database DAC packages with SQL Edge](deploy-dacpac.md). -* Register the Azure SQL Edge instance with the Data Sync Agent for Azure SQL Data Sync. For more information, see [Add a SQL Server database](../azure-sql/database/sql-data-sync-sql-server-configure.md#add-on-prem). +* Register the Azure SQL Edge instance with the Data Sync Agent for Azure SQL Data Sync. For more information, see [Add a SQL Server database](/azure/azure-sql/database/sql-data-sync-sql-server-configure#add-on-prem). ## Sync data between a database in Azure SQL Database and SQL Edge Setting up synchronization between a database in Azure SQL Database and a SQL Edge instance by using SQL Data Sync involves three key steps: -1. Use the Azure portal to create a sync group. For more information, see [Create a sync group](../azure-sql/database/sql-data-sync-sql-server-configure.md#create-sync-group). You can use a single *hub* database to create multiple sync groups to synchronize data from various SQL Edge instances to one or more databases in Azure SQL Database. +1. Use the Azure portal to create a sync group. For more information, see [Create a sync group](/azure/azure-sql/database/sql-data-sync-sql-server-configure#create-sync-group). You can use a single *hub* database to create multiple sync groups to synchronize data from various SQL Edge instances to one or more databases in Azure SQL Database. -2. Add sync members to the sync group. For more information, see [Add sync members](../azure-sql/database/sql-data-sync-sql-server-configure.md#add-sync-members). +2. Add sync members to the sync group. For more information, see [Add sync members](/azure/azure-sql/database/sql-data-sync-sql-server-configure#add-sync-members). -3. Set up the sync group to select the tables that will be part of the synchronization. For more information, see [Configure a sync group](../azure-sql/database/sql-data-sync-sql-server-configure.md#add-sync-members). +3. Set up the sync group to select the tables that will be part of the synchronization. For more information, see [Configure a sync group](/azure/azure-sql/database/sql-data-sync-sql-server-configure#add-sync-members). After you complete the preceding steps, you'll have a sync group that includes a database in Azure SQL Database and a SQL Edge instance. For more info about SQL Data Sync, see these articles: -* [Data Sync Agent for Azure SQL Data Sync](../azure-sql/database/sql-data-sync-agent-overview.md) +* [Data Sync Agent for Azure SQL Data Sync](/azure/azure-sql/database/sql-data-sync-agent-overview) -* [Best practices](../azure-sql/database/sql-data-sync-best-practices.md) and [How to troubleshoot issues with Azure SQL Data Sync](../azure-sql/database/sql-data-sync-troubleshoot.md) +* [Best practices](/azure/azure-sql/database/sql-data-sync-best-practices) and [How to troubleshoot issues with Azure SQL Data Sync](/azure/azure-sql/database/sql-data-sync-troubleshoot) -* [Monitor SQL Data Sync with Azure Monitor logs](../azure-sql/database/monitor-tune-overview.md) +* [Monitor SQL Data Sync with Azure Monitor logs](/azure/azure-sql/database/monitor-tune-overview) -* [Update the sync schema with Transact-SQL](../azure-sql/database/sql-data-sync-update-sync-schema.md) or [PowerShell](../azure-sql/database/scripts/update-sync-schema-in-sync-group.md) +* [Update the sync schema with Transact-SQL](/azure/azure-sql/database/sql-data-sync-update-sync-schema) or [PowerShell](/azure/azure-sql/database/scripts/update-sync-schema-in-sync-group) ## Next steps -* [Use PowerShell to sync between Azure SQL Database and Azure SQL Edge](../azure-sql/database/scripts/sql-data-sync-sync-data-between-azure-onprem.md). In this tutorial, replace the `OnPremiseServer` database details with the Azure SQL Edge details. +* [Use PowerShell to sync between Azure SQL Database and Azure SQL Edge](/azure/azure-sql/database/scripts/sql-data-sync-sync-data-between-azure-onprem). In this tutorial, replace the `OnPremiseServer` database details with the Azure SQL Edge details. |
| azure-sql | Data Discovery And Classification Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/data-discovery-and-classification-overview.md | After the organization-wide policy has been defined, you can continue classifyin ## <a id="audit-sensitive-data"></a>Audit access to sensitive data -An important aspect of the classification is the ability to monitor access to sensitive data. [Azure SQL Auditing](../../azure-sql/database/auditing-overview.md) has been enhanced to include a new field in the audit log called `data_sensitivity_information`. This field logs the sensitivity classifications (labels) of the data that was returned by a query. Here's an example: +An important aspect of the classification is the ability to monitor access to sensitive data. [Azure SQL Auditing](/azure/azure-sql/database/auditing-overview) has been enhanced to include a new field in the audit log called `data_sensitivity_information`. This field logs the sensitivity classifications (labels) of the data that was returned by a query. Here's an example: [](./media/data-discovery-and-classification-overview/11_data_classification_audit_log.png#lightbox) You can use the following SQL drivers to retrieve classification metadata: ## Next steps -- Consider configuring [Azure SQL Auditing](../../azure-sql/database/auditing-overview.md) for monitoring and auditing access to your classified sensitive data.+- Consider configuring [Azure SQL Auditing](/azure/azure-sql/database/auditing-overview) for monitoring and auditing access to your classified sensitive data. - For a presentation that includes data Discovery & Classification, see [Discovering, classifying, labeling & protecting SQL data | Data Exposed](https://www.youtube.com/watch?v=itVi9bkJUNc). - To classify your Azure SQL Databases and Azure Synapse Analytics with Microsoft Purview labels using T-SQL commands, see [Classify your Azure SQL data using Microsoft Purview labels](../../sql-database/scripts/sql-database-import-purview-labels.md). |
| azure-sql | Disaster Recovery Guidance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/disaster-recovery-guidance.md | For more information about database alert rules, see [Receive Alert Notification ### Enable auditing -If auditing is required to access your database, you need to enable Auditing after the database recovery. For more information, see [Database auditing](../../azure-sql/database/auditing-overview.md). +If auditing is required to access your database, you need to enable Auditing after the database recovery. For more information, see [Database auditing](/azure/azure-sql/database/auditing-overview). ## Next steps |
| azure-sql | Dns Alias Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/dns-alias-overview.md | Presently, a DNS alias has the following limitations: - *DNS lookup:* For now, the only authoritative way to check what server a given DNS alias refers to is by performing a [DNS lookup](/windows-server/administration/windows-commands/nslookup). - _Table auditing is not supported:_ You cannot use a DNS alias on a server that has *table auditing* enabled on a database. - Table auditing is deprecated.- - We recommend that you move to [Blob Auditing](../../azure-sql/database/auditing-overview.md). -- DNS alias is subject to [naming restrictions](../../azure-resource-manager/management/resource-name-rules.md).+ - We recommend that you move to [Blob Auditing](/azure/azure-sql/database/auditing-overview). +- DNS alias is subject to [naming restrictions](/azure/azure-resource-manager/management/resource-name-rules). ## Related resources |
| azure-sql | Firewall Configure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/firewall-configure.md | You create the first server-level firewall setting by using the [Azure portal](h To improve performance, server-level IP firewall rules are temporarily cached at the database level. To refresh the cache, see [DBCC FLUSHAUTHCACHE](/sql/t-sql/database-console-commands/dbcc-flushauthcache-transact-sql). > [!TIP]-> You can use [Database Auditing](../../azure-sql/database/auditing-overview.md) to audit server-level and database-level firewall changes. +> You can use [Database Auditing](/azure/azure-sql/database/auditing-overview) to audit server-level and database-level firewall changes. ### Use the Azure portal to manage server-level IP firewall rules |
| azure-sql | Logical Servers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/logical-servers.md | Last updated 03/12/2019 # What is a logical SQL server in Azure SQL Database and Azure Synapse? [!INCLUDE[appliesto-sqldb-asa](../includes/appliesto-sqldb-asa.md)] -In Azure SQL Database and Azure Synapse Analytics, a server is a logical construct that acts as a central administrative point for a collection of databases. At the server level, you can administer [logins](logins-create-manage.md), [firewall rules](firewall-configure.md), [auditing rules](../../azure-sql/database/auditing-overview.md), [threat detection policies](threat-detection-configure.md), and [auto-failover groups](auto-failover-group-overview.md). A server can be in a different region than its resource group. The server must exist before you can create a database in Azure SQL Database or a data warehouse database in Azure Synapse Analytics. All databases managed by a single server are created within the same region as the server. +In Azure SQL Database and Azure Synapse Analytics, a server is a logical construct that acts as a central administrative point for a collection of databases. At the server level, you can administer [logins](logins-create-manage.md), [firewall rules](firewall-configure.md), [auditing rules](/azure/azure-sql/database/auditing-overview), [threat detection policies](threat-detection-configure.md), and [auto-failover groups](auto-failover-group-overview.md). A server can be in a different region than its resource group. The server must exist before you can create a database in Azure SQL Database or a data warehouse database in Azure Synapse Analytics. All databases managed by a single server are created within the same region as the server. This server is distinct from a SQL Server instance that you may be familiar with in the on-premises world. Specifically, there are no guarantees regarding location of the databases or data warehouse database in relation to the server that manages them. Furthermore, neither Azure SQL Database nor Azure Synapse expose any instance-level access or features. In contrast, the instance databases in a managed instance are all physically co-located - in the same way that you are familiar with SQL Server in the on-premises or virtual machine world. |
| azure-sql | Maintenance Window | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/maintenance-window.md | To get the maximum benefit from maintenance windows, make sure your client appli * In Azure SQL Database, any connections using the proxy connection policy could be affected by both the chosen maintenance window and a gateway node maintenance window. However, client connections using the recommended redirect connection policy are unaffected by a gateway node maintenance reconfiguration. -* In Azure SQL Managed Instance, the gateway nodes are hosted [within the virtual cluster](../../azure-sql/managed-instance/connectivity-architecture-overview.md#virtual-cluster-connectivity-architecture) and have the same maintenance window as the managed instance, but using the redirect connection policy is still recommended to minimize number of disruptions during the maintenance event. +* In Azure SQL Managed Instance, the gateway nodes are hosted [within the virtual cluster](/azure/azure-sql/managed-instance/connectivity-architecture-overview#virtual-cluster-connectivity-architecture) and have the same maintenance window as the managed instance, but using the redirect connection policy is still recommended to minimize number of disruptions during the maintenance event. For more on the client connection policy in Azure SQL Database, see [Azure SQL Database Connection policy](../database/connectivity-architecture.md#connection-policy). -For more on the client connection policy in Azure SQL Managed Instance, see [Azure SQL Managed Instance connection types](../../azure-sql/managed-instance/connection-types-overview.md). +For more on the client connection policy in Azure SQL Managed Instance, see [Azure SQL Managed Instance connection types](/azure/azure-sql/managed-instance/connection-types-overview). ## Considerations for Azure SQL Managed Instance |
| azure-sql | Manage Data After Migrating To Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/manage-data-after-migrating-to-database.md | To learn more about Disaster recovery, see: [Azure SQL Database Disaster Recover SQL Database takes Security and Privacy very seriously. Security within SQL Database is available at the database level and at the platform level and is best understood when categorized into several layers. At each layer you get to control and provide optimal security for your application. The layers are: - Identity & authentication ([SQL authentication and Azure Active Directory [Azure AD] authentication](logins-create-manage.md)).-- Monitoring activity ([Auditing](../../azure-sql/database/auditing-overview.md) and [threat detection](threat-detection-configure.md)).+- Monitoring activity ([Auditing](/azure/azure-sql/database/auditing-overview) and [threat detection](threat-detection-configure.md)). - Protecting actual data ([Transparent Data Encryption [TDE]](/sql/relational-databases/security/encryption/transparent-data-encryption-azure-sql) and [Always Encrypted [AE]](/sql/relational-databases/security/encryption/always-encrypted-database-engine)). - Controlling Access to sensitive and privileged data ([Row Level security](/sql/relational-databases/security/row-level-security) and [Dynamic Data Masking](/sql/relational-databases/security/dynamic-data-masking)). -[Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/) offers centralized security management across workloads running in Azure, on-premises, and in other clouds. You can view whether essential SQL Database protection such as [Auditing](../../azure-sql/database/auditing-overview.md) and [Transparent Data Encryption [TDE]](/sql/relational-databases/security/encryption/transparent-data-encryption-azure-sql) are configured on all resources, and create policies based on your own requirements. +[Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/) offers centralized security management across workloads running in Azure, on-premises, and in other clouds. You can view whether essential SQL Database protection such as [Auditing](/azure/azure-sql/database/auditing-overview) and [Transparent Data Encryption [TDE]](/sql/relational-databases/security/encryption/transparent-data-encryption-azure-sql) are configured on all resources, and create policies based on your own requirements. ### What user authentication methods are offered in SQL Database Port 1433. SQL Database communicates over this port. To connect from within a co #### SQL Database Auditing -With SQL Database, you can turn ON Auditing to track database events. [SQL Database Auditing](../../azure-sql/database/auditing-overview.md) records database events and writes them into an audit log file in your Azure Storage Account. Auditing is especially useful if you intend to gain insight into potential security and policy violations, maintain regulatory compliance etc. It allows you to define and configure certain categories of events that you think need auditing and based on that you can get preconfigured reports and a dashboard to get an overview of events occurring on your database. You can apply these auditing policies either at the database level or at the server level. A guide on how to turn on auditing for your server/database, see: [Enable SQL Database Auditing](secure-database-tutorial.md#enable-security-features). +With SQL Database, you can turn ON Auditing to track database events. [SQL Database Auditing](/azure/azure-sql/database/auditing-overview) records database events and writes them into an audit log file in your Azure Storage Account. Auditing is especially useful if you intend to gain insight into potential security and policy violations, maintain regulatory compliance etc. It allows you to define and configure certain categories of events that you think need auditing and based on that you can get preconfigured reports and a dashboard to get an overview of events occurring on your database. You can apply these auditing policies either at the database level or at the server level. A guide on how to turn on auditing for your server/database, see: [Enable SQL Database Auditing](secure-database-tutorial.md#enable-security-features). #### Threat detection |
| azure-sql | Move Resources Across Regions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/move-resources-across-regions.md | This article provides a general workflow for moving resources to a different reg 1. If database-level audit is enabled, disable it and enable server-level auditing instead. After failover, database-level auditing will require the cross-region traffic, which isn't desired or possible after the move. 1. For server-level audits, ensure that: - The storage container, Log Analytics, or event hub with the existing audit logs is moved to the target region.- - Auditing is configured on the target server. For more information, see [Get started with SQL Database auditing](../../azure-sql/database/auditing-overview.md). + - Auditing is configured on the target server. For more information, see [Get started with SQL Database auditing](/azure/azure-sql/database/auditing-overview). 1. If your instance has a long-term retention policy (LTR), the existing LTR backups will remain associated with the current server. Because the target server is different, you'll be able to access the older LTR backups in the source region by using the source server, even if the server is deleted. > [!NOTE] Once the move completes, remove the resources in the source region to avoid unne 1. If a database-level audit is enabled, disable it and enable server-level auditing instead. After failover, database-level auditing will require cross-region traffic, which is not desired, or possible after the move. 1. For server-level audits, ensure that: - The storage container, Log Analytics, or event hub with the existing audit logs is moved to the target region.- - Audit configuration is configured at the target server. For more information, see [SQL Database auditing](../../azure-sql/database/auditing-overview.md). + - Audit configuration is configured at the target server. For more information, see [SQL Database auditing](/azure/azure-sql/database/auditing-overview). 1. If your instance has a long-term retention policy (LTR), the existing LTR backups will remain associated with the current server. Because the target server is different, you'll be able to access the older LTR backups in the source region using the source server, even if the server is deleted. > [!NOTE] |
| azure-sql | Resource Limits Vcore Elastic Pools | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/resource-limits-vcore-elastic-pools.md | vCore resource limits are listed in the following articles, please be sure to up |Max number DBs per pool <sup>1</sup>|100|200|500|500|500|500|500| |Columnstore support|Yes|Yes|Yes|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|N/A|N/A|N/A|N/A|N/A|N/A|N/A|-|Max data size (GB)|512|756|1536|1536|1536|2048|2048| +|Max data size (GB)|512|756|1536|2048|2048|2048|2048| |Max log size (GB) <sup>2</sup>|154|227|461|461|461|614|614| |TempDB max data size (GB)|64|128|192|256|320|384|448| |Storage type|Premium (Remote) Storage|Premium (Remote) Storage|Premium (Remote) Storage|Premium (Remote) Storage|Premium (Remote) Storage|Premium (Remote) Storage|Premium (Remote) Storage| vCore resource limits are listed in the following articles, please be sure to up |Max number DBs per pool <sup>1</sup>|50|100|100|100|100|100| |Columnstore support|Yes|Yes|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|3.14|4.71|6.28|8.65|11.02|13.39|-|Max data size (GB)|1024|1536|1536|1536|3072|3072| +|Max data size (GB)|1024|1536|2048|2048|3072|3072| |Max log size (GB) <sup>2</sup>|307|307|461|461|922|922| |TempDB max data size (GB)|128|192|256|320|384|448| |[Max local storage size](resource-limits-logical-server.md#storage-space-governance) (GB)|4829|4829|4829|4829|4829|4829| |
| azure-sql | Resource Limits Vcore Single Databases | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/resource-limits-vcore-single-databases.md | The [serverless compute tier](serverless-tier-overview.md) is currently availabl |Min-max auto-pause delay (minutes)|60-10080|60-10080|60-10080|60-10080|60-10080| |Columnstore support|Yes <sup>1</sup>|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|N/A|N/A|N/A|N/A|N/A|-|Max data size (GB)|512|1024|1024|1024|1536| +|Max data size (GB)|512|1024|1024|1024|2048| |Max log size (GB) <sup>2</sup>|154|307|307|307|461| |Tempdb max data size (GB)|32|64|128|192|256| |Storage type|Remote SSD|Remote SSD|Remote SSD|Remote SSD|Remote SSD| The [serverless compute tier](serverless-tier-overview.md) is currently availabl |Min-max auto-pause delay (minutes)|60-10080|60-10080|60-10080|60-10080| |Columnstore support|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|N/A|N/A|N/A|N/A|-|Max data size (GB)|1536|3072|3072|3072| +|Max data size (GB)|2048|3072|3072|3072| |Max log size (GB) <sup>1</sup>|461|461|461|922| |Tempdb max data size (GB)|320|384|448|512| |Storage type|Remote SSD|Remote SSD|Remote SSD|Remote SSD| The [serverless compute tier](serverless-tier-overview.md) is currently availabl |Memory (GB)|10.4|20.8|31.1|41.5|51.9|62.3|72.7| |Columnstore support|Yes|Yes|Yes|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|N/A|N/A|N/A|N/A|N/A|N/A|N/A|-|Max data size (GB)|1024|1024|1536|1536|1536|3072|3072| +|Max data size (GB)|1024|1024|1536|2048|2048|3072|3072| |Max log size (GB) <sup>1</sup>|307|307|461|461|461|922|922| |Tempdb max data size (GB)|64|128|192|256|320|384|384| |Storage type|Remote SSD|Remote SSD|Remote SSD|Remote SSD|Remote SSD|Remote SSD|Remote SSD| The [serverless compute tier](serverless-tier-overview.md) is currently availabl |Memory (GB)|10.4|20.8|31.1|41.5|51.9|62.3|72.7| |Columnstore support|Yes|Yes|Yes|Yes|Yes|Yes|Yes| |In-memory OLTP storage (GB)|1.57|3.14|4.71|6.28|8.65|11.02|13.39|-|Max data size (GB)|1024|1024|1536|1536|1536|3072|3072| +|Max data size (GB)|1024|1024|1536|2048|2048|3072|3072| |Max log size (GB) <sup>1</sup>|307|307|461|461|461|922|922| |Tempdb max data size (GB)|64|128|192|256|320|384|448| |[Max local storage size](resource-limits-logical-server.md#storage-space-governance) (GB)|4829|4829|4829|4829|4829|4829|4829| |
| azure-sql | Restore Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/scripts/restore-database-cli.md | This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Setup Geodr Failover Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/scripts/setup-geodr-failover-database-cli.md | This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Setup Geodr Failover Group Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/scripts/setup-geodr-failover-group-cli.md | This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Setup Geodr Failover Pool Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/scripts/setup-geodr-failover-pool-cli.md | This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Secure Database Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/secure-database-tutorial.md | To copy a secure connection string: ## Enable security features -Azure SQL Database provides security features that are accessed using the Azure portal. These features are available for both the database and server, except for data masking, which is only available on the database. To learn more, see [Microsoft Defender for SQL](azure-defender-for-sql.md), [Auditing](../../azure-sql/database/auditing-overview.md), [Dynamic data masking](dynamic-data-masking-overview.md), and [Transparent data encryption](transparent-data-encryption-tde-overview.md). +Azure SQL Database provides security features that are accessed using the Azure portal. These features are available for both the database and server, except for data masking, which is only available on the database. To learn more, see [Microsoft Defender for SQL](azure-defender-for-sql.md), [Auditing](/azure/azure-sql/database/auditing-overview), [Dynamic data masking](dynamic-data-masking-overview.md), and [Transparent data encryption](transparent-data-encryption-tde-overview.md). ### Microsoft Defender for SQL To enable auditing:  > [!IMPORTANT]-> See [SQL Database auditing](../../azure-sql/database/auditing-overview.md) on how to further customize audit events using PowerShell or REST API. +> See [SQL Database auditing](/azure/azure-sql/database/auditing-overview) on how to further customize audit events using PowerShell or REST API. ### Dynamic data masking |
| azure-sql | Security Best Practice | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/security-best-practice.md | Advanced threat protection enables you to detect and respond to potential threat - Configure [Microsoft Defender for SQL](azure-defender-for-sql.md) for a specific server or a managed instance. You can also configure Microsoft Defender for SQL for all servers and managed instances in a subscription by enabling [Microsoft Defender for Cloud](../../security-center/security-center-pricing.md). -- For a full investigation experience, it's recommended to enable [SQL Database Auditing](../../azure-sql/database/auditing-overview.md). With auditing, you can track database events and write them to an audit log in an Azure Storage account or Azure Log Analytics workspace.+- For a full investigation experience, it's recommended to enable [SQL Database Auditing](/azure/azure-sql/database/auditing-overview). With auditing, you can track database events and write them to an audit log in an Azure Storage account or Azure Log Analytics workspace. ### Audit critical security events Tracking of database events helps you understand database activity. You can gain **How to implement**: -- Enable [SQL Database Auditing](../../azure-sql/database/auditing-overview.md) or [Managed Instance Auditing](../managed-instance/auditing-configure.md) to track database events and write them to an audit log in your Azure Storage account, Log Analytics workspace (preview), or Event Hubs (preview).+- Enable [SQL Database Auditing](/azure/azure-sql/database/auditing-overview) or [Managed Instance Auditing](../managed-instance/auditing-configure.md) to track database events and write them to an audit log in your Azure Storage account, Log Analytics workspace (preview), or Event Hubs (preview). - Audit logs can be written to an Azure Storage account, to a Log Analytics workspace for consumption by Azure Monitor logs, or to event hub for consumption using event hub. You can configure any combination of these options, and audit logs will be written to each. **Best practices**: -- By configuring [SQL Database Auditing](../../azure-sql/database/auditing-overview.md) on your server or [Managed Instance Auditing](../managed-instance/auditing-configure.md) to audit events, all existing and newly created databases on that server will be audited.+- By configuring [SQL Database Auditing](/azure/azure-sql/database/auditing-overview) on your server or [Managed Instance Auditing](../managed-instance/auditing-configure.md) to audit events, all existing and newly created databases on that server will be audited. - By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to [configure auditing for different types of actions and action groups using PowerShell](./auditing-overview.md#manage-auditing). Configuring this will help control the number of audited actions, and minimize the risk of event loss. Custom audit configurations allow customers to capture only the audit data that is needed. - Audit logs can be consumed directly in the [Azure portal](https://portal.azure.com/), or from the storage location that was configured. Tracking of database events helps you understand database activity. You can gain **Further resources**: -- [SQL Database Auditing](../../azure-sql/database/auditing-overview.md)+- [SQL Database Auditing](/azure/azure-sql/database/auditing-overview) - [SQL Server Auditing](/sql/relational-databases/security/auditing/sql-server-audit-database-engine) ### Secure audit logs Monitor who accesses sensitive data and capture queries on sensitive data in aud **How to implement**: - Use SQL Audit and Data Classification in combination.- - In your [SQL Database Audit](../../azure-sql/database/auditing-overview.md) log, you can track access specifically to sensitive data. You can also view information such as the data that was accessed, as well as its sensitivity label. For more information, see [Data Discovery and Classification](data-discovery-and-classification-overview.md) and [Auditing access to sensitive data](data-discovery-and-classification-overview.md#audit-sensitive-data). + - In your [SQL Database Audit](/azure/azure-sql/database/auditing-overview) log, you can track access specifically to sensitive data. You can also view information such as the data that was accessed, as well as its sensitivity label. For more information, see [Data Discovery and Classification](data-discovery-and-classification-overview.md) and [Auditing access to sensitive data](data-discovery-and-classification-overview.md#audit-sensitive-data). **Best practices**: |
| azure-sql | Security Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/security-overview.md | SQL Database and SQL Managed Instance secure customer data by providing auditing ### SQL auditing in Azure Monitor logs and Event Hubs -SQL Database and SQL Managed Instance auditing tracks database activities and helps maintain compliance with security standards by recording database events to an audit log in a customer-owned Azure storage account. Auditing allows users to monitor ongoing database activities, as well as analyze and investigate historical activity to identify potential threats or suspected abuse and security violations. For more information, see Get started with [SQL Database Auditing](../../azure-sql/database/auditing-overview.md). +SQL Database and SQL Managed Instance auditing tracks database activities and helps maintain compliance with security standards by recording database events to an audit log in a customer-owned Azure storage account. Auditing allows users to monitor ongoing database activities, as well as analyze and investigate historical activity to identify potential threats or suspected abuse and security violations. For more information, see Get started with [SQL Database Auditing](/azure/azure-sql/database/auditing-overview). ### Advanced Threat Protection In addition to the above features and functionality that can help your applicati ## Next steps - For a discussion of the use of logins, user accounts, database roles, and permissions in SQL Database and SQL Managed Instance, see [Manage logins and user accounts](logins-create-manage.md).-- For a discussion of database auditing, see [auditing](../../azure-sql/database/auditing-overview.md).+- For a discussion of database auditing, see [auditing](/azure/azure-sql/database/auditing-overview). - For a discussion of threat detection, see [threat detection](threat-detection-configure.md). |
| azure-sql | Sql Database Paas Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/sql-database-paas-overview.md | Microsoft Defender for SQL is a unified package for advanced SQL security capabi ### Auditing for compliance and security -[Auditing](../../azure-sql/database/auditing-overview.md) tracks database events and writes them to an audit log in your Azure storage account. Auditing can help you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that might indicate business concerns or suspected security violations. +[Auditing](/azure/azure-sql/database/auditing-overview) tracks database events and writes them to an audit log in your Azure storage account. Auditing can help you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that might indicate business concerns or suspected security violations. ### Data encryption |
| azure-sql | Threat Detection Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/database/threat-detection-overview.md | Advanced Threat Protection is part of the [Microsoft Defender for SQL](../../sec Advanced Threat Protection provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities. Users receive an alert upon suspicious database activities, potential vulnerabilities, and SQL injection attacks, as well as anomalous database access and queries patterns. Advanced Threat Protection integrates alerts with [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/), which include details of suspicious activity and recommend action on how to investigate and mitigate the threat. Advanced Threat Protection makes it simple to address potential threats to the database without the need to be a security expert or manage advanced security monitoring systems. -For a full investigation experience, it is recommended to enable auditing, which writes database events to an audit log in your Azure storage account. To enable auditing, see [Auditing for Azure SQL Database and Azure Synapse](../../azure-sql/database/auditing-overview.md) or [Auditing for Azure SQL Managed Instance](../managed-instance/auditing-configure.md). +For a full investigation experience, it is recommended to enable auditing, which writes database events to an audit log in your Azure storage account. To enable auditing, see [Auditing for Azure SQL Database and Azure Synapse](/azure/azure-sql/database/auditing-overview) or [Auditing for Azure SQL Managed Instance](../managed-instance/auditing-configure.md). ## Alerts Click **Advanced Threat Protection alert** to launch the Microsoft Defender for - Learn more about [Advanced Threat Protection in Azure SQL Database & Azure Synapse](threat-detection-configure.md). - Learn more about [Advanced Threat Protection in Azure SQL Managed Instance](../managed-instance/threat-detection-configure.md). - Learn more about [Microsoft Defender for SQL](azure-defender-for-sql.md).-- Learn more about [Azure SQL Database auditing](../../azure-sql/database/auditing-overview.md)+- Learn more about [Azure SQL Database auditing](/azure/azure-sql/database/auditing-overview) - Learn more about [Microsoft Defender for Cloud](../../security-center/security-center-introduction.md) For more information on pricing, see the [Azure SQL Database pricing page](https://azure.microsoft.com/pricing/details/sql-database/) |
| azure-sql | Identify Query Performance Issues | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/identify-query-performance-issues.md | A suboptimal plan generated by the SQL Query Optimizer may be the cause of slow - Use [Intelligent Insights](database/intelligent-insights-troubleshoot-performance.md#missing-index). - Review recommendations in the [Database Advisor](database/database-advisor-implement-performance-recommendations.md) for single and pooled databases in Azure SQL Database. You may also choose to enable [automatic tuning options for tuning indexes](database/automatic-tuning-overview.md#automatic-tuning-options) for Azure SQL Database. - Missing indexes in DMVs and query execution plans. This article shows you how to [detect and tune nonclustered indexes using missing index requests](/sql/relational-databases/indexes/tune-nonclustered-missing-index-suggestions).-- Try to [update statistics](/sql/t-sql/statements/update-statistics-transact-sql) or [rebuild indexes](/sql/relational-databases/indexes/reorganize-and-rebuild-indexes) to get the better plan. Enable [automatic plan correction](../azure-sql/database/automatic-tuning-overview.md) in Azure SQL Database or Azure SQL Managed Instance to automatically mitigate these problems.+- Try to [update statistics](/sql/t-sql/statements/update-statistics-transact-sql) or [rebuild indexes](/sql/relational-databases/indexes/reorganize-and-rebuild-indexes) to get the better plan. Enable [automatic plan correction](/azure/azure-sql/database/automatic-tuning-overview) in Azure SQL Database or Azure SQL Managed Instance to automatically mitigate these problems. - As an advanced troubleshooting step, use [Query Store hints](/sql/relational-databases/performance/query-store-hints) to apply [query hints](/sql/t-sql/queries/hints-transact-sql-query) using the Query Store, without making code changes. This [example](database/performance-guidance.md#query-tuning-and-hinting) shows the impact of a suboptimal query plan due to a parameterized query, how to detect this condition, and how to use a query hint to resolve. Several workarounds can mitigate PSP problems. Each workaround has associated tr - Use the [OPTION (OPTIMIZE FOR UNKNOWN)](/sql/t-sql/queries/hints-transact-sql-query) query hint to override the actual parameter value and instead use the density vector average. You can also do this by capturing the incoming parameter values in local variables and then using the local variables within the predicates instead of using the parameters themselves. For this fix, the average density must be *good enough*. - Disable parameter sniffing entirely by using the [DISABLE_PARAMETER_SNIFFING](/sql/t-sql/queries/hints-transact-sql-query) query hint. - Use the [KEEPFIXEDPLAN](/sql/t-sql/queries/hints-transact-sql-query) query hint to prevent recompilations in cache. This workaround assumes that the good-enough common plan is the one in cache already. You can also disable automatic statistics updates to reduce the chances that the good plan will be evicted and a new bad plan will be compiled.-- Force the plan by explicitly using the [USE PLAN](/sql/t-sql/queries/hints-transact-sql-query) query hint by rewriting the query and adding the hint in the query text. Or set a specific plan by using Query Store or by enabling [automatic tuning](../azure-sql/database/automatic-tuning-overview.md).+- Force the plan by explicitly using the [USE PLAN](/sql/t-sql/queries/hints-transact-sql-query) query hint by rewriting the query and adding the hint in the query text. Or set a specific plan by using Query Store or by enabling [automatic tuning](/azure/azure-sql/database/automatic-tuning-overview). - Replace the single procedure with a nested set of procedures that can each be used based on conditional logic and the associated parameter values. - Create dynamic string execution alternatives to a static procedure definition. |
| azure-sql | Auditing Configure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/auditing-configure.md | There are several methods you can use to view blob auditing logs. - You can explore audit logs by using a tool such as [Azure Storage Explorer](https://azure.microsoft.com/features/storage-explorer/). In Azure Storage, auditing logs are saved as a collection of blob files within a container that was defined to store the audit logs. For further details about the hierarchy of the storage folder, naming conventions, and log format, see the [Blob Audit Log Format Reference](../database/audit-log-format.md). -- For a full list of audit log consumption methods, refer to [Get started with Azure SQL Database auditing](../../azure-sql/database/auditing-overview.md).+- For a full list of audit log consumption methods, refer to [Get started with Azure SQL Database auditing](/azure/azure-sql/database/auditing-overview). ### Consume logs stored in Event Hubs The key differences in the `CREATE AUDIT` syntax for auditing to Azure Blob stor ## Next steps -- For a full list of audit log consumption methods, refer to [Get started with Azure SQL Database auditing](../../azure-sql/database/auditing-overview.md).+- For a full list of audit log consumption methods, refer to [Get started with Azure SQL Database auditing](/azure/azure-sql/database/auditing-overview). - For more information about Azure programs that support standards compliance, see the [Azure Trust Center](https://gallery.technet.microsoft.com/Overview-of-Azure-c1be3942), where you can find the most current list of compliance certifications. <!--Image references--> |
| azure-sql | Doc Changes Updates Release Notes Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/doc-changes-updates-release-notes-whats-new.md | The following table lists the features of Azure SQL Managed Instance that are cu | | | | [16 TB support in Business Critical](resource-limits.md#service-tier-characteristics) | Support for allocation up to 16 TB of space on SQL Managed Instance in the Business Critical service tier using the new memory optimized premium-series hardware. | | [Data virtualization](data-virtualization-overview.md) | Join locally stored relational data with data queried from external data sources, such as Azure Data Lake Storage Gen2 or Azure Blob Storage. |-|[Endpoint policies](../../azure-sql/managed-instance/service-endpoint-policies-configure.md) | Configure which Azure Storage accounts can be accessed from a SQL Managed Instance subnet. Grants an extra layer of protection against inadvertent or malicious data exfiltration.| +|[Endpoint policies](/azure/azure-sql/managed-instance/service-endpoint-policies-configure) | Configure which Azure Storage accounts can be accessed from a SQL Managed Instance subnet. Grants an extra layer of protection against inadvertent or malicious data exfiltration.| | [Instance pools](instance-pools-overview.md) | A convenient and cost-efficient way to migrate smaller SQL Server instances to the cloud. | | [Managed Instance link](managed-instance-link-feature-overview.md)| Online replication of SQL Server databases hosted anywhere to Azure SQL Managed Instance. | | [Maintenance window advance notifications](../database/advance-notifications.md)| Advance notifications (preview) for databases configured to use a non-default [maintenance window](../database/maintenance-window.md). Advance notifications are in preview for Azure SQL Managed Instance. | Learn about significant changes to the Azure SQL Managed Instance documentation. |**16 TB support for General Purpose GA** | Deploying a 16 TB instance to the General Purpose service tier is now generally available. See [resource limits](resource-limits.md) to learn more. | | **Azure AD-only authentication GA** | Restricting authentication to your Azure SQL Managed Instance only to Azure Active Directory users is now generally available. To learn more, see [Azure AD-only authentication](../database/authentication-azure-ad-only-authentication.md). | | **Distributed transactions GA** | The ability to execute distributed transactions across managed instances is now generally available. See [Distributed transactions](../database/elastic-transactions-overview.md) to learn more. |-|**Endpoint policies preview** | It's now possible to configure an endpoint policy to restrict access from a SQL Managed Instance subnet to an Azure Storage account. This grants an extra layer of protection against inadvertent or malicious data exfiltration. See [Endpoint policies](../../azure-sql/managed-instance/service-endpoint-policies-configure.md) to learn more. | +|**Endpoint policies preview** | It's now possible to configure an endpoint policy to restrict access from a SQL Managed Instance subnet to an Azure Storage account. This grants an extra layer of protection against inadvertent or malicious data exfiltration. See [Endpoint policies](/azure/azure-sql/managed-instance/service-endpoint-policies-configure) to learn more. | |**Link feature preview** | Use the link feature for SQL Managed Instance to replicate data from your SQL Server hosted anywhere to Azure SQL Managed Instance, leveraging the benefits of Azure without moving your data to Azure, to offload your workloads, for disaster recovery, or to migrate to the cloud. See the [Link feature for SQL Managed Instance](managed-instance-link-feature-overview.md) to learn more. The link feature is currently in limited public preview. | |**Long-term backup retention GA** | Storing full backups for a specific database with configured redundancy for up to 10 years in Azure Blob storage is now generally available. To learn more, see [Long-term backup retention](long-term-backup-retention-configure.md). | | **Move instance to different subnet GA** | It's now possible to move your SQL Managed Instance to a different subnet. See [Move instance to different subnet](vnet-subnet-move-instance.md) to learn more. | |
| azure-sql | Instance Create Quickstart | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/instance-create-quickstart.md | If you don't have an Azure subscription, [create a free account](https://azure.m | Setting| Suggested value | DescriptionΓÇ»| | | | -- |-| **Service Tier** | Select one of the options. | Based on your scenario, select one of the following options: </br> <ul><li>**General Purpose**: for most production workloads, and the default option.</li><li>**Business Critical**: designed for low-latency workloads with high resiliency to failures and fast failovers.</li></ul><BR>For more information, review [service tiers](service-tiers-managed-instance-vcore.md) and [resource limits](../../azure-sql/managed-instance/resource-limits.md).| +| **Service Tier** | Select one of the options. | Based on your scenario, select one of the following options: </br> <ul><li>**General Purpose**: for most production workloads, and the default option.</li><li>**Business Critical**: designed for low-latency workloads with high resiliency to failures and fast failovers.</li></ul><BR>For more information, review [service tiers](service-tiers-managed-instance-vcore.md) and [resource limits](/azure/azure-sql/managed-instance/resource-limits).| | **Hardware Configuration** | Select one of the options. | Hardware configuration generally defines the compute and memory limits and other characteristics that impact the performance of the workload. **Gen5** is the default.| | **vCore compute model** | Select an option. | vCores represent exact amount of compute resources that are always provisioned for your workload. **Eight vCores** is the default.|-| **Storage in GB** | Select an option. | Storage size in GB, select based on expected data size. If migrating existing data from on-premises or on various cloud platforms, see [Migration overview: SQL Server to SQL Managed Instance](../../azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview.md).| -| **Azure Hybrid Benefit** | Check option if applicable. | For leveraging an existing license for Azure. For more information, see [Azure Hybrid Benefit - Azure SQL Database & SQL Managed Instance](../../azure-sql/azure-hybrid-benefit.md). | +| **Storage in GB** | Select an option. | Storage size in GB, select based on expected data size. If migrating existing data from on-premises or on various cloud platforms, see [Migration overview: SQL Server to SQL Managed Instance](/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview).| +| **Azure Hybrid Benefit** | Check option if applicable. | For leveraging an existing license for Azure. For more information, see [Azure Hybrid Benefit - Azure SQL Database & SQL Managed Instance](/azure/azure-sql/azure-hybrid-benefit). | | **Backup storage redundancy** | Select **Geo-redundant backup storage**. | Storage redundancy inside Azure for backup storage. Note that this value cannot be changed later. Geo-redundant backup storage is default and recommended, though Zone and Local redundancy allow for more cost flexibility and single region data residency. For more information, see [Backup Storage redundancy](../database/automated-backups-overview.md?tabs=managed-instance#backup-storage-redundancy).| |
| azure-sql | Job Automation Managed Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/job-automation-managed-instance.md | Using [SQL Server Agent](/sql/ssms/agent/sql-server-agent) in SQL Server and [SQ ### SQL Agent job limitations in SQL Managed Instance -It is worth noting the differences between SQL Agent available in SQL Server and as part of SQL Managed Instance. For more on the supported feature differences between SQL Server and SQL Managed Instance, see [Azure SQL Managed Instance T-SQL differences from SQL Server](../../azure-sql/managed-instance/transact-sql-tsql-differences-sql-server.md#sql-server-agent). +It is worth noting the differences between SQL Agent available in SQL Server and as part of SQL Managed Instance. For more on the supported feature differences between SQL Server and SQL Managed Instance, see [Azure SQL Managed Instance T-SQL differences from SQL Server](/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server#sql-server-agent). Some of the SQL Agent features that are available in SQL Server are not supported in SQL Managed Instance: SQL Agent enables you to create different types of job steps, such as Transact-S > [!Note] > For more information on leveraging the Azure SSIS Integration Runtime with SSISDB hosted by SQL Managed Instance, see [Use Azure SQL Managed Instance with SQL Server Integration Services (SSIS) in Azure Data Factory](../../data-factory/how-to-use-sql-managed-instance-with-ir.md). -[Transactional replication](../managed-instance/replication-transactional-overview.md) can replicate the changes from your tables into other databases in SQL Managed Instance, Azure SQL Database, or SQL Server. For information, see [Configure replication in Azure SQL Managed Instance](../../azure-sql/managed-instance/replication-between-two-instances-configure-tutorial.md). +[Transactional replication](../managed-instance/replication-transactional-overview.md) can replicate the changes from your tables into other databases in SQL Managed Instance, Azure SQL Database, or SQL Server. For information, see [Configure replication in Azure SQL Managed Instance](/azure/azure-sql/managed-instance/replication-between-two-instances-configure-tutorial). Other types of job steps are not currently supported in SQL Managed Instance, including: GRANT EXECUTE ON master.dbo.xp_sqlagent_notify TO [login_name]; - [What is Azure SQL Managed Instance?](../managed-instance/sql-managed-instance-paas-overview.md) - [What's new in Azure SQL Managed Instance?](doc-changes-updates-release-notes-whats-new.md)-- [Azure SQL Managed Instance T-SQL differences from SQL Server](../../azure-sql/managed-instance/transact-sql-tsql-differences-sql-server.md#sql-server-agent)-- [Features comparison: Azure SQL Database and Azure SQL Managed Instance](../../azure-sql/database/features-comparison.md)+- [Azure SQL Managed Instance T-SQL differences from SQL Server](/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server#sql-server-agent) +- [Features comparison: Azure SQL Database and Azure SQL Managed Instance](/azure/azure-sql/database/features-comparison) + ## Next steps |
| azure-sql | Create Configure Managed Instance Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/scripts/create-configure-managed-instance-cli.md | Last updated 01/26/2022 [!INCLUDE[appliesto-sqldb](../../includes/appliesto-sqlmi.md)] -This Azure CLI script example creates an Azure SQL Managed Instance in a dedicated subnet within a new virtual network. It also configures a route table and a network security group for the virtual network. Once the script has been successfully run, the managed instance can be accessed from within the virtual network or from an on-premises environment. See [Configure Azure VM to connect to an Azure SQL Managed Instance](../../../azure-sql/managed-instance/connect-vm-instance-configure.md) and [Configure a point-to-site connection to an Azure SQL Managed Instance from on-premises](../../../azure-sql/managed-instance/point-to-site-p2s-configure.md). +This Azure CLI script example creates an Azure SQL Managed Instance in a dedicated subnet within a new virtual network. It also configures a route table and a network security group for the virtual network. Once the script has been successfully run, the managed instance can be accessed from within the virtual network or from an on-premises environment. See [Configure Azure VM to connect to an Azure SQL Managed Instance](/azure/azure-sql/managed-instance/connect-vm-instance-configure) and [Configure a point-to-site connection to an Azure SQL Managed Instance from on-premises](/azure/azure-sql/managed-instance/point-to-site-p2s-configure). > [!IMPORTANT]-> For limitations, see [supported regions](../../../azure-sql/managed-instance/resource-limits.md#supported-regions) and [supported subscription types](../../../azure-sql/managed-instance/resource-limits.md#supported-subscription-types). +> For limitations, see [supported regions](/azure/azure-sql/managed-instance/resource-limits#supported-regions) and [supported subscription types](/azure/azure-sql/managed-instance/resource-limits#supported-subscription-types). [!INCLUDE [quickstarts-free-trial-note](../../../../includes/quickstarts-free-trial-note.md)] This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Restore Geo Backup Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/scripts/restore-geo-backup-cli.md | This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Transparent Data Encryption Byok Sql Managed Instance Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/managed-instance/scripts/transparent-data-encryption-byok-sql-managed-instance-cli.md | Last updated 01/26/2022 [!INCLUDE[appliesto-sqldb](../../includes/appliesto-sqlmi.md)] -This Azure CLI script example configures Transparent Data Encryption (TDE) with customer-managed key for Azure SQL Managed Instance, using a key from Azure Key Vault. This is often referred to as a Bring Your Own Key scenario for TDE. To learn more about the TDE with customer-managed key, see [TDE Bring Your Own Key to Azure SQL](../../../azure-sql/database/transparent-data-encryption-byok-overview.md). +This Azure CLI script example configures Transparent Data Encryption (TDE) with customer-managed key for Azure SQL Managed Instance, using a key from Azure Key Vault. This is often referred to as a Bring Your Own Key scenario for TDE. To learn more about the TDE with customer-managed key, see [TDE Bring Your Own Key to Azure SQL](/azure/azure-sql/database/transparent-data-encryption-byok-overview). This sample requires an existing Managed Instance, see [Use Azure CLI to create an Azure SQL Managed Instance](create-configure-managed-instance-cli.md). This script uses the following commands. Each command in the table links to comm For more information on Azure CLI, see [Azure CLI documentation](/cli/azure). -Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](../../../azure-sql/database/az-cli-script-samples-content-guide.md). +Additional SQL Database CLI script samples can be found in the [Azure SQL Database documentation](/azure/azure-sql/database/az-cli-script-samples-content-guide). |
| azure-sql | Sql Server To Managed Instance Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide.md | The test approach for database migration consists of the following activities: You can take advantage of the advanced cloud-based features offered by SQL Managed Instance, such as [built-in high availability](../../database/high-availability-sla.md), [threat detection](../../database/azure-defender-for-sql.md), and [monitoring and tuning your workload](../../database/monitor-tune-overview.md). -[Azure SQL Analytics](../../../azure-sql/database/monitor-tune-overview.md) allows you to monitor a large set of managed instances in a centralized manner. +[Azure SQL Analytics](/azure/azure-sql/database/monitor-tune-overview) allows you to monitor a large set of managed instances in a centralized manner. Some SQL Server features are only available once the [database compatibility level](/sql/relational-databases/databases/view-or-change-the-compatibility-level-of-a-database) is changed to the latest compatibility level (150). |
| azure-sql | Application Patterns Development Strategies | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/virtual-machines/windows/application-patterns-development-strategies.md | In n-tier hybrid application pattern, you can implement the following workflow i * With secure point-to-site connection, you can establish network connectivity between your virtual network in Azure and your individual computers running anywhere. It is mostly recommended for development and test purposes. For information on how to connect to SQL Server in Azure, see [Connect to a SQL Server virtual machine on Azure](ways-to-connect-to-sql.md).-4. Set up scheduled jobs and alerts that back up on-premises data in a virtual machine disk in Azure. For more information, see [SQL Server Backup and Restore with Azure Blob Storage](/sql/relational-databases/backup-restore/sql-server-backup-and-restore-with-microsoft-azure-blob-storage-service) and [Backup and Restore for SQL Server on Azure Virtual Machines](../../../azure-sql/virtual-machines/windows/backup-restore.md). +4. Set up scheduled jobs and alerts that back up on-premises data in a virtual machine disk in Azure. For more information, see [SQL Server Backup and Restore with Azure Blob Storage](/sql/relational-databases/backup-restore/sql-server-backup-and-restore-with-microsoft-azure-blob-storage-service) and [Backup and Restore for SQL Server on Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/backup-restore). 5. Depending on your applicationΓÇÖs needs, you can implement one of the following three common scenarios: 1. You can keep your web server, application server, and insensitive data in a database server in Azure whereas you keep the sensitive data on-premises. |
| azure-sql | Business Continuity High Availability Disaster Recovery Hadr Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md | You can have a disaster recovery solution for your SQL Server databases in Azure | | | | [**Availability groups**](availability-group-overview.md) |Availability replicas running across multiple datacenters in Azure VMs for disaster recovery. This cross-region solution helps protect against a complete site outage. <br/> .| | **Database mirroring** |Principal and mirror and servers running in different datacenters for disaster recovery. You must deploy them by using server certificates. SQL Server database mirroring is not supported for SQL Server 2008 or SQL Server 2008 R2 on an Azure VM. <br/> |-| **Backup and restore with Azure Blob storage** |Production databases backed up directly to Blob storage in a different datacenter for disaster recovery.<br/>. | +| **Backup and restore with Azure Blob storage** |Production databases backed up directly to Blob storage in a different datacenter for disaster recovery.<br/><br/>For more information, see [Backup and restore for SQL Server on Azure VMs](/azure/azure-sql/virtual-machines/windows/backup-restore). | | **Replicate and fail over SQL Server to Azure with Azure Site Recovery** |Production SQL Server instance in one Azure datacenter replicated directly to Azure Storage in a different Azure datacenter for disaster recovery.<br/>. | You can have a disaster recovery solution for your SQL Server databases in a hyb | [**Availability groups**](availability-group-overview.md) |Some availability replicas running in Azure VMs and other replicas running on-premises for cross-site disaster recovery. The production site can be either on-premises or in an Azure datacenter.<br/>.| | **Database mirroring** |One partner running in an Azure VM and the other running on-premises for cross-site disaster recovery by using server certificates. Partners don't need to be in the same Active Directory domain, and no VPN connection is required.<br/> is required.<br/><br/>For successful disaster recovery of your databases, you should also install a replica domain controller at the disaster recovery site. SQL Server database mirroring is not supported for SQL Server 2008 or SQL Server 2008 R2 on an Azure VM. | | **Log shipping** |One server running in an Azure VM and the other running on-premises for cross-site disaster recovery. Log shipping depends on Windows file sharing, so a VPN connection between the Azure virtual network and the on-premises network is required.<br/><br/>For successful disaster recovery of your databases, you should also install a replica domain controller at the disaster recovery site. |-| **Backup and restore with Azure Blob storage** |On-premises production databases backed up directly to Azure Blob storage for disaster recovery.<br/>. | +| **Backup and restore with Azure Blob storage** |On-premises production databases backed up directly to Azure Blob storage for disaster recovery.<br/><br/>For more information, see [Backup and restore for SQL Server on Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/backup-restore). | | **Replicate and fail over SQL Server to Azure with Azure Site Recovery** |On-premises production SQL Server instance replicated directly to Azure Storage for disaster recovery.<br/>. | |
| azure-sql | Migrate To Vm From Sql Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/virtual-machines/windows/migrate-to-vm-from-sql-server.md | The following table lists each of the primary migration methods and discusses wh | [Perform an on-premises backup using compression and manually copy the backup file into the Azure virtual machine](#back-up-and-restore) |SQL Server 2005 or greater |SQL Server 2005 or greater |[Azure VM storage limit](../../../index.yml) | This technique is simple and well-tested for moving databases across machines. | | [Perform a backup to URL and restore into the Azure virtual machine from the URL](#backup-to-url-and-restore-from-url) |SQL Server 2012 SP1 CU2 or greater | SQL Server 2012 SP1 CU2 or greater | < 12.8 TB for SQL Server 2016, otherwise < 1 TB | This method is just another way to move the backup file to the VM using Azure storage. | | [Detach and then copy the data and log files to Azure Blob storage and then attach to SQL Server in Azure virtual machine from URL](#detach-and-attach-from-a-url) | SQL Server 2005 or greater |SQL Server 2014 or greater | [Azure VM storage limit](../../../index.yml) | Use this method when you plan to [store these files using the Azure Blob storage service](/sql/relational-databases/databases/sql-server-data-files-in-microsoft-azure) and attach them to SQL Server running in an Azure VM, particularly with very large databases |-| [Convert on-premises machine to Hyper-V VHDs, upload to Azure Blob storage, and then deploy a new virtual machine using uploaded VHD](#convert-to-a-vm-upload-to-a-url-and-deploy-as-a-new-vm) |SQL Server 2005 or greater |SQL Server 2005 or greater |[Azure VM storage limit](../../../index.yml) |Use when [bringing your own SQL Server license](../../../azure-sql/azure-sql-iaas-vs-paas-what-is-overview.md), when migrating a database that you'll run on an older version of SQL Server, or when migrating system and user databases together as part of the migration of database dependent on other user databases and/or system databases. | +| [Convert on-premises machine to Hyper-V VHDs, upload to Azure Blob storage, and then deploy a new virtual machine using uploaded VHD](#convert-to-a-vm-upload-to-a-url-and-deploy-as-a-new-vm) |SQL Server 2005 or greater |SQL Server 2005 or greater |[Azure VM storage limit](../../../index.yml) |Use when [bringing your own SQL Server license](/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview), when migrating a database that you'll run on an older version of SQL Server, or when migrating system and user databases together as part of the migration of database dependent on other user databases and/or system databases. | | [Ship hard drive using Windows Import/Export Service](#ship-a-hard-drive) |SQL Server 2005 or greater |SQL Server 2005 or greater |[Azure VM storage limit](../../../index.yml) |Use the [Windows Import/Export Service](../../../import-export/storage-import-export-service.md) when manual copy method is too slow, such as with very large databases | | [Use the Add Azure Replica Wizard](/previous-versions/azure/virtual-machines/windows/sqlclassic/virtual-machines-windows-classic-sql-onprem-availability) |SQL Server 2012 or greater |SQL Server 2012 or greater |[Azure VM storage limit](../../../index.yml) |Minimizes downtime, use when you have an Always On on-premises deployment | | [Use SQL Server transactional replication](/sql/relational-databases/replication/transactional/transactional-replication) |SQL Server 2005 or greater |SQL Server 2005 or greater |[Azure VM storage limit](../../../index.yml) |Use when you need to minimize downtime and don't have an Always On on-premises deployment | |
| azure-sql | Storage Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-sql/virtual-machines/windows/storage-configuration.md | Based on your choices, Azure performs the following storage configuration tasks * Associates the storage pool with a new drive on the virtual machine. * Optimizes this new drive based on your specified workload type (Data warehousing, Transactional processing, or General). -For a full walkthrough of how to create a SQL Server VM in the Azure portal, see [the provisioning tutorial](../../../azure-sql/virtual-machines/windows/create-sql-vm-portal.md). +For a full walkthrough of how to create a SQL Server VM in the Azure portal, see [the provisioning tutorial](/azure/azure-sql/virtual-machines/windows/create-sql-vm-portal). |
| backup | Backup Azure Arm Restore Vms | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-azure-arm-restore-vms.md | There are many common scenarios in which you might need to restore VMs. **Network Security Group (NSG) on NIC/Subnet** | Azure VM backup supports Backup and Restore of NSG information at vnet, subnet, and NIC level. **Zone Pinned VMs** | If you back up an Azure VM that's pinned to a zone (with Azure Backup), then you can restore it in the same zone where it was pinned. [Learn more](../availability-zones/az-overview.md) **Restore VM in any availability set** | When restoring a VM from the portal, there's no option to choose an availability set. A restored VM doesn't have an availability set. If you use the restore disk option, then you can [specify an availability set](../virtual-machines/windows/tutorial-availability-sets.md) when you create a VM from the disk using the provided template or PowerShell.-**Restore special VMs such as SQL VMs** | If you're backing up a SQL VM using Azure VM backup and then use the restore VM option or create a VM after restoring disks, then the newly created VM must be registered with the SQL provider as mentioned [here](../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md?tabs=azure-cli%2cbash). This will convert the restored VM into a SQL VM. +**Restore special VMs such as SQL VMs** | If you're backing up a SQL VM using Azure VM backup and then use the restore VM option or create a VM after restoring disks, then the newly created VM must be registered with the SQL provider as mentioned [here](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm?tabs=azure-cli%2cbash). This will convert the restored VM into a SQL VM. ### Restore domain controller VMs |
| backup | Backup Azure Backup Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-azure-backup-sql.md | To back up a SQL Server database to Azure and to recover it from Azure: >[!NOTE] >DPM 2019 UR2 supports SQL Server Failover Cluster Instances (FCI) using Cluster Shared Volumes (CSV).<br><br>->Protection of [SQL Server failover cluster instance with Storage Spaces Direct on Azure](../azure-sql/virtual-machines/windows/failover-cluster-instance-storage-spaces-direct-manually-configure.md) and [SQL Server failover cluster instance with Azure shared disks](../azure-sql/virtual-machines/windows/failover-cluster-instance-azure-shared-disks-manually-configure.md) is supported with this feature. The DPM server must be deployed in the Azure Virtual Machine to protect SQL FCI instance deployed on Azure VMs. +>Protection of [SQL Server failover cluster instance with Storage Spaces Direct on Azure](/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-storage-spaces-direct-manually-configure) and [SQL Server failover cluster instance with Azure shared disks](/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-azure-shared-disks-manually-configure) is supported with this feature. The DPM server must be deployed in the Azure Virtual Machine to protect SQL FCI instance deployed on Azure VMs. ## Prerequisites and limitations |
| backup | Backup Azure Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-azure-sql-database.md | This solution leverages the SQL native APIs to take backups of your SQL database Before you start, verify the following requirements: -1. Make sure you have a SQL Server instance running in Azure. You can [quickly create a SQL Server instance](../azure-sql/virtual-machines/windows/sql-vm-create-portal-quickstart.md) in the marketplace. +1. Make sure you have a SQL Server instance running in Azure. You can [quickly create a SQL Server instance](/azure/azure-sql/virtual-machines/windows/sql-vm-create-portal-quickstart) in the marketplace. 2. Review the [feature considerations](sql-support-matrix.md#feature-considerations-and-limitations) and [scenario support](sql-support-matrix.md#scenario-support). 3. [Review common questions](faq-backup-sql-server.yml) about this scenario. |
| backup | Backup Sql Server Azure Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-sql-server-azure-troubleshoot.md | This file should be placed before you trigger the restore operation. ## Next steps -For more information about Azure Backup for SQL Server VMs (public preview), see [Azure Backup for SQL VMs](../azure-sql/virtual-machines/windows/backup-restore.md#azbackup). +For more information about Azure Backup for SQL Server VMs (public preview), see [Azure Backup for SQL VMs](/azure/azure-sql/virtual-machines/windows/backup-restore#azbackup). |
| cloud-services | Cloud Services Disaster Recovery Guidance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cloud-services/cloud-services-disaster-recovery-guidance.md | For more detail about how to create and deploy a cloud service application, see Depending on your application data sources, you may need to check the recovery procedures for your application data source. * For Azure Storage data sources, see [Azure Storage redundancy](../storage/common/storage-redundancy.md) to check on the options that are available based on the chosen redundancy model for your application.-* For SQL Database sources, read [Overview: Cloud business continuity and database disaster recovery with SQL Database](../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md) to check on the options that are available based on the chosen replication model for your application. +* For SQL Database sources, read [Overview: Cloud business continuity and database disaster recovery with SQL Database](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview) to check on the options that are available based on the chosen replication model for your application. ## Option 3: Wait for recovery |
| cognitive-services | Language Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Translator/language-support.md | +| 🆕Faroese | `fo` |✔||||| | Fijian | `fj` |✔|✔|✔||| | Filipino | `fil` |✔|✔|✔||| | Finnish | `fi` |✔|✔|✔|✔|✔|-| Somali | `so` |✔|||✔|| +| 🆕Somali | `so` |✔|||✔|| | Spanish | `es` |✔|✔|✔|✔|✔| | Swahili | `sw` |✔|✔|✔|✔|✔| | Swedish | `sv` |✔|✔|✔|✔|✔|-| Zulu | `zu` |✔||||| +| 🆕Zulu | `zu` |✔||||| > [!NOTE] > Language code `pt` will default to `pt-br`, Portuguese (Brazil). |
| cognitive-services | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/language-service/question-answering/overview.md | Question answering provides cloud-based Natural Language Processing (NLP) that a Question answering is commonly used to build conversational client applications, which include social media applications, chat bots, and speech-enabled desktop applications. Several new features have been added including enhanced relevance using a deep learning ranker, precise answers, and end-to-end region support. +Question answering comprises of two capabilities: ++* Custom question answering: Using this capability users can customize different aspects like edit question and answer pairs extracted from the content source, define synonyms and metadata, accept question suggestions etc. +* Prebuilt question answering: This capability allows users to get a response by querying a text passage without having the need to manage knowledgebases. + This documentation contains the following article types: * The [quickstarts](./quickstart/sdk.md) are step-by-step instructions that let you make calls to the service and get results in a short period of time. |
| cognitive-services | Document Format Guidelines | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/language-service/question-answering/reference/document-format-guidelines.md | Below is an example of an unstructured PDF document: > [!div class="mx-imgBorder"] >  - Currently this functionality is available only via document upload and only for PDF and DOC file formats. +> [!NOTE] +> QnA pairs are not extracted in the "Edit sources" tab for unstructured sources. > [!IMPORTANT] > Support for unstructured file/content is available only in question answering. When you import the knowledge base through these **TSV and XLS files**, the ques ## Next steps -* [Tutorial: Create an FAQ bot](../tutorials/bot-service.md) +* [Tutorial: Create an FAQ bot](../tutorials/bot-service.md) |
| communication-services | Create Communication Resource | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/communication-services/quickstarts/create-communication-resource.md | ms.devlang: azurecli Get started with Azure Communication Services by provisioning your first Communication Services resource. Communication Services resources can be provisioned through the [Azure portal](https://portal.azure.com) or with the .NET management SDK. The management SDK and the Azure portal allow you to create, configure, update and delete your resources and interface with [Azure Resource Manager](../../azure-resource-manager/management/overview.md), Azure's deployment and management service. All functionality available in the SDKs is available in the Azure portal. -> [!WARNING] -> While Communication Services is available in multiple geographies, in order to get a phone number the resource must have a data location set to 'US'. -> Also, it is not possible to create a resource group at the same time as a resource for Azure Communication Services. When creating a resource, a resource group that has been created already must be used. ++> [!WARNING] +> Note that it is not possible to create a resource group at the same time as a resource for Azure Communication Services. When creating a resource, a resource group that has been created already, must be used. + ::: zone pivot="platform-azp" [!INCLUDE [Azure portal](./includes/create-resource-azp.md)] |
| connectors | Connectors Create Api Sqlazure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/connectors/connectors-create-api-sqlazure.md | For example, you can use actions that get, insert, and delete data along with ru The SQL Server connector supports the following SQL editions: * [SQL Server](/sql/sql-server/sql-server-technical-documentation)-* [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) -* [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) +* [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) +* [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) If you're new to Azure Logic Apps, review the following documentation: If you're new to Azure Logic Apps, review the following documentation: * An Azure account and subscription. If you don't have a subscription, [sign up for a free Azure account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). -* [SQL Server database](/sql/relational-databases/databases/create-a-database), [Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md), or [SQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* [SQL Server database](/sql/relational-databases/databases/create-a-database), [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart), or [SQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). The SQL connector requires that your tables contain data so that SQL connector operations can return results when called. For example, if you use Azure SQL Database, you can use the included sample databases to try the SQL connector operations. After you provide this information, continue with these steps: ### Connect to Azure SQL Database or SQL Managed Instance -To access a SQL Managed Instance without using the on-premises data gateway or integration service environment, you have to [set up the public endpoint on the SQL Managed Instance](../azure-sql/managed-instance/public-endpoint-configure.md). The public endpoint uses port 3342, so make sure that you specify this port number when you create the connection from your logic app. +To access a SQL Managed Instance without using the on-premises data gateway or integration service environment, you have to [set up the public endpoint on the SQL Managed Instance](/azure/azure-sql/managed-instance/public-endpoint-configure). The public endpoint uses port 3342, so make sure that you specify this port number when you create the connection from your logic app. The first time that you add either a [SQL Server trigger](#add-sql-trigger) or [SQL Server action](#add-sql-action), and you haven't previously created a connection to your database, you're prompted to complete these steps: The first time that you add either a [SQL Server trigger](#add-sql-trigger) or [ |-|-| | **Service principal (Azure AD application)** | - Available only for the managed SQL Server connector. <br><br>- Requires an Azure AD application and service principal. For more information, see [Create an Azure AD application and service principal that can access resources using the Azure portal](../active-directory/develop/howto-create-service-principal-portal.md). | | **Logic Apps Managed Identity** | - Available only for the managed SQL Server connector and ISE SQL Server connector. <br><br>- Requires the following items: <br><br> A valid managed identity that's [enabled on your logic app resource](../logic-apps/create-managed-service-identity.md) and has access to your database. <br><br> **SQL DB Contributor** role access to the SQL Server resource <br><br> **Contributor** access to the resource group that includes the SQL Server resource. <br><br>For more information, see [SQL - Server-Level Roles](/sql/relational-databases/security/authentication-access/server-level-roles). |- | [**Azure AD Integrated**](../azure-sql/database/authentication-aad-overview.md) | - Available only for the managed SQL Server connector and ISE SQL Server connector. <br><br>- Requires a valid managed identity in Azure Active Directory (Azure AD) that's [enabled on your logic app resource](../logic-apps/create-managed-service-identity.md) and has access to your database. For more information, see these topics: <br><br>- [Azure SQL Security Overview - Authentication](../azure-sql/database/security-overview.md#authentication) <br>- [Authorize database access to Azure SQL - Authentication and authorization](../azure-sql/database/logins-create-manage.md#authentication-and-authorization) <br>- [Azure SQL - Azure AD Integrated authentication](../azure-sql/database/authentication-aad-overview.md) | - | [**SQL Server Authentication**](/sql/relational-databases/security/choose-an-authentication-mode#connecting-through-sql-server-authentication) | - Available only for the managed SQL Server connector and ISE SQL Server connector. <br><br>- Requires the following items: <br><br> A data gateway resource that's previously created in Azure for your connection, regardless whether your logic app is in multi-tenant Azure Logic Apps or an ISE. <br><br> A valid user name and strong password that are created and stored in your SQL Server database. For more information, see the following topics: <br><br>- [Azure SQL Security Overview - Authentication](../azure-sql/database/security-overview.md#authentication) <br>- [Authorize database access to Azure SQL - Authentication and authorization](../azure-sql/database/logins-create-manage.md#authentication-and-authorization) | + | [**Azure AD Integrated**](/azure/azure-sql/database/authentication-aad-overview) | - Available only for the managed SQL Server connector and ISE SQL Server connector. <br><br>- Requires a valid managed identity in Azure Active Directory (Azure AD) that's [enabled on your logic app resource](../logic-apps/create-managed-service-identity.md) and has access to your database. For more information, see these topics: <br><br>- [Azure SQL Security Overview - Authentication](/azure/azure-sql/database/security-overview#authentication) <br>- [Authorize database access to Azure SQL - Authentication and authorization](/azure/azure-sql/database/logins-create-manage#authentication-and-authorization) <br>- [Azure SQL - Azure AD Integrated authentication](/azure/azure-sql/database/authentication-aad-overview) | + | [**SQL Server Authentication**](/sql/relational-databases/security/choose-an-authentication-mode#connecting-through-sql-server-authentication) | - Available only for the managed SQL Server connector and ISE SQL Server connector. <br><br>- Requires the following items: <br><br> A data gateway resource that's previously created in Azure for your connection, regardless whether your logic app is in multi-tenant Azure Logic Apps or an ISE. <br><br> A valid user name and strong password that are created and stored in your SQL Server database. For more information, see the following topics: <br><br>- [Azure SQL Security Overview - Authentication](/azure/azure-sql/database/security-overview#authentication) <br>- [Authorize database access to Azure SQL - Authentication and authorization](/azure/azure-sql/database/logins-create-manage#authentication-and-authorization) | This connection and authentication information box looks similar to the following example, which selects **Azure AD Integrated**: Sometimes, you have to work with result sets so large that the connector doesn't > Some stored procedures might take longer than this limit to complete, causing a `504 Timeout` error. You can work around this problem > by using a SQL completion trigger, native SQL pass-through query, a state table, and server-side jobs. > - > For this task, you can use the [Azure Elastic Job Agent](../azure-sql/database/elastic-jobs-overview.md) - > for [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md). For + > For this task, you can use the [Azure Elastic Job Agent](/azure/azure-sql/database/elastic-jobs-overview) + > for [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview). For > [SQL Server on premises](/sql/sql-server/sql-server-technical-documentation) - > and [SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md), + > and [SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview), > you can use the [SQL Server Agent](/sql/ssms/agent/sql-server-agent). To learn more, see > [Handle long-running stored procedure timeouts in the SQL connector for Azure Logic Apps](../logic-apps/handle-long-running-stored-procedures-sql-connector.md). |
| container-instances | Container Instances Using Azure Container Registry | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/container-instances/container-instances-using-azure-container-registry.md | -* You can't pull images from [Azure Container Registry](../container-registry/container-registry-vnet.md) deployed into an Azure Virtual Network at this time. +* The [Azure Container Registry](../container-registry/container-registry-vnet.md) must have [Public Access set to 'All Networks'](../container-registry/container-registry-access-selected-networks.md). To use an Azure container registry with Public Access set to 'Select Networks' or 'None', visit [ACI's article for using Managed-Identity based authentication with ACR](/using-azure-container-registry-mi.md). ## Configure registry authentication |
| container-instances | Using Azure Container Registry Mi | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/container-instances/using-azure-container-registry-mi.md | -> [!IMPORTANT] -> Managed identity-authenticated container image pulls from ACR are not supported in Canada Central, South India, and West Central US at this time. --* Virtual Network injected container groups don't support managed identity authentication image pulls with ACR. +* Container groups running in Azure Virtual Networks don't support managed identity authentication image pulls with ACR. * Windows containers don't support managed identity-authenticated image pulls with ACR. -* Container groups don't support pulling images from an Azure Container Registry using [private DNS zones][private-dns-zones]. +* The Azure container registry must have [Public Access set to either 'Select networks' or 'None'](../container-registry/container-registry-access-selected-networks.md). To set the Azure container registry's Public Access to 'All networks', visit ACI's article on [how to authenticate with ACR with service principal based authentication](container-instances-using-azure-container-registry.md). ## Configure registry authentication az group delete --name myResourceGroup [allow-access-trusted-services]: ../container-registry/allow-access-trusted-services.md <!-- Links External -->-[cloud-shell-bash]: https://shell.azure.com/bash +[cloud-shell-bash]: https://shell.azure.com/bash |
| cosmos-db | Performance Tips Java Sdk V4 Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/sql/performance-tips-java-sdk-v4-sql.md | So if you're asking "How can I improve my database performance?" consider the fo ## Networking * **Connection mode: Use Direct mode**-<a id="direct-connection"></a> - + Java SDK default connection mode is direct. You can configure the connection mode in the client builder using the *directMode()* or *gatewayMode()* methods, as shown below. To configure either mode with default settings, call either method without arguments. Otherwise, pass a configuration settings class instance as the argument (*DirectConnectionConfig* for *directMode()*, *GatewayConnectionConfig* for *gatewayMode()*.). To learn more about different connectivity options, see the [connectivity modes](sql-sdk-connection-modes.md) article.- -### <a id="override-default-consistency-javav4"></a> Java V4 SDK # [Async](#tab/api-async) Java SDK V4 (Maven com.azure::azure-cosmos) Sync API The *directMode()* method has an additional override, for the following reason. Control plane operations such as database and container CRUD *always* utilize Gateway mode; when the user has configured Direct mode for data plane operations, control plane operations use default Gateway mode settings. This suits most users. However, users who want Direct mode for data plane operations as well as tunability of control plane Gateway mode parameters can use the following *directMode()* override: -### <a id="override-default-consistency-javav4"></a> Java V4 SDK - # [Async](#tab/api-async) Java SDK V4 (Maven com.azure::azure-cosmos) Async API Please see the [Windows](../../virtual-network/create-vm-accelerated-networking- The Azure Cosmos DB SDKs are constantly being improved to provide the best performance. See the [Azure Cosmos DB SDK](sql-api-sdk-async-java.md) pages to determine the most recent SDK and review improvements. -* **Use a singleton Azure Cosmos DB client for the lifetime of your application** +* <a id="max-connection"></a> **Use a singleton Azure Cosmos DB client for the lifetime of your application** Each Azure Cosmos DB client instance is thread-safe and performs efficient connection management and address caching. To allow efficient connection management and better performance by the Azure Cosmos DB client, it is recommended to use a single instance of the Azure Cosmos DB client per AppDomain for the lifetime of the application. -<a id="max-connection"></a> --* **Use the lowest consistency level required for your application** +* <a id="override-default-consistency-javav4"></a> **Use the lowest consistency level required for your application** When you create a *CosmosClient*, the default consistency used if not explicitly set is *Session*. If *Session* consistency is not required by your application logic set the *Consistency* to *Eventual*. Note: it is recommended to use at least *Session* consistency in applications employing the Azure Cosmos DB Change Feed processor. Some users may also be unfamiliar with [Project Reactor](https://projectreactor. The following code snippets show how to initialize your Azure Cosmos DB client for Async API or Sync API operation, respectively: -### <a id="override-default-consistency-javav4"></a> Java V4 SDK - # [Async](#tab/api-async) Java SDK V4 (Maven com.azure::azure-cosmos) Async API By default, Direct mode Cosmos DB requests are made over TCP when using Azure Co In Azure Cosmos DB Java SDK v4, Direct mode is the best choice to improve database performance with most workloads. * ***Overview of Direct mode***+<a id="direct-connection"></a> :::image type="content" source="./media/performance-tips-async-java/rntbdtransportclient.png" alt-text="Illustration of the Direct mode architecture" border="false"::: A good rule of thumb is not to exceed >50% CPU utilization on any given server, The asynchronous functionality of Azure Cosmos DB Java SDK is based on [netty](https://netty.io/) non-blocking IO. The SDK uses a fixed number of IO netty event loop threads (as many CPU cores your machine has) for executing IO operations. The Flux returned by API emits the result on one of the shared IO event loop netty threads. So it is important to not block the shared IO event loop netty threads. Doing CPU intensive work or blocking operation on the IO event loop netty thread may cause deadlock or significantly reduce SDK throughput. For example the following code executes a cpu intensive work on the event loop IO netty thread:-### <a id="java4-noscheduler"></a>Java SDK V4 (Maven com.azure::azure-cosmos) Async API +<a id="java4-noscheduler"></a> [!code-java[](~/azure-cosmos-java-sql-api-samples/src/main/java/com/azure/cosmos/examples/documentationsnippets/async/SampleDocumentationSnippetsAsync.java?name=PerformanceNeedsSchedulerAsync)] After result is received if you want to do CPU intensive work on the result you should avoid doing so on event loop IO netty thread. You can instead provide your own Scheduler to provide your own thread for running your work, as shown below (requires `import reactor.core.scheduler.Schedulers`). -### <a id="java4-scheduler"></a>Java SDK V4 (Maven com.azure::azure-cosmos) Async API +<a id="java4-scheduler"></a> [!code-java[](~/azure-cosmos-java-sql-api-samples/src/main/java/com/azure/cosmos/examples/documentationsnippets/async/SampleDocumentationSnippetsAsync.java?name=PerformanceAddSchedulerAsync)] The latter is supported but will add latency to your application; the SDK must p For query operations see the [performance tips for queries](performance-tips-query-sdk.md?pivots=programming-language-java). -## Indexing policy +## <a id="java4-indexing"></a><a id="indexing-policy"></a> Indexing policy * **Exclude unused paths from indexing for faster writes** Azure Cosmos DBΓÇÖs indexing policy allows you to specify which document paths to include or exclude from indexing by leveraging Indexing Paths (setIncludedPaths and setExcludedPaths). The use of indexing paths can offer improved write performance and lower index storage for scenarios in which the query patterns are known beforehand, as indexing costs are directly correlated to the number of unique paths indexed. For example, the following code shows how to include and exclude entire sections of the documents (also known as a subtree) from indexing using the "*" wildcard. -### <a id="java4-indexing"></a>Java SDK V4 (Maven com.azure::azure-cosmos) - [!code-java[](~/azure-cosmos-java-sql-api-samples/src/main/java/com/azure/cosmos/examples/documentationsnippets/async/SampleDocumentationSnippetsAsync.java?name=MigrateIndexingAsync)] For more information, see [Azure Cosmos DB indexing policies](../index-policy.md). |
| cosmos-db | Sql Api Sdk Bulk Executor Java | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/sql/sql-api-sdk-bulk-executor-java.md | +> [!IMPORTANT] +> This is *not* the latest Java Bulk Executor for Azure Cosmos DB! Consider using [Azure Cosmos DB Java SDK v4](bulk-executor-java.md) for performing bulk operations. To upgrade, follow the instructions in the [Migrate to Azure Cosmos DB Java SDK v4](migrate-java-v4-sdk.md) guide and the [Reactor vs RxJava](https://github.com/Azure-Samples/azure-cosmos-java-sql-api-samples/blob/main/reactor-rxjava-guide.md) guide. +> ++> [!IMPORTANT] +> On February 29, 2024 the Azure Cosmos DB Sync Java SDK v2.x +> will be retired; the SDK and all applications using the SDK including Bulk Executor +> **will continue to function**; Azure Cosmos DB will simply cease +> to provide further maintenance and support for this SDK. +> We recommend following the instructions above to migrate to +> Azure Cosmos DB Java SDK v4. +> + | | Link/notes | ||| |**Description**|The bulk executor library allows client applications to perform bulk operations in Azure Cosmos DB accounts. bulk executor library provides BulkImport, and BulkUpdate namespaces. The BulkImport module can bulk ingest documents in an optimized way such that the throughput provisioned for a collection is consumed to its maximum extent. The BulkUpdate module can bulk update existing data in Azure Cosmos containers as patches.| |
| cosmos-db | Tutorial Springboot Azure Kubernetes Service | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/sql/tutorial-springboot-azure-kubernetes-service.md | If you intend to run the application on Azure Kubernetes Service, skip this sect 1. Log into Azure Container Registry. - ```bash + ```azurecli az acr login -n cosmosdbspringbootregistry ``` 1. Push image to Azure Container Registry and list it. - ```bash + ```azurecli docker push cosmosdbspringbootregistry.azurecr.io/spring-cosmos-app:v1 az acr repository list --name cosmosdbspringbootregistry --output table |
| cost-management-billing | Tutorial Export Acm Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/costs/tutorial-export-acm-data.md | Select an export to view its run history. :::image type="content" source="./media/tutorial-export-acm-data/single-export-run-history.png" alt-text="Screenshot shows the run history of an export."::: +### Export runs twice a day for the first five days of the month ++If you've created a daily export, you'll have two runs per day for the first five days of each month. One run executes and creates a file with the current monthΓÇÖs cost data. It's the run that's available for you to see in the run history. A second run also executes to create a file with all the costs from the prior month. The second run isn't currently visible in the run history. Azure executes the second run to ensure that your latest file for the past month contains all charges exactly as seen on your invoice. It runs because there are cases where latent usage and charges are included in the invoice up to 72 hours after the calendar month has closed. To learn more about Cost Management usage data updates, see [Cost and usage data updates and retention](understand-cost-mgt-data.md#cost-and-usage-data-updates-and-retention). ++ ## Access exported data from other systems One of the purposes of exporting your Cost Management data is to access the data from external systems. You might use a dashboard system or other financial system. Such systems vary widely so showing an example wouldn't be practical. However, you can get started with accessing your data from your applications at [Introduction to Azure Storage](../../storage/common/storage-introduction.md). |
| cost-management-billing | Assign Roles Azure Service Principals | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/assign-roles-azure-service-principals.md | Now you can use the SPN to automatically access EA APIs. The SPN has the Subscri You must identify and use the Enterprise application object ID where you granted the EA role. If you use the Object ID from some other application, API calls will fail. Verify that youΓÇÖre using the correct Enterprise application object ID. +If you receive the following error when making your API call, then you may be incorrectly using the SPN object ID value located in App Registrations. To resolve this error, ensure you're using the SPN object ID from Enterprise Applications, not App Registrations. ++`The provided principal Tenant Id = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and principal Object Id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are not valid` ++ ## Next steps Learn more about [Azure EA portal administration](ea-portal-administration.md). |
| cost-management-billing | Mca Request Billing Ownership | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/mca-request-billing-ownership.md | Title: Transfer Azure subscription billing ownership for a Microsoft Customer Agreement -description: Learn how to transfer billing ownership of Azure subscriptions. + Title: Transfer Azure product billing ownership to a Microsoft Customer Agreement +description: Learn how to transfer billing ownership of Azure subscriptions and reservations. -+ tags: billing Previously updated : 03/14/2022 Last updated : 04/21/2022 -# Transfer Azure subscription billing ownership for a Microsoft Customer Agreement +# Transfer Azure product billing ownership for a Microsoft Customer Agreement -Transfer billing ownership for your Azure subscriptions when: +Transfer billing ownership for your Azure products (subscriptions and reservations) to a Microsoft Customer Agreement when: -- You want to move billing responsibilities for the subscriptions to a different billing owner.-- You're transferring your Azure subscriptions from one licensing agreement to another. For example, from an Enterprise Agreement or a Microsoft Online Subscription Agreement (MOSA) to a Microsoft Customer Agreement.+- You want to move billing responsibilities for a product to a different billing owner. +- You want to transfer your Azure products from one licensing agreement to another. For example, from an Enterprise Agreement or a Microsoft Online Subscription Agreement (MOSA) to a Microsoft Customer Agreement. +- You want to transfer reservation ownership. [Check if you have access to a Microsoft Customer Agreement](#check-for-access). -The transition moves only the billing responsibility for your Azure subscriptions ΓÇô the Azure resources tied to your subscriptions don't move, so the transition won't interrupt your Azure services. +The transition moves only the billing responsibility for your Azure products ΓÇô the Azure resources tied to your products don't move, so the transition won't interrupt your Azure services. -This process contains the following tasks, which weΓÇÖll guide you through step by step: +This process contains the following primary tasks, which weΓÇÖll guide you through step by step: 1. Request billing ownership-2. Review/approve transfer request +2. Review and approve the transfer request 3. Check transfer request status +There are three options to transfer products: ++- Transfer only subscriptions +- Transfer only reservations +- Transfer both subscriptions and reservations + When you send or accept transfer request, you agree to terms and conditions. For more information, see [Transfer terms and conditions](subscription-transfer.md#transfer-terms-and-conditions). -Before you begin, make sure that the person you're requesting billing ownership from has one of the following roles: +Before you transfer billing products, read [Supplemental information about transfers](subscription-transfer.md#supplemental-information-about-transfers). -- For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks).-- For an Enterprise Agreement, the person must be an Account Owner.-- For a Microsoft Online Subscription Agreement, the person must be an Account Administrator.+## Prerequisites ++Before you begin, make sure that the people involved in the product transfer have the required permissions. > [!NOTE] > To perform a transfer, the destination account must be a paid account with a valid form of payment. For example, if the destination is an Azure free account, you can upgrade it to a pay-as-you-go Azure plan under a Microsoft Customer Agreement. Then you can make the transfer. -When you're ready, use the following instructions. You can also go along with the following video that outlines each step of the process. +You can also go along with the following video that outlines each step of the process for subscription transfer. However, it doesn't cover reservation transfer. >[!VIDEO https://www.youtube.com/embed/gfiUI2YLsgc] -## Create the transfer request +### Required permission for the transfer requestor ++For both subscriptions and reservations, the product transfer requestor must have one of the following permissions: ++For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [Billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). ++### Required permission for the subscription transfer recipient ++The subscription product owner (transfer request recipient) must have one of the following permissions: ++- For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [Billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). +- For an Enterprise Agreement, the person must be an account owner or EA administrator. +- For a Microsoft Online Subscription Agreement, the person must be an Account Administrator. ++### Required permission for the reservation transfer recipient ++The reservation product owner (transfer request recipient) must have one of the following permissions: ++- For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [Billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). +- For an Enterprise Agreement, the person must be an EA administrator. +- For a Microsoft Online Subscription Agreement, the person must be an Account Administrator. ++## Create the product transfer request ++The person creating the transfer request uses the following procedure to create the transfer request. The transfer request essentially asks the owner of the product to allow subscriptions and or reservations associated with a subscription to be transferred. ++When the request is created, an email is sent to the target recipient. The following procedure has you navigate to **Transfer requests** by selecting a **Billing scope** > **Billing account** > **Billing profile** > **Invoice sections** to **Add a new request**. If you navigate to **Add a new request** from selecting a billing profile, you'll have to select a billing profile and then select an invoice section. 1. Sign in to the [Azure portal](https://portal.azure.com) as an invoice section owner or contributor for a billing account for Microsoft Customer Agreement. Use the same credentials that you used to accept your Microsoft Customer Agreement. 1. Search for **Cost Management + Billing**. :::image type="content" source="./media/mca-request-billing-ownership/billing-search-cost-management-billing.png" alt-text="Screenshot that shows Azure portal search for Cost Management + Billing." lightbox="./media/mca-request-billing-ownership/billing-search-cost-management-billing.png" :::-1. On the billing scopes page, select **Billing scopes** and then select the billing account, which would be used to pay for Azure usage in your subscriptions. Select the billing account labeled **Microsoft Customer Agreement**. +1. On the billing scopes page, select **Billing scopes** and then select the billing account, which would be used to pay for Azure usage in your products. Select the billing account labeled **Microsoft Customer Agreement**. :::image type="content" source="./media/mca-request-billing-ownership/billing-scopes.png" alt-text="Screenshot that shows search in portal for Cost Management + Billing." lightbox="./media/mca-request-billing-ownership/billing-scopes.png" ::: The Azure portal remembers the last billing scope that you access and displays the scope the next time you come to Cost Management + Billing page. You won't see the billing scopes page if you have visited Cost Management + Billing earlier. If so, check that you are in the [right scope](#check-for-access). If not, [switch the scope](view-all-accounts.md#switch-billing-scope-in-the-azure-portal) to select the billing account for a Microsoft Customer Agreement.-1. Select **Billing profiles** from the left-hand side and then select a **Billing profile** from the list. Once you take over the ownership of the subscriptions, their usage will be billed to this billing profile. +1. Select **Billing profiles** from the left-hand side and then select a **Billing profile** from the list. Once you take over the ownership of the products, their usage will be billed to this billing profile. :::image type="content" source="./media/mca-request-billing-ownership/billing-profile.png" alt-text="Screenshot that shows selecting billing profiles." lightbox="./media/mca-request-billing-ownership/billing-profile.png" ::: - >[!NOTE] - > If you don't see Billing profiles, you are not in the right billing scope. You need to select a billing account for a Microsoft Customer Agreement and then select Billing profiles. To learn how to change scopes, see [Switch billing scopes in the Azure portal](view-all-accounts.md#switch-billing-scope-in-the-azure-portal). -1. Select **Invoice sections** from the left-hand side and then select an invoice section from the list. Each billing profile contains on invoice section by default. Select the invoice where you want to move your Azure subscription billing - that's where the Azure subscription consumption is transferred to. + *If you don't see Billing profiles, you aren't in the right billing scope.* You need to select a billing account for a Microsoft Customer Agreement and then select Billing profiles. To learn how to change scopes, see [Switch billing scopes in the Azure portal](view-all-accounts.md#switch-billing-scope-in-the-azure-portal). +1. Select **Invoice sections** from the left-hand side and then select an invoice section from the list. Each billing profile contains on invoice section by default. Select the invoice where you want to move your Azure product billing - that's where the Azure product consumption is transferred to. :::image type="content" source="./media/mca-request-billing-ownership/invoice-section.png" alt-text="Screenshot that shows selecting invoice sections." lightbox="./media/mca-request-billing-ownership/invoice-section.png" ::: -1. Select **Transfer requests** from the lower-left side and then select **Add a new request**. Enter the email address of the user you're requesting billing ownership from. The user must have an account administrator role for the old subscriptions. +1. Select **Transfer requests** from the lower-left side and then select **Add a new request**. Enter the email address of the user you're requesting billing ownership from. The user must have an account administrator role for the old products. :::image type="content" source="./media/mca-request-billing-ownership/transfer-request-add-email.png" alt-text="Screenshot that shows selecting transfer requests." lightbox="./media/mca-request-billing-ownership/transfer-request-add-email.png" ::: 1. Select **Send transfer request**. ## Review and approve transfer request +The recipient of the transfer request uses the following procedure to review and approve the transfer request. They can choose to: ++- Transfer one or more subscriptions only +- Transfer one or more reservations only +- Transfer both subscriptions and reservations ++ 1. The user gets an email with instructions to review your transfer request. Select **Review the request** to open it in the Azure portal. - :::image type="content" source="./media/mca-request-billing-ownership/mca-review-transfer-request-email.png" alt-text="Screenshot that shows review transfer request email." lightbox="./media/mca-request-billing-ownership/mca-review-transfer-request-email.png" ::: -1. In the Azure portal, the user selects the billing account that they want to transfer Azure products from. Then they select eligible subscriptions on the **Subscriptions** tab. + :::image type="content" source="./media/mca-request-billing-ownership/mca-review-transfer-request-email.png" alt-text="Screenshot that shows review transfer request email." lightbox="./media/mca-request-billing-ownership/mca-review-transfer-request-email.png" ::: + If the transfer recipientΓÇÖs user account doesnΓÇÖt have email enabled, the person that created the request can manually give the target recipient a link to accept the transfer request after the request is created. The person that created the request can navigate to Transfer status page, copy it, and then manually give it to the recipient. + :::image type="content" source="./media/mca-request-billing-ownership/transfer-status-pending-link.png" alt-text="Screenshot showing the Transfer status where you can copy the transfer link sent to the recipient." lightbox="./media/mca-request-billing-ownership/transfer-status-pending-link.png" ::: +1. In the Azure portal, the user selects the billing account that they want to transfer Azure products from. Then they select eligible subscriptions on the **Subscriptions** tab. If the owner doesnΓÇÖt want to transfer subscriptions and instead wants to transfer reservations only, make sure that no subscriptions are selected. :::image type="content" source="./media/mca-request-billing-ownership/review-transfer-request-subscriptions-select.png" alt-text="Screenshot showing the Subscriptions tab." lightbox="./media/mca-request-billing-ownership/review-transfer-request-subscriptions-select.png" ::: - >[!NOTE] - > Disabled subscriptions can't be transferred. -1. If there are reservations available to transfer, select the **Reservations** tab. Then select them. + *Disabled subscriptions can't be transferred.* +1. If there are reservations available to transfer, select the **Reservations** tab and then select them. If reservations wonΓÇÖt be transferred, make sure that no reservations are selected. +If reservations are transferred, they're applied to the scope thatΓÇÖs set in the request. If you want to change the scope of the reservation after itΓÇÖs transferred, see [Change the reservation scope](../reservations/manage-reserved-vm-instance.md#change-the-reservation-scope). :::image type="content" source="./media/mca-request-billing-ownership/review-transfer-request-reservations-select.png" alt-text="Screenshot showing the Reservations tab." lightbox="./media/mca-request-billing-ownership/review-transfer-request-reservations-select.png" :::-1. Select the **Review request** tab and verify the information about the subscriptions and reservations to transfer. If there is Warnings or Failed status messages, see the following information. When you're ready to continue, select **Transfer**. +1. Select the **Review request** tab and verify the information about the products to transfer. If there are Warnings or Failed status messages, see the following information. When you're ready to continue, select **Transfer**. :::image type="content" source="./media/mca-request-billing-ownership/review-transfer-request-complete.png" alt-text="Screenshot showing the Review request tab where you review your transfer selections." lightbox="./media/mca-request-billing-ownership/review-transfer-request-complete.png" ::: 1. You'll briefly see a `Transfer is in progress` message. When the transfer is completed successfully, you'll see the Transfer details page with the `Transfer completed successfully` message. :::image type="content" source="./media/mca-request-billing-ownership/transfer-completed-successfully.png" alt-text="Screenshot showing the Transfer completed successfully page." lightbox="./media/mca-request-billing-ownership/transfer-completed-successfully.png" ::: The following procedure has you navigate to **Transfer requests** by selecting a On the Review request tab, the following status messages might be displayed. * **Ready to transfer** - Validation for this Azure product has passed and can be transferred.-* **Warnings** - There's a warning for the selected Azure product. While the product can still be transferred, doing so will have some consequence that the user should be aware of in case they want to take mitigating actions. For example, the Azure subscription being transferred is benefitting from an RI. After transfer, the subscription will no longer receive that benefit. To maximize savings, ensure that the RI is associated to another subscription that can use its benefits. Instead, the user can also choose to go back to the selection page and unselect this Azure subscription. Select **Check details** for more information. +* **Warnings** - There's a warning for the selected Azure product. While the product can still be transferred, doing so will have some consequence that the user should be aware of in case they want to take mitigating actions. For example, the Azure subscription being transferred is benefitting from a reservation. After transfer, the subscription will no longer receive that benefit. To maximize savings, ensure that the reservation is associated to another subscription that can use its benefits. Instead, the user can also choose to go back to the selection page and unselect this Azure subscription. Select **Check details** for more information. * **Failed** - The selected Azure product can't be transferred because of an error. User will need to go back to the selection page and unselect this product to transfer the other selected Azure products. ## Check the transfer request status The Transfer requests page displays the following information: |Expiration date|The date when the request expires| |Status|The status of transfer request| -The transfer request can have one of the following statuses: +The transfer request can have one of the following states: |Status|Definition| ||| |In progress|The user hasn't accepted the transfer request.|-|Processing|The user approved the transfer request. Billing for subscriptions that the user selected is getting transferred to your invoice section.| -|Completed| The billing for subscriptions that the user selected is transferred to your invoice section.| -|Finished with errors|The request completed but billing for some subscriptions that the user selected couldn't be transferred.| +|Processing|The user approved the transfer request. Billing for the products that the user selected is getting transferred to your invoice section.| +|Completed| The billing for products that the user selected is transferred to your invoice section.| +|Finished with errors|The request completed but billing for some products that the user selected couldn't be transferred.| |Expired|The user didn't accept the request on time and it expired.| |Canceled|Someone with access to the transfer request canceled the request.| |Declined|The user declined the transfer request.| As the user that approved the transfer: ## Supported subscription types -You can request billing ownership of the subscription types listed below. +You can request billing ownership of products for the subscription types listed below. - [Action pack](https://azure.microsoft.com/offers/ms-azr-0025p/)<sup>1</sup> - [Azure in Open Licensing](https://azure.microsoft.com/offers/ms-azr-0111p/)<sup>1</sup> You can request billing ownership of the subscription types listed below. <sup>1</sup> Any credit available on the subscription won't be available in the new account after the transfer. -<sup>2</sup> Only supported for subscriptions in accounts that are created during sign-up on the Azure website. --## Additional information --The following sections provide additional information about transferring subscriptions. --### Cancel a prior support plan --If you have an Azure support plan and you transfer all of your Azure subscriptions to a new agreement, then you must cancel the support plan because it doesn't transfer with the subscriptions. For example, when you transfer a Microsoft Online Subscription Agreement (an Azure subscription purchased on the web) to the Microsoft Customer Agreement. To cancel your support plan: --Use your account administrator credentials for your old account if the credentials differ from the ones used to access your new Microsoft Customer Agreement account. --1. Sign in to the Azure portal at https://portal.azure.com. -1. Navigate to **Cost Management + Billing**. -1. Select **Billing Scopes** in the left pane. -1. Select the billing account associated with your Microsoft support plan. - - For a Microsoft Customer Agreement: - - Select **Recurring charges** in the left pane. - - In the right pane, to the right of the support plan line item, select the ellipsis (**...**) and then select **Turn off auto-renewal**. - - For a Microsoft Online Subscription Agreement (MOSA): - - Select **Subscriptions** in the left pane. - - Select the support plan subscription in the right pane and then select **Cancel**. --### Access your historical invoices --You may want to access your invoices for your old Microsoft Online Subscription Agreement account (an Azure subscription purchased on the web) after you transfer billing ownership to your new Microsoft Customer Agreement account. To do so, use the following steps: --Use your account administrator credentials for your old account if the credentials differ from the ones used to access your new Microsoft Customer Agreement account. --1. Sign in to the Azure portal at https://portal.azure.com/. -1. Navigate to **Cost Management + Billing**. -1. Select **Billing Scopes** in the left pane. -1. Select the billing account associated with your Microsoft Online Subscription Agreement account. -1. Select **Invoices** in the left pane to access your historical invoices. --### No service downtime --Azure services in the subscription keep running without any interruption. We only transition the billing relationship for the Azure subscriptions that the user selects to transfer. --### Disabled subscriptions --Disabled subscriptions can't be transferred. Subscriptions must be in active state to transfer their billing ownership. --### Azure resources transfer --All resources from the subscriptions like VMs, disks, and websites transfer. --### Azure Marketplace products transfer --Azure Marketplace products transfer along with their respective subscriptions. --### Azure Reservations transfer --If you're transferring Enterprise Agreement (EA) subscriptions or Microsoft Customer Agreements, Azure Reservations automatically move with the subscriptions. --### Access to Azure services --Access for existing users, groups, or service principals that was assigned using [Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) isn't affected during the transition. --### Charges for transferred subscription --The original billing owner of the subscriptions is responsible for any charges that were reported up to the point that the transfer is completed. Your invoice section is responsible for charges reported from the time of transfer onwards. There may be some charges that took place before transfer but was reported afterwards. These charges show up on your invoice section. --### Cancel a transfer request --You can cancel the transfer request until the request is approved or declined. To cancel the transfer request, go to the [transfer details page](#check-the-transfer-request-status) and select cancel from the bottom of the page. --### Software as a Service (SaaS) transfer --SaaS products don't transfer with the subscriptions. Ask the user to [Contact Azure support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade) to transfer billing ownership of SaaS products. Along with the billing ownership, the user can also transfer resource ownership. Resource ownership lets you conduct management operations like deleting and viewing the details of the product. The user must be a resource owner on the SaaS product to transfer resource ownership. +<sup>2</sup> Only supported for products in accounts that are created during sign-up on the Azure website. ## Check for access [!INCLUDE [billing-check-mca](../../../includes/billing-check-mca.md)] If you need help, [contact support](https://portal.azure.com/?#blade/Microsoft_A ## Next steps -- The billing ownership of the Azure subscriptions is transferred to your invoice section. Keep track of the charges for these subscriptions in the [Azure portal](https://portal.azure.com).-- Give others permissions to view and manage billing for these subscriptions. For more information, see [Invoice section roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks).+- The billing ownership of the Azure products is transferred to your invoice section. Keep track of the charges for these subscriptions in the [Azure portal](https://portal.azure.com). +- Give others permissions to view and manage billing for transferred products. For more information, see [Invoice section roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). |
| cost-management-billing | Mpa Request Ownership | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/mpa-request-ownership.md | Title: Get billing ownership of Azure subscriptions for Microsoft Partner Agreement (MPA) -description: Learn how to request billing ownership of Azure subscriptions from other users for Microsoft Partner Agreement (MPA). + Title: Transfer Azure product billing ownership to your Microsoft Partner Agreement (MPA) +description: Learn how to request billing ownership of Azure billing products from other users for a Microsoft Partner Agreement (MPA). tags: billing Previously updated : 04/08/2022 Last updated : 04/22/2022 -# Get billing ownership of Azure subscriptions to your MPA account +# Transfer Azure product billing ownership to your Microsoft Partner Agreement (MPA) -An Azure Expert MSP can request to transfer their customer's Enterprise subscriptions and reservations to the Microsoft Partner Agreement (MPA) that they manage. Supported billing ownership transfer options for subscriptions and reservations include: +An Azure Expert MSP can request to transfer their customer's Enterprise subscriptions and reservations to the Microsoft Partner Agreement (MPA) that they manage. -- A direct Enterprise Agreement transfer to MPA-- An enterprise Microsoft Customer Agreement transfer to MPA+Supported product (subscriptions and reservations) billing ownership transfer options include: ++- A direct Enterprise Agreement transfer to an Azure plan under the MPA +- An enterprise Microsoft Customer Agreement transfer to an Azure plan under the MPA > [!NOTE]-> Indirect Enterprise Agreement transfer to a Microsoft Customer Agreement isn't supported. +> Indirect Enterprise Agreement transfers to an Azure plan under an MPA aren't supported. This feature is available only for CSP Direct Bill Partners certified as [Azure Expert MSP](https://partner.microsoft.com/membership/azure-expert-msp). It's subject to Microsoft governance and policies and might require review and approval for certain customers. -To request the billing ownership, you must have **Global Admin** or **Admin Agents** role. To learn more, see [Partner Center - Assign users roles and permissions](/partner-center/permissions-overview). - This article applies to billing accounts for Microsoft Partner Agreements. These accounts are created for Cloud Solution Providers (CSPs) to manage billing for their customers in the new commerce experience. The new experience is only available for partners, who have at least one customer that has accepted a Microsoft Customer Agreement (MCA) and has an Azure Plan. [Check if you have access to a Microsoft Partner Agreement](#check-access-to-a-microsoft-partner-agreement). -When you send or accept transfer request, you agree to terms and conditions. For more information, see [Transfer terms and conditions](subscription-transfer.md#transfer-terms-and-conditions). +When you send or accept a transfer request, you agree to terms and conditions. For more information, see [Transfer terms and conditions](subscription-transfer.md#transfer-terms-and-conditions). ++There are three options to transfer products: ++- Transfer only subscriptions +- Transfer only reservations +- Transfer both subscriptions and reservations ## Prerequisites -1. Establish [reseller relationship](/partner-center/request-a-relationship-with-a-customer) with the customer. Check [CSP Regional Authorization Overview](/partner-center/regional-authorization-overview) to ensure both customer and Partner tenant are within the same authorized regions. -1. [Confirm customer has accepted the Microsoft Customer Agreement](/partner-center/confirm-customer-agreement). +1. Establish [reseller relationship](/partner-center/request-a-relationship-with-a-customer) with the customer. + 1. Make sure that both the customer and Partner tenants are within the same authorized region. Check [CSP Regional Authorization Overview](/partner-center/regional-authorization-overview). + 1. [Confirm that the customer has accepted the Microsoft Customer Agreement](/partner-center/confirm-customer-agreement). 1. Set up an [Azure plan](/partner-center/purchase-azure-plan) for the customer. If the customer is purchasing through multiple resellers, you need to set up an Azure plan for each combination of a customer and a reseller. +Before you begin, make sure that the people involved in the product transfer have the required permissions. ++### Required permission for the transfer requestor ++To request the billing ownership, you must have **Global Admin** or **Admin Agents** role. To learn more, see [Partner Center - Assign users roles and permissions](/partner-center/permissions-overview). ++### Required permission for the subscription transfer recipient ++The subscription product owner (transfer request recipient) must have one of the following permissions: ++- For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [Billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). +- For an Enterprise Agreement, the person must be an account owner or EA administrator. ++### Required permission for the reservation transfer recipient ++The reservation product owner (transfer request recipient) must have one of the following permissions: ++- For a Microsoft Customer Agreement, the person must have an owner or contributor role for the billing account or for the relevant billing profile or invoice section. For more information, see [Billing roles and tasks](understand-mca-roles.md#invoice-section-roles-and-tasks). +- For an Enterprise Agreement, the person must be an EA administrator. + ## Request billing ownership 1. Sign in to the [Azure portal](https://portal.azure.com) using CSP Admin Agent credentials in the CSP tenant. When you send or accept transfer request, you agree to terms and conditions. For [](./media/mpa-request-ownership/mpa-select-customers.png#lightbox) 1. Select **Transfer requests** from the lower-left side and then select **Add a new request**. [](./media/mpa-request-ownership/mpa-select-transfer-requests.png#lightbox)-1. Enter the email address of the user in the customer organization who will accept the transfer request. The user must be an account owner on an Enterprise Agreement. Select **Send transfer request**. +1. Enter the email address of the user in the customer organization who will accept the transfer request. Select **Send transfer request**. [](./media/mpa-request-ownership/mpa-send-transfer-requests.png#lightbox)-1. The user gets an email with instructions to review your transfer request. -  -1. To approve the transfer request, the user selects the link in the email and follows the instructions. - [](./media/mpa-request-ownership/review-transfer-requests.png#lightbox) - User can select the billing account that they want to transfer Azure products from. Once selected, eligible products that can be transferred are shown. **Note:** Disabled subscriptions can't be transferred and will show up in the "Non-transferrable Azure Products" list if applicable. Once the Azure products to be transferred are selected, select **Validate**. -1. The **Transfer Validation Result** area will show the impact of the Azure products that are going to be transferred. Here are the possible states: - * **Passed** - Validation for this Azure product has passed and can be transferred. - * **Warning** - There's a warning for the selected Azure product. While the product can still be transferred, doing so will have some impact that the user should be aware of in case they want to take mitigating actions. For example, the Azure subscription being transferred is benefitting from an RI. After transfer, the subscription will no longer receive that benefit. To maximize savings, ensure that the RI is associated with another subscription that can use its benefits. Instead, the user can also choose to go back to the selection page and unselect this Azure subscription. - * **Failed** - The selected Azure product can't be transferred because of an error. The user will need to go back to the selection page and unselect this product to transfer the other selected Azure products. -  +++## Review and approve transfer request ++The recipient of the transfer request uses the following procedure to review and approve the transfer request. They can choose to: ++- Transfer one or more subscriptions only +- Transfer one or more reservations only +- Transfer both subscriptions and reservations ++1. The user gets an email with instructions to review your transfer request. Select **Review the request** to open it in the Azure portal. + :::image type="content" source="./media/mpa-request-ownership/mpa-review-transfer-request-email.png" alt-text="Screenshot that shows review transfer request email." lightbox="./media/mpa-request-ownership/mpa-review-transfer-request-email.png" ::: + If the transfer recipientΓÇÖs user account doesnΓÇÖt have email enabled, the person that created the request can manually give the target recipient a link to accept the transfer request after the request is created. The person that created the request can navigate to Transfer status page, copy it, and then manually give it to the recipient. + :::image type="content" source="./media/mpa-request-ownership/transfer-status-pending-link.png" alt-text="Screenshot showing the Transfer status where you can copy the transfer link sent to the recipient." lightbox="./media/mpa-request-ownership/transfer-status-pending-link.png" ::: +1. In the Azure portal, the user selects the billing account that they want to transfer Azure products from. Then they select eligible subscriptions on the **Subscriptions** tab. If the owner doesnΓÇÖt want to transfer subscriptions and instead wants to transfer reservations only, make sure that no subscriptions are selected. + :::image type="content" source="./media/mpa-request-ownership/review-transfer-request-subscriptions-select.png" alt-text="Screenshot showing the Subscriptions tab." lightbox="./media/mpa-request-ownership/review-transfer-request-subscriptions-select.png" ::: + *Disabled subscriptions can't be transferred.* +1. If there are reservations available to transfer, select the **Reservations** tab and then select them. If reservations wonΓÇÖt be transferred, make sure that no reservations are selected. +If reservations are transferred, they're applied to the scope thatΓÇÖs set in the request. If you want to change the scope of the reservation after itΓÇÖs transferred, see [Change the reservation scope](../reservations/manage-reserved-vm-instance.md#change-the-reservation-scope). + :::image type="content" source="./media/mpa-request-ownership/review-transfer-request-reservations-select.png" alt-text="Screenshot showing the Reservations tab." lightbox="./media/mpa-request-ownership/review-transfer-request-reservations-select.png" ::: +1. Select the **Review request** tab and verify the information about the products to transfer. If there are Warnings or Failed status messages, see the following information. When you're ready to continue, select **Transfer**. + :::image type="content" source="./media/mpa-request-ownership/review-transfer-request-complete.png" alt-text="Screenshot showing the Review request tab where you review your transfer selections." lightbox="./media/mpa-request-ownership/review-transfer-request-complete.png" ::: +1. You'll briefly see a `Transfer is in progress` message. When the transfer is completed successfully, you'll see the Transfer details page with the `Transfer completed successfully` message. + :::image type="content" source="./media/mpa-request-ownership/transfer-completed-successfully.png" alt-text="Screenshot showing the Transfer completed successfully page." lightbox="./media/mpa-request-ownership/transfer-completed-successfully.png" ::: ++On the Review request tab, the following status messages might be displayed. ++* **Ready to transfer** - Validation for this Azure product has passed and can be transferred. +* **Warnings** - There's a warning for the selected Azure product. While the product can still be transferred, doing so will have some consequence that the user should be aware of in case they want to take mitigating actions. For example, the Azure subscription being transferred is benefitting from a reservation. After transfer, the subscription will no longer receive that benefit. To maximize savings, ensure that the reservation is associated to another subscription that can use its benefits. Instead, the user can also choose to go back to the selection page and unselect this Azure subscription. Select **Check details** for more information. +* **Failed** - The selected Azure product can't be transferred because of an error. User will need to go back to the selection page and unselect this product to transfer the other selected Azure products. + ## Check the transfer request status When you send or accept transfer request, you agree to terms and conditions. For |Expiration date|The date when the request expires| |Status|The status of transfer request| - The transfer request can have one of the following statuses: + The transfer request can have one of the following states: |Status|Definition| ||| |In progress|The user hasn't accepted the transfer request|- |Processing|The user approved the transfer request. Billing for subscriptions that the user selected is getting transferred to your account| - |Completed| The billing for subscriptions that the user selected is transferred to your account| - |Finished with errors|The request completed but billing for some subscriptions that the user selected couldn't be transferred| + |Processing|The user approved the transfer request. Billing for the products that the user selected is getting transferred to your account| + |Completed| The billing for products that the user selected is transferred to your account| + |Finished with errors|The request completed but billing for some products that the user selected couldn't be transferred| |Expired|The user didn't accept the request on time and it expired| |Canceled|Someone with access to the transfer request canceled the request| |Declined|The user declined the transfer request| When you send or accept transfer request, you agree to terms and conditions. For |Transfer requested by|The email address of the user who sent the transfer request| |Transfer request expires on| The date when the transfer request expires| |Recipient's email address|The email address of the user that you sent the request to transfer billing ownership|- |Transfer link sent to recipient|The url that was sent to the user to review the transfer request| + |Transfer link sent to recipient|The URL that was sent to the user to review the transfer request| ## Supported subscription types You can request billing ownership of the following subscription types. * [Microsoft Enterprise Agreement](https://azure.microsoft.com/pricing/enterprise-agreement/) * Azure Plan<sup>1</sup> [(Microsoft Customer Agreement in Enterprise Motion)](https://www.microsoft.com/Licensing/how-to-buy/microsoft-customer-agreement) -<sup>1</sup> You must convert an EA Dev/Test subscription to an EA Enterprise offer using a support ticket and respectively, an Azure Plan Dev/Test offer to Azure plan. A Dev/Test subscription will be billed at a pay-as-you-go rate after conversion. There is no discount currently available through the Dev/Test offer to CSP partners. +<sup>1</sup> You must convert an EA Dev/Test subscription to an EA Enterprise offer using a support ticket and respectively, an Azure Plan Dev/Test offer to Azure plan. A Dev/Test subscription will be billed at a pay-as-you-go rate after conversion. There's no discount currently available through the Dev/Test offer to CSP partners. ## Additional information All resources from the subscriptions like VMs, disks, and websites transfer. Whe Azure Marketplace products, which are available for subscriptions that are managed by Cloud Solution Providers (CSPs) are transferred along with their respective subscriptions. Subscriptions that have Azure Marketplace products that aren't enabled for CSPs can't be transferred. -### Azure Reservations transfer --Azure Reservations don't automatically move with subscriptions. Either you can keep the Reservation in EAfor other subscriptions or [cancel the Reservation](../reservations/exchange-and-refund-azure-reservations.md) and partner can repurchase in CSP. - ### Access to Azure services -Access for existing users, groups, or service principals that was assigned using [Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) isn't affected during the transition. The partner wonΓÇÖt get any new Azure RBAC access to the subscriptions. +Access for existing users, groups, or service principals that was assigned using [Azure role-based access control (Azure RBAC role)](../../role-based-access-control/overview.md) isn't affected during the transition. The partner wonΓÇÖt get any new Azure RBAC role access to the subscriptions. The partners should work with the customer to get access to subscriptions. The partners need to get either Admin on Behalf Of - AOBO or [Azure Lighthouse](../../lighthouse/concepts/cloud-solution-provider.md) access open support tickets. If you need help, [contact support](https://portal.azure.com/?#blade/Microsoft_A ## Next steps -* The billing ownership of the Azure subscriptions is transferred to you. Keep track of the charges for these subscriptions in the [Azure portal](https://portal.azure.com). -* Work with the customer to get access to the transferred Azure subscriptions. [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md). +* The billing ownership of the Azure products is transferred to you. Keep track of the charges for these products in the [Azure portal](https://portal.azure.com). +* Work with the customer to get access to the transferred Azure products. [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md). |
| cost-management-billing | Pay By Invoice | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/pay-by-invoice.md | tags: billing Previously updated : 12/10/2021 Last updated : 04/25/2022 Users with a Microsoft Customer Agreement must always submit a request to Azure > * Pay all outstanding charges before switching to pay by by check or wire transfer. > * An outstanding invoice is paid by your default payment method. In order to have it paid by check or wire transfer, you must change your default payment method to check or wire transfer after you've been approved. > * Currently, payment by check or wire transfer isn't supported for Global Azure in China.-> * If you switch to pay by check or wire transfer, you can't switch back to paying by credit or debit card. +> * For Microsoft Online Services Program accounts, if you switch to pay by check or wire transfer, you can't switch back to paying by credit or debit card. ## Request to pay by check or wire transfer |
| cost-management-billing | Subscription Transfer | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/subscription-transfer.md | tags: billing Previously updated : 04/07/2022 Last updated : 04/21/2022 When you accept a transfer, must select the **Review + validate** option. By mak ### Resources transfer with subscriptions -When only billing ownership is changing, then resources aren't affected. However, when you do a resource move or change the service tenant, then resources could be affected. +When only billing ownership is changing, then resources aren't affected. All resources from the subscriptions like VMs, disks, and websites transfer. However, when you do a resource move or change the service tenant, then resources could be affected. ### Transfer a product from one account to another Your account is responsible for payment for any usage that is reported from the The Enterprise Administrator can update account ownership for any account, even after an original account owner is no longer part of the organization. For more information about transferring Azure Enterprise Agreement accounts, see [Azure Enterprise transfers](ea-transfers.md). +## Supplemental information about transfers ++The following sections provide additional information about transferring subscriptions. ++### Cancel a prior support plan ++If you have an Azure support plan and you transfer all of your Azure subscriptions to a new agreement, then you must cancel the support plan because it doesn't transfer with the subscriptions. For example, when you transfer a Microsoft Online Subscription Agreement (an Azure subscription purchased on the web) to the Microsoft Customer Agreement. To cancel your support plan: ++Use your account administrator credentials for your old account if the credentials differ from the ones used to access your new Microsoft Customer Agreement account. ++1. Sign in to the Azure portal at https://portal.azure.com. +1. Navigate to **Cost Management + Billing**. +1. Select **Billing Scopes** in the left pane. +1. Select the billing account associated with your Microsoft support plan. + - For a Microsoft Customer Agreement: + - Select **Recurring charges** in the left pane. + - In the right pane, to the right of the support plan line item, select the ellipsis (**...**) and then select **Turn off auto-renewal**. + - For a Microsoft Online Subscription Agreement (MOSA): + - Select **Subscriptions** in the left pane. + - Select the support plan subscription in the right pane and then select **Cancel**. ++### Access your historical invoices ++You may want to access your invoices for your old Microsoft Online Subscription Agreement account (an Azure subscription purchased on the web) after you transfer billing ownership to your new Microsoft Customer Agreement account. To do so, use the following steps: ++Use your account administrator credentials for your old account if the credentials differ from the ones used to access your new Microsoft Customer Agreement account. ++1. Sign in to the Azure portal at https://portal.azure.com/. +1. Navigate to **Cost Management + Billing**. +1. Select **Billing Scopes** in the left pane. +1. Select the billing account associated with your Microsoft Online Subscription Agreement account. +1. Select **Invoices** in the left pane to access your historical invoices. ++### Disabled subscriptions ++Disabled subscriptions can't be transferred. Subscriptions must be in active state to transfer their billing ownership. ++### Azure Marketplace products transfer ++Azure Marketplace products transfer along with their respective subscriptions. ++### Azure Reservations transfer ++If you're transferring Enterprise Agreement (EA) subscriptions or Microsoft Customer Agreements, Azure Reservations automatically move with the subscriptions. ++### Access to Azure services ++Access for existing users, groups, or service principals that was assigned using [Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) isn't affected during the transition. ++### Charges for transferred subscription ++The original billing owner of the subscriptions is responsible for any charges that were reported up to the point that the transfer is completed. Your invoice section is responsible for charges reported from the time of transfer onwards. There may be some charges that took place before transfer but was reported afterwards. These charges show up on your invoice section. ++### Cancel a transfer request ++You can cancel the transfer request until the request is approved or declined. To cancel the transfer request, go to the [transfer details page](mca-request-billing-ownership.md#check-the-transfer-request-status) and select cancel from the bottom of the page. ++### Software as a Service (SaaS) transfer ++SaaS products don't transfer with the subscriptions. Ask the user to [Contact Azure support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade) to transfer billing ownership of SaaS products. Along with the billing ownership, the user can also transfer resource ownership. Resource ownership lets you conduct management operations like deleting and viewing the details of the product. The user must be a resource owner on the SaaS product to transfer resource ownership. ++ ## Next steps - [Move resources to a new resource group or subscription](../../azure-resource-manager/management/move-resource-group-and-subscription.md). |
| cost-management-billing | Understand Vm Reservation Charges | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/understand-vm-reservation-charges.md | To learn more about Azure Reservations, see the following articles: - [What are reservations for Azure?](../reservations/save-compute-costs-reservations.md) - [Prepay for Virtual Machines with Azure Reserved VM Instances](../../virtual-machines/prepay-reserved-vm-instances.md)-- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md)+- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) - [Manage reservations for Azure](../reservations/manage-reserved-vm-instance.md) - [Understand reservation usage for your Pay-As-You-Go subscription](../reservations/understand-reserved-instance-usage.md) - [Understand reservation usage for your Enterprise enrollment](../reservations/understand-reserved-instance-usage-ea.md) |
| cost-management-billing | Microsoft Customer Agreement Get Started | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/microsoft-customer-agreement/microsoft-customer-agreement-get-started.md | Make sure that you complete any outstanding payments for your older [pay-as-you- ## Cancel support plan -Learn how to [cancel a previous support plan](../manage/mca-request-billing-ownership.md?toc=/azure/cost-management-billing/microsoft-customer-agreement/toc.json#cancel-a-prior-support-plan). +Learn how to [cancel a previous support plan](../manage/subscription-transfer.md?toc=/azure/cost-management-billing/microsoft-customer-agreement/toc.json#cancel-a-prior-support-plan). ## Need help? Contact us |
| cost-management-billing | Prepare Buy Reservation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/prepare-buy-reservation.md | You can purchase reservations from Azure portal, APIs, PowerShell, CLI. Read the - [Disk Storage](../../virtual-machines/disks-reserved-capacity.md) - [SAP HANA Large Instances](prepay-hana-large-instances-reserved-capacity.md) - [Software plans](../../virtual-machines/linux/prepay-suse-software-charges.md?toc=/azure/cost-management-billing/reservations/toc.json)-- [SQL Database](../../azure-sql/database/reserved-capacity-overview.md?toc=/azure/cost-management-billing/reservations/toc.json)+- [SQL Database](/azure/azure-sql/database/reserved-capacity-overview?toc=/azure/cost-management-billing/reservations/toc.json) - [Synapse Analytics - data warehouse](prepay-sql-data-warehouse-charges.md) - [Synapse Analytics - Pre-purchase](synapse-analytics-pre-purchase-plan.md) - [Virtual machines](../../virtual-machines/prepay-reserved-vm-instances.md?toc=/azure/cost-management-billing/reservations/toc.json) |
| cost-management-billing | Reservation Apis | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/reservation-apis.md | You can also buy a reservation in the Azure portal. For more information, see th Service plans: - [Virtual machine](../../virtual-machines/prepay-reserved-vm-instances.md?toc=/azure/cost-management-billing/reservations/toc.json) - [Cosmos DB](../../cosmos-db/cosmos-db-reserved-capacity.md?toc=/azure/cost-management-billing/reservations/toc.json)-- [SQL Database](../../azure-sql/database/reserved-capacity-overview.md?toc=/azure/cost-management-billing/reservations/toc.json)+- [SQL Database](/azure/azure-sql/database/reserved-capacity-overview?toc=/azure/cost-management-billing/reservations/toc.json) Software plans: - [SUSE Linux software](../../virtual-machines/linux/prepay-suse-software-charges.md?toc=/azure/cost-management-billing/reservations/toc.json) |
| cost-management-billing | Save Compute Costs Reservations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/save-compute-costs-reservations.md | If you have questions or need help, [create a support request](https://go.micro - Learn more about reservations for service plans: - [Virtual Machines with Azure Reserved VM Instances](../../virtual-machines/prepay-reserved-vm-instances.md) - [Azure Cosmos DB resources with Azure Cosmos DB reserved capacity](../../cosmos-db/cosmos-db-reserved-capacity.md)- - [SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md) + - [SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) - [Azure Cache for Redis resources with Azure Cache for Redis reserved capacity](../../azure-cache-for-redis/cache-reserved-pricing.md) Learn more about reservations for software plans: - [Red Hat software plans from Azure Reservations](../../virtual-machines/linux/prepay-suse-software-charges.md) |
| cost-management-billing | Understand Cosmosdb Reservation Charges | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/understand-cosmosdb-reservation-charges.md | To learn more about Azure reservations, see the following articles: * [What are reservations for Azure](save-compute-costs-reservations.md) * [Prepay for Azure Cosmos DB resources with Azure Cosmos DB reserved capacity](../../cosmos-db/cosmos-db-reserved-capacity.md) -* [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md) +* [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) * [Manage reservations for Azure](manage-reserved-vm-instance.md) * [Understand reservation usage for your Pay-As-You-Go subscription](understand-reserved-instance-usage.md) * [Understand reservation usage for your Enterprise enrollment](understand-reserved-instance-usage-ea.md) |
| cost-management-billing | Understand Reservation Charges | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/understand-reservation-charges.md | To learn more about Azure Reservations, see the following articles: - [What are Azure Reservations?](save-compute-costs-reservations.md) - [Prepay for Virtual Machines with Azure Reserved VM Instances](../../virtual-machines/prepay-reserved-vm-instances.md)-- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md)+- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) - [Manage Azure Reservations](manage-reserved-vm-instance.md) - [Understand reservation usage for your Pay-As-You-Go subscription](understand-reserved-instance-usage.md) - [Understand reservation usage for your Enterprise enrollment](understand-reserved-instance-usage-ea.md) |
| cost-management-billing | Understand Reserved Instance Usage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/understand-reserved-instance-usage.md | To learn more about Azure Reservations, see the following articles: - [What are Azure Reservations?](save-compute-costs-reservations.md) - [Prepay for Virtual Machines with Azure Reserved VM Instances](../../virtual-machines/prepay-reserved-vm-instances.md)-- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md)+- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) - [Manage Azure Reservations](manage-reserved-vm-instance.md) - [Understand how the reservation discount is applied](../manage/understand-vm-reservation-charges.md) - [Understand reservation usage for your Enterprise enrollment](understand-reserved-instance-usage-ea.md) |
| cost-management-billing | Understand Vm Software Reservation Discount | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/understand-vm-software-reservation-discount.md | To learn more about Azure Reservations, see the following articles: - [What are reservations for Azure?](save-compute-costs-reservations.md) - [Prepay for Azure virtual machine software reservations](buy-vm-software-reservation.md) - [Prepay for Virtual Machines with Azure Reserved VM Instances](../../virtual-machines/prepay-reserved-vm-instances.md)-- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](../../azure-sql/database/reserved-capacity-overview.md)+- [Prepay for SQL Database compute resources with Azure SQL Database reserved capacity](/azure/azure-sql/database/reserved-capacity-overview) - [Manage reservations for Azure](manage-reserved-vm-instance.md) - [Understand reservation usage for your Pay-As-You-Go subscription](understand-reserved-instance-usage.md) - [Understand reservation usage for your Enterprise enrollment](understand-reserved-instance-usage-ea.md) |
| cost-management-billing | Create Sql License Assignments | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/scope-level/create-sql-license-assignments.md | The following prerequisites must be met to create SQL Server license assignments - Your organization has a supported agreement type and supported offer. - You're a member of a role that has permissions to assign SQL licenses. - Your organization has SQL Server core licenses with Software Assurance or core subscription licenses available to assign to Azure.-- Your organization is enrolled to automatic registration of the Azure SQL VMs with the IaaS extension. To learn more, see [Automatic registration with SQL IaaS Agent extension](../../azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms.md).+- Your organization is enrolled to automatic registration of the Azure SQL VMs with the IaaS extension. To learn more, see [Automatic registration with SQL IaaS Agent extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms). > [!IMPORTANT] > Failure to meet this prerequisite will cause Azure to produce incomplete data about your current Azure Hybrid Benefit usage. This situation could lead to incorrect license assignments and might result in unnecessary pay-as-you-go charges for SQL Server licenses. |
| cost-management-billing | Overview Azure Hybrid Benefit Scope | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/scope-level/overview-azure-hybrid-benefit-scope.md | To use centrally manage licenses, you must have a specific role assigned to you, At a high level, here's how it works: -1. First, confirm that all your SQL Server VMs are visible to you and Azure by enabling automatic registration of the self-installed SQL server images with the IaaS extension. For more information, see [Register multiple SQL VMs in Azure with the SQL IaaS Agent extension](../../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-vms-bulk.md). +1. First, confirm that all your SQL Server VMs are visible to you and Azure by enabling automatic registration of the self-installed SQL server images with the IaaS extension. For more information, see [Register multiple SQL VMs in Azure with the SQL IaaS Agent extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-vms-bulk). 1. Under **Cost Management + Billing** in the Azure portal, you (the billing administrator) choose the scope and the number of qualifying licenses that you want to assign to cover the resources in the scope. :::image type="content" source="./media/overview-azure-hybrid-benefit-scope/set-scope-assign-licenses.png" alt-text="Screenshot showing setting a scope and assigning licenses." lightbox="./media/overview-azure-hybrid-benefit-scope/set-scope-assign-licenses.png" ::: In the previous example, detected usage for 108 normalized core licenses is need - Any usage above the number of assigned licenses is billed at normal, pay-as-you-go prices. - When you choose to manage the benefit by assigning licenses at a scope level, you can't manage individual resources in the scope any longer. -The original resource-level way to enable Azure Hybrid Benefit is still available for SQL Server and is currently the only option for Windows Server. It involves a DevOps role selecting the benefit for each individual resource (like a SQL Database or Windows Server VM) when creating or managing it. Doing so results in the hourly cost of that resource being discounted. For more information, see [Azure Hybrid Benefit for Windows Server](../../azure-sql/azure-hybrid-benefit.md). +The original resource-level way to enable Azure Hybrid Benefit is still available for SQL Server and is currently the only option for Windows Server. It involves a DevOps role selecting the benefit for each individual resource (like a SQL Database or Windows Server VM) when creating or managing it. Doing so results in the hourly cost of that resource being discounted. For more information, see [Azure Hybrid Benefit for Windows Server](/azure/azure-sql/azure-hybrid-benefit). Enabling centralized management of Azure Hybrid Benefit of for SQL Server at a subscription or account scope level is currently in preview. It's available to enterprise customers and to customers that buy directly from Azure.com with a Microsoft Customer Agreement. We hope to extend the capability to Windows Server and more customers. |
| cost-management-billing | Tutorial Azure Hybrid Benefits Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/scope-level/tutorial-azure-hybrid-benefits-sql.md | Have read and understand the [What is centrally managed Azure Hybrid Benefit?](o > [!NOTE] > Managing Azure Hybrid Benefit centrally at a scope-level is currently in public preview and limited to enterprise customers and customers buying directly from Azure.com with a Microsoft Customer Agreement. -Verify that your self-installed virtual machines running SQL Server in Azure are registered before you start to use the new experience. Doing so ensures that Azure resources that are running SQL Server are visible to you and Azure. For more information about registering SQL VMs in Azure, see [Register SQL Server VM with SQL IaaS Agent Extension](../../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md) and [Register multiple SQL VMs in Azure with the SQL IaaS Agent extension](../../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-vms-bulk.md). +Verify that your self-installed virtual machines running SQL Server in Azure are registered before you start to use the new experience. Doing so ensures that Azure resources that are running SQL Server are visible to you and Azure. For more information about registering SQL VMs in Azure, see [Register SQL Server VM with SQL IaaS Agent Extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm) and [Register multiple SQL VMs in Azure with the SQL IaaS Agent extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-vms-bulk). ## Gather license usage and availability details |
| data-catalog | Register Data Assets Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-catalog/register-data-assets-tutorial.md | To set up Data Catalog, you must be the owner or co-owner of an Azure subscripti ### Register a data source -You register data assets (tables) from a [database sample](../azure-sql/database/single-database-create-quickstart.md) for Azure SQL Database, but you can use any supported data source if you prefer to work with data that is familiar and relevant to your role. For a list of supported data sources, see [Supported data sources](data-catalog-dsr.md). +You register data assets (tables) from a [database sample](/azure/azure-sql/database/single-database-create-quickstart) for Azure SQL Database, but you can use any supported data source if you prefer to work with data that is familiar and relevant to your role. For a list of supported data sources, see [Supported data sources](data-catalog-dsr.md). The database name we're using in this tutorial is *RLSTest*. |
| data-factory | Configure Azure Ssis Integration Runtime Performance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/configure-azure-ssis-integration-runtime-performance.md | $SSISDBPricingTier = "[Basic|S0|S1|S2|S3|S4|S6|S7|S9|S12|P1|P2|P4|P6|P11|P15|… ``` ## AzureSSISLocation-**AzureSSISLocation** is the location for the integration runtime worker node. The worker node maintains a constant connection to the SSIS Catalog database (SSISDB) in Azure SQL Database. Set the **AzureSSISLocation** to the same location as [logical SQL server](../azure-sql/database/logical-servers.md) that hosts SSISDB, which lets the integration runtime to work as efficiently as possible. +**AzureSSISLocation** is the location for the integration runtime worker node. The worker node maintains a constant connection to the SSIS Catalog database (SSISDB) in Azure SQL Database. Set the **AzureSSISLocation** to the same location as [logical SQL server](/azure/azure-sql/database/logical-servers) that hosts SSISDB, which lets the integration runtime to work as efficiently as possible. ## AzureSSISNodeSize Data Factory, including the Azure-SSIS IR, supports the following options: Here are the guidelines for setting the right value for the **AzureSSISMaxParall - Choose a more powerful database such as s3 if the logging level is set to verbose. According our unofficial in-house testing, s3 pricing tier can support SSIS package execution with 2 nodes, 128 parallel counts and verbose logging level. -You can also adjust the database pricing tier based on [database transaction unit](../azure-sql/database/service-tiers-dtu.md) (DTU) usage information available on the Azure portal. +You can also adjust the database pricing tier based on [database transaction unit](/azure/azure-sql/database/service-tiers-dtu) (DTU) usage information available on the Azure portal. ## Design for high performance Designing an SSIS package to run on Azure is different from designing a package for on-premises execution. Instead of combining multiple independent tasks in the same package, separate them into several packages for more efficient execution in the Azure-SSIS IR. Create a package execution for each package, so that they don’t have to wait for each other to finish. This approach benefits from the scalability of the Azure-SSIS integration runtime and improves the overall throughput. |
| data-factory | Configure Bcdr Azure Ssis Integration Runtime | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/configure-bcdr-azure-ssis-integration-runtime.md | Last updated 02/15/2022 Azure SQL Database/Managed Instance and SQL Server Integration Services (SSIS) in Azure Data Factory (ADF) or Synapse Pipelines can be combined as the recommended all-Platform as a Service (PaaS) solution for SQL Server migration. You can deploy your SSIS projects into SSIS catalog database (SSISDB) hosted by Azure SQL Database/Managed Instance and run your SSIS packages on Azure SSIS integration runtime (IR) in ADF or Synapse Pipelines. -For business continuity and disaster recovery (BCDR), Azure SQL Database/Managed Instance can be configured with a [geo-replication/failover group](../azure-sql/database/auto-failover-group-overview.md), where SSISDB in a primary Azure region with read-write access (primary role) will be continuously replicated to a secondary region with read-only access (secondary role). When a disaster occurs in the primary region, a failover will be triggered, where the primary and secondary SSISDBs will swap roles. +For business continuity and disaster recovery (BCDR), Azure SQL Database/Managed Instance can be configured with a [geo-replication/failover group](/azure/azure-sql/database/auto-failover-group-overview), where SSISDB in a primary Azure region with read-write access (primary role) will be continuously replicated to a secondary region with read-only access (secondary role). When a disaster occurs in the primary region, a failover will be triggered, where the primary and secondary SSISDBs will swap roles. For BCDR, you can also configure a dual standby Azure SSIS IR pair that works in sync with Azure SQL Database/Managed Instance failover group. This allows you to have a pair of running Azure-SSIS IRs that at any given time, only one can access the primary SSISDB to fetch and execute packages, as well as write package execution logs (primary role), while the other can only do the same for packages deployed somewhere else, for example in Azure Files (secondary role). When SSISDB failover occurs, the primary and secondary Azure-SSIS IRs will also swap roles and if both are running, there'll be a near-zero downtime. To configure a dual standby Azure-SSIS IR pair that works in sync with Azure SQL When [selecting to use SSISDB](./tutorial-deploy-ssis-packages-azure.md#creating-ssisdb) on the **Deployment settings** page of **Integration runtime setup** pane, select also the **Use dual standby Azure-SSIS Integration Runtime pair with SSISDB failover** check box. For **Dual standby pair name**, enter a name to identify your pair of primary and secondary Azure-SSIS IRs. When you complete the creation of your primary Azure-SSIS IR, it will be started and attached to a primary SSISDB that will be created on your behalf with read-write access. If you've just reconfigured it, you need to restart it. -1. Using Azure portal, you can check whether the primary SSISDB has been created on the **Overview** page of your primary Azure SQL Database server. Once it's created, you can [create a failover group for your primary and secondary Azure SQL Database servers and add SSISDB to it](../azure-sql/database/failover-group-add-single-database-tutorial.md?tabs=azure-portal#2create-the-failover-group) on the **Failover groups** page. Once your failover group is created, you can check whether the primary SSISDB has been replicated to a secondary one with read-only access on the **Overview** page of your secondary Azure SQL Database server. +1. Using Azure portal, you can check whether the primary SSISDB has been created on the **Overview** page of your primary Azure SQL Database server. Once it's created, you can [create a failover group for your primary and secondary Azure SQL Database servers and add SSISDB to it](/azure/azure-sql/database/failover-group-add-single-database-tutorial?tabs=azure-portal#2create-the-failover-group) on the **Failover groups** page. Once your failover group is created, you can check whether the primary SSISDB has been replicated to a secondary one with read-only access on the **Overview** page of your secondary Azure SQL Database server. 1. Using Azure portal/ADF UI, you can create another Azure-SSIS IR with your secondary Azure SQL Database server to host SSISDB in the secondary region. This will be your secondary Azure-SSIS IR. For complete BCDR, make sure that all resources it depends on are also created in the secondary region, for example Azure Storage for storing custom setup script/files, ADF for orchestration/scheduling package executions, etc. To configure a dual standby Azure-SSIS IR pair that works in sync with Azure SQL 1. If you [use ADF for orchestration/scheduling package executions](./how-to-invoke-ssis-package-ssis-activity.md), make sure that all relevant ADF pipelines with Execute SSIS Package activities and associated triggers are copied to your secondary ADF with the triggers initially disabled. When SSISDB failover occurs, you need to enable them. -1. You can [test your Azure SQL Database failover group](../azure-sql/database/failover-group-add-single-database-tutorial.md?tabs=azure-portal#3test-failover) and check on [Azure-SSIS IR monitoring page in ADF portal](./monitor-integration-runtime.md#monitor-the-azure-ssis-integration-runtime-in-azure-portal) whether your primary and secondary Azure-SSIS IRs have swapped roles. +1. You can [test your Azure SQL Database failover group](/azure/azure-sql/database/failover-group-add-single-database-tutorial?tabs=azure-portal#3test-failover) and check on [Azure-SSIS IR monitoring page in ADF portal](./monitor-integration-runtime.md#monitor-the-azure-ssis-integration-runtime-in-azure-portal) whether your primary and secondary Azure-SSIS IRs have swapped roles. ## Configure a dual standby Azure-SSIS IR pair with Azure SQL Managed Instance failover group To configure a dual standby Azure-SSIS IR pair that works in sync with Azure SQL Managed Instance failover group, complete the following steps. -1. Using Azure portal, you can [create a failover group for your primary and secondary Azure SQL Managed Instances](../azure-sql/managed-instance/failover-group-add-instance-tutorial.md?tabs=azure-portal) on the **Failover groups** page of your primary Azure SQL Managed Instance. +1. Using Azure portal, you can [create a failover group for your primary and secondary Azure SQL Managed Instances](/azure/azure-sql/managed-instance/failover-group-add-instance-tutorial?tabs=azure-portal) on the **Failover groups** page of your primary Azure SQL Managed Instance. 1. Using Azure portal/ADF UI, you can create a new Azure-SSIS IR with your primary Azure SQL Managed Instance to host SSISDB in the primary region. If you have an existing Azure-SSIS IR that's already attached to SSIDB hosted by your primary Azure SQL Managed Instance and it's still running, you need to stop it first to reconfigure it. This will be your primary Azure-SSIS IR. To configure a dual standby Azure-SSIS IR pair that works in sync with Azure SQL 1. If you [use ADF for orchestration/scheduling package executions](./how-to-invoke-ssis-package-ssis-activity.md), make sure that all relevant ADF pipelines with Execute SSIS Package activities and associated triggers are copied to your secondary ADF with the triggers initially disabled. When SSISDB failover occurs, you need to enable them. -1. You can [test your Azure SQL Managed Instance failover group](../azure-sql/managed-instance/failover-group-add-instance-tutorial.md?tabs=azure-portal#test-failover) and check on [Azure-SSIS IR monitoring page in ADF portal](./monitor-integration-runtime.md#monitor-the-azure-ssis-integration-runtime-in-azure-portal) whether your primary and secondary Azure-SSIS IRs have swapped roles. +1. You can [test your Azure SQL Managed Instance failover group](/azure/azure-sql/managed-instance/failover-group-add-instance-tutorial?tabs=azure-portal#test-failover) and check on [Azure-SSIS IR monitoring page in ADF portal](./monitor-integration-runtime.md#monitor-the-azure-ssis-integration-runtime-in-azure-portal) whether your primary and secondary Azure-SSIS IRs have swapped roles. ## Attach a new Azure-SSIS IR to existing SSISDB hosted by Azure SQL Database/Managed Instance |
| data-factory | Connector Amazon Rds For Sql Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-amazon-rds-for-sql-server.md | To learn details about the properties, check [GetMetadata activity](control-flow When you copy data from/to Amazon RDS for SQL Server with [Always Encrypted](/sql/relational-databases/security/encryption/always-encrypted-database-engine), follow below steps: -1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](../azure-sql/database/always-encrypted-azure-key-vault-configure.md?tabs=azure-powershell) +1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell) 2. Make sure to grant access to the key vault where the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) is stored. Refer to this [article](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true#key-vaults) for required permissions. |
| data-factory | Connector Azure Blob Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-blob-storage.md | These properties are supported for an Azure Blob storage linked service: ``` >[!IMPORTANT]->If you use PolyBase or COPY statement to load data from Blob storage (as a source or as staging) into Azure Synapse Analytics, when you use managed identity authentication for Blob storage, make sure you also follow steps 1 to 3 in [this guidance](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Those steps will register your server with Azure AD and assign the Storage Blob Data Contributor role to your server. Data Factory handles the rest. If you configure Blob storage with an Azure Virtual Network endpoint, you also need to have **Allow trusted Microsoft services to access this storage account** turned on under Azure Storage account **Firewalls and Virtual networks** settings menu as required by Azure Synapse. +>If you use PolyBase or COPY statement to load data from Blob storage (as a source or as staging) into Azure Synapse Analytics, when you use managed identity authentication for Blob storage, make sure you also follow steps 1 to 3 in [this guidance](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Those steps will register your server with Azure AD and assign the Storage Blob Data Contributor role to your server. Data Factory handles the rest. If you configure Blob storage with an Azure Virtual Network endpoint, you also need to have **Allow trusted Microsoft services to access this storage account** turned on under Azure Storage account **Firewalls and Virtual networks** settings menu as required by Azure Synapse. > [!NOTE] > |
| data-factory | Connector Azure Data Lake Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-data-lake-storage.md | These properties are supported for the linked service: >If you use Data Factory UI to author and the managed identity is not set with "Storage Blob Data Reader/Contributor" role in IAM, when doing test connection or browsing/navigating folders, choose "Test connection to file path" or "Browse from specified path", and specify a path with **Read + Execute** permission to continue. >[!IMPORTANT]->If you use PolyBase or COPY statement to load data from Data Lake Storage Gen2 into Azure Synapse Analytics, when you use managed identity authentication for Data Lake Storage Gen2, make sure you also follow steps 1 to 3 in [this guidance](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Those steps will register your server with Azure AD and assign the Storage Blob Data Contributor role to your server. Data Factory handles the rest. If you configure Blob storage with an Azure Virtual Network endpoint, you also need to have **Allow trusted Microsoft services to access this storage account** turned on under Azure Storage account **Firewalls and Virtual networks** settings menu as required by Azure Synapse. +>If you use PolyBase or COPY statement to load data from Data Lake Storage Gen2 into Azure Synapse Analytics, when you use managed identity authentication for Data Lake Storage Gen2, make sure you also follow steps 1 to 3 in [this guidance](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Those steps will register your server with Azure AD and assign the Storage Blob Data Contributor role to your server. Data Factory handles the rest. If you configure Blob storage with an Azure Virtual Network endpoint, you also need to have **Allow trusted Microsoft services to access this storage account** turned on under Azure Storage account **Firewalls and Virtual networks** settings menu as required by Azure Synapse. ## Dataset properties |
| data-factory | Connector Azure Database For Postgresql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-database-for-postgresql.md | The below table lists the properties supported by Azure Database for PostgreSQL | Skip writing key columns | If you wish to not write the value to the key column, select "Skip writing key columns". | No | `true` or `false` | skipKeyWrites | | Table action |Determines whether to recreate or remove all rows from the destination table prior to writing.<br>- **None**: No action will be done to the table.<br>- **Recreate**: The table will get dropped and recreated. Required if creating a new table dynamically.<br>- **Truncate**: All rows from the target table will get removed. | No | `true` or `false` | recreate<br/>truncate | | Batch size | Specify how many rows are being written in each batch. Larger batch sizes improve compression and memory optimization, but risk out of memory exceptions when caching data. | No | Integer | batchSize |+| Select user DB schema | By default, a temporary table will be created under the sink schema as staging. You can alternatively uncheck the **Use sink schema** option and instead, specify a schema name under which Data Factory will create a staging table to load upstream data and automatically clean them up upon completion. Make sure you have create table permission in the database and alter permission on the schema. | No | String | stagingSchemaName | | Pre and Post SQL scripts | Specify multi-line SQL scripts that will execute before (pre-processing) and after (post-processing) data is written to your Sink database. | No | String | preSQLs<br>postSQLs | > [!TIP] |
| data-factory | Connector Azure Sql Data Warehouse | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-sql-data-warehouse.md | For Copy activity, this Azure Synapse Analytics connector supports these functio - As a sink, load data by using [COPY statement](#use-copy-statement) or [PolyBase](#use-polybase-to-load-data-into-azure-synapse-analytics) or bulk insert. We recommend COPY statement or PolyBase for better copy performance. The connector also supports automatically creating destination table with DISTRIBUTION = ROUND_ROBIN if not exists based on the source schema. > [!IMPORTANT]-> If you copy data by using an Azure Integration Runtime, configure a [server-level firewall rule](../azure-sql/database/firewall-configure.md) so that Azure services can access the [logical SQL server](../azure-sql/database/logical-servers.md). +> If you copy data by using an Azure Integration Runtime, configure a [server-level firewall rule](/azure/azure-sql/database/firewall-configure) so that Azure services can access the [logical SQL server](/azure/azure-sql/database/logical-servers). > If you copy data by using a self-hosted integration runtime, configure the firewall to allow the appropriate IP range. This range includes the machine's IP that is used to connect to Azure Synapse Analytics. ## Get started To use service principal-based Azure AD application token authentication, follow - Application key - Tenant ID -2. **[Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database)** for your server in the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with managed identity an admin role, skip steps 3 and 4. The administrator will have full access to the database. +2. **[Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database)** for your server in the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with managed identity an admin role, skip steps 3 and 4. The administrator will have full access to the database. -3. **[Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities)** for the service principal. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: +3. **[Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities)** for the service principal. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: ```sql CREATE USER [your_application_name] FROM EXTERNAL PROVIDER; A data factory or Synapse workspace can be associated with a [system-assigned ma To use system-assigned managed identity authentication, follow these steps: -1. **[Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with system-assigned managed identity an admin role, skip steps 3 and 4. The administrator will have full access to the database. +1. **[Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with system-assigned managed identity an admin role, skip steps 3 and 4. The administrator will have full access to the database. -2. **[Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities)** for the system-assigned managed identity. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL. +2. **[Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities)** for the system-assigned managed identity. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL. ```sql CREATE USER [your_resource_name] FROM EXTERNAL PROVIDER; A data factory or Synapse workspace can be associated with a [user-assigned mana To use user-assigned managed identity authentication, follow these steps: -1. **[Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator will have full access to the database. +1. **[Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator will have full access to the database. -2. **[Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities)** for the user-assigned managed identity. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL. +2. **[Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities)** for the user-assigned managed identity. Connect to the data warehouse from or to which you want to copy data by using tools like SSMS, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL. ```sql CREATE USER [your_resource_name] FROM EXTERNAL PROVIDER; Azure Synapse Analytics COPY statement directly supports Azure Blob, Azure Data >[!IMPORTANT] >- When you use managed identity authentication for your storage linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.- >- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). + >- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). 2. Format settings are with the following: To use this feature, create an [Azure Blob Storage linked service](connector-azu >[!IMPORTANT] >- When you use managed identity authentication for your staging linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.->- If your staging Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). +>- If your staging Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). >[!IMPORTANT] >If your staging Azure Storage is configured with Managed Private Endpoint and has the storage firewall enabled, you must use managed identity authentication and grant Storage Blob Data Reader permissions to the Synapse SQL Server to ensure it can access the staged files during the COPY statement load. If the requirements aren't met, the service checks the settings and automaticall >[!IMPORTANT] >- When you use managed identity authentication for your storage linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.- >- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). + >- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). 2. The **source data format** is of **Parquet**, **ORC**, or **Delimited text**, with the following configurations: To use this feature, create an [Azure Blob Storage linked service](connector-azu >[!IMPORTANT] >- When you use managed identity authentication for your staging linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.->- If your staging Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). +>- If your staging Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). >[!IMPORTANT] >If your staging Azure Storage is configured with Managed Private Endpoint and has the storage firewall enabled, you must use managed identity authentication and grant Storage Blob Data Reader permissions to the Synapse SQL Server to ensure it can access the staged files during the PolyBase load. Settings specific to Azure Synapse Analytics are available in the **Source Optio **Enable Staging** It is highly recommended that you use this option in production workloads with Azure Synapse Analytics sources. When you execute a [data flow activity](control-flow-execute-data-flow-activity.md) with Azure Synapse Analytics sources from a pipeline, you will be prompted for a staging location storage account and will use that for staged data loading. It is the fastest mechanism to load data from Azure Synapse Analytics. - When you use managed identity authentication for your storage linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.-- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage).+- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). - When you use Azure Synapse **serverless** SQL pool as source, enable staging is not supported. **Query**: If you select Query in the input field, enter a SQL query for your source. This setting overrides any table that you've chosen in the dataset. **Order By** clauses aren't supported here, but you can set a full SELECT FROM statement. You can also use user-defined table functions. **select * from udfGetData()** is a UDF in SQL that returns a table. This query will produce a source table that you can use in your data flow. Using queries is also a great way to reduce rows for testing or for lookups. Settings specific to Azure Synapse Analytics are available in the **Settings** t **Enable staging:** This enables loading into Azure Synapse Analytics SQL Pools using the copy command and is recommended for most Synpase sinks. The staging storage is configured in [Execute Data Flow activity](control-flow-execute-data-flow-activity.md). - When you use managed identity authentication for your storage linked service, learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.-- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage).+- If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). **Batch size**: Controls how many rows are being written in each bucket. Larger batch sizes improve compression and memory optimization, but risk out of memory exceptions when caching data. +**Use sink schema**: By default, a temporary table will be created under the sink schema as staging. You can alternatively uncheck the **Use sink schema** option and instead, in **Select user DB schema**, specify a schema name under which Data Factory will create a staging table to load upstream data and automatically clean them up upon completion. Make sure you have create table permission in the database and alter permission on the schema. ++ **Pre and Post SQL scripts**: Enter multi-line SQL scripts that will execute before (pre-processing) and after (post-processing) data is written to your Sink database > [!TIP] > 1. It's recommended to break single batch scripts with multiple commands into multiple batches. |
| data-factory | Connector Azure Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-sql-database.md | For Copy activity, this Azure SQL Database connector supports these functions: - As a source, retrieving data by using a SQL query or a stored procedure. You can also choose to parallel copy from an Azure SQL Database source, see the [Parallel copy from SQL database](#parallel-copy-from-sql-database) section for details. - As a sink, automatically creating destination table if not exists based on the source schema; appending data to a table or invoking a stored procedure with custom logic during the copy. -If you use Azure SQL Database [serverless tier](../azure-sql/database/serverless-tier-overview.md), note when the server is paused, activity run fails instead of waiting for the auto resume to be ready. You can add activity retry or chain additional activities to make sure the server is live upon the actual execution. +If you use Azure SQL Database [serverless tier](/azure/azure-sql/database/serverless-tier-overview), note when the server is paused, activity run fails instead of waiting for the auto resume to be ready. You can add activity retry or chain additional activities to make sure the server is live upon the actual execution. > [!IMPORTANT]-> If you copy data by using the Azure integration runtime, configure a [server-level firewall rule](../azure-sql/database/firewall-configure.md) so that Azure services can access the server. +> If you copy data by using the Azure integration runtime, configure a [server-level firewall rule](/azure/azure-sql/database/firewall-configure) so that Azure services can access the server. > If you copy data by using a self-hosted integration runtime, configure the firewall to allow the appropriate IP range. This range includes the machine's IP that's used to connect to Azure SQL Database. ## Get started To use a service principal-based Azure AD application token authentication, foll - Application key - Tenant ID -2. [Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator must be an Azure AD user or Azure AD group, but it can't be a service principal. This step is done so that, in the next step, you can use an Azure AD identity to create a contained database user for the service principal. +2. [Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator must be an Azure AD user or Azure AD group, but it can't be a service principal. This step is done so that, in the next step, you can use an Azure AD identity to create a contained database user for the service principal. -3. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the service principal. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: +3. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the service principal. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: ```sql CREATE USER [your application name] FROM EXTERNAL PROVIDER; A data factory or Synapse workspace can be associated with a [system-assigned ma To use system-assigned managed identity authentication, follow these steps. -1. [Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with managed identity an admin role, skip steps 3 and 4. The administrator has full access to the database. +1. [Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with managed identity an admin role, skip steps 3 and 4. The administrator has full access to the database. -2. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the managed identity. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: +2. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the managed identity. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: ```sql CREATE USER [your_resource_name] FROM EXTERNAL PROVIDER; A data factory or Synapse workspace can be associated with a [user-assigned mana To use user-assigned managed identity authentication, follow these steps. -1. [Provision an Azure Active Directory administrator](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator has full access to the database. +1. [Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator has full access to the database. -2. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the user-assigned managed identity. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: +2. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the user-assigned managed identity. Connect to the database from or to which you want to copy data by using tools like SQL Server Management Studio, with an Azure AD identity that has at least ALTER ANY USER permission. Run the following T-SQL: ```sql CREATE USER [your_resource_name] FROM EXTERNAL PROVIDER; To learn details about the properties, check [GetMetadata activity](control-flow When you copy data from/to Azure SQL Database with [Always Encrypted](/sql/relational-databases/security/encryption/always-encrypted-database-engine), follow below steps: -1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](../azure-sql/database/always-encrypted-azure-key-vault-configure.md?tabs=azure-powershell) +1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell) 2. Make sure to great access to the key vault where the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) is stored. Refer to this [article](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true#key-vaults) for required permissions. |
| data-factory | Connector Azure Sql Managed Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-azure-sql-managed-instance.md | For Copy activity, this Azure SQL Database connector supports these functions: ## Prerequisites -To access the SQL Managed Instance [public endpoint](../azure-sql/managed-instance/public-endpoint-overview.md), you can use a managed Azure integration runtime. Make sure that you enable the public endpoint and also allow public endpoint traffic on the network security group so that the service can connect to your database. For more information, see [this guidance](../azure-sql/managed-instance/public-endpoint-configure.md). +To access the SQL Managed Instance [public endpoint](/azure/azure-sql/managed-instance/public-endpoint-overview), you can use a managed Azure integration runtime. Make sure that you enable the public endpoint and also allow public endpoint traffic on the network security group so that the service can connect to your database. For more information, see [this guidance](/azure/azure-sql/managed-instance/public-endpoint-configure). -To access the SQL Managed Instance private endpoint, set up a [self-hosted integration runtime](create-self-hosted-integration-runtime.md) that can access the database. If you provision the self-hosted integration runtime in the same virtual network as your managed instance, make sure that your integration runtime machine is in a different subnet than your managed instance. If you provision your self-hosted integration runtime in a different virtual network than your managed instance, you can use either a virtual network peering or a virtual network to virtual network connection. For more information, see [Connect your application to SQL Managed Instance](../azure-sql/managed-instance/connect-application-instance.md). +To access the SQL Managed Instance private endpoint, set up a [self-hosted integration runtime](create-self-hosted-integration-runtime.md) that can access the database. If you provision the self-hosted integration runtime in the same virtual network as your managed instance, make sure that your integration runtime machine is in a different subnet than your managed instance. If you provision your self-hosted integration runtime in a different virtual network than your managed instance, you can use either a virtual network peering or a virtual network to virtual network connection. For more information, see [Connect your application to SQL Managed Instance](/azure/azure-sql/managed-instance/connect-application-instance). ## Get started For different authentication types, refer to the following sections on prerequis To use a service principal-based Azure AD application token authentication, follow these steps: -1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-managed-instance). +1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-managed-instance). 2. [Create an Azure Active Directory application](../active-directory/develop/howto-create-service-principal-portal.md#register-an-application-with-azure-ad-and-create-a-service-principal) from the Azure portal. Make note of the application name and the following values that define the linked service: To use a service principal-based Azure AD application token authentication, foll CREATE LOGIN [your application name] FROM EXTERNAL PROVIDER ``` -4. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the service principal. Connect to the database from or to which you want to copy data, run the following T-SQL: +4. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the service principal. Connect to the database from or to which you want to copy data, run the following T-SQL: ```sql CREATE USER [your application name] FROM EXTERNAL PROVIDER A data factory or Synapse workspace can be associated with a [system-assigned ma To use system-assigned managed identity authentication, follow these steps. -1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-managed-instance). +1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-managed-instance). 2. [Create logins](/sql/t-sql/statements/create-login-transact-sql) for the system-assigned managed identity. In SQL Server Management Studio (SSMS), connect to your managed instance using a SQL Server account that is a **sysadmin**. In **master** database, run the following T-SQL: To use system-assigned managed identity authentication, follow these steps. CREATE LOGIN [your_factory_or_workspace_ name] FROM EXTERNAL PROVIDER ``` -3. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the system-assigned managed identity. Connect to the database from or to which you want to copy data, run the following T-SQL: +3. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the system-assigned managed identity. Connect to the database from or to which you want to copy data, run the following T-SQL: ```sql CREATE USER [your_factory_or_workspace_name] FROM EXTERNAL PROVIDER A data factory or Synapse workspace can be associated with a [user-assigned mana To use user-assigned managed identity authentication, follow these steps. -1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-managed-instance). +1. Follow the steps to [Provision an Azure Active Directory administrator for your Managed Instance](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-managed-instance). 2. [Create logins](/sql/t-sql/statements/create-login-transact-sql) for the user-assigned managed identity. In SQL Server Management Studio (SSMS), connect to your managed instance using a SQL Server account that is a **sysadmin**. In **master** database, run the following T-SQL: To use user-assigned managed identity authentication, follow these steps. CREATE LOGIN [your_factory_or_workspace_ name] FROM EXTERNAL PROVIDER ``` -3. [Create contained database users](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities) for the user-assigned managed identity. Connect to the database from or to which you want to copy data, run the following T-SQL: +3. [Create contained database users](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities) for the user-assigned managed identity. Connect to the database from or to which you want to copy data, run the following T-SQL: ```sql CREATE USER [your_factory_or_workspace_name] FROM EXTERNAL PROVIDER When data is copied to and from SQL Managed Instance using copy activity, the fo When you copy data from/to SQL Managed Instance with [Always Encrypted](/sql/relational-databases/security/encryption/always-encrypted-database-engine), follow below steps: -1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](../azure-sql/database/always-encrypted-azure-key-vault-configure.md?tabs=azure-powershell) +1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell) 2. Make sure to great access to the key vault where the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) is stored. Refer to this [article](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true#key-vaults) for required permissions. |
| data-factory | Connector Sql Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-sql-server.md | To learn details about the properties, check [GetMetadata activity](control-flow When you copy data from/to SQL Server with [Always Encrypted](/sql/relational-databases/security/encryption/always-encrypted-database-engine), follow below steps: -1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](../azure-sql/database/always-encrypted-azure-key-vault-configure.md?tabs=azure-powershell) +1. Store the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) in an [Azure Key Vault](../key-vault/general/overview.md). Learn more on [how to configure Always Encrypted by using Azure Key Vault](/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell) 2. Make sure to grant access to the key vault where the [Column Master Key (CMK)](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true) is stored. Refer to this [article](/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-ver15&preserve-view=true#key-vaults) for required permissions. |
| data-factory | Connector Troubleshoot Synapse Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-troubleshoot-synapse-sql.md | This article provides suggestions to troubleshoot common problems with the Azure | Cause analysis | Recommendation | | :-- | :-- |- | For Azure SQL, if the error message contains the string "SqlErrorNumber=47073", it means that public network access is denied in the connectivity setting. | On the Azure SQL firewall, set the **Deny public network access** option to *No*. For more information, see [Azure SQL connectivity settings](../azure-sql/database/connectivity-settings.md#deny-public-network-access). | - | For Azure SQL, if the error message contains an SQL error code such as "SqlErrorNumber=[errorcode]", see the Azure SQL troubleshooting guide. | For a recommendation, see [Troubleshoot connectivity issues and other errors with Azure SQL Database and Azure SQL Managed Instance](../azure-sql/database/troubleshoot-common-errors-issues.md). | + | For Azure SQL, if the error message contains the string "SqlErrorNumber=47073", it means that public network access is denied in the connectivity setting. | On the Azure SQL firewall, set the **Deny public network access** option to *No*. For more information, see [Azure SQL connectivity settings](/azure/azure-sql/database/connectivity-settings#deny-public-network-access). | + | For Azure SQL, if the error message contains an SQL error code such as "SqlErrorNumber=[errorcode]", see the Azure SQL troubleshooting guide. | For a recommendation, see [Troubleshoot connectivity issues and other errors with Azure SQL Database and Azure SQL Managed Instance](/azure/azure-sql/database/troubleshoot-common-errors-issues). | | Check to see whether port 1433 is in the firewall allowlist. | For more information, see [Ports used by SQL Server](/sql/sql-server/install/configure-the-windows-firewall-to-allow-sql-server-access#ports-used-by-). | | If the error message contains the string "SqlException", SQL Database the error indicates that some specific operation failed. | For more information, search by SQL error code in [Database engine errors](/sql/relational-databases/errors-events/database-engine-events-and-errors). For further help, contact Azure SQL support. | | If this is a transient issue (for example, an instable network connection), add retry in the activity policy to mitigate. | For more information, see [Pipelines and activities](./concepts-pipelines-activities.md#activity-policy). |- | If the error message contains the string "Client with IP address '...' is not allowed to access the server", and you're trying to connect to Azure SQL Database, the error is usually caused by an Azure SQL Database firewall issue. | In the Azure SQL Server firewall configuration, enable the **Allow Azure services and resources to access this server** option. For more information, see [Azure SQL Database and Azure Synapse IP firewall rules](../azure-sql/database/firewall-configure.md). | + | If the error message contains the string "Client with IP address '...' is not allowed to access the server", and you're trying to connect to Azure SQL Database, the error is usually caused by an Azure SQL Database firewall issue. | In the Azure SQL Server firewall configuration, enable the **Allow Azure services and resources to access this server** option. For more information, see [Azure SQL Database and Azure Synapse IP firewall rules](/azure/azure-sql/database/firewall-configure). | ## Error code: SqlOperationFailed |
| data-factory | Control Flow Execute Data Flow Activity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/control-flow-execute-data-flow-activity.md | dataflow | The reference to the Data Flow being executed | DataFlowReference | Y integrationRuntime | The compute environment the data flow runs on. If not specified, the auto-resolve Azure integration runtime will be used. | IntegrationRuntimeReference | No compute.coreCount | The number of cores used in the spark cluster. Can only be specified if the auto-resolve Azure Integration runtime is used | 8, 16, 32, 48, 80, 144, 272 | No compute.computeType | The type of compute used in the spark cluster. Can only be specified if the auto-resolve Azure Integration runtime is used | "General", "MemoryOptimized" | No-staging.linkedService | If you're using an Azure Synapse Analytics source or sink, specify the storage account used for PolyBase staging.<br/><br/>If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](../azure-sql/database/vnet-service-endpoint-rule-overview.md#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Also learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.<br/> | LinkedServiceReference | Only if the data flow reads or writes to an Azure Synapse Analytics +staging.linkedService | If you're using an Azure Synapse Analytics source or sink, specify the storage account used for PolyBase staging.<br/><br/>If your Azure Storage is configured with VNet service endpoint, you must use managed identity authentication with "allow trusted Microsoft service" enabled on storage account, refer to [Impact of using VNet Service Endpoints with Azure storage](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#impact-of-using-virtual-network-service-endpoints-with-azure-storage). Also learn the needed configurations for [Azure Blob](connector-azure-blob-storage.md#managed-identity) and [Azure Data Lake Storage Gen2](connector-azure-data-lake-storage.md#managed-identity) respectively.<br/> | LinkedServiceReference | Only if the data flow reads or writes to an Azure Synapse Analytics staging.folderPath | If you're using an Azure Synapse Analytics source or sink, the folder path in blob storage account used for PolyBase staging | String | Only if the data flow reads or writes to Azure Synapse Analytics traceLevel | Set logging level of your data flow activity execution | Fine, Coarse, None | No |
| data-factory | Control Flow Get Metadata Activity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/control-flow-get-metadata-activity.md | Note the following: |: |: |: |: | | [Amazon RDS for SQL Server](connector-amazon-rds-for-sql-server.md) | √ | √ | √ | | [Azure SQL Database](connector-azure-sql-database.md) | √ | √ | √ |-| [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) | √ | √ | √ | +| [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) | √ | √ | √ | | [Azure Synapse Analytics](connector-azure-sql-data-warehouse.md) | √ | √ | √ | | [SQL Server](connector-sql-server.md) | √ | √ | √ | |
| data-factory | Copy Activity Performance Troubleshooting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/copy-activity-performance-troubleshooting.md | Activity execution time varies when the dataset is based on different Integratio - Azure SQL Database tier is not high enough. - - Azure SQL Database DTU usage is close to 100%. You can [monitor the performance](../azure-sql/database/monitor-tune-overview.md) and consider to upgrade the Azure SQL Database tier. + - Azure SQL Database DTU usage is close to 100%. You can [monitor the performance](/azure/azure-sql/database/monitor-tune-overview) and consider to upgrade the Azure SQL Database tier. - Indexes are not set properly. Remove all the indexes before data load and recreate them after load complete. Here is performance monitoring and tuning references for some of the supported d * Azure Blob storage: [Scalability and performance targets for Blob storage](../storage/blobs/scalability-targets.md) and [Performance and scalability checklist for Blob storage](../storage/blobs/storage-performance-checklist.md). * Azure Table storage: [Scalability and performance targets for Table storage](../storage/tables/scalability-targets.md) and [Performance and scalability checklist for Table storage](../storage/tables/storage-performance-checklist.md).-* Azure SQL Database: You can [monitor the performance](../azure-sql/database/monitor-tune-overview.md) and check the Database Transaction Unit (DTU) percentage. +* Azure SQL Database: You can [monitor the performance](/azure/azure-sql/database/monitor-tune-overview) and check the Database Transaction Unit (DTU) percentage. * Azure Synapse Analytics: Its capability is measured in Data Warehouse Units (DWUs). See [Manage compute power in Azure Synapse Analytics (Overview)](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md). * Azure Cosmos DB: [Performance levels in Azure Cosmos DB](../cosmos-db/performance-levels.md). * SQL Server: [Monitor and tune for performance](/sql/relational-databases/performance/monitor-and-tune-for-performance). |
| data-factory | Create Azure Ssis Integration Runtime Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/create-azure-ssis-integration-runtime-portal.md | If you select the check box, complete the following steps to bring your own data Select **Test connection** when applicable, and if it's successful, select **Continue**. > [!NOTE]-> If you use Azure SQL Database server to host SSISDB, your data will be stored in geo-redundant storage for backups by default. If you don't want your data to be replicated in other regions, please follow the instructions to [Configure backup storage redundancy by using PowerShell](../azure-sql/database/automated-backups-overview.md?tabs=single-database#configure-backup-storage-redundancy-by-using-powershell). +> If you use Azure SQL Database server to host SSISDB, your data will be stored in geo-redundant storage for backups by default. If you don't want your data to be replicated in other regions, please follow the instructions to [Configure backup storage redundancy by using PowerShell](/azure/azure-sql/database/automated-backups-overview?tabs=single-database#configure-backup-storage-redundancy-by-using-powershell). #### Creating Azure-SSIS IR package stores |
| data-factory | Create Azure Ssis Integration Runtime Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/create-azure-ssis-integration-runtime-powershell.md | If you don't use SSISDB, you can omit the `CatalogServerEndpoint`, `CatalogPrici If you don't use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB, or require access to on-premises data, you can omit the `VNetId` and `Subnet` parameters or pass empty values for them. You can also omit them if you configure a self-hosted IR as proxy for your Azure-SSIS IR to access data on-premises. Otherwise, you can't omit them and must pass valid values from your virtual network configuration. For more information, see [Join an Azure-SSIS IR to a virtual network](./join-azure-ssis-integration-runtime-virtual-network.md). -If you use managed instance to host SSISDB, you can omit the `CatalogPricingTier` parameter or pass an empty value for it. Otherwise, you can't omit it and must pass a valid value from the list of supported pricing tiers for Azure SQL Database. For more information, see [SQL Database resource limits](../azure-sql/database/resource-limits-logical-server.md). +If you use managed instance to host SSISDB, you can omit the `CatalogPricingTier` parameter or pass an empty value for it. Otherwise, you can't omit it and must pass a valid value from the list of supported pricing tiers for Azure SQL Database. For more information, see [SQL Database resource limits](/azure/azure-sql/database/resource-limits-logical-server). If you use Azure AD authentication with the specified system/user-assigned managed identity for your data factory to connect to the database server, you can omit the `CatalogAdminCredential` parameter. But you must add the specified system/user-assigned managed identity for your data factory into an Azure AD group with access permissions to the database server. For more information, see [Enable Azure AD authentication for an Azure-SSIS IR](./enable-aad-authentication-azure-ssis-ir.md). Otherwise, you can't omit it and must pass a valid object formed from your server admin username and password for SQL authentication. |
| data-factory | Create Azure Ssis Integration Runtime | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/create-azure-ssis-integration-runtime.md | These articles shows how to provision an Azure-SSIS IR by using the [Azure porta If you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a SQL managed instance with private endpoint to host SSISDB, or if you require access to on-premises data without configuring a self-hosted IR, you need to join your Azure-SSIS IR to a virtual network. For more information, see [Join an Azure-SSIS IR to a virtual network](./join-azure-ssis-integration-runtime-virtual-network.md). - - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a SQL managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](../azure-sql/database/secure-database-tutorial.md#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). + - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a SQL managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](/azure/azure-sql/database/secure-database-tutorial#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). - - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](../azure-sql/database/firewall-configure.md). + - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](/azure/azure-sql/database/firewall-configure). - You can connect to the database server by using SQL authentication with your server admin credentials, or by using Azure AD authentication with the specified system/user-assigned managed identity for your data factory. For the latter, you need to add the specified system/user-assigned managed identity for your data factory into an Azure AD group with access permissions to the database server. For more information, see [Enable Azure AD authentication for an Azure-SSIS IR](./enable-aad-authentication-azure-ssis-ir.md). The following table compares certain features of an Azure SQL Database server an | **Scheduling** | The SQL Server Agent is not available.<br/><br/>See [Schedule a package execution in a Data Factory pipeline](/sql/integration-services/lift-shift/ssis-azure-schedule-packages#activity).| The Managed Instance Agent is available. | | **Authentication** | You can create an SSISDB instance with a contained database user who represents any Azure AD group with the managed identity of your data factory as a member in the **db_owner** role.<br/><br/>See [Enable Azure AD authentication to create an SSISDB in Azure SQL Database server](enable-aad-authentication-azure-ssis-ir.md#enable-azure-ad-authentication-on-azure-sql-database). | You can create an SSISDB instance with a contained database user who represents the managed identity of your data factory. <br/><br/>See [Enable Azure AD authentication to create an SSISDB in Azure SQL Managed Instance](enable-aad-authentication-azure-ssis-ir.md#enable-azure-ad-authentication-on-azure-sql-managed-instance). | | **Service tier** | When you create an Azure-SSIS IR with your Azure SQL Database server, you can select the service tier for SSISDB. There are multiple service tiers. | When you create an Azure-SSIS IR with your managed instance, you can't select the service tier for SSISDB. All databases in your managed instance share the same resource allocated to that instance. |-| **Virtual network** | Your Azure-SSIS IR can join an Azure Resource Manager virtual network if you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints. | Your Azure-SSIS IR can join an Azure Resource Manager virtual network if you use a managed instance with private endpoint. The virtual network is required when you don't enable a public endpoint for your managed instance.<br/><br/>If you join your Azure-SSIS IR to the same virtual network as your managed instance, make sure that your Azure-SSIS IR is in a different subnet from your managed instance. If you join your Azure-SSIS IR to a different virtual network from your managed instance, we recommend either a virtual network peering or a network-to-network connection. See [Connect your application to an Azure SQL Database Managed Instance](../azure-sql/managed-instance/connect-application-instance.md). | -| **Distributed transactions** | This feature is supported through elastic transactions. Microsoft Distributed Transaction Coordinator (MSDTC) transactions are not supported. If your SSIS packages use MSDTC to coordinate distributed transactions, consider migrating to elastic transactions for Azure SQL Database. For more information, see [Distributed transactions across cloud databases](../azure-sql/database/elastic-transactions-overview.md). | Not supported. | +| **Virtual network** | Your Azure-SSIS IR can join an Azure Resource Manager virtual network if you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints. | Your Azure-SSIS IR can join an Azure Resource Manager virtual network if you use a managed instance with private endpoint. The virtual network is required when you don't enable a public endpoint for your managed instance.<br/><br/>If you join your Azure-SSIS IR to the same virtual network as your managed instance, make sure that your Azure-SSIS IR is in a different subnet from your managed instance. If you join your Azure-SSIS IR to a different virtual network from your managed instance, we recommend either a virtual network peering or a network-to-network connection. See [Connect your application to an Azure SQL Database Managed Instance](/azure/azure-sql/managed-instance/connect-application-instance). | +| **Distributed transactions** | This feature is supported through elastic transactions. Microsoft Distributed Transaction Coordinator (MSDTC) transactions are not supported. If your SSIS packages use MSDTC to coordinate distributed transactions, consider migrating to elastic transactions for Azure SQL Database. For more information, see [Distributed transactions across cloud databases](/azure/azure-sql/database/elastic-transactions-overview). | Not supported. | | | | | |
| data-factory | Data Flow Troubleshoot Connector Format | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/data-flow-troubleshoot-connector-format.md | When you use the Synapse as a source/sink in the data flow to preview data, debu Confirm the SQL pool was created from the Azure Synapse workspace. - If the SQL pool was created from the Azure Synapse workspace, no additional steps are necessary. You no longer need to re-register the Managed Identity (MI) of the workspace. The system assigned managed identity (SA-MI) of the workspace is a member of the Synapse Administrator role and thus has elevated privileges on the dedicated SQL pools of the workspace.-- If the SQL pool is a dedicated SQL pool (formerly SQL DW) pre-dating Azure Synapse, only enable MI for your SQL server and assign the permission of the staging store to the MI of your SQL Server. You can refer to the steps in this article as an example: [Use virtual network service endpoints and rules for servers in Azure SQL Database](../azure-sql/database/vnet-service-endpoint-rule-overview.md#steps).+- If the SQL pool is a dedicated SQL pool (formerly SQL DW) pre-dating Azure Synapse, only enable MI for your SQL server and assign the permission of the staging store to the MI of your SQL Server. You can refer to the steps in this article as an example: [Use virtual network service endpoints and rules for servers in Azure SQL Database](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#steps). ### Failed with an error: "SQLServerException: Not able to validate external location because the remote server returned an error: (403)" Currently folder names that contain certain special characters are not supported #### Recommendation -For Cause 1, you can refer to the following document: [Use virtual network service endpoints and rules for servers in Azure SQL Database-Steps](../azure-sql/database/vnet-service-endpoint-rule-overview.md#steps) to solve this issue. +For Cause 1, you can refer to the following document: [Use virtual network service endpoints and rules for servers in Azure SQL Database-Steps](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#steps) to solve this issue. For Cause 2, work around it with one of the following options: |
| data-factory | Data Movement Security Considerations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/data-movement-security-considerations.md | Some data stores in the cloud also require that you allow the IP address of the The following cloud data stores require that you allow the IP address of the self-hosted integration runtime machine. Some of these data stores, by default, might not require allow list. -* [Azure SQL Database](../azure-sql/database/firewall-configure.md) +* [Azure SQL Database](/azure/azure-sql/database/firewall-configure) * [Azure Synapse Analytics](../synapse-analytics/sql-data-warehouse/create-data-warehouse-portal.md) * [Azure Data Lake Store](../data-lake-store/data-lake-store-secure-data.md#set-ip-address-range-for-data-access) * [Azure Cosmos DB](../cosmos-db/how-to-configure-firewall.md) |
| data-factory | Enable Aad Authentication Azure Ssis Ir | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/enable-aad-authentication-azure-ssis-ir.md | You can use an existing Azure AD group or create a new one using Azure AD PowerS ### Configure Azure AD authentication for Azure SQL Database -You can [Configure and manage Azure AD authentication for Azure SQL Database](../azure-sql/database/authentication-aad-configure.md) using the following steps: +You can [Configure and manage Azure AD authentication for Azure SQL Database](/azure/azure-sql/database/authentication-aad-configure) using the following steps: 1. In Azure portal, select **All services** -> **SQL servers** from the left-hand navigation. For this next step, you need [SSMS](/sql/ssms/download-sql-server-management-st 2. In the **Connect to Server** dialog, enter your server name in the **Server name** field. -3. In the **Authentication** field, select **Active Directory - Universal with MFA support** (you can also use the other two Active Directory authentication types, see [Configure and manage Azure AD authentication for Azure SQL Database](../azure-sql/database/authentication-aad-configure.md)). +3. In the **Authentication** field, select **Active Directory - Universal with MFA support** (you can also use the other two Active Directory authentication types, see [Configure and manage Azure AD authentication for Azure SQL Database](/azure/azure-sql/database/authentication-aad-configure)). 4. In the **User name** field, enter the name of Azure AD account that you set as the server administrator, e.g. testuser@xxxonline.com. Azure SQL Managed Instance supports creating a database with the specified syste ### Configure Azure AD authentication for Azure SQL Managed Instance -Follow the steps in [Provision an Azure AD administrator for Azure SQL Managed Instance](../azure-sql/database/authentication-aad-configure.md#provision-azure-ad-admin-sql-managed-instance). +Follow the steps in [Provision an Azure AD administrator for Azure SQL Managed Instance](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-managed-instance). ### Add the specified system/user-assigned managed identity for your ADF or Azure Synapse as a user in Azure SQL Managed Instance |
| data-factory | How To Clean Up Ssisdb Logs With Elastic Jobs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/how-to-clean-up-ssisdb-logs-with-elastic-jobs.md | If you use Azure SQL Database server to host SSISDB, it doesn't have a built-in Elastic Database Jobs is an Azure service that can automate and run jobs against a database or group of databases. You can schedule, run, and monitor these jobs by using Azure portal, Azure PowerShell, T-SQL, or REST APIs. Use Elastic Database Jobs to invoke the relevant SSISDB stored procedures for log clean-up one time or on a schedule. You can choose the schedule interval based on SSISDB resource usage to avoid heavy database load. -For more info, see [Manage groups of databases with Elastic Database Jobs](../azure-sql/database/elastic-jobs-overview.md). +For more info, see [Manage groups of databases with Elastic Database Jobs](/azure/azure-sql/database/elastic-jobs-overview). The following sections describe how to invoke the relevant SSISDB stored procedures, `[internal].[cleanup_server_retention_window_exclusive]`/`[internal].[cleanup_completed_jobs_exclusive]`/`[internal].[cleanup_expired_worker]`, which remove SSISDB logs that are outside their specific retention periods. The following sections describe how to invoke the relevant SSISDB stored procedu [!INCLUDE [requires-azurerm](../../includes/requires-azurerm.md)] -The following Azure PowerShell scripts create a new Elastic Job that invokes your selected SSISDB log clean-up stored procedure. For more info, see [Create an Elastic Job agent using PowerShell](../azure-sql/database/elastic-jobs-powershell-create.md). +The following Azure PowerShell scripts create a new Elastic Job that invokes your selected SSISDB log clean-up stored procedure. For more info, see [Create an Elastic Job agent using PowerShell](/azure/azure-sql/database/elastic-jobs-powershell-create). #### Create parameters $Job | Set-AzureRmSqlElasticJob -IntervalType $IntervalType -IntervalCount $Inte ### Configure Elastic Database Jobs using T-SQL -The following T-SQL scripts create a new Elastic Job that invokes your selected SSISDB log clean-up stored procedure. For more info, see [Use T-SQL to create and manage Elastic Database Jobs](../azure-sql/database/elastic-jobs-tsql-create-manage.md). +The following T-SQL scripts create a new Elastic Job that invokes your selected SSISDB log clean-up stored procedure. For more info, see [Use T-SQL to create and manage Elastic Database Jobs](/azure/azure-sql/database/elastic-jobs-tsql-create-manage). 1. Identify an empty S0/higher service tier of Azure SQL Database or create a new one for your job database. Then create an Elastic Job Agent in [Azure portal](https://portal.azure.com/#create/Microsoft.SQLElasticJobAgent). The following T-SQL scripts create a new Elastic Job that invokes your selected SELECT * FROM jobs.target_group_members WHERE target_group_name = 'SSISDBTargetGroup'; ``` -4. Create SSISDB log clean-up user from login in SSISDB and grant it permissions to invoke SSISDB log clean-up stored procedure. For detailed guidance, see [Manage logins](../azure-sql/database/logins-create-manage.md). +4. Create SSISDB log clean-up user from login in SSISDB and grant it permissions to invoke SSISDB log clean-up stored procedure. For detailed guidance, see [Manage logins](/azure/azure-sql/database/logins-create-manage). ```sql -- Connect to the master database of target server that hosts SSISDB |
| data-factory | How To Use Sql Managed Instance With Ir | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/how-to-use-sql-managed-instance-with-ir.md | You can now move your SQL Server Integration Services (SSIS) projects, packages, - Inside the same virtual network as the managed instance, with **different subnet**. - Inside a different virtual network than the managed instance, via virtual network peering (which is limited to the same region due to Global VNet peering constraints) or a connection from virtual network to virtual network. - For more info on SQL Managed Instance connectivity, see [Connect your application to Azure SQL Managed Instance](../azure-sql/managed-instance/connect-application-instance.md). + For more info on SQL Managed Instance connectivity, see [Connect your application to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/connect-application-instance). 1. [Configure virtual network](#configure-virtual-network). - Over public endpoint - Azure SQL Managed Instances can provide connectivity over [public endpoints](../azure-sql/managed-instance/public-endpoint-configure.md). Inbound and outbound requirements need to meet to allow traffic between SQL Managed Instance and Azure-SSIS IR: + Azure SQL Managed Instances can provide connectivity over [public endpoints](/azure/azure-sql/managed-instance/public-endpoint-configure). Inbound and outbound requirements need to meet to allow traffic between SQL Managed Instance and Azure-SSIS IR: - when Azure-SSIS IR not inside a virtual network (preferred) You can now move your SQL Server Integration Services (SSIS) projects, packages, |||||| |TCP|Azure Cloud service tag|*|VirtualNetwork|3342| - For more information, see [Allow public endpoint traffic on the network security group](../azure-sql/managed-instance/public-endpoint-configure.md#allow-public-endpoint-traffic-on-the-network-security-group). + For more information, see [Allow public endpoint traffic on the network security group](/azure/azure-sql/managed-instance/public-endpoint-configure#allow-public-endpoint-traffic-on-the-network-security-group). - when Azure-SSIS IR inside a virtual network You can now move your SQL Server Integration Services (SSIS) projects, packages, | Transport protocol | Source | Source port range | Destination |Destination port range | ||||||- |TCP|VirtualNetwork|*|[SQL Managed Instance public endpoint IP address](../azure-sql/managed-instance/management-endpoint-find-ip-address.md)|3342| + |TCP|VirtualNetwork|*|[SQL Managed Instance public endpoint IP address](/azure/azure-sql/managed-instance/management-endpoint-find-ip-address)|3342| ### Configure virtual network |
| data-factory | Join Azure Ssis Integration Runtime Virtual Network | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/join-azure-ssis-integration-runtime-virtual-network.md | When joining your Azure-SSIS IR to a virtual network, remember these important p If you host SSISDB in Azure SQL Database server configured with a virtual network service endpoint, make sure that you join your Azure-SSIS IR to the same virtual network and subnet. -If you host SSISDB in Azure SQL Managed Instance that joins a virtual network, make sure that you join your Azure-SSIS IR to the same virtual network, but in a different subnet than the managed instance. To join your Azure-SSIS IR to a different virtual network than the managed instance, we recommend either virtual network peering (which is limited to the same region) or virtual network-to-virtual network connection. For more information, see [Connect your application to Azure SQL Managed Instance](../azure-sql/managed-instance/connect-application-instance.md). +If you host SSISDB in Azure SQL Managed Instance that joins a virtual network, make sure that you join your Azure-SSIS IR to the same virtual network, but in a different subnet than the managed instance. To join your Azure-SSIS IR to a different virtual network than the managed instance, we recommend either virtual network peering (which is limited to the same region) or virtual network-to-virtual network connection. For more information, see [Connect your application to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/connect-application-instance). ## Access to Azure data stores |
| data-factory | Lab Data Flow Data Share | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/lab-data-flow-data-share.md | The data used in this lab is New York City taxi data. To import it into your dat * **Azure subscription**: If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. -* **Azure SQL Database**: If you don't have a SQL DB, learn how to [create a SQL DB account](../azure-sql/database/single-database-create-quickstart.md?tabs=azure-portal) +* **Azure SQL Database**: If you don't have a SQL DB, learn how to [create a SQL DB account](/azure/azure-sql/database/single-database-create-quickstart?tabs=azure-portal) * **Azure Data Lake Storage Gen2 storage account**: If you don't have an ADLS Gen2 storage account, learn how to [create an ADLS Gen2 storage account](../storage/common/storage-account-create.md). |
| data-factory | Load Azure Sql Data Warehouse | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/load-azure-sql-data-warehouse.md | This article shows you how to use the Copy Data tool to _load data from Azure SQ * Azure subscription: If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. * Azure Synapse Analytics: The data warehouse holds the data that's copied over from the SQL database. If you don't have an Azure Synapse Analytics, see the instructions in [Create an Azure Synapse Analytics](../synapse-analytics/sql-data-warehouse/load-data-from-azure-blob-storage-using-copy.md).-* Azure SQL Database: This tutorial copies data from the Adventure Works LT sample dataset in Azure SQL Database. You can create this sample database in SQL Database by following the instructions in [Create a sample database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md). +* Azure SQL Database: This tutorial copies data from the Adventure Works LT sample dataset in Azure SQL Database. You can create this sample database in SQL Database by following the instructions in [Create a sample database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). * Azure storage account: Azure Storage is used as the _staging_ blob in the bulk copy operation. If you don't have an Azure storage account, see the instructions in [Create a storage account](../storage/common/storage-account-create.md). ## Create a data factory |
| data-factory | Ssis Integration Runtime Ssis Activity Faq | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/ssis-integration-runtime-ssis-activity-faq.md | This error occurs when package execution can't find a file in the local disk in ### Error message: "The database 'SSISDB' has reached its size quota " A potential cause is that the SSISDB database created in Azure SQL Database or in SQL Managed Instance has reached its quota. Try these actions:-* Consider increasing the DTU of your database. You can find details in [SQL Database limits for a logical server](../azure-sql/database/resource-limits-logical-server.md). +* Consider increasing the DTU of your database. You can find details in [SQL Database limits for a logical server](/azure/azure-sql/database/resource-limits-logical-server). * Check whether your package would generate many logs. If so, you can configure an elastic job to clean up these logs. For details, see [Clean up SSISDB logs with Azure Elastic Database jobs](how-to-clean-up-ssisdb-logs-with-elastic-jobs.md). ### Error message: "The request limit for the database is ... and has been reached. " -If many packages are running in parallel in the SSIS integration runtime, this error might occur because SSISDB has hit its request limit. Consider increasing the DTU of SSISDB to resolve this issue. You can find details in [SQL Database limits for a logical server](../azure-sql/database/resource-limits-logical-server.md). +If many packages are running in parallel in the SSIS integration runtime, this error might occur because SSISDB has hit its request limit. Consider increasing the DTU of SSISDB to resolve this issue. You can find details in [SQL Database limits for a logical server](/azure/azure-sql/database/resource-limits-logical-server). ### Error message: "SSIS Operation failed with unexpected operation status: ... " |
| data-factory | Tutorial Bulk Copy Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-bulk-copy-portal.md | If you don't have an Azure subscription, create a [free account](https://azure.m ## Prerequisites * **Azure Storage account**. The Azure Storage account is used as staging blob storage in the bulk copy operation. -* **Azure SQL Database**. This database contains the source data. Create a database in SQL Database with Adventure Works LT sample data following [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) article. This tutorial copies all the tables from this sample database to an Azure Synapse Analytics. +* **Azure SQL Database**. This database contains the source data. Create a database in SQL Database with Adventure Works LT sample data following [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) article. This tutorial copies all the tables from this sample database to an Azure Synapse Analytics. * **Azure Synapse Analytics**. This data warehouse holds the data copied over from the SQL Database. If you don't have an Azure Synapse Analytics workspace, see the [Get started with Azure Synapse Analytics](..\synapse-analytics\get-started.md) article for steps to create one. ## Azure services to access SQL server |
| data-factory | Tutorial Bulk Copy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-bulk-copy.md | If you don't have an Azure subscription, create a [free](https://azure.microsoft **Prepare the source Azure SQL Database**: -Create a database with the Adventure Works LT sample data in SQL Database by following [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) article. This tutorial copies all the tables from this sample database to Azure Synapse Analytics. +Create a database with the Adventure Works LT sample data in SQL Database by following [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) article. This tutorial copies all the tables from this sample database to Azure Synapse Analytics. **Prepare the sink Azure Synapse Analytics**: |
| data-factory | Tutorial Control Flow Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-control-flow-portal.md | This tutorial uses Azure portal. You can use other mechanisms to interact with A * **Azure subscription**. If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account before you begin. * **Azure Storage account**. You use the blob storage as **source** data store. If you don't have an Azure storage account, see the [Create a storage account](../storage/common/storage-account-create.md) article for steps to create one.-* **Azure SQL Database**. You use the database as **sink** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) article for steps to create one. +* **Azure SQL Database**. You use the database as **sink** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) article for steps to create one. ### Create blob table |
| data-factory | Tutorial Control Flow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-control-flow.md | If you don't have an Azure subscription, create a [free account](https://azure.m * Azure Storage account. You use blob storage as a source data store. If you don't have an Azure storage account, see [Create a storage account](../storage/common/storage-account-create.md). * Azure Storage Explorer. To install this tool, see [Azure Storage Explorer](https://storageexplorer.com/).-* Azure SQL Database. You use the database as a sink data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md). +* Azure SQL Database. You use the database as a sink data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). * Visual Studio. This article uses Visual Studio 2019. * Azure .NET SDK. Download and install the [Azure .NET SDK](https://azure.microsoft.com/downloads/). |
| data-factory | Tutorial Copy Data Dot Net | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-copy-data-dot-net.md | If you don't have an Azure subscription, create a [free Azure account](https://a ## Prerequisites * *Azure Storage account*. You use the blob storage as *source* data store. If you don't have an Azure storage account, see [Create a general-purpose storage account](../storage/common/storage-account-create.md).-* *Azure SQL Database*. You use the database as *sink* data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md). +* *Azure SQL Database*. You use the database as *sink* data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). * *Visual Studio*. The walkthrough in this article uses Visual Studio 2019. * *[Azure SDK for .NET](/dotnet/azure/dotnet-tools)*. * *Azure Active Directory application*. If you don't have an Azure Active Directory application, see the [Create an Azure Active Directory application](../active-directory/develop/howto-create-service-principal-portal.md#register-an-application-with-azure-ad-and-create-a-service-principal) section of [How to: Use the portal to create an Azure AD application](../active-directory/develop/howto-create-service-principal-portal.md). Copy the following values for use in later steps: **Application (client) ID**, **authentication key**, and **Directory (tenant) ID**. Assign the application to the **Contributor** role by following the instructions in the same article. |
| data-factory | Tutorial Copy Data Portal Private | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-copy-data-portal-private.md | In this tutorial, you do the following steps: ## Prerequisites * **Azure subscription**. If you don't have an Azure subscription, create a [free Azure account](https://azure.microsoft.com/free/) before you begin. * **Azure storage account**. You use Blob storage as a *source* data store. If you don't have a storage account, see [Create an Azure storage account](../storage/common/storage-account-create.md?tabs=azure-portal) for steps to create one. *Ensure the storage account allows access only from selected networks.* -* **Azure SQL Database**. You use the database as a *sink* data store. If you don't have an Azure SQL database, see [Create a SQL database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. *Ensure the SQL Database account allows access only from selected networks.* +* **Azure SQL Database**. You use the database as a *sink* data store. If you don't have an Azure SQL database, see [Create a SQL database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. *Ensure the SQL Database account allows access only from selected networks.* ### Create a blob and a SQL table |
| data-factory | Tutorial Copy Data Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-copy-data-portal.md | In this tutorial, you perform the following steps: ## Prerequisites * **Azure subscription**. If you don't have an Azure subscription, create a [free Azure account](https://azure.microsoft.com/free/) before you begin. * **Azure storage account**. You use Blob storage as a *source* data store. If you don't have a storage account, see [Create an Azure storage account](../storage/common/storage-account-create.md) for steps to create one.-* **Azure SQL Database**. You use the database as a *sink* data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. +* **Azure SQL Database**. You use the database as a *sink* data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. ### Create a blob and a SQL table |
| data-factory | Tutorial Copy Data Tool | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-copy-data-tool.md | In this tutorial, you perform the following steps: * **Azure subscription**: If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. * **Azure Storage account**: Use Blob storage as the _source_ data store. If you don't have an Azure Storage account, see the instructions in [Create a storage account](../storage/common/storage-account-create.md).-* **Azure SQL Database**: Use a SQL Database as the _sink_ data store. If you don't have a SQL Database, see the instructions in [Create a SQL Database](../azure-sql/database/single-database-create-quickstart.md). +* **Azure SQL Database**: Use a SQL Database as the _sink_ data store. If you don't have a SQL Database, see the instructions in [Create a SQL Database](/azure/azure-sql/database/single-database-create-quickstart). ### Create a blob and a SQL table Prepare your Blob storage and your SQL Database for the tutorial by performing t 2. Allow Azure services to access SQL Server. Verify that the setting **Allow Azure services and resources to access this server** is enabled for your server that's running SQL Database. This setting lets Data Factory write data to your database instance. To verify and turn on this setting, go to logical SQL server > Security > Firewalls and virtual networks > set the **Allow Azure services and resources to access this server** option to **ON**. > [!NOTE]- > The option to **Allow Azure services and resources to access this server** enables network access to your SQL Server from any Azure resource, not just those in your subscription. For more information, see [Azure SQL Server Firewall rules](../azure-sql/database/firewall-configure.md). Instead, you can use [Private endpoints](../private-link/private-endpoint-overview.md) to connect to Azure PaaS services without using public IPs. + > The option to **Allow Azure services and resources to access this server** enables network access to your SQL Server from any Azure resource, not just those in your subscription. For more information, see [Azure SQL Server Firewall rules](/azure/azure-sql/database/firewall-configure). Instead, you can use [Private endpoints](../private-link/private-endpoint-overview.md) to connect to Azure PaaS services without using public IPs. ## Create a data factory |
| data-factory | Tutorial Deploy Ssis Packages Azure Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-deploy-ssis-packages-azure-powershell.md | In this tutorial, you will: If you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB, or if you require access to on-premises data without configuring a self-hosted IR, you need to join your Azure-SSIS IR to a virtual network. For more information, see [Create an Azure-SSIS IR in a virtual network](./create-azure-ssis-integration-runtime.md). - - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](../azure-sql/database/secure-database-tutorial.md#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). + - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](/azure/azure-sql/database/secure-database-tutorial#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). - - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](../azure-sql/database/firewall-configure.md). + - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](/azure/azure-sql/database/firewall-configure). - You can connect to the database server by using SQL authentication with your server admin credentials, or by using Azure AD authentication with the specified system/user-assigned managed identity for your data factory. For the latter, you need to add the specified system/user-assigned managed identity for your data factory into an Azure AD group with access permissions to the database server. For more information, see [Create an Azure-SSIS IR with Azure AD authentication](./create-azure-ssis-integration-runtime.md). |
| data-factory | Tutorial Deploy Ssis Packages Azure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-deploy-ssis-packages-azure.md | In this tutorial, you complete the following steps: If you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB, or if you require access to on-premises data without configuring a self-hosted IR, you need to join your Azure-SSIS IR to a virtual network. For more information, see [Create an Azure-SSIS IR in a virtual network](./create-azure-ssis-integration-runtime.md). - - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](../azure-sql/database/secure-database-tutorial.md#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). + - Confirm that the **Allow access to Azure services** setting is enabled for the database server. This setting is not applicable when you use an Azure SQL Database server with IP firewall rules/virtual network service endpoints or a managed instance with private endpoint to host SSISDB. For more information, see [Secure Azure SQL Database](/azure/azure-sql/database/secure-database-tutorial#create-firewall-rules). To enable this setting by using PowerShell, see [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule). - - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](../azure-sql/database/firewall-configure.md). + - Add the IP address of the client machine, or a range of IP addresses that includes the IP address of the client machine, to the client IP address list in the firewall settings for the database server. For more information, see [Azure SQL Database server-level and database-level firewall rules](/azure/azure-sql/database/firewall-configure). - You can connect to the database server by using SQL authentication with your server admin credentials, or by using Azure Active Directory (Azure AD) authentication with the specified system/user-assigned managed identity for your data factory. For the latter, you need to add the specified system/user-assigned managed identity for your data factory into an Azure AD group with access permissions to the database server. For more information, see [Create an Azure-SSIS IR with Azure AD authentication](./create-azure-ssis-integration-runtime.md). |
| data-factory | Tutorial Incremental Copy Change Data Capture Feature Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-change-data-capture-feature-portal.md | In this tutorial, you create a pipeline that performs the following operations: If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account before you begin. ## Prerequisites-* **Azure SQL Database Managed Instance**. You use the database as the **source** data store. If you don't have an Azure SQL Database Managed Instance, see the [Create an Azure SQL Database Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md) article for steps to create one. +* **Azure SQL Database Managed Instance**. You use the database as the **source** data store. If you don't have an Azure SQL Database Managed Instance, see the [Create an Azure SQL Database Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart) article for steps to create one. * **Azure Storage account**. You use the blob storage as the **sink** data store. If you don't have an Azure storage account, see the [Create a storage account](../storage/common/storage-account-create.md) article for steps to create one. Create a container named **raw**. ### Create a data source table in Azure SQL Database |
| data-factory | Tutorial Incremental Copy Change Tracking Feature Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-change-tracking-feature-portal.md | In this tutorial, you create two pipelines that perform the following two operat If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account before you begin. ## Prerequisites-* **Azure SQL Database**. You use the database as the **source** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) article for steps to create one. +* **Azure SQL Database**. You use the database as the **source** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) article for steps to create one. * **Azure Storage account**. You use the blob storage as the **sink** data store. If you don't have an Azure storage account, see the [Create a storage account](../storage/common/storage-account-create.md) article for steps to create one. Create a container named **adftutorial**. ### Create a data source table in Azure SQL Database |
| data-factory | Tutorial Incremental Copy Change Tracking Feature Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-change-tracking-feature-powershell.md | If you don't have an Azure subscription, create a [free](https://azure.microsoft ## Prerequisites * Azure PowerShell. Install the latest Azure PowerShell modules by following instructions in [How to install and configure Azure PowerShell](/powershell/azure/install-Az-ps).-* **Azure SQL Database**. You use the database as the **source** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) article for steps to create one. +* **Azure SQL Database**. You use the database as the **source** data store. If you don't have a database in Azure SQL Database, see the [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) article for steps to create one. * **Azure Storage account**. You use the blob storage as the **sink** data store. If you don't have an Azure storage account, see the [Create a storage account](../storage/common/storage-account-create.md) article for steps to create one. Create a container named **adftutorial**. ### Create a data source table in your database |
| data-factory | Tutorial Incremental Copy Multiple Tables Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-multiple-tables-portal.md | If you don't have an Azure subscription, create a [free](https://azure.microsoft ## Prerequisites * **SQL Server**. You use a SQL Server database as the source data store in this tutorial. -* **Azure SQL Database**. You use a database in Azure SQL Database as the sink data store. If you don't have a database in SQL Database, see [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. +* **Azure SQL Database**. You use a database in Azure SQL Database as the sink data store. If you don't have a database in SQL Database, see [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. ### Create source tables in your SQL Server database |
| data-factory | Tutorial Incremental Copy Multiple Tables Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-multiple-tables-powershell.md | If you don't have an Azure subscription, create a [free](https://azure.microsoft ## Prerequisites * **SQL Server**. You use a SQL Server database as the source data store in this tutorial. -* **Azure SQL Database**. You use a database in Azure SQL Database as the sink data store. If you don't have a SQL database, see [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. +* **Azure SQL Database**. You use a database in Azure SQL Database as the sink data store. If you don't have a SQL database, see [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. ### Create source tables in your SQL Server database |
| data-factory | Tutorial Incremental Copy Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-portal.md | Here are the important steps to create this solution: If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account before you begin. ## Prerequisites-* **Azure SQL Database**. You use the database as the source data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. +* **Azure SQL Database**. You use the database as the source data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. * **Azure Storage**. You use the blob storage as the sink data store. If you don't have a storage account, see [Create a storage account](../storage/common/storage-account-create.md) for steps to create one. Create a container named adftutorial. ### Create a data source table in your SQL database |
| data-factory | Tutorial Incremental Copy Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/tutorial-incremental-copy-powershell.md | If you don't have an Azure subscription, create a [free](https://azure.microsoft [!INCLUDE [updated-for-az](../../includes/updated-for-az.md)] -* **Azure SQL Database**. You use the database as the source data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) for steps to create one. +* **Azure SQL Database**. You use the database as the source data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) for steps to create one. * **Azure Storage**. You use the blob storage as the sink data store. If you don't have a storage account, see [Create a storage account](../storage/common/storage-account-create.md) for steps to create one. Create a container named adftutorial. * **Azure PowerShell**. Follow the instructions in [Install and configure Azure PowerShell](/powershell/azure/install-Az-ps). |
| data-factory | Data Factory Compute Linked Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-compute-linked-services.md | You can create a Batch linked service to register a Batch pool of virtual machin If you are new to using the Batch service: -* Learn about [Azure Batch basics](../../azure-sql/database/sql-database-paas-overview.md). +* Learn about [Azure Batch basics](/azure/azure-sql/database/sql-database-paas-overview). * Learn about the [New-AzureBatchAccount](/previous-versions/azure/mt125880(v=azure.100)) cmdlet. Use this cmdlet to create a Batch account. Or, you can create the Batch account by using the [Azure portal](../../batch/batch-account-create-portal.md). For detailed information about using the cmdlet, see [Using PowerShell to manage a Batch account](/archive/blogs/windowshpc/using-azure-powershell-to-manage-azure-batch-account). * Learn about the [New-AzureBatchPool](/previous-versions/azure/mt125936(v=azure.100)) cmdlet. Use this cmdlet to create a Batch pool. |
| data-factory | Data Factory Copy Activity Performance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-copy-activity-performance.md | Here are performance monitoring and tuning references for some of the supported * Azure Blob storage: [Scalability and performance targets for Blob storage](../../storage/blobs/scalability-targets.md) and [Performance and scalability checklist for Blob storage](../../storage/blobs/storage-performance-checklist.md). * Azure Table storage: [Scalability and performance targets for Table storage](../../storage/tables/scalability-targets.md) and [Performance and scalability checklist for Table storage](../../storage/tables/storage-performance-checklist.md).-* Azure SQL Database: You can [monitor the performance](../../azure-sql/database/monitor-tune-overview.md) and check the database transaction unit (DTU) percentage +* Azure SQL Database: You can [monitor the performance](/azure/azure-sql/database/monitor-tune-overview) and check the database transaction unit (DTU) percentage * Azure Synapse Analytics: Its capability is measured in data warehouse units (DWUs); see [Manage compute power in Azure Synapse Analytics (Overview)](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md) * Azure Cosmos DB: [Performance levels in Azure Cosmos DB](../../cosmos-db/performance-levels.md) * On-premises SQL Server: [Monitor and tune for performance](/sql/relational-databases/performance/monitor-and-tune-for-performance) |
| data-factory | Data Factory Copy Data From Azure Blob Storage To Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-copy-data-from-azure-blob-storage-to-sql-database.md | Before you begin this tutorial, you must have the following prerequisites: * **Azure subscription**. If you don't have a subscription, you can create a free trial account in just a couple of minutes. See the [Free Trial](https://azure.microsoft.com/pricing/free-trial/) article for details. * **Azure Storage Account**. You use the blob storage as a **source** data store in this tutorial. if you don't have an Azure storage account, see the [Create a storage account](../../storage/common/storage-account-create.md) article for steps to create one.-* **Azure SQL Database**. You use Azure SQL Database as a **destination** data store in this tutorial. If you don't have a database in Azure SQL Database that you can use in the tutorial, See [How to create and configure a database in Azure SQL Database](../../azure-sql/database/single-database-create-quickstart.md) to create one. +* **Azure SQL Database**. You use Azure SQL Database as a **destination** data store in this tutorial. If you don't have a database in Azure SQL Database that you can use in the tutorial, See [How to create and configure a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) to create one. * **SQL Server 2012/2014 or Visual Studio 2013**. You use SQL Server Management Studio or Visual Studio to create a sample database and to view the result data in the database. ## Collect blob storage account name and key Now, prepare your Azure blob storage and Azure SQL Database for the tutorial by CREATE CLUSTERED INDEX IX_emp_ID ON dbo.emp (ID); ``` - **If you have SQL Server 2012/2014 installed on your computer:** follow instructions from [Managing Azure SQL Database using SQL Server Management Studio](../../azure-sql/database/single-database-manage.md) to connect to your server and run the SQL script. + **If you have SQL Server 2012/2014 installed on your computer:** follow instructions from [Managing Azure SQL Database using SQL Server Management Studio](/azure/azure-sql/database/single-database-manage) to connect to your server and run the SQL script. - If your client is not allowed to access the logical SQL server, you need to configure firewall for your server to allow access from your machine (IP Address). See [this article](../../azure-sql/database/firewall-configure.md) for steps to configure the firewall for your server. + If your client is not allowed to access the logical SQL server, you need to configure firewall for your server to allow access from your machine (IP Address). See [this article](/azure/azure-sql/database/firewall-configure) for steps to configure the firewall for your server. ## Create a data factory You have completed the prerequisites. You can create a data factory using one of the following ways. Click one of the options in the drop-down list at the top or the following links to perform the tutorial. |
| data-factory | Data Factory Customer Profiling Usecase | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-customer-profiling-usecase.md | ContosoΓÇÖs goal is to identify up-sell/cross-sell opportunities based on the ga In this solution, Contoso wants to evaluate the effectiveness of a marketing campaign it has recently launched. We start with the raw gaming logs, process and enrich them with geolocation data, join it with advertising reference data, and lastly copy them into an Azure SQL Database to analyze the campaignΓÇÖs impact. ## Deploy Solution-All you need to access and try out this simple use case is an [Azure subscription](https://azure.microsoft.com/pricing/free-trial/), an [Azure Blob storage account](../../storage/common/storage-account-create.md), and an [Azure SQL Database](../../azure-sql/database/single-database-create-quickstart.md). You deploy the customer profiling pipeline from the **Sample pipelines** tile on the home page of your data factory. +All you need to access and try out this simple use case is an [Azure subscription](https://azure.microsoft.com/pricing/free-trial/), an [Azure Blob storage account](../../storage/common/storage-account-create.md), and an [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). You deploy the customer profiling pipeline from the **Sample pipelines** tile on the home page of your data factory. 1. Create a data factory or open an existing data factory. See [Copy data from Blob Storage to SQL Database using Data Factory](data-factory-copy-data-from-azure-blob-storage-to-sql-database.md) for steps to create a data factory. 2. In the **DATA FACTORY** blade for the data factory, click the **Sample pipelines** tile. |
| data-factory | Data Factory Data Management Gateway | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-data-management-gateway.md | At Windows firewall level, these outbound ports are normally enabled. If not, yo > [!NOTE] > 1. Based on your source/ sinks, you may have to allow additional domains and outbound ports in your corporate/Windows firewall.-> 2. For some Cloud Databases (For example: [Azure SQL Database](../../azure-sql/database/firewall-configure.md), [Azure Data Lake](../../data-lake-store/data-lake-store-secure-data.md#set-ip-address-range-for-data-access), etc.), you may need to allow IP address of Gateway machine on their firewall configuration. +> 2. For some Cloud Databases (For example: [Azure SQL Database](/azure/azure-sql/database/firewall-configure), [Azure Data Lake](../../data-lake-store/data-lake-store-secure-data.md#set-ip-address-range-for-data-access), etc.), you may need to allow IP address of Gateway machine on their firewall configuration. > > |
| data-factory | Data Factory Data Movement Security Considerations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-data-movement-security-considerations.md | Some data stores in the cloud also require approving of IP address of the machin The following cloud data stores require approving of IP address of the gateway machine. Some of these data stores, by default, may not require approving of the IP address. -- [Azure SQL Database](../../azure-sql/database/firewall-configure.md) +- [Azure SQL Database](/azure/azure-sql/database/firewall-configure) - [Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/create-data-warehouse-portal.md) - [Azure Data Lake Store](../../data-lake-store/data-lake-store-secure-data.md#set-ip-address-range-for-data-access) - [Azure Cosmos DB](../../cosmos-db/how-to-configure-firewall.md) |
| data-factory | Data Factory Data Processing Using Batch | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-data-processing-using-batch.md | With the Batch service, you define Azure compute resources to execute your appli If you aren't familiar with Batch, the following articles help you understand the architecture/implementation of the solution described in this article: -* [Basics of Batch](../../azure-sql/database/sql-database-paas-overview.md) +* [Basics of Batch](/azure/azure-sql/database/sql-database-paas-overview) * [Batch feature overview](../../batch/batch-service-workflow-features.md) Optionally, to learn more about Batch, see [the Batch documentation](../../batch/index.yml). After you process data, you can consume it with online tools such as Power BI. H * [Use custom activities in a Data Factory pipeline](data-factory-use-custom-activities.md) * [Azure Batch](https://azure.microsoft.com/documentation/services/batch/) - * [Basics of Batch](../../azure-sql/database/sql-database-paas-overview.md) + * [Basics of Batch](/azure/azure-sql/database/sql-database-paas-overview) * [Overview of Batch features](../../batch/batch-service-workflow-features.md)) * [Create and manage a Batch account in the Azure portal](../../batch/batch-account-create-portal.md) * [Get started with the Batch client library for .NET](../../batch/quick-run-dotnet.md) |
| data-factory | Data Factory Use Custom Activities | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/v1/data-factory-use-custom-activities.md | The [Azure Data Factory - local environment](https://github.com/gbrueckl/Azure.D [batch-net-library]: ../../batch/quick-run-dotnet.md [batch-create-account]: ../../batch/batch-account-create-portal.md-[batch-technical-overview]:../../azure-sql/database/sql-database-paas-overview.md +[batch-technical-overview]:/azure/azure-sql/database/sql-database-paas-overview [batch-get-started]: ../../batch/quick-run-dotnet.md [use-custom-activities]: data-factory-use-custom-activities.md [troubleshoot]: data-factory-troubleshoot.md |
| data-lake-analytics | Understand Spark Code Concepts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-lake-analytics/understand-spark-code-concepts.md | U-SQL also offers a variety of other features and concepts, such as federated qu ### Federated Queries against SQL Server databases/external tables -U-SQL provides data source and external tables as well as direct queries against Azure SQL Database. While Spark does not offer the same object abstractions, it provides [Spark connector for Azure SQL Database](../azure-sql/database/spark-connector.md) that can be used to query SQL databases. +U-SQL provides data source and external tables as well as direct queries against Azure SQL Database. While Spark does not offer the same object abstractions, it provides [Spark connector for Azure SQL Database](/azure/azure-sql/database/spark-connector) that can be used to query SQL databases. ### U-SQL parameters and variables |
| data-lake-store | Data Lake Store Data Transfer Sql Sqoop | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-lake-store/data-lake-store-data-transfer-sql-sqoop.md | Before you begin, you must have the following: * **An Azure subscription**. See [Get Azure free trial](https://azure.microsoft.com/pricing/free-trial/). * **An Azure Data Lake Storage Gen1 account**. For instructions on how to create the account, see [Get started with Azure Data Lake Storage Gen1](data-lake-store-get-started-portal.md) * **Azure HDInsight cluster** with access to a Data Lake Storage Gen1 account. See [Create an HDInsight cluster with Data Lake Storage Gen1](data-lake-store-hdinsight-hadoop-use-portal.md). This article assumes you have an HDInsight Linux cluster with Data Lake Storage Gen1 access.-* **Azure SQL Database**. For instructions on how to create a database in Azure SQL Database, see [Create a database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) +* **Azure SQL Database**. For instructions on how to create a database in Azure SQL Database, see [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) ## Create sample tables in the database -1. To start, create two sample tables in the database. Use [SQL Server Management Studio](../azure-sql/database/connect-query-ssms.md) or Visual Studio to connect to the database and then run the following queries. +1. To start, create two sample tables in the database. Use [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms) or Visual Studio to connect to the database and then run the following queries. **Create Table1** An HDInsight cluster already has the Sqoop packages available. If you've configu sqoop-export --connect "jdbc:sqlserver://mysqoopserver.database.windows.net:1433;username=user1@mysqoopserver;password=<password>;database=mysqoopdatabase" --table Table2 --export-dir adl://myadlsg1store.azuredatalakestore.net/Sqoop/SqoopImportTable1 --input-fields-terminated-by "," ``` -1. Verify that the data was uploaded to the SQL Database table. Use [SQL Server Management Studio](../azure-sql/database/connect-query-ssms.md) or Visual Studio to connect to the Azure SQL Database and then run the following query. +1. Verify that the data was uploaded to the SQL Database table. Use [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms) or Visual Studio to connect to the Azure SQL Database and then run the following query. ```tsql SELECT * FROM TABLE2 |
| data-share | How To Share From Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-share/how-to-share-from-sql.md | When you share data from a SQL source, the following mappings are used from SQL To share data snapshots from your Azure SQL resources, you first need to prepare your environment. You'll need: - An Azure subscription: If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin.-- An [Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md) with tables and views that you want to share.+- An [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md) with tables and views that you want to share. - [An Azure Data Share account](share-your-data-portal.md#create-a-data-share-account). - Your data recipient's Azure sign in e-mail address (using their e-mail alias won't work). - If your Azure SQL resource is in a different Azure subscription than your Azure Data Share account, register the [Microsoft.DataShare resource provider](concepts-roles-permissions.md#resource-provider-registration) in the subscription where your source Azure SQL resource is located. You can follow the [step by step demo video](https://youtu.be/hIE-TjJD8Dc) to co - Permission to write to the databases on SQL server: *Microsoft.Sql/servers/databases/write*. This permission exists in the **Contributor** role. - Permission for the Azure Data Share resource's managed identity to access the database: 1. In the [Azure portal](https://portal.azure.com/), navigate to the SQL server and set yourself as the **Azure Active Directory Admin**.- 1. Connect to the Azure SQL Database/Data Warehouse using the [Query Editor](../azure-sql/database/connect-query-portal.md#connect-using-azure-active-directory) or SQL Server Management Studio with Azure Active Directory authentication. + 1. Connect to the Azure SQL Database/Data Warehouse using the [Query Editor](/azure/azure-sql/database/connect-query-portal#connect-using-azure-active-directory) or SQL Server Management Studio with Azure Active Directory authentication. 1. Execute the following script to add the Data Share resource-Managed Identity as a db_datareader. Connect using Active Directory and not SQL Server authentication. ```sql Confirm that all pre-requisites are complete before accepting a data share invit - Register the [Microsoft.DataShare resource provider](concepts-roles-permissions.md#resource-provider-registration) in the Azure subscription where you'll create a Data Share resource and the Azure subscription where your target Azure data stores are located. - You'll need a resource in Azure to store the shared data. You can use these kinds of resources: - [Azure Storage](../storage/common/storage-account-create.md)- - [Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) + - [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) - [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md) - [Azure Synapse Analytics (workspace) dedicated SQL pool](../synapse-analytics/get-started-analyze-sql-pool.md) If you choose to receive data into Azure Storage, complete these prerequisites b For a SQL server where you're the **Azure Active Directory admin** of the SQL server, complete these prerequisites before accepting a data share: -- An [Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md).+- An [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md). - Permission to write to the databases on SQL server: *Microsoft.Sql/servers/databases/write*. This permission exists in the Azure RBAC **Contributor** role. - SQL Server Firewall access: 1. In the [Azure portal](https://portal.azure.com/), navigate to your SQL server. Select **Firewalls and virtual networks** from left navigation. For a SQL server where you're **not** the **Azure Active Directory admin**, comp You can follow the [step by step demo video](https://youtu.be/aeGISgK1xro), or the steps below to configure prerequisites. -- An [Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md).+- An [Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart) or [Azure Synapse Analytics (formerly Azure SQL DW)](../synapse-analytics/get-started-create-workspace.md). - Permission to write to databases on the SQL server: *Microsoft.Sql/servers/databases/write*. This permission exists in the Azure RBAC **Contributor** role. - Permission for the Data Share resource's managed identity to access the Azure SQL Database or Azure Synapse Analytics: 1. In the [Azure portal](https://portal.azure.com/), navigate to the SQL server and set yourself as the **Azure Active Directory Admin**.- 1. Connect to the Azure SQL Database/Data Warehouse using the [Query Editor](../azure-sql/database/connect-query-portal.md#connect-using-azure-active-directory) or SQL Server Management Studio with Azure Active Directory authentication. + 1. Connect to the Azure SQL Database/Data Warehouse using the [Query Editor](/azure/azure-sql/database/connect-query-portal#connect-using-azure-active-directory) or SQL Server Management Studio with Azure Active Directory authentication. 1. Execute the following script to add the Data Share Managed Identity as a 'db_datareader, db_datawriter, db_ddladmin'. ```sql |
| databox-online | Azure Stack Edge Gpu Create Virtual Machine Marketplace Image | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/databox-online/azure-stack-edge-gpu-create-virtual-machine-marketplace-image.md | az vm image list --all --publisher "Canonical" Here is an example output when VM images of a certain publisher, offer, and SKU were queried. -```output +```azurecli PS /home/user> az vm image list --all --publisher "Canonical" --offer "UbuntuServer" --sku "12.04.4-LTS"+``` ++```output [ { "offer": "UbuntuServer", |
| databox-online | Azure Stack Edge Gpu Deploy Virtual Machine Cli Python | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/databox-online/azure-stack-edge-gpu-deploy-virtual-machine-cli-python.md | Before you begin creating and managing a VM on your Azure Stack Edge Pro device ``` The following shows sample usage of the above command: - ```output + ```azurecli PS C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2> az cloud register -n az-new-env --endpoint-resource-manager "https://management.team3device.teatraining1.com" ``` Before you begin creating and managing a VM on your Azure Stack Edge Pro device ``` The following shows sample usage of the above command: - ```output + ```azurecli PS C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2> az cloud set -n az-new-env Switched active cloud to 'az-new-env'. Use 'az login' to log in to this cloud. |
| defender-for-cloud | Defender For Containers Introduction | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-containers-introduction.md | The recommendation **Running container images should have vulnerability findings :::image type="content" source="media/defender-for-containers/running-image-vulnerabilities-recommendation.png" alt-text="Screenshot showing where the recommendation is viewable" lightbox="media/defender-for-containers/running-image-vulnerabilities-recommendation-expanded.png"::: -> [!NOTE] -> This recommendation is currently supported for Linux containers only, as there's no Defender profile/extension for Windows. -> ## Run-time protection for Kubernetes nodes and clusters Defender for Cloud provides real-time threat protection for your containerized environments and generates alerts for suspicious activities. You can use this information to quickly remediate security issues and improve the security of your containers. |
| defender-for-cloud | Defender For Sql Introduction | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-sql-introduction.md | -Microsoft Defender for SQL includes two Microsoft Defender plans that extend Microsoft Defender for Cloud's [data security package](../azure-sql/database/azure-defender-for-sql.md) to secure your databases and their data wherever they're located. Microsoft Defender for SQL includes functionalities for discovering and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your databases. +Microsoft Defender for SQL includes two Microsoft Defender plans that extend Microsoft Defender for Cloud's [data security package](/azure/azure-sql/database/azure-defender-for-sql) to secure your databases and their data wherever they're located. Microsoft Defender for SQL includes functionalities for discovering and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your databases. ## Availability Microsoft Defender for SQL includes two Microsoft Defender plans that extend Mic |-|:-| |Release state:|**Microsoft Defender for Azure SQL database servers** - Generally available (GA)<br>**Microsoft Defender for SQL servers on machines** - Generally available (GA) | |Pricing:|The two plans that form **Microsoft Defender for SQL** are billed as shown on the [pricing page](https://azure.microsoft.com/pricing/details/defender-for-cloud/)|-|Protected SQL versions:|[SQL on Azure virtual machines](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md)<br>[SQL Server on Azure Arc-enabled servers](/sql/sql-server/azure-arc/overview)<br>On-premises SQL servers on Windows machines without Azure Arc<br>Azure SQL [single databases](../azure-sql/database/single-database-overview.md) and [elastic pools](../azure-sql/database/elastic-pool-overview.md)<br>[Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md)<br>[Azure Synapse Analytics (formerly SQL DW) dedicated SQL pool](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md)| +|Protected SQL versions:|[SQL on Azure virtual machines](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview)<br>[SQL Server on Azure Arc-enabled servers](/sql/sql-server/azure-arc/overview)<br>On-premises SQL servers on Windows machines without Azure Arc<br>Azure SQL [single databases](/azure/azure-sql/database/single-database-overview) and [elastic pools](/azure/azure-sql/database/elastic-pool-overview)<br>[Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview)<br>[Azure Synapse Analytics (formerly SQL DW) dedicated SQL pool](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md)| |Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Azure Government<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Azure China 21Vianet (**Partial**: Subset of alerts and vulnerability assessment for SQL servers. Behavioral threat protections aren't available.)| Microsoft Defender for SQL includes two Microsoft Defender plans that extend Mic **Microsoft Defender for SQL** comprises two separate Microsoft Defender plans: - **Microsoft Defender for Azure SQL database servers** protects:- - [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) - - [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) + - [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) + - [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) - [Dedicated SQL pool in Azure Synapse](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md) - **Microsoft Defender for SQL servers on machines** extends the protections for your Azure-native SQL Servers to fully support hybrid environments and protect SQL servers (all supported version) hosted in Azure, other cloud environments, and even on-premises machines: These two plans include functionality for identifying and mitigating potential d A vulnerability assessment service discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans provide an overview of your SQL machines' security state, and details of any security findings. -- Learn more about [vulnerability assessment for Azure SQL Database](../azure-sql/database/sql-vulnerability-assessment.md).+- Learn more about [vulnerability assessment for Azure SQL Database](/azure/azure-sql/database/sql-vulnerability-assessment). - Learn more about [vulnerability assessment for Azure SQL servers on machines](defender-for-sql-on-machines-vulnerability-assessment.md). -An advanced threat protection service continuously monitors your SQL servers for threats such as SQL injection, brute-force attacks, and privilege abuse. This service provides action-oriented security alerts in Microsoft Defender for Cloud with details of the suspicious activity, guidance on how to mitigate to the threats, and options for continuing your investigations with Microsoft Sentinel. Learn more about [advanced threat protection](../azure-sql/database/threat-detection-overview.md). +An advanced threat protection service continuously monitors your SQL servers for threats such as SQL injection, brute-force attacks, and privilege abuse. This service provides action-oriented security alerts in Microsoft Defender for Cloud with details of the suspicious activity, guidance on how to mitigate to the threats, and options for continuing your investigations with Microsoft Sentinel. Learn more about [advanced threat protection](/azure/azure-sql/database/threat-detection-overview). > [!TIP] > View the list of security alerts for SQL servers [in the alerts reference page](alerts-reference.md#alerts-sql-db-and-warehouse). The focus of **Microsoft Defender for SQL on machines** is obviously security. B The service has a split architecture to balance data uploading and speed with performance: -- Some of our detectors, including an [extended events trace](../azure-sql/database/xevent-db-diff-from-svr.md) named `SQLAdvancedThreatProtectionTraffic`, run on the machine for real-time speed advantages.+- Some of our detectors, including an [extended events trace](/azure/azure-sql/database/xevent-db-diff-from-svr) named `SQLAdvancedThreatProtectionTraffic`, run on the machine for real-time speed advantages. - Other detectors run in the cloud to spare the machine from heavy computational loads. Lab tests of our solution, comparing it against benchmark loads, showed CPU usage averaging 3% for peak slices. An analysis of the telemetry for our current users shows a negligible impact on CPU and memory usage. |
| defender-for-cloud | Defender For Sql On Machines Vulnerability Assessment | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-sql-on-machines-vulnerability-assessment.md | Last updated 11/09/2021 - [SQL Server on Azure Arc-enabled servers](/sql/sql-server/azure-arc/overview) - [SQL Server running on Windows machines without Azure Arc](../azure-monitor/agents/agent-windows.md) -The integrated [vulnerability assessment scanner](../azure-sql/database/sql-vulnerability-assessment.md) discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans findings provide an overview of your SQL machines' security state, and details of any security findings. +The integrated [vulnerability assessment scanner](/azure/azure-sql/database/sql-vulnerability-assessment) discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans findings provide an overview of your SQL machines' security state, and details of any security findings. > [!NOTE] > The scan is lightweight, safe, only takes a few seconds per database to run and is entirely read-only. It does not make any changes to your database. |
| defender-for-cloud | Defender For Sql Usage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-sql-usage.md | To enable this plan: ### Step 1. Install the agent extension -- **SQL Server on Azure VM** - Register your SQL Server VM with the SQL IaaS Agent extension as explained in [Register SQL Server VM with SQL IaaS Agent Extension](../azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md).+- **SQL Server on Azure VM** - Register your SQL Server VM with the SQL IaaS Agent extension as explained in [Register SQL Server VM with SQL IaaS Agent Extension](/azure/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm). - **SQL Server on Azure Arc-enabled servers** - Install the Azure Arc agent by following the installation methods described in the [Azure Arc documentation](../azure-arc/servers/manage-vm-extensions.md). |
| defender-for-cloud | Enhanced Security Features Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/enhanced-security-features-overview.md | Defender for Cloud is offered in two modes: - [My subscription has Microsoft Defender for Servers enabled, do I pay for not-running servers?](#my-subscription-has-microsoft-defender-for-servers-enabled-do-i-pay-for-not-running-servers) - [Will I be charged for machines without the Log Analytics agent installed?](#will-i-be-charged-for-machines-without-the-log-analytics-agent-installed) - [If a Log Analytics agent reports to multiple workspaces, will I be charged twice?](#if-a-log-analytics-agent-reports-to-multiple-workspaces-will-i-be-charged-twice)-- [If a Log Analytics agent reports to multiple workspaces, is the 500-MB free data ingestion available on all of them?](#if-a-log-analytics-agent-reports-to-multiple-workspaces-is-the-500-mb-free-data-ingestion-available-on-all-of-them)-- [Is the 500-MB free data ingestion calculated for an entire workspace or strictly per machine?](#is-the-500-mb-free-data-ingestion-calculated-for-an-entire-workspace-or-strictly-per-machine)-- [What data types are included in the 500-MB data daily allowance?](#what-data-types-are-included-in-the-500-mb-data-daily-allowance)+- [If a Log Analytics agent reports to multiple workspaces, is the 500 MB free data ingestion available on all of them?](#if-a-log-analytics-agent-reports-to-multiple-workspaces-is-the-500-mb-free-data-ingestion-available-on-all-of-them) +- [Is the 500 MB free data ingestion calculated for an entire workspace or strictly per machine?](#is-the-500-mb-free-data-ingestion-calculated-for-an-entire-workspace-or-strictly-per-machine) +- [What data types are included in the 500 MB data daily allowance?](#what-data-types-are-included-in-the-500-mb-data-daily-allowance) ### How can I track who in my organization enabled a Microsoft Defender plan in Defender for Cloud? Azure Subscriptions may have multiple administrators with permissions to change the pricing settings. To find out which user made a change, use the Azure Activity Log. Yes. When you enable [Microsoft Defender for Servers](defender-for-servers-intro ### If a Log Analytics agent reports to multiple workspaces, will I be charged twice? Yes. If you've configured your Log Analytics agent to send data to two or more different Log Analytics workspaces (multi-homing), you'll be charged for every workspace that has a 'Security' or 'AntiMalware' solution installed. -### If a Log Analytics agent reports to multiple workspaces, is the 500-MB free data ingestion available on all of them? -Yes. If you've configured your Log Analytics agent to send data to two or more different Log Analytics workspaces (multi-homing), you'll get 500-MB free data ingestion. It's calculated per node, per reported workspace, per day, and available for every workspace that has a 'Security' or 'AntiMalware' solution installed. You'll be charged for any data ingested over the 500-MB limit. +### If a Log Analytics agent reports to multiple workspaces, is the 500 MB free data ingestion available on all of them? +Yes. If you've configured your Log Analytics agent to send data to two or more different Log Analytics workspaces (multi-homing), you'll get 500 MB free data ingestion. It's calculated per node, per reported workspace, per day, and available for every workspace that has a 'Security' or 'AntiMalware' solution installed. You'll be charged for any data ingested over the 500 MB limit. -### Is the 500-MB free data ingestion calculated for an entire workspace or strictly per machine? -You'll get 500-MB free data ingestion per day, for every Windows machine connected to the workspace. Specifically for security data types directly collected by Defender for Cloud. +### Is the 500 MB free data ingestion calculated for an entire workspace or strictly per machine? +You'll get 500 MB free data ingestion per day, for every Windows machine connected to the workspace. Specifically for security data types directly collected by Defender for Cloud. -This data is a daily rate averaged across all nodes. So even if some machines send 100-MB and others send 800-MB, if the total doesn't exceed the **[number of machines] x 500-MB** free limit, you won't be charged extra. +This data is a daily rate averaged across all nodes. So even if some machines send 100-MB and others send 800-MB, if the total doesn't exceed the **[number of machines] x 500 MB** free limit, you won't be charged extra. -### What data types are included in the 500-MB data daily allowance? +### What data types are included in the 500 MB data daily allowance? Defender for Cloud's billing is closely tied to the billing for Log Analytics. [Microsoft Defender for Servers](defender-for-servers-introduction.md) provides a 500 MB/node/day allocation for Windows machines against the following subset of [security data types](/azure/azure-monitor/reference/tables/tables-category#security): - SecurityAlert - SecurityBaseline |
| defender-for-cloud | Onboard Management Group | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/onboard-management-group.md | Title: Onboard a management group to Microsoft Defender for Cloud description: Learn how to use a supplied Azure Policy definition to enable Microsoft Defender for Cloud for all the subscriptions in a management group. Previously updated : 11/09/2021 Last updated : 04/25/2022 # Enable Defender for Cloud on all subscriptions in a management group You can use Azure Policy to enable Microsoft Defender for Cloud on all the Azure To onboard a management group and all its subscriptions: -1. As a user with **Security Admin** permissions, open Azure Policy and search for the definition **Enable Defender for Cloud on your subscription**. +1. As a user with **Security Admin** permissions, open Azure Policy and search for the definition `Enable Azure Security Center on your subscription`. - :::image type="content" source="./media/get-started/enable-microsoft-defender-for-cloud-policy.png" alt-text="The Azure Policy definition Enable Defender for Cloud on your subscription."::: + :::image type="content" source="./media/get-started/enable-microsoft-defender-for-cloud-policy.png" alt-text="Screenshot showing the Azure Policy definition Enable Defender for Cloud on your subscription." lightbox="media/get-started/enable-microsoft-defender-for-cloud-policy-extended.png"::: 1. Select **Assign** and ensure you set the scope to the MG level. - :::image type="content" source="./media/get-started/assign-policy.png" alt-text="Assigning the definition Enable Defender for Cloud on your subscription."::: + :::image type="content" source="./media/get-started/assign-policy.png" alt-text="Screenshot showing how to assign the definition Enable Defender for Cloud on your subscription."::: > [!TIP] > Other than the scope, there are no required parameters. -1. Select **Create a remediation task** to ensure all existing subscriptions that don't have Defender for Cloud enabled, will get onboarded. +1. Select **Remediation**, and select **Create a remediation task** to ensure all existing subscriptions that don't have Defender for Cloud enabled, will get onboarded. - :::image type="content" source="./media/get-started/remediation-task.png" alt-text="Creating a remediation task for the Azure Policy definition Enable Defender for Cloud on your subscription."::: + :::image type="content" source="./media/get-started/remediation-task.png" alt-text="Screenshot that shows how to create a remediation task for the Azure Policy definition Enable Defender for Cloud on your subscription."::: 1. When the definition is assigned it will: |
| defender-for-cloud | Release Notes Archive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/release-notes-archive.md | Applications that are installed in virtual machines could often have vulnerabili Azure Security Center's support for threat protection and vulnerability assessment for SQL DBs running on IaaS VMs is now in preview. -[Vulnerability assessment](../azure-sql/database/sql-vulnerability-assessment.md) is an easy to configure service that can discover, track, and help you remediate potential database vulnerabilities. It provides visibility into your security posture as part of secure score and includes the steps to resolve security issues and enhance your database fortifications. +[Vulnerability assessment](/azure/azure-sql/database/sql-vulnerability-assessment) is an easy to configure service that can discover, track, and help you remediate potential database vulnerabilities. It provides visibility into your security posture as part of secure score and includes the steps to resolve security issues and enhance your database fortifications. -[Advanced threat protection](../azure-sql/database/threat-detection-overview.md) detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit your SQL server. It continuously monitors your database for suspicious activities and provides action-oriented security alerts on anomalous database access patterns. These alerts provide the suspicious activity details and recommended actions to investigate and mitigate the threat. +[Advanced threat protection](/azure/azure-sql/database/threat-detection-overview) detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit your SQL server. It continuously monitors your database for suspicious activities and provides action-oriented security alerts on anomalous database access patterns. These alerts provide the suspicious activity details and recommended actions to investigate and mitigate the threat. ### Support for custom policies (preview) |
| defender-for-cloud | Sql Information Protection Policy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/sql-information-protection-policy.md | Last updated 11/09/2021 [!INCLUDE [Banner for top of topics](./includes/banner.md)] -SQL information protection's [data discovery and classification mechanism](../azure-sql/database/data-discovery-and-classification-overview.md) provides advanced capabilities for discovering, classifying, labeling, and reporting the sensitive data in your databases. It's built into [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md), [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md), and [Azure Synapse Analytics](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md). +SQL information protection's [data discovery and classification mechanism](/azure/azure-sql/database/data-discovery-and-classification-overview) provides advanced capabilities for discovering, classifying, labeling, and reporting the sensitive data in your databases. It's built into [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview), [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview), and [Azure Synapse Analytics](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md). The classification mechanism is based on the following two elements: Learn more in [Grant and request tenant-wide visibility](tenant-wide-permissions ## Next steps -In this article, you learned about defining an information protection policy in Microsoft Defender for Cloud. To learn more about using SQL Information Protection to classify and protect sensitive data in your SQL databases, see [Azure SQL Database Data Discovery and Classification](../azure-sql/database/data-discovery-and-classification-overview.md). +In this article, you learned about defining an information protection policy in Microsoft Defender for Cloud. To learn more about using SQL Information Protection to classify and protect sensitive data in your SQL databases, see [Azure SQL Database Data Discovery and Classification](/azure/azure-sql/database/data-discovery-and-classification-overview). For more information on security policies and data security in Defender for Cloud, see the following articles: |
| defender-for-cloud | Supported Machines Endpoint Solutions Clouds Containers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/supported-machines-endpoint-solutions-clouds-containers.md | The **tabs** below show the features that are available, by environment, for Mic |--|--|--|--|--|--|--|--| | Compliance | Docker CIS | VMs | GA | X | Log Analytics agent | Defender for Servers Plan 2 | | | Vulnerability Assessment | Registry scan | ACR, Private ACR | GA | Γ£ô (Preview) | Agentless | Defender for Containers | Commercial clouds<br><br> National clouds: Azure Government, Azure China 21Vianet |-| Vulnerability Assessment | View vulnerabilities for running images | AKS | Preview | X | Defender profile | Defender for Containers | Commercial clouds | +| Vulnerability Assessment | View vulnerabilities for running images | AKS | Preview | Γ£ô (Preview) | Defender profile | Defender for Containers | Commercial clouds | | Hardening | Control plane recommendations | ACR, AKS | GA | Γ£ô | Agentless | Free | Commercial clouds<br><br> National clouds: Azure Government, Azure China 21Vianet | | Hardening | Kubernetes data plane recommendations | AKS | GA | X | Azure Policy | Free | Commercial clouds<br><br> National clouds: Azure Government, Azure China 21Vianet | | Runtime protection| Threat detection (control plane)| AKS | GA | Γ£ô | Agentless | Defender for Containers | Commercial clouds<br><br> National clouds: Azure Government, Azure China 21Vianet | |
| devtest-labs | Lab Services Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/devtest-labs/lab-services-overview.md | You can use two different Azure services to set up lab environments in the cloud - [Azure Lab Services](../lab-services/lab-services-overview.md) provides managed classroom labs. - Lab Services does all infrastructure management, from spinning up VMs and scaling infrastructure to handling errors. After an IT administrator creates a Lab Services lab account, instructors can [create classroom labs](../lab-services/how-to-manage-classroom-labs.md#create-a-classroom-lab) in the account. An instructor specifies the number and type of VMs they need for the class, and adds users to the class. Once users register in the class, they can access the VMs to do class exercises and homework. + Lab Services does all infrastructure management, from spinning up VMs and scaling infrastructure to handling errors. After an IT administrator creates a Lab Services lab account, instructors can [create labs](../lab-services/quick-create-lab-portal.md) in the account. An instructor specifies the number and type of VMs they need for the class, and adds users to the class. Once users register in the class, they can access the VMs to do class exercises and homework. ## Key capabilities |
| dms | How To Migrate Ssis Packages Managed Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/how-to-migrate-ssis-packages-managed-instance.md | To complete these steps, you need: * To open your Windows Firewall to allow the Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. * If you're running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that the Azure Database Migration Service can connect to a named instance on your source server. * If you're using a firewall appliance in front of your source databases, you may need to add firewall rules to allow the Azure Database Migration Service to access the source database(s) for migration, as well as files via SMB port 445.-* A SQL Managed Instance to host SSISDB. If you need to create one, follow the detail in the article [Create a Azure SQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* A SQL Managed Instance to host SSISDB. If you need to create one, follow the detail in the article [Create a Azure SQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). * To ensure that the logins used to connect the source SQL Server and target managed instance are members of the sysadmin server role. * To verify that SSIS is provisioned in Azure Data Factory (ADF) containing Azure-SSIS Integration Runtime (IR) with the destination SSISDB hosted by a SQL Managed Instance (as described in the article [Create the Azure-SSIS integration runtime in Azure Data Factory](../data-factory/create-azure-ssis-integration-runtime.md)). |
| dms | How To Migrate Ssis Packages | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/how-to-migrate-ssis-packages.md | In this article, you learn how to: To complete these steps, you need: * SSMS version 17.2 or later.-* An instance of your target database server to host SSISDB. If you don't already have one, create a [logical SQL server](../azure-sql/database/logical-servers.md) (without a database) using the Azure portal by navigating to the SQL Server (logical server only) [form](https://portal.azure.com/#create/Microsoft.SQLServer). +* An instance of your target database server to host SSISDB. If you don't already have one, create a [logical SQL server](/azure/azure-sql/database/logical-servers) (without a database) using the Azure portal by navigating to the SQL Server (logical server only) [form](https://portal.azure.com/#create/Microsoft.SQLServer). * SSIS must be provisioned in Azure Data Factory (ADF) containing Azure-SSIS Integration Runtime (IR) with the destination SSISDB hosted by SQL Database (as described in the article [Provision the Azure-SSIS Integration Runtime in Azure Data Factory](../data-factory/tutorial-deploy-ssis-packages-azure.md)). ## Assess source SSIS projects/packages |
| dms | Howto Sql Server To Azure Sql Managed Instance Powershell Offline | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/howto-sql-server-to-azure-sql-managed-instance-powershell-offline.md | To complete these steps, you need: * To enable the TCP/IP protocol, which is disabled by default with SQL Server Express installation. Enable the TCP/IP protocol by following the article [Enable or Disable a Server Network Protocol](/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol#SSMSProcedure). * To configure your [Windows Firewall for database engine access](/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access). * An Azure subscription. If you don't have one, [create a free account](https://azure.microsoft.com/free/) before you begin.-* A SQL Managed Instance. You can create a SQL Managed Instance by following the detail in the article [Create a ASQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* A SQL Managed Instance. You can create a SQL Managed Instance by following the detail in the article [Create a ASQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). * To download and install [Data Migration Assistant](https://www.microsoft.com/download/details.aspx?id=53595) v3.3 or later. * A Microsoft Azure Virtual Network created using the Azure Resource Manager deployment model, which provides the Azure Database Migration Service with site-to-site connectivity to your on-premises source servers by using either [ExpressRoute](../expressroute/expressroute-introduction.md) or [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md). * A completed assessment of your on-premises database and schema migration using Data Migration Assistant, as described in the article [Performing a SQL Server migration assessment](/sql/dma/dma-assesssqlonprem). |
| dms | Howto Sql Server To Azure Sql Managed Instance Powershell Online | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/howto-sql-server-to-azure-sql-managed-instance-powershell-online.md | To complete these steps, you need: * To enable the TCP/IP protocol, which is disabled by default with SQL Server Express installation. Enable the TCP/IP protocol by following the article [Enable or Disable a Server Network Protocol](/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol#SSMSProcedure). * To configure your [Windows Firewall for database engine access](/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access). * An Azure subscription. If you don't have one, [create a free account](https://azure.microsoft.com/free/) before you begin.-* A SQL Managed Instance. You can create a SQL Managed Instance by following the detail in the article [Create a ASQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* A SQL Managed Instance. You can create a SQL Managed Instance by following the detail in the article [Create a ASQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). * To download and install [Data Migration Assistant](https://www.microsoft.com/download/details.aspx?id=53595) v3.3 or later. * A Microsoft Azure Virtual Network created using the Azure Resource Manager deployment model, which provides the Azure Database Migration Service with site-to-site connectivity to your on-premises source servers by using either [ExpressRoute](../expressroute/expressroute-introduction.md) or [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md). * A completed assessment of your on-premises database and schema migration using Data Migration Assistant, as described in the article [Performing a SQL Server migration assessment](/sql/dma/dma-assesssqlonprem). |
| dms | Howto Sql Server To Azure Sql Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/howto-sql-server-to-azure-sql-powershell.md | To complete these steps, you need: * [SQL Server 2016 or above](https://www.microsoft.com/sql-server/sql-server-downloads) (any edition) * To enable the TCP/IP protocol, which is disabled by default with SQL Server Express installation. Enable the TCP/IP protocol by following the article [Enable or Disable a Server Network Protocol](/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol#SSMSProcedure). * To configure your [Windows Firewall for database engine access](/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access).-* An Azure SQL Database instance. You can create an Azure SQL Database instance by following the detail in the article [Create a database in Azure SQL Database in the Azure portal](../azure-sql/database/single-database-create-quickstart.md). +* An Azure SQL Database instance. You can create an Azure SQL Database instance by following the detail in the article [Create a database in Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). * [Data Migration Assistant](https://www.microsoft.com/download/details.aspx?id=53595) v3.3 or later. * To have created a Microsoft Azure Virtual Network by using the Azure Resource Manager deployment model, which provides the Azure Database Migration Service with site-to-site connectivity to your on-premises source servers by using either [ExpressRoute](../expressroute/expressroute-introduction.md) or [VPN](../vpn-gateway/vpn-gateway-about-vpngateways.md). * To have completed assessment of your on-premises database and schema migration using Data Migration Assistant as described in the article [Performing a SQL Server migration assessment](/sql/dma/dma-assesssqlonprem) |
| dms | Migrate Mysql To Azure Mysql Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/migrate-mysql-to-azure-mysql-powershell.md | To complete these steps, you need: * Ensure that your virtual network Network Security Group rules don't block the outbound port 443 of ServiceTag for Storage and AzureMonitor. For more detail on virtual network NSG traffic filtering, see the article [Filter network traffic with network security groups](../virtual-network/virtual-network-vnet-plan-design-arm.md). * Open your Windows firewall to allow connections from Virtual Network for Azure Database Migration Service to access the source MySQL Server, which by default is TCP port 3306. * When using a firewall appliance in front of your source database(s), you may need to add firewall rules to allow connections from Virtual Network for Azure Database Migration Service to access the source database(s) for migration.-* Create a server-level [firewall rule](../azure-sql/database/firewall-configure.md) or [configure VNET service endpoints](../mysql/howto-manage-vnet-using-portal.md) for target Azure Database for MySQL to allow Virtual Network for Azure Database Migration Service access to the target databases. +* Create a server-level [firewall rule](/azure/azure-sql/database/firewall-configure) or [configure VNET service endpoints](../mysql/howto-manage-vnet-using-portal.md) for target Azure Database for MySQL to allow Virtual Network for Azure Database Migration Service access to the target databases. * The source MySQL must be on supported MySQL community edition. To determine the version of MySQL instance, in the MySQL utility or MySQL Workbench, run the following command: ``` |
| dms | Migration Dms Powershell Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/migration-dms-powershell-cli.md | Pre-requisites that are common across all supported migration scenarios using Az - Owner or Contributor role for the Azure subscription. > [!IMPORTANT] > Azure account is only required when running the migration steps and is not required for assessment or Azure recommendation steps process.-* Create a target [Azure SQL Managed Instance](../azure-sql/managed-instance/create-configure-managed-instance-powershell-quickstart.md) or [SQL Server on Azure Virtual Machine](../azure-sql/virtual-machines/windows/sql-vm-create-powershell-quickstart.md) +* Create a target [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/create-configure-managed-instance-powershell-quickstart) or [SQL Server on Azure Virtual Machine](/azure/azure-sql/virtual-machines/windows/sql-vm-create-powershell-quickstart) > [!IMPORTANT]- > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md#management-modes). + > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management#management-modes). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Use one of the following storage options for the full database and transaction log backup files: - SMB network share Pre-requisites that are common across all supported migration scenarios using Az > - Each backup can be written to either a separate backup file or multiple backup files. However, appending multiple backups (i.e. full and t-log) into a single backup media is not supported. > - Use compressed backups to reduce the likelihood of experiencing potential issues associated with migrating large backups. * Ensure that the service account running the source SQL Server instance has read and write permissions on the SMB network share that contains database backup files.-* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](../azure-sql/managed-instance/tde-certificate-migrate.md) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). +* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/tde-certificate-migrate) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). > [!TIP] > If your database contains sensitive data that is protected by [Always Encrypted](/sql/relational-databases/security/encryption/configure-always-encrypted-using-sql-server-management-studio), migration process using Azure Data Studio with DMS will automatically migrate your Always Encrypted keys to your target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine. |
| dms | Migration Using Azure Data Studio | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/migration-using-azure-data-studio.md | The workflow of the migration process is illustrated below. :::image type="content" source="media/migration-using-azure-data-studio/architecture-ads-sql-migration.png" alt-text="Diagram of architecture for database migration using Azure Data Studio with DMS"::: 1. **Source SQL Server**: SQL Server instance on-premises, private cloud, or any public cloud virtual machine. All versions of SQL Server 2008 and above are supported.-1. **Target Azure SQL**: Supported Azure SQL targets are Azure SQL Managed Instance or SQL Server on Azure Virtual Machines (registered with SQL IaaS Agent extension in [Full management mode](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md#management-modes)) +1. **Target Azure SQL**: Supported Azure SQL targets are Azure SQL Managed Instance or SQL Server on Azure Virtual Machines (registered with SQL IaaS Agent extension in [Full management mode](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management#management-modes)) 1. **Network File Share**: Server Message Block (SMB) network file share where backup files are stored for the database(s) to be migrated. Azure Storage blob containers and Azure Storage file share are also supported. 1. **Azure Data Studio**: Download and install the [Azure SQL migration extension in Azure Data Studio](/sql/azure-data-studio/extensions/azure-sql-migration-extension). 1. **Azure DMS**: Azure service that orchestrates migration pipelines to do data movement activities from on-premises to Azure. DMS is associated with Azure Data Factory's (ADF) self-hosted integration runtime (IR) and provides the capability to register and monitor the self-hosted IR. Azure Database Migration Service prerequisites that are common across all suppor - Owner or Contributor role for the Azure subscription. > [!IMPORTANT] > Azure account is only required when configuring the migration steps and is not required for assessment or Azure recommendation steps in the migration wizard.-* Create a target [Azure SQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md) or [SQL Server on Azure Virtual Machine](../azure-sql/virtual-machines/windows/create-sql-vm-portal.md) +* Create a target [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart) or [SQL Server on Azure Virtual Machine](/azure/azure-sql/virtual-machines/windows/create-sql-vm-portal) > [!IMPORTANT]- > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md#management-modes). + > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management#management-modes). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Use one of the following storage options for the full database and transaction log backup files: - SMB network share Azure Database Migration Service prerequisites that are common across all suppor > - Each backup can be written to either a separate backup file or multiple backup files. However, appending multiple backups (i.e. full and t-log) into a single backup media is not supported. > - Use compressed backups to reduce the likelihood of experiencing potential issues associated with migrating large backups. * Ensure that the service account running the source SQL Server instance has read and write permissions on the SMB network share that contains database backup files.-* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](../azure-sql/managed-instance/tde-certificate-migrate.md) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). +* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/tde-certificate-migrate) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). > [!TIP] > If your database contains sensitive data that is protected by [Always Encrypted](/sql/relational-databases/security/encryption/configure-always-encrypted-using-sql-server-management-studio), migration process using Azure Data Studio with DMS will automatically migrate your Always Encrypted keys to your target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine. |
| dms | Pre Reqs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/pre-reqs.md | In addition to Azure Database Migration Service prerequisites that are common to When using the Azure Database Migration Service to perform SQL Server to Azure SQL Database migrations, in addition to the prerequisites that are common to all migration scenarios, be sure to address the following additional prerequisites: -* Create an instance of Azure SQL Database instance, which you do by following the detail in the article [Create a database in Azure SQL Database in the Azure portal](../azure-sql/database/single-database-create-quickstart.md). +* Create an instance of Azure SQL Database instance, which you do by following the detail in the article [Create a database in Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). * Download and install the [Data Migration Assistant](https://www.microsoft.com/download/details.aspx?id=53595) v3.3 or later. * Open your Windows Firewall to allow the Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. * If you are running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that the Azure Database Migration Service can connect to a named instance on your source server.-* Create a server-level [firewall rule](../azure-sql/database/firewall-configure.md) for SQL Database to allow the Azure Database Migration Service access to the target databases. Provide the subnet range of the virtual network used for the Azure Database Migration Service. +* Create a server-level [firewall rule](/azure/azure-sql/database/firewall-configure) for SQL Database to allow the Azure Database Migration Service access to the target databases. Provide the subnet range of the virtual network used for the Azure Database Migration Service. * Ensure that the credentials used to connect to source SQL Server instance have [CONTROL SERVER](/sql/t-sql/statements/grant-server-permissions-transact-sql) permissions. * Ensure that the credentials used to connect to target database have CONTROL DATABASE permission on the target database. When using the Azure Database Migration Service to perform SQL Server to Azure S ## Prerequisites for migrating SQL Server to Azure SQL Managed Instance -* Create a SQL Managed Instance by following the detail in the article [Create a Azure SQL Managed Instance in the Azure portal](../azure-sql/managed-instance/instance-create-quickstart.md). +* Create a SQL Managed Instance by following the detail in the article [Create a Azure SQL Managed Instance in the Azure portal](/azure/azure-sql/managed-instance/instance-create-quickstart). * Open your firewalls to allow SMB traffic on port 445 for the Azure Database Migration Service IP address or subnet range. * Open your Windows Firewall to allow the Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. * If you are running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that the Azure Database Migration Service can connect to a named instance on your source server. |
| dms | Tutorial Azure Postgresql To Azure Postgresql Online Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-azure-postgresql-to-azure-postgresql-online-portal.md | To complete this tutorial, you need to: * Create a Microsoft Azure Virtual Network for Azure Database Migration Service by using the Azure Resource Manager deployment model. For more information about creating a virtual network, see the [Virtual Network Documentation](../virtual-network/index.yml), and especially the quickstart articles with step-by-step details. * Ensure that the Network Security Group (NSG) rules for your virtual network don't block the outbound port 443 of ServiceTag for ServiceBus, Storage and AzureMonitor. For more detail on virtual network NSG traffic filtering, see the article [Filter network traffic with network security groups](../virtual-network/virtual-network-vnet-plan-design-arm.md).-* Create a server-level [firewall rule](../azure-sql/database/firewall-configure.md) for Azure Database for PostgreSQL source to allow Azure Database Migration Service to access to the source databases. Provide the subnet range of the virtual network used for Azure Database Migration Service. -* Create a server-level [firewall rule](../azure-sql/database/firewall-configure.md) for Azure Database for PostgreSQL target to allow Azure Database Migration Service to access to the target databases. Provide the subnet range of the virtual network used for Azure Database Migration Service. +* Create a server-level [firewall rule](/azure/azure-sql/database/firewall-configure) for Azure Database for PostgreSQL source to allow Azure Database Migration Service to access to the source databases. Provide the subnet range of the virtual network used for Azure Database Migration Service. +* Create a server-level [firewall rule](/azure/azure-sql/database/firewall-configure) for Azure Database for PostgreSQL target to allow Azure Database Migration Service to access to the target databases. Provide the subnet range of the virtual network used for Azure Database Migration Service. * [Enable logical replication](../postgresql/concepts-logical.md) in the Azure DB for PostgreSQL source. * Set the following Server parameters in the Azure Database for PostgreSQL instance being used as a source: |
| dms | Tutorial Mysql Azure Mysql Offline Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-mysql-azure-mysql-offline-portal.md | To complete this tutorial, you need to: * Ensure that your virtual network Network Security Group rules don't block the outbound port 443 of ServiceTag for ServiceBus, Storage and AzureMonitor. For more detail on virtual network NSG traffic filtering, see the article [Filter network traffic with network security groups](../virtual-network/virtual-network-vnet-plan-design-arm.md). * Open your Windows firewall to allow connections from Virtual Network for Azure Database Migration Service to access the source MySQL Server, which by default is TCP port 3306. * When using a firewall appliance in front of your source database(s), you may need to add firewall rules to allow connections from Virtual Network for Azure Database Migration Service to access the source database(s) for migration.-* Create a server-level [firewall rule](../azure-sql/database/firewall-configure.md) or [configure VNET service endpoints](../mysql/howto-manage-vnet-using-portal.md) for target Azure Database for MySQL to allow Virtual Network for Azure Database Migration Service access to the target databases. +* Create a server-level [firewall rule](/azure/azure-sql/database/firewall-configure) or [configure VNET service endpoints](../mysql/howto-manage-vnet-using-portal.md) for target Azure Database for MySQL to allow Virtual Network for Azure Database Migration Service access to the target databases. * The source MySQL must be on supported MySQL community edition. To determine the version of MySQL instance, in the MySQL utility or MySQL Workbench, run the following command: ``` |
| dms | Tutorial Sql Server Managed Instance Offline Ads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-managed-instance-offline-ads.md | Last updated 10/05/2021 # Tutorial: Migrate SQL Server to an Azure SQL Managed Instance offline using Azure Data Studio with DMS -You can use the Azure SQL migration extension in Azure Data Studio to migrate the database(s) from a SQL Server instance to Azure SQL Managed Instance. For methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](../azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide.md). +You can use the Azure SQL migration extension in Azure Data Studio to migrate the database(s) from a SQL Server instance to Azure SQL Managed Instance. For methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide). In this tutorial, you migrate the **AdventureWorks** database from an on-premises instance of SQL Server to Azure SQL Managed Instance by using Azure Data Studio with Azure Database Migration Service (DMS). This tutorial focuses on the offline migration mode that considers an acceptable downtime during the migration process. To complete this tutorial, you need to: - Owner or Contributor role for the Azure subscription (required if creating a new DMS service). > [!IMPORTANT] > Azure account is only required when configuring the migration steps and is not required for assessment or Azure recommendation steps in the migration wizard.-* Create a target [Azure SQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* Create a target [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Provide an SMB network share, Azure storage account file share, or Azure storage account blob container that contains your full database backup files and subsequent transaction log backup files, which Azure Database Migration Service can use for database migration. > [!IMPORTANT] To complete this tutorial, you need to: > - You can provide compressed backups to reduce the likelihood of experiencing potential issues associated with migrating large backups. * Ensure that the service account running the source SQL Server instance has read and write permissions on the SMB network share that contains database backup files. -* If you're migrating a database protected by Transparent Data Encryption (TDE), the certificate from the source SQL Server instance needs to be migrated to your target Azure SQL Managed Instance before database restore. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](../azure-sql/managed-instance/tde-certificate-migrate.md). +* If you're migrating a database protected by Transparent Data Encryption (TDE), the certificate from the source SQL Server instance needs to be migrated to your target Azure SQL Managed Instance before database restore. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/tde-certificate-migrate). > [!TIP] > If your database contains sensitive data that is protected by [Always Encrypted](/sql/relational-databases/security/encryption/configure-always-encrypted-using-sql-server-management-studio), migration process using Azure Data Studio with DMS will automatically migrate your Always Encrypted keys to your target Azure SQL Managed Instance. To complete this tutorial, you need to: After all database backups are restored on Azure SQL Managed Instance, an automatic migration cutover will be initiated by the Azure DMS to ensure the migrated database in Azure SQL Managed Instance is ready for use and the migration status changes from *in progress* to *Succeeded*. > [!IMPORTANT]-> After the migration, availability of SQL Managed Instance with Business Critical service tier can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information, see [Management operations duration](../azure-sql/managed-instance/management-operations-overview.md#duration). +> After the migration, availability of SQL Managed Instance with Business Critical service tier can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information, see [Management operations duration](/azure/azure-sql/managed-instance/management-operations-overview#duration). ## Next steps -* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](../azure-sql/managed-instance/restore-sample-database-quickstart.md). -* For information about SQL Managed Instance, see [What is SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md). -* For information about connecting apps to SQL Managed Instance, see [Connect applications](../azure-sql/managed-instance/connect-application-instance.md). +* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](/azure/azure-sql/managed-instance/restore-sample-database-quickstart). +* For information about SQL Managed Instance, see [What is SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). +* For information about connecting apps to SQL Managed Instance, see [Connect applications](/azure/azure-sql/managed-instance/connect-application-instance). |
| dms | Tutorial Sql Server Managed Instance Online Ads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-managed-instance-online-ads.md | Last updated 10/05/2021 # Tutorial: Migrate SQL Server to an Azure SQL Managed Instance online using Azure Data Studio with DMS -Use the Azure SQL migration extension in Azure Data Studio to migrate database(s) from a SQL Server instance to an [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](../azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide.md). +Use the Azure SQL migration extension in Azure Data Studio to migrate database(s) from a SQL Server instance to an [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide). In this tutorial, you migrate the **AdventureWorks** database from an on-premises instance of SQL Server to Azure SQL Managed Instance with minimal downtime by using Azure Data Studio with Azure Database Migration Service (DMS). This tutorial focuses on the online migration mode where application downtime is limited to a short cutover at the end of the migration. To complete this tutorial, you need to: - Owner or Contributor role for the Azure subscription (required if creating a new DMS service). > [!IMPORTANT] > Azure account is only required when configuring the migration steps and is not required for assessment or Azure recommendation steps in the migration wizard.-* Create a target [Azure SQL Managed Instance](../azure-sql/managed-instance/instance-create-quickstart.md). +* Create a target [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/instance-create-quickstart). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Use one of the following storage options for the full database and transaction log backup files: - SMB network share To complete this tutorial, you need to: > - Each backup can be written to either a separate backup file or multiple backup files. However, appending multiple backups (i.e. full and t-log) into a single backup media is not supported. > - Use compressed backups to reduce the likelihood of experiencing potential issues associated with migrating large backups. * Ensure that the service account running the source SQL Server instance has read and write permissions on the SMB network share that contains database backup files.-* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](../azure-sql/managed-instance/tde-certificate-migrate.md) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). +* The source SQL Server instance certificate from a database protected by Transparent Data Encryption (TDE) needs to be migrated to the target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine before migrating data. To learn more, see [Migrate a certificate of a TDE-protected database to Azure SQL Managed Instance](/azure/azure-sql/managed-instance/tde-certificate-migrate) and [Move a TDE Protected Database to Another SQL Server](/sql/relational-databases/security/encryption/move-a-tde-protected-database-to-another-sql-server). > [!TIP] > If your database contains sensitive data that is protected by [Always Encrypted](/sql/relational-databases/security/encryption/configure-always-encrypted-using-sql-server-management-studio), migration process using Azure Data Studio with DMS will automatically migrate your Always Encrypted keys to your target Azure SQL Managed Instance or SQL Server on Azure Virtual Machine. To complete the cutover, During the cutover process, the migration status changes from *in progress* to *completing*. When the cutover process is completed, the migration status changes to *succeeded* to indicate that the database migration is successful and that the migrated database is ready for use. > [!IMPORTANT]-> After the cutover, availability of SQL Managed Instance with Business Critical service tier only can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information, see [Management operations duration](../azure-sql/managed-instance/management-operations-overview.md#duration). +> After the cutover, availability of SQL Managed Instance with Business Critical service tier only can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information, see [Management operations duration](/azure/azure-sql/managed-instance/management-operations-overview#duration). ## Next steps -* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](../azure-sql/managed-instance/restore-sample-database-quickstart.md). -* For information about SQL Managed Instance, see [What is SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md). -* For information about connecting apps to SQL Managed Instance, see [Connect applications](../azure-sql/managed-instance/connect-application-instance.md). +* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](/azure/azure-sql/managed-instance/restore-sample-database-quickstart). +* For information about SQL Managed Instance, see [What is SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). +* For information about connecting apps to SQL Managed Instance, see [Connect applications](/azure/azure-sql/managed-instance/connect-application-instance). |
| dms | Tutorial Sql Server Managed Instance Online | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-managed-instance-online.md | Last updated 08/20/2021 # Tutorial: Migrate SQL Server to an Azure SQL Managed Instance online using DMS -You can use Azure Database Migration Service to migrate the databases from a SQL Server instance to an [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) with minimal downtime. For additional methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](../azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide.md). +You can use Azure Database Migration Service to migrate the databases from a SQL Server instance to an [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) with minimal downtime. For additional methods that may require some manual effort, see the article [SQL Server instance migration to Azure SQL Managed Instance](/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide). In this tutorial, you migrate the [AdventureWorks2016](/sql/samples/adventureworks-install-configure#download-backup-files) database from an on-premises instance of SQL Server to a SQL Managed Instance with minimal downtime by using Azure Database Migration Service. To complete this tutorial, you need to: * Open your Windows Firewall to allow Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. If your default instance is listening on some other port, add that to the firewall. * If you're running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that Azure Database Migration Service can connect to a named instance on your source server. * If you're using a firewall appliance in front of your source databases, you may need to add firewall rules to allow Azure Database Migration Service to access the source database(s) for migration, as well as files via SMB port 445.-* Create a SQL Managed Instance by following the detail in the article [Create a SQL Managed Instance in the Azure portal](../azure-sql/managed-instance/instance-create-quickstart.md). +* Create a SQL Managed Instance by following the detail in the article [Create a SQL Managed Instance in the Azure portal](/azure/azure-sql/managed-instance/instance-create-quickstart). * Ensure that the logins used to connect the source SQL Server and the target SQL Managed Instance are members of the sysadmin server role. * Provide an SMB network share that contains all your database full database backup files and subsequent transaction log backup files, which Azure Database Migration Service can use for database migration. * Ensure that the service account running the source SQL Server instance has write privileges on the network share that you created and that the computer account for the source server has read/write access to the same share. To complete this tutorial, you need to: * Create or make a note of **Standard Performance tier**, Azure Storage Account, that allows DMS service to upload the database backup files to and use for migrating databases. Make sure to create the Azure Storage Account in the same region as the Azure Database Migration Service instance is created. > [!NOTE]- > When you migrate a database that's protected by [Transparent Data Encryption](../azure-sql/database/transparent-data-encryption-tde-overview.md) to a managed instance by using online migration, the corresponding certificate from the on-premises or Azure VM SQL Server instance must be migrated before the database restore. For detailed steps, see [Migrate a TDE cert to a managed instance](../azure-sql/database/transparent-data-encryption-tde-overview.md). + > When you migrate a database that's protected by [Transparent Data Encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) to a managed instance by using online migration, the corresponding certificate from the on-premises or Azure VM SQL Server instance must be migrated before the database restore. For detailed steps, see [Migrate a TDE cert to a managed instance](/azure/azure-sql/database/transparent-data-encryption-tde-overview). [!INCLUDE [resource-provider-register](../../includes/database-migration-service-resource-provider-register.md)] After an instance of the service is created, locate it within the Azure portal, 2. Select the **Subscription** containing the target instance of SQL Managed Instance, and then choose the target SQL Managed instance. - If you haven't already provisioned the SQL Managed Instance, select the [link](../azure-sql/managed-instance/instance-create-quickstart.md) to help you provision the instance. When the SQL Managed Instance is ready, return to this specific project to execute the migration. + If you haven't already provisioned the SQL Managed Instance, select the [link](/azure/azure-sql/managed-instance/instance-create-quickstart) to help you provision the instance. When the SQL Managed Instance is ready, return to this specific project to execute the migration. 3. Provide **SQL User** and **Password** to connect to the SQL Managed Instance. After the full database backup is restored on the target instance of SQL Managed  > [!IMPORTANT]- > After the cutover, availability of SQL Managed Instance with Business Critical service tier only can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information see [Management operations duration](../azure-sql/managed-instance/management-operations-overview.md#duration). + > After the cutover, availability of SQL Managed Instance with Business Critical service tier only can take significantly longer than General Purpose as three secondary replicas have to be seeded for AlwaysOn High Availability group. This operation duration depends on the size of data, for more information see [Management operations duration](/azure/azure-sql/managed-instance/management-operations-overview#duration). 5. When the database migration status shows **Completed**, connect your applications to the new target instance of SQL Managed Instance. After the full database backup is restored on the target instance of SQL Managed ## Additional resources -* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](../azure-sql/managed-instance/restore-sample-database-quickstart.md). -* For information about SQL Managed Instance, see [What is SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md). -* For information about connecting apps to SQL Managed Instance, see [Connect applications](../azure-sql/managed-instance/connect-application-instance.md). +* For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](/azure/azure-sql/managed-instance/restore-sample-database-quickstart). +* For information about SQL Managed Instance, see [What is SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). +* For information about connecting apps to SQL Managed Instance, see [Connect applications](/azure/azure-sql/managed-instance/connect-application-instance). |
| dms | Tutorial Sql Server To Azure Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-to-azure-sql.md | To complete this tutorial, you need to: - Download and install [SQL Server 2016 or later](https://www.microsoft.com/sql-server/sql-server-downloads). - Enable the TCP/IP protocol, which is disabled by default during SQL Server Express installation, by following the instructions in the article [Enable or Disable a Server Network Protocol](/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol#SSMSProcedure). - [Restore the AdventureWorks2016 database to the SQL Server instance.](/sql/samples/adventureworks-install-configure#restore-to-sql-server)-- Create a database in Azure SQL Database, which you do by following the details in the article [Create a database in Azure SQL Database using the Azure portal](../azure-sql/database/single-database-create-quickstart.md). For purposes of this tutorial, the name of the Azure SQL Database is assumed to be **AdventureWorksAzure**, but you can provide whatever name you wish.+- Create a database in Azure SQL Database, which you do by following the details in the article [Create a database in Azure SQL Database using the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). For purposes of this tutorial, the name of the Azure SQL Database is assumed to be **AdventureWorksAzure**, but you can provide whatever name you wish. > [!NOTE] > If you use SQL Server Integration Services (SSIS) and want to migrate the catalog database for your SSIS projects/packages (SSISDB) from SQL Server to Azure SQL Database, the destination SSISDB will be created and managed automatically on your behalf when you provision SSIS in Azure Data Factory (ADF). For more information about migrating SSIS packages, see the article [Migrate SQL Server Integration Services packages to Azure](./how-to-migrate-ssis-packages.md). To complete this tutorial, you need to: - Open your Windows firewall to allow Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. If your default instance is listening on some other port, add that to the firewall. - If you're running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that Azure Database Migration Service can connect to a named instance on your source server. - When using a firewall appliance in front of your source database(s), you may need to add firewall rules to allow Azure Database Migration Service to access the source database(s) for migration.-- Create a server-level IP [firewall rule](../azure-sql/database/firewall-configure.md) for Azure SQL Database to allow Azure Database Migration Service access to the target databases. Provide the subnet range of the virtual network used for Azure Database Migration Service.+- Create a server-level IP [firewall rule](/azure/azure-sql/database/firewall-configure) for Azure SQL Database to allow Azure Database Migration Service access to the target databases. Provide the subnet range of the virtual network used for Azure Database Migration Service. - Ensure that the credentials used to connect to source SQL Server instance have [CONTROL SERVER](/sql/t-sql/statements/grant-server-permissions-transact-sql) permissions. - Ensure that the credentials used to connect to target Azure SQL Database instance have [CONTROL DATABASE](/sql/t-sql/statements/grant-database-permissions-transact-sql) permission on the target databases. Select either all databases or specific databases that you want to migrate to Az ## Additional resources - For information about Azure Database Migration Service, see the article [What is Azure Database Migration Service?](./dms-overview.md).-- For information about Azure SQL Database, see the article [What is the Azure SQL Database service?](../azure-sql/database/sql-database-paas-overview.md).+- For information about Azure SQL Database, see the article [What is the Azure SQL Database service?](/azure/azure-sql/database/sql-database-paas-overview). |
| dms | Tutorial Sql Server To Managed Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-to-managed-instance.md | Last updated 08/16/2021 # Tutorial: Migrate SQL Server to an Azure SQL Managed Instance offline using DMS -You can use Azure Database Migration Service to migrate the databases from a SQL Server instance to an [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md). For additional methods that may require some manual effort, see the article [SQL Server to Azure SQL Managed Instance](../azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide.md). +You can use Azure Database Migration Service to migrate the databases from a SQL Server instance to an [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). For additional methods that may require some manual effort, see the article [SQL Server to Azure SQL Managed Instance](/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide). In this tutorial, you migrate the [AdventureWorks2016](/sql/samples/adventureworks-install-configure#download-backup-files) database from an on-premises instance of SQL Server to a SQL Managed Instance by using Azure Database Migration Service. To complete this tutorial, you need to: - Open your Windows Firewall to allow Azure Database Migration Service to access the source SQL Server, which by default is TCP port 1433. If your default instance is listening on some other port, add that to the firewall. - If you're running multiple named SQL Server instances using dynamic ports, you may wish to enable the SQL Browser Service and allow access to UDP port 1434 through your firewalls so that Azure Database Migration Service can connect to a named instance on your source server. - If you're using a firewall appliance in front of your source databases, you may need to add firewall rules to allow Azure Database Migration Service to access the source database(s) for migration, as well as files via SMB port 445.-- Create a SQL Managed Instance by following the detail in the article [Create a SQL Managed Instance in the Azure portal](../azure-sql/managed-instance/instance-create-quickstart.md).+- Create a SQL Managed Instance by following the detail in the article [Create a SQL Managed Instance in the Azure portal](/azure/azure-sql/managed-instance/instance-create-quickstart). - Ensure that the logins used to connect the source SQL Server and target SQL Managed Instance are members of the sysadmin server role. >[!NOTE] After an instance of the service is created, locate it within the Azure portal, 1. On the **Select target** screen, specify the connection details for the target, which is the pre-provisioned SQL Managed Instance to which you're migrating the **AdventureWorks2016** database. - If you haven't already provisioned the SQL Managed Instance, select the [link](../azure-sql/managed-instance/instance-create-quickstart.md) to help you provision the instance. You can still continue with project creation and then, when the SQL Managed Instance is ready, return to this specific project to execute the migration. + If you haven't already provisioned the SQL Managed Instance, select the [link](/azure/azure-sql/managed-instance/instance-create-quickstart) to help you provision the instance. You can still continue with project creation and then, when the SQL Managed Instance is ready, return to this specific project to execute the migration.  After an instance of the service is created, locate it within the Azure portal, ## Additional resources -- For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](../azure-sql/managed-instance/restore-sample-database-quickstart.md).-- For information about SQL Managed Instance, see [What is SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md).-- For information about connecting apps to SQL Managed Instance, see [Connect applications](../azure-sql/managed-instance/connect-application-instance.md).+- For a tutorial showing you how to migrate a database to SQL Managed Instance using the T-SQL RESTORE command, see [Restore a backup to SQL Managed Instance using the restore command](/azure/azure-sql/managed-instance/restore-sample-database-quickstart). +- For information about SQL Managed Instance, see [What is SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). +- For information about connecting apps to SQL Managed Instance, see [Connect applications](/azure/azure-sql/managed-instance/connect-application-instance). |
| dms | Tutorial Sql Server To Virtual Machine Offline Ads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-to-virtual-machine-offline-ads.md | Last updated 10/05/2021 # Tutorial: Migrate SQL Server to SQL Server on Azure Virtual Machine offline using Azure Data Studio with DMS -Use the Azure SQL migration extension in Azure Data Studio to migrate the databases from a SQL Server instance to a [SQL Server on Azure Virtual Machine (SQL Server 2016 and above)](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to SQL Server on Azure Virtual Machine](../azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-migration-overview.md). +Use the Azure SQL migration extension in Azure Data Studio to migrate the databases from a SQL Server instance to a [SQL Server on Azure Virtual Machine (SQL Server 2016 and above)](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to SQL Server on Azure Virtual Machine](/azure/azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-migration-overview). In this tutorial, you migrate the **AdventureWorks** database from an on-premises instance of SQL Server to a SQL Server on Azure Virtual Machine with the offline migration method by using Azure Data Studio with Azure Database Migration Service. To complete this tutorial, you need to: - Owner or Contributor role for the Azure subscription. > [!IMPORTANT] > Azure account is only required when configuring the migration steps and is not required for assessment or Azure recommendation steps in the migration wizard.-* Create a target [SQL Server on Azure Virtual Machine](../azure-sql/virtual-machines/windows/create-sql-vm-portal.md). +* Create a target [SQL Server on Azure Virtual Machine](/azure/azure-sql/virtual-machines/windows/create-sql-vm-portal). > [!IMPORTANT]- > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md#management-modes). + > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management#management-modes). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Use one of the following storage options for the full database and transaction log backup files: - SMB network share After all database backups are restored on SQL Server on Azure Virtual Machine, ## Next steps -* For a tutorial showing you how to migrate a database to SQL Server on Azure Virtual Machines using the T-SQL RESTORE command, see [Migrate a SQL Server database to SQL Server on a virtual machine](../azure-sql/virtual-machines/windows/migrate-to-vm-from-sql-server.md). -* For information about SQL Server on Azure Virtual Machines, see [Overview of SQL Server on Azure Windows Virtual Machines](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md). -* For information about connecting apps to SQL Server on Azure Virtual Machines, see [Connect applications](../azure-sql/virtual-machines/windows/ways-to-connect-to-sql.md). +* For a tutorial showing you how to migrate a database to SQL Server on Azure Virtual Machines using the T-SQL RESTORE command, see [Migrate a SQL Server database to SQL Server on a virtual machine](/azure/azure-sql/virtual-machines/windows/migrate-to-vm-from-sql-server). +* For information about SQL Server on Azure Virtual Machines, see [Overview of SQL Server on Azure Windows Virtual Machines](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview). +* For information about connecting apps to SQL Server on Azure Virtual Machines, see [Connect applications](/azure/azure-sql/virtual-machines/windows/ways-to-connect-to-sql). |
| dms | Tutorial Sql Server To Virtual Machine Online Ads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dms/tutorial-sql-server-to-virtual-machine-online-ads.md | Last updated 10/05/2021 # Tutorial: Migrate SQL Server to SQL Server on Azure Virtual Machine online using Azure Data Studio with DMS -Use the Azure SQL migration extension in Azure Data Studio to migrate the databases from a SQL Server instance to a [SQL Server on Azure Virtual Machine (SQL Server 2016 and above)](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to SQL Server on Azure Virtual Machine](../azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-migration-overview.md). +Use the Azure SQL migration extension in Azure Data Studio to migrate the databases from a SQL Server instance to a [SQL Server on Azure Virtual Machine (SQL Server 2016 and above)](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview) with minimal downtime. For methods that may require some manual effort, see the article [SQL Server instance migration to SQL Server on Azure Virtual Machine](/azure/azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-migration-overview). In this tutorial, you migrate the **AdventureWorks** database from an on-premises instance of SQL Server to a SQL Server on Azure Virtual Machine with minimal downtime by using Azure Data Studio with Azure Database Migration Service. To complete this tutorial, you need to: - Owner or Contributor role for the Azure subscription. > [!IMPORTANT] > Azure account is only required when configuring the migration steps and is not required for assessment or Azure recommendation steps in the migration wizard.-* Create a target [SQL Server on Azure Virtual Machine](../azure-sql/virtual-machines/windows/create-sql-vm-portal.md). +* Create a target [SQL Server on Azure Virtual Machine](/azure/azure-sql/virtual-machines/windows/create-sql-vm-portal). > [!IMPORTANT]- > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md#management-modes). + > If you have an existing Azure Virtual Machine, it should be registered with [SQL IaaS Agent extension in Full management mode](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management#management-modes). * Ensure that the logins used to connect the source SQL Server are members of the *sysadmin* server role or have `CONTROL SERVER` permission. * Use one of the following storage options for the full database and transaction log backup files: - SMB network share During the cutover process, the migration status changes from *in progress* to * ## Next steps -* How to migrate a database to SQL Server on Azure Virtual Machines using the T-SQL RESTORE command, see [Migrate a SQL Server database to SQL Server on a virtual machine](../azure-sql/virtual-machines/windows/migrate-to-vm-from-sql-server.md). -* For information about SQL Server on Azure Virtual Machines, see [Overview of SQL Server on Azure Windows Virtual Machines](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md). -* For information about connecting apps to SQL Server on Azure Virtual Machines, see [Connect applications](../azure-sql/virtual-machines/windows/ways-to-connect-to-sql.md). +* How to migrate a database to SQL Server on Azure Virtual Machines using the T-SQL RESTORE command, see [Migrate a SQL Server database to SQL Server on a virtual machine](/azure/azure-sql/virtual-machines/windows/migrate-to-vm-from-sql-server). +* For information about SQL Server on Azure Virtual Machines, see [Overview of SQL Server on Azure Windows Virtual Machines](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview). +* For information about connecting apps to SQL Server on Azure Virtual Machines, see [Connect applications](/azure/azure-sql/virtual-machines/windows/ways-to-connect-to-sql). |
| dms | Tutorial Sql Server To Virtual Machine Online Ads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dotnet-develop-multitenant-applications.md | A properly implemented multitenant application provides the following benefits t In short, while there are many considerations that you must take into account to provide a highly scalable service, there are also multiple goals and requirements that are common to many multitenant applications. Some may not be relevant in specific scenarios, and the importance of individual goals and requirements will differ in each scenario. As a provider of the multitenant application, you'll also have goals and requirements, such as meeting the tenant's needs, profitability, billing, multiple service levels, provisioning, maintainability monitoring, and automation. -For more information on additional design considerations of a multitenant application, see [Hosting a Multi-Tenant Application on Azure][Hosting a Multi-Tenant Application on Azure]. For information on common data architecture patterns of multi-tenant software-as-a-service (SaaS) database applications, see [Design Patterns for Multi-tenant SaaS Applications with Azure SQL Database](./azure-sql/database/saas-tenancy-app-design-patterns.md). +For more information on additional design considerations of a multitenant application, see [Hosting a Multi-Tenant Application on Azure][Hosting a Multi-Tenant Application on Azure]. For information on common data architecture patterns of multi-tenant software-as-a-service (SaaS) database applications, see [Design Patterns for Multi-tenant SaaS Applications with Azure SQL Database](/azure/azure-sql/database/saas-tenancy-app-design-patterns). Azure provides many features that allow you to address the key problems encountered when designing a multitenant system. |
| event-grid | Delivery Properties | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/event-grid/delivery-properties.md | You can also specify custom properties when sending messages to Service Bus queu ### Event Hubs example -If you need to publish events to a specific partition within an event hub, set the `ParitionKey` property on your event subscription to specify the partition key that identifies the target event hub partition. +If you need to publish events to a specific partition within an event hub, set the `PartitionKey` property on your event subscription to specify the partition key that identifies the target event hub partition. | Header name | Header type | | :-- | :-- | |
| event-grid | Secure Webhook Delivery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/event-grid/secure-webhook-delivery.md | Based on the diagram above, follow the next steps to configure the tenant. 8. Login as the Event Grid subscription writer Azure AD Application by running the command. - ```Shell + ```azurecli PS /home/user>az login --service-principal -u [REPLACE_WITH_EVENT_GRID_SUBSCRIPTION_WRITER_APP_ID] -p [REPLACE_WITH_EVENT_GRID_SUBSCRIPTION_WRITER_APP_SECRET_VALUE] --tenant [REPLACE_WITH_TENANT_ID] ``` 9. Create your subscription by running the command. - ```Shell + ```azurecli PS /home/user>az eventgrid system-topic event-subscription create --name [REPLACE_WITH_SUBSCRIPTION_NAME] -g [REPLACE_WITH_RESOURCE_GROUP] --system-topic-name [REPLACE_WITH_SYSTEM_TOPIC] --endpoint [REPLACE_WITH_WEBHOOK_ENDPOINT] --event-delivery-schema [REPLACE_WITH_WEBHOOK_EVENT_SCHEMA] --azure-active-directory-tenant-id [REPLACE_WITH_TENANT_ID] --azure-active-directory-application-id-or-uri [REPLACE_WITH_APPLICATION_ID_FROM_SCRIPT] --endpoint-type webhook ``` Back in **Tenant A**, do the following steps: 1. Open the [Azure Shell](https://portal.azure.com/#cloudshell/), and login as the Event Grid subscription writer Azure AD Application by running the command. - ```Shell + ```azurecli PS /home/user>az login --service-principal -u [REPLACE_WITH_APP_ID] -p [REPLACE_WITH_SECRET_VALUE] --tenant [REPLACE_WITH_TENANT_ID] ``` 2. Create your subscription by running the command. - ```Shell + ```azurecli PS /home/user>az eventgrid system-topic event-subscription create --name [REPLACE_WITH_SUBSCRIPTION_NAME] -g [REPLACE_WITH_RESOURCE_GROUP] --system-topic-name [REPLACE_WITH_SYSTEM_TOPIC] --endpoint [REPLACE_WITH_WEBHOOK_ENDPOINT] --event-delivery-schema [REPLACE_WITH_WEBHOOK_EVENT_SCHEMA] --azure-active-directory-tenant-id [REPLACE_WITH_TENANT_B_ID] --azure-active-directory-application-id-or-uri [REPLACE_WITH_APPLICATION_ID_FROM_SCRIPT] --endpoint-type webhook ``` |
| expressroute | How To Move Peering | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/expressroute/how-to-move-peering.md | To connect to Microsoft peering, you need to set up and manage NAT. Your connect Refer to [Asymmetric routing with multiple network paths](./expressroute-asymmetric-routing.md) for caveats of asymmetric routing before configuring Microsoft peering. -* If you are using public peering and currently have IP Network rules for public IP addresses that are used to access [Azure Storage](../storage/common/storage-network-security.md) or [Azure SQL Database](../azure-sql/database/vnet-service-endpoint-rule-overview.md), you need to make sure that the NAT IP pool configured with Microsoft peering is included in the list of public IP addresses for the Azure storage account or Azure SQL account. +* If you are using public peering and currently have IP Network rules for public IP addresses that are used to access [Azure Storage](../storage/common/storage-network-security.md) or [Azure SQL Database](/azure/azure-sql/database/vnet-service-endpoint-rule-overview), you need to make sure that the NAT IP pool configured with Microsoft peering is included in the list of public IP addresses for the Azure storage account or Azure SQL account. * Note that legacy Public peering makes use of Source Network Address Translation (SNAT) to a Microsoft-registered public IP, while Microsoft peering does not. * In order to move to Microsoft peering with no downtime, use the steps in this article in the order that they are presented. |
| firewall-manager | Private Link Inspection Secure Virtual Hub | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/firewall-manager/private-link-inspection-secure-virtual-hub.md | Azure Firewall filters traffic using any of the following methods: Use application rules over network rules to inspect traffic destined to private endpoints. A secured virtual hub is managed by Microsoft and it cannot be linked to a [Private DNS Zone](../dns/private-dns-privatednszone.md). This is required to resolve a [private link resource](../private-link/private-endpoint-overview.md#private-link-resource) FQDN to its corresponding private endpoint IP address. -SQL FQDN filtering is supported in [proxy-mode](../azure-sql/database/connectivity-architecture.md#connection-policy) only (port 1433). *Proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using FQDN in firewall network rules. +SQL FQDN filtering is supported in [proxy-mode](/azure/azure-sql/database/connectivity-architecture#connection-policy) only (port 1433). *Proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using FQDN in firewall network rules. ## Filter traffic using FQDN in network and application rules |
| firewall | Sql Fqdn Filtering | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/firewall/sql-fqdn-filtering.md | With SQL FQDNs, you can filter traffic: - From on-premises to Azure SQL Managed Instances or SQL IaaS running in your VNets. - From spoke-to-spoke to Azure SQL Managed Instances or SQL IaaS running in your VNets. -SQL FQDN filtering is supported in [proxy-mode](../azure-sql/database/connectivity-architecture.md#connection-policy) only (port 1433). If you use SQL in the default redirect mode, you can filter access using the SQL service tag as part of [network rules](features.md#network-traffic-filtering-rules). +SQL FQDN filtering is supported in [proxy-mode](/azure/azure-sql/database/connectivity-architecture#connection-policy) only (port 1433). If you use SQL in the default redirect mode, you can filter access using the SQL service tag as part of [network rules](features.md#network-traffic-filtering-rules). If you use non-default ports for SQL IaaS traffic, you can configure those ports in the firewall application rules. ## Configure using Azure CLI 1. Deploy an [Azure Firewall using Azure CLI](deploy-cli.md).-2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](../azure-sql/database/connectivity-settings.md#change-the-connection-policy-via-the-azure-cli). +2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli). > [!NOTE] > SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule). If you use non-default ports for SQL IaaS traffic, you can configure those ports ## Configure using Azure PowerShell 1. Deploy an [Azure Firewall using Azure PowerShell](deploy-ps.md).-2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](../azure-sql/database/connectivity-settings.md#change-the-connection-policy-via-the-azure-cli). +2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli). > [!NOTE] > SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule). If you use non-default ports for SQL IaaS traffic, you can configure those ports ## Configure using the Azure portal 1. Deploy an [Azure Firewall using Azure CLI](deploy-cli.md).-2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](../azure-sql/database/connectivity-settings.md#change-the-connection-policy-via-the-azure-cli). +2. If you filter traffic to Azure SQL Database, Azure Synapse Analytics, or SQL Managed Instance, ensure the SQL connectivity mode is set to **Proxy**. To learn how to switch SQL connectivity mode, see [Azure SQL Connectivity Settings](/azure/azure-sql/database/connectivity-settings#change-the-connection-policy-via-the-azure-cli). > [!NOTE] > SQL *proxy* mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using the SQL [service tag](service-tags.md) in firewall [network rules](tutorial-firewall-deploy-portal.md#configure-a-network-rule). If you use non-default ports for SQL IaaS traffic, you can configure those ports ## Next steps -To learn about SQL proxy and redirect modes, see [Azure SQL Database connectivity architecture](../azure-sql/database/connectivity-architecture.md). +To learn about SQL proxy and redirect modes, see [Azure SQL Database connectivity architecture](/azure/azure-sql/database/connectivity-architecture). |
| frontdoor | Rules Match Conditions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/frontdoor/rules-match-conditions.md | The **remote address** match condition identifies requests based on the requeste * When you specify multiple IP addresses and IP address blocks, 'OR' logic is applied. * **IPv4 example**: if you add two IP addresses `1.2.3.4` and `10.20.30.40`, the condition is matched for any requests that arrive from either address 1.2.3.4 or 10.20.30.40. * **IPv6 example**: if you add two IP addresses `1:2:3:4:5:6:7:8` and `10:20:30:40:50:60:70:80`, the condition is matched for any requests that arrive from either address 1:2:3:4:5:6:7:8 or 10:20:30:40:50:60:70:80.-* The remote address represents the original client IP that is either from the network connection or typically the X-Forwarded-For request header if the user is behind a proxy. Use the [socket address](#socket-address) match condition if you need to match based on the TCP request's IP address. +* The remote address represents the original client IP that is either from the network connection or typically the X-Forwarded-For request header if the user is behind a proxy. Use the [socket address](#socket-address) match condition (available in Standard/Premium), if you need to match based on the TCP request's IP address. ### Properties |
| governance | Control Mapping | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/blueprints/samples/iso27001-ase-sql-workload/control-mapping.md | appropriate separation of duties. ## A.8.2.1 Classification of information -Azure's [SQL Vulnerability Assessment service](../../../../azure-sql/database/sql-vulnerability-assessment.md) +Azure's [SQL Vulnerability Assessment service](/azure/azure-sql/database/sql-vulnerability-assessment) can help you discover sensitive data stored in your databases and includes recommendations to classify that data. This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition to audit that vulnerabilities identified during SQL Vulnerability Assessment scan are remediated. |
| governance | Index | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/blueprints/samples/iso27001-ase-sql-workload/index.md | composed of: used to host one or more web applications, web APIs, or functions - An [Azure Key Vault](../../../../key-vault/general/overview.md) instance using a VNet service endpoint, for storing secrets used by applications running in the workload environment- - An [Azure SQL Database](../../../../azure-sql/database/sql-database-paas-overview.md) server + - An [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) server instance using a VNet service endpoint, for hosting databases used for applications in the workload environment |
| governance | Control Mapping | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/blueprints/samples/iso27001-shared/control-mapping.md | appropriate separation of duties. ## A.8.2.1 Classification of information Azure's-[SQL Vulnerability Assessment service](../../../../azure-sql/database/sql-vulnerability-assessment.md) +[SQL Vulnerability Assessment service](/azure/azure-sql/database/sql-vulnerability-assessment) can help you discover sensitive data stored in your databases and includes recommendations to classify that data. This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition to audit that vulnerabilities identified during SQL Vulnerability Assessment scan are remediated. |
| governance | Policy For Kubernetes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/concepts/policy-for-kubernetes.md | az k8s-extension create --cluster-type connectedClusters --cluster-name my-test- To check the extension instance creation was successful, and inspect extension metadata, run the following command substituting `<>` with your values: -```console +```azurecli az k8s-extension show --cluster-type connectedClusters --cluster-name <CLUSTER_NAME> --resource-group <RESOURCE_GROUP> --name <EXTENSION_INSTANCE_NAME> ``` #### Example: -```console +```azurecli az k8s-extension show --cluster-type connectedClusters --cluster-name my-test-cluster --resource-group my-test-rg --name azurepolicy ``` |
| governance | Australia Ism | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/australia-ism.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | ||||| |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## Guidelines for Database Systems - Database management system software initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## Guidelines for Cryptography - Transport Layer Security |
| governance | Azure Security Benchmark | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/azure-security-benchmark.md | initiative definition. |[Automation account variables should be encrypted](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F3657f5a0-770e-44a3-b44e-9431ba1e9735) |It is important to enable encryption of Automation account variable assets when storing sensitive data |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Use customer-managed key option in data at rest encryption when required |
| governance | Azure Security Benchmarkv1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/azure-security-benchmarkv1.md | initiative definition. |[SQL managed instances should use customer-managed keys to encrypt data at rest](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fac01ad65-10e5-46df-bdd9-6b0cad13e1d2) |Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Deny.json) | |[SQL servers should use customer-managed keys to encrypt data at rest](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0a370ff3-6cab-4e85-8995-295fd854c5b8) |Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |Audit, Deny, Disabled |[2.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Log and alert on changes to critical Azure resources |
| governance | Built In Policies | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/built-in-policies.md | Title: List of built-in policy definitions description: List built-in policy definitions for Azure Policy. Categories include Tags, Regulatory Compliance, Key Vault, Kubernetes, Guest Configuration, and more. Previously updated : 04/21/2022 Last updated : 04/25/2022 |
| governance | Canada Federal Pbmm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/canada-federal-pbmm.md | This built-in initiative is deployed as part of the |[Azure Defender for SQL should be enabled for unprotected Azure SQL servers](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb4388-5bf4-4ad7-ba82-2cd2f41ceae9) |Audit SQL servers without Advanced Data Security |AuditIfNotExists, Disabled |[2.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json) | |[Azure Defender for SQL should be enabled for unprotected SQL Managed Instances](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb7388-5bf4-4ad7-ba99-2cd2f41cebb9) |Audit each SQL Managed Instance without advanced data security. |AuditIfNotExists, Disabled |[1.0.2](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Cis Azure 1 1 0 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/cis-azure-1-1-0.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure ASC Default policy setting "Monitor Network Security Groups" is not "Disabled" initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that 'Data disks' are encrypted initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that only approved extensions are installed |
| governance | Cis Azure 1 3 0 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/cis-azure-1-3-0.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that only approved extensions are installed |
| governance | Cmmc L3 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/cmmc-l3.md | initiative definition. |[Storage accounts should have infrastructure encryption](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4733ea7b-a883-42fe-8cac-97454c2a9e4a) |Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json) | |[Storage accounts should use customer-managed key for encryption](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6fac406b-40ca-413b-bf8e-0bf964659c25) |Secure your blob and file storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data. |Audit, Disabled |[1.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. initiative definition. |[Storage accounts should have infrastructure encryption](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4733ea7b-a883-42fe-8cac-97454c2a9e4a) |Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json) | |[Storage accounts should restrict network access](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F34c877ad-507e-4c82-993e-3452a6e0ad3c) |Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges |Audit, Deny, Disabled |[1.1.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Fedramp High | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/fedramp-high.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Fedramp Moderate | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/fedramp-moderate.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Gov Azure Security Benchmark | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-azure-security-benchmark.md | initiative definition. |[Automation account variables should be encrypted](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F3657f5a0-770e-44a3-b44e-9431ba1e9735) |It is important to enable encryption of Automation account variable assets when storing sensitive data |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Use customer-managed key option in data at rest encryption when required |
| governance | Gov Cis Azure 1 1 0 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-cis-azure-1-1-0.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure ASC Default policy setting "Enable Next Generation Firewall(NGFW) Monitoring" is not "Disabled" initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that 'Data disks' are encrypted initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that only approved extensions are installed |
| governance | Gov Cis Azure 1 3 0 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-cis-azure-1-3-0.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Ensure that only approved extensions are installed |
| governance | Gov Cmmc L3 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-cmmc-l3.md | initiative definition. |[Storage accounts should have infrastructure encryption](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4733ea7b-a883-42fe-8cac-97454c2a9e4a) |Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json) | |[Storage accounts should use customer-managed key for encryption](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6fac406b-40ca-413b-bf8e-0bf964659c25) |Secure your blob and file storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data. |Audit, Disabled |[1.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. initiative definition. |[Storage accounts should have infrastructure encryption](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4733ea7b-a883-42fe-8cac-97454c2a9e4a) |Enable infrastructure encryption for higher level of assurance that the data is secure. When infrastructure encryption is enabled, data in a storage account is encrypted twice. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountInfrastructureEncryptionEnabled_Audit.json) | |[Storage accounts should restrict network access](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F34c877ad-507e-4c82-993e-3452a6e0ad3c) |Network access to storage accounts should be restricted. Configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premises clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges |Audit, Deny, Disabled |[1.1.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_NetworkAcls_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Gov Dod Impact Level 4 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-dod-impact-level-4.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Identify unauthorized use of organizational systems. initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Identify unauthorized use of organizational systems. |
| governance | Gov Dod Impact Level 5 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-dod-impact-level-5.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Identify unauthorized use of organizational systems. initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Identify unauthorized use of organizational systems. |
| governance | Gov Fedramp High | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-fedramp-high.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Gov Fedramp Moderate | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-fedramp-moderate.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Gov Irs 1075 Sept2016 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-irs-1075-sept2016.md | initiative definition. |[Azure Defender for SQL should be enabled for unprotected Azure SQL servers](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb4388-5bf4-4ad7-ba82-2cd2f41ceae9) |Audit SQL servers without Advanced Data Security |AuditIfNotExists, Disabled |[2.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json) | |[Azure Defender for SQL should be enabled for unprotected SQL Managed Instances](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb7388-5bf4-4ad7-ba99-2cd2f41cebb9) |Audit each SQL Managed Instance without advanced data security. |AuditIfNotExists, Disabled |[1.0.2](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Denial of Service Protection (SC-5) |
| governance | Gov Iso 27001 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-iso-27001.md | This built-in initiative is deployed as part of the |[Secure transfer to storage accounts should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) |Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Web Application should only be accessible over HTTPS](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa4af4a39-4135-47fb-b175-47fbdf85311d) |Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json) | ## Operations security |
| governance | Gov Nist Sp 800 53 R5 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/gov-nist-sp-800-53-r5.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Hipaa Hitrust 9 2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/hipaa-hitrust-9-2.md | initiative definition. |Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> | |||||-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### The organization restricts the use of writable removable media and personally-owned removable media in organizational systems. |
| governance | Irs 1075 Sept2016 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/irs-1075-sept2016.md | initiative definition. |[Azure Defender for SQL should be enabled for unprotected Azure SQL servers](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb4388-5bf4-4ad7-ba82-2cd2f41ceae9) |Audit SQL servers without Advanced Data Security |AuditIfNotExists, Disabled |[2.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_AdvancedDataSecurity_Audit.json) | |[Azure Defender for SQL should be enabled for unprotected SQL Managed Instances](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb7388-5bf4-4ad7-ba99-2cd2f41cebb9) |Audit each SQL Managed Instance without advanced data security. |AuditIfNotExists, Disabled |[1.0.2](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_AdvancedDataSecurity_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Denial of Service Protection (SC-5) |
| governance | Iso 27001 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/iso-27001.md | This built-in initiative is deployed as part of the |[Secure transfer to storage accounts should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) |Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Web Application should only be accessible over HTTPS](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa4af4a39-4135-47fb-b175-47fbdf85311d) |Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json) | ## Operations security |
| governance | New Zealand Ism | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/new-zealand-ism.md | initiative definition. |[SQL servers should use customer-managed keys to encrypt data at rest](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0a370ff3-6cab-4e85-8995-295fd854c5b8) |Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |Audit, Deny, Disabled |[2.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_EnsureServerTDEisEncryptedWithYourOwnKey_Deny.json) | |[Storage accounts should use customer-managed key for encryption](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6fac406b-40ca-413b-bf8e-0bf964659c25) |Secure your blob and file storage account with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data. |Audit, Disabled |[1.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountCustomerManagedKeyEnabled_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### 17.4.16 Using TLS |
| governance | Nist Sp 800 53 R5 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/nist-sp-800-53-r5.md | initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ### Cryptographic Protection initiative definition. |[Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F41425d9f-d1a5-499a-9932-f8ed8453932c) |To enhance data security, the data stored on the virtual machine (VM) host of your Azure Kubernetes Service nodes VMs should be encrypted at rest. This is a common requirement in many regulatory and industry compliance standards. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_EncryptionAtHost_Deny.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) | |[Virtual machines and virtual machine scale sets should have encryption at host enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc4d8e41-e223-45ea-9bf5-eada37891d87) |Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at [https://aka.ms/vm-hbe](../../../virtual-machines/disks-enable-host-based-encryption-portal.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/HostBasedEncryptionRequired_Deny.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## System and Information Integrity |
| governance | Pci Dss 3 2 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/pci-dss-3-2-1.md | initiative definition. |[Secure transfer to storage accounts should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) |Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Web Application should only be accessible over HTTPS](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa4af4a39-4135-47fb-b175-47fbdf85311d) |Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json) | ## Requirement 4 initiative definition. |[Secure transfer to storage accounts should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) |Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Web Application should only be accessible over HTTPS](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa4af4a39-4135-47fb-b175-47fbdf85311d) |Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json) | ## Requirement 5 initiative definition. |[Secure transfer to storage accounts should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) |Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Web Application should only be accessible over HTTPS](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa4af4a39-4135-47fb-b175-47fbdf85311d) |Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppServiceWebapp_AuditHTTP_Audit.json) | ### PCI DSS requirement 6.6 |
| governance | Rmit Malaysia | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/rmit-malaysia.md | initiative definition. |[Public network access should be disabled for Container registries](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0fdf0491-d080-4575-b627-ad0e843cba0f) |Disabling public network access improves security by ensuring that container registries are not exposed on the public internet. Creating private endpoints can limit exposure of container registry resources. Learn more at: [https://aka.ms/acr/portal/public-network](../../../container-registry/container-registry-access-selected-networks.md) and [https://aka.ms/acr/private-link](../../../container-registry/container-registry-private-link.md). |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Registry/ACR_PublicNetworkAccess_AuditDeny.json) | |[Subnets should be associated with a Network Security Group](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fe71308d3-144b-4262-b144-efdc3cc90517) |Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet. |AuditIfNotExists, Disabled |[3.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json) | |[Virtual machines should be connected to an approved virtual network](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fd416745a-506c-48b6-8ab1-83cb814bcaa3) |This policy audits any virtual machine connected to a virtual network that is not approved. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/ApprovedVirtualNetwork_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Virtual networks should use specified virtual network gateway](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff1776c76-f58c-4245-a8d0-2b207198dc8b) |This policy audits any virtual network if the default route does not point to the specified virtual network gateway. |AuditIfNotExists, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Network/VirtualNetwork_ApprovedVirtualNetworkGateway_AuditIfNotExists.json) | ### Network Resilience - 10.35 initiative definition. |[Remote debugging should be turned off for Web Applications](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fcb510bfd-1cba-4d9f-a230-cb0976f4bb71) |Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off. |AuditIfNotExists, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/App%20Service/AppService_DisableRemoteDebugging_WebApp_Audit.json) | |[Subnets should be associated with a Network Security Group](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fe71308d3-144b-4262-b144-efdc3cc90517) |Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet. |AuditIfNotExists, Disabled |[3.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_NetworkSecurityGroupsOnSubnets_Audit.json) | |[Subscriptions should have a contact email address for security issues](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7) |To ensure the relevant people in your organization are notified when there is a potential security breach in one of your subscriptions, set a security contact to receive email notifications from Security Center. |AuditIfNotExists, Disabled |[1.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_Security_contact_email.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | |[Vulnerabilities in container security configurations should be remediated](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fe8cbc669-f12d-49eb-93e7-9273119e9933) |Audit vulnerabilities in security configuration on machines with Docker installed and display as recommendations in Azure Security Center. |AuditIfNotExists, Disabled |[3.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_ContainerBenchmark_Audit.json) | ## Next steps |
| governance | Ukofficial Uknhs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/samples/ukofficial-uknhs.md | This built-in initiative is deployed as part of the |[Automation account variables should be encrypted](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F3657f5a0-770e-44a3-b44e-9431ba1e9735) |It is important to enable encryption of Automation account variable assets when storing sensitive data |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Automation/Automation_AuditUnencryptedVars_Audit.json) | |[Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F617c02be-7f02-4efd-8836-3180d47b6c68) |Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |Audit, Deny, Disabled |[1.1.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Service%20Fabric/ServiceFabric_AuditClusterProtectionLevel_Audit.json) | |[Transparent Data Encryption on SQL databases should be enabled](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F17k78e20-9358-41c9-923c-fb736d382a12) |Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements |AuditIfNotExists, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlDBEncryption_Audit.json) |-|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse,](https://aka.ms/disksse,) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | +|[Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0961003e-5a0a-4549-abde-af6a37f2724d) |By default, a virtual machine's OS and data disks are encrypted-at-rest using platform-managed keys. Temp disks, data caches and data flowing between compute and storage aren't encrypted. Disregard this recommendation if: 1. using encryption-at-host, or 2. server-side encryption on Managed Disks meets your security requirements. Learn more in: Server-side encryption of Azure Disk Storage: [https://aka.ms/disksse](https://aka.ms/disksse) Different disk encryption offerings: [https://aka.ms/diskencryptioncomparison](../../../virtual-machines/disk-encryption-overview.md#comparison) |AuditIfNotExists, Disabled |[2.0.3](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Security%20Center/ASC_UnencryptedVMDisks_Audit.json) | ## Operational security |
| guides | Azure Developer Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/guides/developer/azure-developer-guide.md | Most applications must store data, so however you decide to host your applicatio > **When to use**: When your application requires data storage with referential integrity, transactional support, and support for TSQL queries. >- > **Get started**: [Create a database in Azure SQL Database in minutes by using the Azure portal](../../azure-sql/database/single-database-create-quickstart.md). + > **Get started**: [Create a database in Azure SQL Database in minutes by using the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). You can use [Azure Data Factory](../../data-factory/introduction.md) to move existing on-premises data to Azure. If you aren't ready to move data to the cloud, [Hybrid Connections](../../app-service/app-service-hybrid-connections.md) in Azure App Service lets you connect your App Service hosted app to on-premises resources. You can also connect to Azure data and storage services from your on-premises applications. |
| hdinsight | Apache Ambari Usage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/apache-ambari-usage.md | This is the sequence of service start at boot time: ## Ambari Database -HDInsight creates a database in SQL Database under the hood to serve as the database for Ambari server. The default [service tier is S0](../azure-sql/database/elastic-pool-scale.md). +HDInsight creates a database in SQL Database under the hood to serve as the database for Ambari server. The default [service tier is S0](/azure/azure-sql/database/elastic-pool-scale). For any cluster with worker node count bigger than 16 when creating the cluster, S2 is the database service tier. |
| hdinsight | Apache Domain Joined Configure Using Azure Adds | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/domain-joined/apache-domain-joined-configure-using-azure-adds.md | New-SelfSignedCertificate -Subject contoso100.onmicrosoft.com ` ``` > [!NOTE] -> Only tenant administrators have the privileges to enable Azure AD DS. If the cluster storage is Azure Data Lake Storage Gen1 or Gen2, you must disable Azure AD Multi-Factor Authentication only for users who will need to access the cluster by using basic Kerberos authentication. +> Only tenant administrators have the privileges to enable Azure AD DS. If the cluster storage is Azure Data Lake Storage Gen1 or Gen2, you must disable Azure AD Multi-Factor Authentication only for users who will need to access the cluster by using basic Kerberos authentication. If your organization requires Multi-Factor Authentication, try using the [HDInsight ID Broker feature](identity-broker.md). >-> You can use [trusted IPs](../../active-directory/authentication/howto-mfa-mfasettings.md#trusted-ips) or [Conditional Access](../../active-directory/conditional-access/overview.md) to disable Multi-Factor Authentication for specific users *only* when they're accessing the IP range for the HDInsight cluster's virtual network. If you're using Conditional Access, make sure that the Active Directory service endpoint in enabled on the HDInsight virtual network. +> You can use [trusted IPs](../../active-directory/authentication/howto-mfa-mfasettings.md#trusted-ips) or [Conditional Access](../../active-directory/conditional-access/overview.md) to disable Multi-Factor Authentication for specific users *only* when they're accessing the IP range for the HDInsight cluster's virtual network. > > If the cluster storage is Azure Blob storage, do not disable Multi-Factor Authentication. |
| hdinsight | Hdinsight Security Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/domain-joined/hdinsight-security-overview.md | The following table provides links to resources for each type of security soluti | Data Access Security | Configure [access control lists ACLs](../../storage/blobs/data-lake-storage-access-control.md) for Azure Data Lake Storage Gen1 and Gen2 | Customer | | | Enable the ["Secure transfer required"](../../storage/common/storage-require-secure-transfer.md) property on storage accounts. | Customer | | | Configure [Azure Storage firewalls](../../storage/common/storage-network-security.md) and virtual networks | Customer |-| | Configure [Azure virtual network service endpoints](../../virtual-network/virtual-network-service-endpoints-overview.md) for Cosmos DB and [Azure SQL DB](../../azure-sql/database/vnet-service-endpoint-rule-overview.md) | Customer | +| | Configure [Azure virtual network service endpoints](../../virtual-network/virtual-network-service-endpoints-overview.md) for Cosmos DB and [Azure SQL DB](/azure/azure-sql/database/vnet-service-endpoint-rule-overview) | Customer | | | Ensure that the [Encryption in transit](./encryption-in-transit.md) feature is enabled to use TLS and IPSec for intra-cluster communication. | Customer | | | Configure [customer-managed keys](../../storage/common/customer-managed-keys-configure-key-vault.md) for Azure Storage encryption | Customer | | | Control access to your data by Azure support using [Customer lockbox](../../security/fundamentals/customer-lockbox-overview.md) | Customer | |
| hdinsight | Apache Hadoop Etl At Scale | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hadoop/apache-hadoop-etl-at-scale.md | HBase adaptability is dependent on the number of nodes in the HDInsight cluster. Azure offers three PaaS relational databases: -* [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md) is an implementation of Microsoft SQL Server. For more information on performance, see [Tuning Performance in Azure SQL Database](../../azure-sql/database/performance-guidance.md). +* [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) is an implementation of Microsoft SQL Server. For more information on performance, see [Tuning Performance in Azure SQL Database](/azure/azure-sql/database/performance-guidance). * [Azure Database for MySQL](../../mysql/overview.md) is an implementation of Oracle MySQL. * [Azure Database for PostgreSQL](../../postgresql/quickstart-create-server-database-portal.md) is an implementation of PostgreSQL. |
| hdinsight | Apache Hadoop Use Sqoop Curl | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hadoop/apache-hadoop-use-sqoop-curl.md | Curl is used to demonstrate how you can interact with HDInsight by using raw HTT * Completion of [Set up test environment](./hdinsight-use-sqoop.md#create-cluster-and-sql-database) from [Use Apache Sqoop with Hadoop in HDInsight](./hdinsight-use-sqoop.md). -* A client to query the Azure SQL Database. Consider using [SQL Server Management Studio](../../azure-sql/database/connect-query-ssms.md) or [Visual Studio Code](../../azure-sql/database/connect-query-vscode.md). +* A client to query the Azure SQL Database. Consider using [SQL Server Management Studio](/azure/azure-sql/database/connect-query-ssms) or [Visual Studio Code](/azure/azure-sql/database/connect-query-vscode). * [Curl](https://curl.haxx.se/). Curl is a tool to transfer data from or to a HDInsight cluster. |
| hdinsight | Hdinsight Use Sqoop | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hadoop/hdinsight-use-sqoop.md | The cluster, SQL database, and other objects are created through the Azure porta |Bacpac File Name |Use the default value unless you want to use your own bacpac file.| |Location |Use the default value.| - The [logical SQL server](../../azure-sql/database/logical-servers.md) name will be `<ClusterName>dbserver`. The database name will be `<ClusterName>db`. The default storage account name will be `e6qhezrh2pdqu`. + The [logical SQL server](/azure/azure-sql/database/logical-servers) name will be `<ClusterName>dbserver`. The database name will be `<ClusterName>db`. The default storage account name will be `e6qhezrh2pdqu`. 3. Select **I agree to the terms and conditions stated above**. |
| hdinsight | Hdinsight Apps Install Hiveserver2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-apps-install-hiveserver2.md | In this article, you've learned how to install HiveServer2 onto your cluster. To * [Install edge node](hdinsight-apps-use-edge-node.md): Learn how to install an edge node onto your HDInsight cluster. * [Install HDInsight applications](hdinsight-apps-install-applications.md): Learn how to install an HDInsight application to your clusters.-* [Azure SQL DTU Connection Limits](../azure-sql/database/resource-limits-dtu-single-databases.md): Learn about Azure SQL database limits using DTU. -* [Azure SQL vCore Connection Limits](../azure-sql/database/resource-limits-vcore-elastic-pools.md): Learn about Azure SQL database limits using vCores. +* [Azure SQL DTU Connection Limits](/azure/azure-sql/database/resource-limits-dtu-single-databases): Learn about Azure SQL database limits using DTU. +* [Azure SQL vCore Connection Limits](/azure/azure-sql/database/resource-limits-vcore-elastic-pools): Learn about Azure SQL database limits using vCores. |
| hdinsight | Hdinsight Business Continuity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-business-continuity.md | It doesn't always take a catastrophic event to impact business functionality. Se ### HDInsight metastore -HDInsight uses [Azure SQL Database](https://azure.microsoft.com/support/legal/sl). +HDInsight uses [Azure SQL Database](https://azure.microsoft.com/support/legal/sla/azure-sql-database/v1_4/) as a metastore, which provides an SLA of 99.99%. Three replicas of data persist within a data center with synchronous replication. If there is a replica loss, an alternate replica is served seamlessly. [Active geo-replication](/azure/azure-sql/database/active-geo-replication-overview) is supported out of the box with a maximum of four data centers. When there is a failover, either manual or data center, the first replica in the hierarchy will automatically become read-write capable. For more information, see [Azure SQL Database business continuity](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview). ### HDInsight Storage |
| hdinsight | Hdinsight Custom Ambari Db | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-custom-ambari-db.md | Last updated 01/12/2021 Apache Ambari simplifies the management and monitoring of an Apache Hadoop cluster. Ambari provides an easy to use web UI and REST API. Ambari is included on HDInsight clusters, and is used to monitor the cluster and make configuration changes. -In normal cluster creation, as described in other articles such as [Set up clusters in HDInsight](hdinsight-hadoop-provision-linux-clusters.md), Ambari is deployed in an [S0 Azure SQL Database](../azure-sql/database/resource-limits-dtu-single-databases.md#standard-service-tier) that is managed by HDInsight and is not accessible to users. +In normal cluster creation, as described in other articles such as [Set up clusters in HDInsight](hdinsight-hadoop-provision-linux-clusters.md), Ambari is deployed in an [S0 Azure SQL Database](/azure/azure-sql/database/resource-limits-dtu-single-databases#standard-service-tier) that is managed by HDInsight and is not accessible to users. The custom Ambari DB feature allows you to deploy a new cluster and setup Ambari in an external database that you manage. The deployment is done with an Azure Resource Manager template. This feature has the following benefits: The custom Ambari DB has the following other requirements: - You must have an existing Azure SQL DB server and database. - The database that you provide for Ambari setup must be empty. There should be no tables in the default dbo schema. - The user used to connect to the database should have SELECT, CREATE TABLE, and INSERT permissions on the database.-- Turn on the option to [Allow access to Azure services](../azure-sql/database/vnet-service-endpoint-rule-overview.md#azure-portal-steps) on the server where you will host Ambari.+- Turn on the option to [Allow access to Azure services](/azure/azure-sql/database/vnet-service-endpoint-rule-overview#azure-portal-steps) on the server where you will host Ambari. - Management IP addresses from HDInsight service need to be allowed in the firewall rule. See [HDInsight management IP addresses](hdinsight-management-ip-addresses.md) for a list of the IP addresses that must be added to the server-level firewall rule. When you host your Apache Ambari DB in an external database, remember the following points: - You're responsible for the additional costs of the Azure SQL DB that holds Ambari.-- Back up your custom Ambari DB periodically. Azure SQL Database generates backups automatically, but the backup retention time-frame varies. For more information, see [Learn about automatic SQL Database backups](../azure-sql/database/automated-backups-overview.md).+- Back up your custom Ambari DB periodically. Azure SQL Database generates backups automatically, but the backup retention time-frame varies. For more information, see [Learn about automatic SQL Database backups](/azure/azure-sql/database/automated-backups-overview). - Don't change the custom Ambari DB password after the HDInsight cluster reaches the **Running** state. It is not supported. ## Deploy clusters with a custom Ambari DB |
| hdinsight | Hdinsight Operationalize Data Pipeline | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-operationalize-data-pipeline.md | This pipeline requires an Azure SQL Database and an HDInsight Hadoop cluster in ### Provision Azure SQL Database -1. Create an Azure SQL Database. See [Create an Azure SQL Database in the Azure portal](../azure-sql/database/single-database-create-quickstart.md). +1. Create an Azure SQL Database. See [Create an Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). -1. To make sure that your HDInsight cluster can access the connected Azure SQL Database, configure Azure SQL Database firewall rules to allow Azure services and resources to access the server. You can enable this option in the Azure portal by selecting **Set server firewall**, and selecting **ON** underneath **Allow Azure services and resources to access this server** for Azure SQL Database. For more information, see [Create and manage IP firewall rules](../azure-sql/database/firewall-configure.md#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). +1. To make sure that your HDInsight cluster can access the connected Azure SQL Database, configure Azure SQL Database firewall rules to allow Azure services and resources to access the server. You can enable this option in the Azure portal by selecting **Set server firewall**, and selecting **ON** underneath **Allow Azure services and resources to access this server** for Azure SQL Database. For more information, see [Create and manage IP firewall rules](/azure/azure-sql/database/firewall-configure#use-the-azure-portal-to-manage-server-level-ip-firewall-rules). -1. Use [Query editor](../azure-sql/database/single-database-create-quickstart.md#query-the-database) to execute the following SQL statements to create the `dailyflights` table that will store the summarized data from each run of the pipeline. +1. Use [Query editor](/azure/azure-sql/database/single-database-create-quickstart#query-the-database) to execute the following SQL statements to create the `dailyflights` table that will store the summarized data from each run of the pipeline. ```sql CREATE TABLE dailyflights |
| hdinsight | Hdinsight Restrict Outbound Traffic | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-restrict-outbound-traffic.md | Create the network rules to correctly configure your HDInsight cluster. | Name | Protocol | Source Addresses | Service Tags | Destination Ports | Notes | | | | | | | |- | Rule_6 | TCP | * | SQL | 1433 , 11000-11999 | If you are using the default sql servers provided by HDInsight, configure a network rule in the Service Tags section for SQL that will allow you to log and audit SQL traffic. Unless you configured Service Endpoints for SQL Server on the HDInsight subnet, which will bypass the firewall. If you are using custom SQL server for Ambari, Oozie, Ranger and Hive metastores then you only need to allow the traffic to your own custom SQL Servers. Refer to [Azure SQL Database and Azure Synapse Analytics connectivity architecture](../azure-sql/database/connectivity-architecture.md) to see why 11000-11999 port range is also needed in addition to 1433. | + | Rule_6 | TCP | * | SQL | 1433 , 11000-11999 | If you are using the default sql servers provided by HDInsight, configure a network rule in the Service Tags section for SQL that will allow you to log and audit SQL traffic. Unless you configured Service Endpoints for SQL Server on the HDInsight subnet, which will bypass the firewall. If you are using custom SQL server for Ambari, Oozie, Ranger and Hive metastores then you only need to allow the traffic to your own custom SQL Servers. Refer to [Azure SQL Database and Azure Synapse Analytics connectivity architecture](/azure/azure-sql/database/connectivity-architecture) to see why 11000-11999 port range is also needed in addition to 1433. | | Rule_7 | TCP | * | Azure Monitor | * | (optional) Customers who plan to use auto scale feature should add this rule. | :::image type="content" source="./media/hdinsight-restrict-outbound-traffic/hdinsight-restrict-outbound-traffic-add-network-rule-collection.png" alt-text="Title: Enter application rule collection"::: |
| hdinsight | Hdinsight Upgrade Cluster | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-upgrade-cluster.md | The following documents provide guidance on how to migrate specific workloads: ## Backup and restore -For more information about database backup and restore, see [Recover a database in Azure SQL Database by using automated database backups](../azure-sql/database/recovery-using-backups.md). +For more information about database backup and restore, see [Recover a database in Azure SQL Database by using automated database backups](/azure/azure-sql/database/recovery-using-backups). ## Upgrade scenarios |
| hdinsight | Hdinsight Use External Metadata Stores | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-use-external-metadata-stores.md | HDInsight also supports custom metastores, which are recommended for production ### Create and config Azure SQL Database for the custom metastore -Create or have an existing Azure SQL Database before setting up a custom Hive metastore for a HDInsight cluster. For more information, see [Quickstart: Create a single database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md?tabs=azure-portal). +Create or have an existing Azure SQL Database before setting up a custom Hive metastore for a HDInsight cluster. For more information, see [Quickstart: Create a single database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart?tabs=azure-portal). -While creating the cluster, HDInsight service needs to connect to the external metastore and verify your credentials. Configure Azure SQL Database firewall rules to allow Azure services and resources to access the server. Enable this option in the Azure portal by selecting **Set server firewall**. Then select **No** underneath **Deny public network access**, and **Yes** underneath **Allow Azure services and resources to access this server** for Azure SQL Database. For more information, see [Create and manage IP firewall rules](../azure-sql/database/firewall-configure.md#use-the-azure-portal-to-manage-server-level-ip-firewall-rules) +While creating the cluster, HDInsight service needs to connect to the external metastore and verify your credentials. Configure Azure SQL Database firewall rules to allow Azure services and resources to access the server. Enable this option in the Azure portal by selecting **Set server firewall**. Then select **No** underneath **Deny public network access**, and **Yes** underneath **Allow Azure services and resources to access this server** for Azure SQL Database. For more information, see [Create and manage IP firewall rules](/azure/azure-sql/database/firewall-configure#use-the-azure-portal-to-manage-server-level-ip-firewall-rules) Private endpoints for SQL stores is only supported on the clusters created with `outbound` ResourceProviderConnection. To learn more, see this [documentationa](./hdinsight-private-link.md). You can point your cluster to a previously created Azure SQL Database at any tim * If you intend multiple HDInsight clusters to access separate data, use a separate database for the metastore on each cluster. If you share a metastore across multiple HDInsight clusters, it means that the clusters use the same metadata and underlying user data files. -* Back up your custom metastore periodically. Azure SQL Database generates backups automatically, but the backup retention timeframe varies. For more information, see [Learn about automatic SQL Database backups](../azure-sql/database/automated-backups-overview.md). +* Back up your custom metastore periodically. Azure SQL Database generates backups automatically, but the backup retention timeframe varies. For more information, see [Learn about automatic SQL Database backups](/azure/azure-sql/database/automated-backups-overview). * Locate your metastore and HDInsight cluster in the same region. This configuration will provide the highest performance and lowest network egress charges. |
| hdinsight | Hdinsight Use Oozie Linux Mac | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/hdinsight-use-oozie-linux-mac.md | You can also use Oozie to schedule jobs that are specific to a system, like Java * **An SSH client**. See [Connect to HDInsight (Apache Hadoop) using SSH](hdinsight-hadoop-linux-use-ssh-unix.md). -* **An Azure SQL Database**. See [Create a database in Azure SQL Database in the Azure portal](../azure-sql/database/single-database-create-quickstart.md). This article uses a database named **oozietest**. +* **An Azure SQL Database**. See [Create a database in Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). This article uses a database named **oozietest**. * The URI scheme for your clusters primary storage. `wasb://` for Azure Storage, `abfs://` for Azure Data Lake Storage Gen2 or `adl://` for Azure Data Lake Storage Gen1. If secure transfer is enabled for Azure Storage, the URI would be `wasbs://`. See also, [secure transfer](../storage/common/storage-require-secure-transfer.md). Oozie workflow definitions are written in Hadoop Process Definition Language (hP sudo apt-get --assume-yes install freetds-dev freetds-bin ``` -2. Edit the code below to replace `<serverName>` with your [logical SQL server](../azure-sql/database/logical-servers.md) name, and `<sqlLogin>` with the server login. Enter the command to connect to the prerequisite SQL database. Enter the password at the prompt. +2. Edit the code below to replace `<serverName>` with your [logical SQL server](/azure/azure-sql/database/logical-servers) name, and `<sqlLogin>` with the server login. Enter the command to connect to the prerequisite SQL database. Enter the password at the prompt. ```bash TDSVER=8.0 tsql -H <serverName>.database.windows.net -U <sqlLogin> -p 1433 -D oozietest |
| hdinsight | Apache Hive Migrate Workloads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/interactive-query/apache-hive-migrate-workloads.md | Migration of Hive tables to a new Storage Account needs to be done as a separate * If the cluster uses a default Hive metastore, follow this [guide](./hive-default-metastore-export-import.md) to export metadata to an external metastore. Then, create a copy of the external metastore for upgrade. -* If the cluster uses an external Hive metastore, create a copy of it. Options include [export/import](../../azure-sql/database/database-export.md) and [point-in-time restore](../../azure-sql/database/recovery-using-backups.md#point-in-time-restore). +* If the cluster uses an external Hive metastore, create a copy of it. Options include [export/import](/azure/azure-sql/database/database-export) and [point-in-time restore](/azure/azure-sql/database/recovery-using-backups#point-in-time-restore). ### 3. Upgrade the metastore schema This step uses the [`Hive Schema Tool`](https://cwiki.apache.org/confluence/disp > [!NOTE] > This utility uses client `beeline` to execute SQL scripts in `/usr/hdp/$STACK_VERSION/hive/scripts/metastore/upgrade/mssql/upgrade-*.mssql.sql`. >- > SQL Syntax in these scripts is not necessarily compatible to other client tools. For example, [SSMS](/sql/ssms/download-sql-server-management-studio-ssms) and [Query Editor on Azure Portal](../../azure-sql/database/connect-query-portal.md) require keyword `GO` after each command. + > SQL Syntax in these scripts is not necessarily compatible to other client tools. For example, [SSMS](/sql/ssms/download-sql-server-management-studio-ssms) and [Query Editor on Azure Portal](/azure/azure-sql/database/connect-query-portal) require keyword `GO` after each command. > > If any script fails due to resource capacity or transaction timeouts, scale up the SQL Database. |
| hdinsight | Hive Default Metastore Export Import | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/interactive-query/hive-default-metastore-export-import.md | An HDInsight cluster created only after 2020-10-15 supports SQL Export/Import fo hdfs dfs -put $TARGET_FILE /bacpacs/ ``` -4. Import the BACPAC file to a new database with steps listed [here](../../azure-sql/database/database-import.md). +4. Import the BACPAC file to a new database with steps listed [here](/azure/azure-sql/database/database-import). 5. The new database is ready to be [configured as external metastore DB on a new HDInsight cluster](../hdinsight-use-external-metadata-stores.md#select-a-custom-metastore-during-cluster-creation). |
| hdinsight | Interactive Query Tutorial Analyze Flight Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/interactive-query/interactive-query-tutorial-analyze-flight-data.md | This tutorial covers the following tasks: * An Interactive Query cluster on HDInsight. See [Create Apache Hadoop clusters using the Azure portal](../hdinsight-hadoop-create-linux-clusters-portal.md) and select **Interactive Query** for **Cluster type**. -* A database in Azure SQL Database. You use the database as a destination data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database in the Azure portal](../../azure-sql/database/single-database-create-quickstart.md). +* A database in Azure SQL Database. You use the database as a destination data store. If you don't have a database in Azure SQL Database, see [Create a database in Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). * An SSH client. For more information, see [Connect to HDInsight (Apache Hadoop) using SSH](../hdinsight-hadoop-linux-use-ssh-unix.md). |
| hdinsight | Apache Spark Connect To Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/spark/apache-spark-connect-to-sql-database.md | Learn how to connect an Apache Spark cluster in Azure HDInsight with Azure SQL D * Azure HDInsight Spark cluster. Follow the instructions at [Create an Apache Spark cluster in HDInsight](apache-spark-jupyter-spark-sql.md). -* Azure SQL Database. Follow the instructions at [Create a database in Azure SQL Database](../../azure-sql/database/single-database-create-quickstart.md). Make sure you create a database with the sample **AdventureWorksLT** schema and data. Also, make sure you create a server-level firewall rule to allow your client's IP address to access the SQL database. The instructions to add the firewall rule is available in the same article. Once you've created your SQL database, make sure you keep the following values handy. You need them to connect to the database from a Spark cluster. +* Azure SQL Database. Follow the instructions at [Create a database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). Make sure you create a database with the sample **AdventureWorksLT** schema and data. Also, make sure you create a server-level firewall rule to allow your client's IP address to access the SQL database. The instructions to add the firewall rule is available in the same article. Once you've created your SQL database, make sure you keep the following values handy. You need them to connect to the database from a Spark cluster. * Server name. * Database name. * Azure SQL Database admin user name / password. -* SQL Server Management Studio (SSMS). Follow the instructions at [Use SSMS to connect and query data](../../azure-sql/database/connect-query-ssms.md). +* SQL Server Management Studio (SSMS). Follow the instructions at [Use SSMS to connect and query data](/azure/azure-sql/database/connect-query-ssms). ## Create a Jupyter Notebook |
| healthcare-apis | Convert Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/healthcare-apis/azure-api-for-fhir/convert-data.md | You can register up to 20 ACR servers in the Azure API for FHIR. Install Azure Health Data Services CLI from Azure PowerShell if needed: -```powershell +```azurecli az extension add -n healthcareapis ``` Register the acr servers to Azure API for FHIR following the examples below: ##### Register a single ACR server -```powershell +```azurecli az healthcareapis acr add --login-servers "fhiracr2021.azurecr.io" --resource-group fhir-test --resource-name fhirtest2021 ``` ##### Register multiple ACR servers -```powershell +```azurecli az healthcareapis acr add --login-servers "fhiracr2021.azurecr.io fhiracr2020.azurecr.io" --resource-group fhir-test --resource-name fhirtest2021 ``` ### Configure ACR firewall |
| healthcare-apis | Convert Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/healthcare-apis/fhir/convert-data.md | You can register up to 20 ACR servers in the FHIR service. Install the Azure Health Data Services CLI from Azure PowerShell if needed: -```powershell +```azurecli az extension add -n healthcareapis ``` Register the acr servers to FHIR service following the examples below: ##### Register a single ACR server -```powershell +```azurecli az healthcareapis acr add --login-servers "fhiracr2021.azurecr.io" --resource-group fhir-test --resource-name fhirtest2021 ``` ##### Register multiple ACR servers -```powershell +```azurecli az healthcareapis acr add --login-servers "fhiracr2021.azurecr.io fhiracr2020.azurecr.io" --resource-group fhir-test --resource-name fhirtest2021 ``` ### Configure ACR firewall |
| internet-peering | Walkthrough Communications Services Partner | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/internet-peering/walkthrough-communications-services-partner.md | Use for Peering > *Do not enable unless you have contacted peering@microsoft.com about becoming a MAPS provider.* - **2a. Use Existing Direct peering connection for Peering Services** --If you have an existing Direct peering that you want to use to support Peering Service, you can activate on Azure portal. -1. Follow the instructions to [Convert a legacy Direct peering to Azure resource using the portal](./howto-legacy-direct-portal.md). -As required, order additional circuits to meet high-availability requirement. --2. Follow steps to [Enable Peering Service](./howto-peering-service-portal.md) on a Direct peering using the portal. - |
| iot-dps | Concepts Control Access Dps Azure Ad | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-dps/concepts-control-access-dps-azure-ad.md | For more information, see the [Azure IoT extension for Azure CLI release page](h ## Azure AD access from the Azure portal >[!NOTE]->Azure AD access from the Azure portal us currently not available during preview. +>Azure AD access from the Azure portal is currently not available during preview. ## Next steps |
| iot-edge | How To Deploy Blob | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-edge/how-to-deploy-blob.md | A deployment manifest is a JSON document that describes which modules to deploy, - use [bind mount](https://docs.docker.com/storage/bind-mounts/): `C:/ContainerData:C:/BlobRoot`. - Instead of using your local drive, you can map your SMB network location, for more information, see [using SMB share as your local storage](how-to-store-data-blob.md#using-smb-share-as-your-local-storage) - > [!IMPORTANT] - > Do not change the second half of the storage mount value, which points to a specific location in the Blob Storage on IoT Edge module. The storage mount must always end with **:/blobroot** for Linux containers and **:C:/BlobRoot** for Windows containers. + > [!IMPORTANT] + > * Do not change the second half of the storage mount value, which points to a specific location in the Blob Storage on IoT Edge module. The storage mount must always end with **:/blobroot** for Linux containers and **:C:/BlobRoot** for Windows containers. + > + > * IoT Edge does not remove volumes attached to module containers. This behavior is by design, as it allows persisting the data across container instances such as upgrade scenarios. However, if these volumes are left unused, then it may lead to disk space exhaustion and subsequent system errors. If you use docker volumes in your scenario, then we encourage you to use docker tools such as [docker volume prune](https://docs.docker.com/engine/reference/commandline/volume_prune/) and [docker volume rm](https://docs.docker.com/engine/reference/commandline/volume_rm/) to remove the unused volumes, especially for production scenarios. + 5. On the **Module Twin Settings** tab, copy the following JSON and paste it into the box. Azure IoT Edge provides templates in Visual Studio Code to help you develop edge - Use [bind mount](https://docs.docker.com/storage/bind-mounts/): `C:/ContainerData:C:/BlobRoot`. - Instead of using your local drive, you can map your SMB network location. For more information, see [using SMB share as your local storage](how-to-store-data-blob.md#using-smb-share-as-your-local-storage). - > [!IMPORTANT] - > Do not change the second half of the storage mount value, which points to a specific location in the Blob Storage on IoT Edge module. The storage mount must always end with **:/blobroot** for Linux containers and **:C:/BlobRoot** for Windows containers. + > [!IMPORTANT] + > * Do not change the second half of the storage mount value, which points to a specific location in the Blob Storage on IoT Edge module. The storage mount must always end with **:/blobroot** for Linux containers and **:C:/BlobRoot** for Windows containers. + > + > * IoT Edge does not remove volumes attached to module containers. This behavior is by design, as it allows persisting the data across container instances such as upgrade scenarios. However, if these volumes are left unused, then it may lead to disk space exhaustion and subsequent system errors. If you use docker volumes in your scenario, then we encourage you to use docker tools such as [docker volume prune](https://docs.docker.com/engine/reference/commandline/volume_prune/) and [docker volume rm](https://docs.docker.com/engine/reference/commandline/volume_rm/) to remove the unused volumes, especially for production scenarios. 1. Configure [deviceToCloudUploadProperties](how-to-store-data-blob.md#devicetoclouduploadproperties) and [deviceAutoDeleteProperties](how-to-store-data-blob.md#deviceautodeleteproperties) for your module by adding the following JSON to the *deployment.template.json* file. Configure each property with an appropriate value and save the file. If you are using the IoT Edge simulator, set the values to the related environment variables for these properties, which you can find in the explanation section of [deviceToCloudUploadProperties](how-to-store-data-blob.md#devicetoclouduploadproperties) and [deviceAutoDeleteProperties](how-to-store-data-blob.md#deviceautodeleteproperties) |
| iot-edge | Production Checklist | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-edge/production-checklist.md | If you deploy a large number of modules, you might exhaust this twin size limit. * **Important** * Use tags to manage versions+ * Manage volumes * **Helpful** * Store runtime containers in your private registry The IoT Edge agent and IoT Edge hub images are tagged with the IoT Edge version * **Specific tags** - Use all three values of the version number to explicitly set the image version. For example, 1.1.0 won't change after its initial release. You can declare a new version number in the deployment manifest when you're ready to update. *This approach is suggested for production purposes.* +### Manage volumes +IoT Edge does not remove volumes attached to module containers. This behavior is by design, as it allows persisting the data across container instances such as upgrade scenarios. However, if these volumes are left unused, then it may lead to disk space exhaustion and subsequent system errors. If you use docker volumes in your scenario, then we encourage you to use docker tools such as [docker volume prune](https://docs.docker.com/engine/reference/commandline/volume_prune/) and [docker volume rm](https://docs.docker.com/engine/reference/commandline/volume_rm/) to remove the unused volumes, especially for production scenarios. + ### Store runtime containers in your private registry You know about storing your container images for custom code modules in your private Azure registry, but you can also use it to store public container images such as for the edgeAgent and edgHub runtime modules. Doing so may be required if you have very tight firewall restrictions as these runtime containers are stored in the Microsoft Container Registry (MCR). |
| iot-edge | Tutorial Develop For Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-edge/tutorial-develop-for-linux.md | Cloud resources: [!INCLUDE [quickstarts-free-trial-note](../../includes/quickstarts-free-trial-note.md)] +> [!TIP] +> For guidance on interactive debugging in Visual Studio Code or Visual Studio 2019: +>* [Use Visual Studio Code to develop and debug modules for Azure IoT Edge](how-to-vs-code-develop-module.md) +>* [Use Visual Studio 2019 to develop and debug modules for Azure IoT Edge](how-to-visual-studio-develop-module.md) +> +>This tutorial teaches the development steps for Visual Studio Code. + ## Key concepts This tutorial walks through the development of an IoT Edge module. An *IoT Edge module*, or sometimes just *module* for short, is a container with executable code. You can deploy one or more modules to an IoT Edge device. Modules perform specific tasks like ingesting data from sensors, cleaning and analyzing data, or sending messages to an IoT hub. For more information, see [Understand Azure IoT Edge modules](iot-edge-modules.md). The following table lists the supported development scenarios for **Linux contai | **Languages** | C <br> C# <br> Java <br> Node.js <br> Python | C <br> C# | | **More information** | [Azure IoT Edge for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=vsciot-vscode.azure-iot-edge) | [Azure IoT Edge Tools for Visual Studio 2017](https://marketplace.visualstudio.com/items?itemName=vsc-iot.vsiotedgetools) <br> [Azure IoT Edge Tools for Visual Studio 2019](https://marketplace.visualstudio.com/items?itemName=vsc-iot.vs16iotedgetools) | -This tutorial teaches the development steps for Visual Studio Code. If you would rather use Visual Studio, refer to the instructions in [Use Visual Studio 2019 to develop and debug modules for Azure IoT Edge](how-to-visual-studio-develop-module.md). - ## Install container engine IoT Edge modules are packaged as containers, so you need a container engine on your development machine to build and manage them. We recommend Docker Desktop for development because of its feature support and popularity. Docker Desktop on Windows lets you switch between Linux containers and Windows containers so that you can easily develop modules for different types of IoT Edge devices. Use the IoT extensions for Visual Studio Code to develop IoT Edge modules. These  + [!INCLUDE [iot-edge-create-container-registry](../../includes/iot-edge-create-container-registry.md)] ## Create a new module project |
| iot-hub | Iot Hub Devguide Direct Methods | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/iot-hub/iot-hub-devguide-direct-methods.md | This example will allow you to securely initiate a request to invoke a Direct Me To begin, use the [Microsoft Azure IoT extension for Azure CLI](https://github.com/Azure/azure-iot-cli-extension) to create a SharedAccessSignature. -```bash +```azurecli az iot hub generate-sas-token -n <iothubName> --du <duration> ``` |
| key-vault | Quick Create Java | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/certificates/quick-create-java.md | Open the *pom.xml* file in your text editor. Add the following dependency elemen #### Grant access to your key vault Create an access policy for your key vault that grants certificate permissions to your user account. -```console +```azurecli az keyvault set-policy --name <your-key-vault-name> --upn user@domain.com --certificate-permissions delete get list create purge ``` |
| key-vault | Quick Create Net | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/certificates/quick-create-net.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants certificate permissions to your user account -```console +```azurecli az keyvault set-policy --name <your-key-vault-name> --upn user@domain.com --certificate-permissions delete get list create purge ``` |
| key-vault | Quick Create Python | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/certificates/quick-create-python.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants certificate permission to your user account -```console +```azurecli az keyvault set-policy --name <your-unique-keyvault-name> --upn user@domain.com --certificate-permissions delete get list create ``` |
| key-vault | Assign Access Policy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/general/assign-access-policy.md | For more information on creating groups in Azure Active Directory using the Azur 1. Local CLI only: sign in to Azure using `az login`: - ```bash + ```azurecli az login ``` |
| key-vault | Overview Vnet Service Endpoints | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/general/overview-vnet-service-endpoints.md | Here's a list of trusted services that are allowed to access a key vault if the |Exchange Online & SharePoint Online|Allow access to customer key for Azure Storage Service Encryption with [Customer Key](/microsoft-365/compliance/customer-key-overview).| |Azure Information Protection|Allow access to tenant key for [Azure Information Protection.](/azure/information-protection/what-is-information-protection)| |Azure App Service|App Service is trusted only for [Deploying Azure Web App Certificate through Key Vault](https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html), for individual app itself, the outbound IPs can be added in Key Vault's IP-based rules|-|Azure SQL Database|[Transparent Data Encryption with Bring Your Own Key support for Azure SQL Database and Azure Synapse Analytics](../../azure-sql/database/transparent-data-encryption-byok-overview.md).| +|Azure SQL Database|[Transparent Data Encryption with Bring Your Own Key support for Azure SQL Database and Azure Synapse Analytics](/azure/azure-sql/database/transparent-data-encryption-byok-overview).| |Azure Storage|[Storage Service Encryption using customer-managed keys in Azure Key Vault](../../storage/common/customer-managed-keys-configure-key-vault.md).| |Azure Data Lake Store|[Encryption of data in Azure Data Lake Store](../../data-lake-store/data-lake-store-encryption.md) with a customer-managed key.| |Azure Synapse Analytics|[Encryption of data using customer-managed keys in Azure Key Vault](../../synapse-analytics/security/workspaces-encryption.md)| |
| key-vault | Quick Create Java | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/keys/quick-create-java.md | Open the *pom.xml* file in your text editor. Add the following dependency elemen #### Grant access to your key vault Create an access policy for your key vault that grants key permissions to your user account. -```console +```azurecli az keyvault set-policy --name <your-key-vault-name> --upn user@domain.com --key-permissions delete get list create purge ``` |
| key-vault | Quick Create Net | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/keys/quick-create-net.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants key permissions to your user account -```console +```azurecli az keyvault set-policy --name <your-key-vault-name> --upn user@domain.com --key-permissions delete get list create purge ``` |
| key-vault | Quick Create Python | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/keys/quick-create-python.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants secret permission to your user account. -```console +```azurecli az keyvault set-policy --name <<your-unique-keyvault-name> --upn user@domain.com --secret-permissions delete get list set ``` |
| key-vault | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/managed-hsm/overview.md | For pricing information, please see Managed HSM Pools section on [Azure Key Vaul ### Integrated with Azure and Microsoft PaaS/SaaS services -- Generate (or import using [BYOK](hsm-protected-keys-byok.md)) keys and use them to encrypt your data at rest in Azure services such as [Azure Storage](../../storage/common/customer-managed-keys-overview.md), [Azure SQL](../../azure-sql/database/transparent-data-encryption-byok-overview.md), [Azure Information Protection](/azure/information-protection/byok-price-restrictions), and [Customer Key for Microsoft 365](/microsoft-365/compliance/customer-key-set-up). For a more complete list of Azure services which work with Managed HSM, see [Data Encryption Models](../../security/fundamentals/encryption-models.md#supporting-services).+- Generate (or import using [BYOK](hsm-protected-keys-byok.md)) keys and use them to encrypt your data at rest in Azure services such as [Azure Storage](../../storage/common/customer-managed-keys-overview.md), [Azure SQL](/azure/azure-sql/database/transparent-data-encryption-byok-overview), [Azure Information Protection](/azure/information-protection/byok-price-restrictions), and [Customer Key for Microsoft 365](/microsoft-365/compliance/customer-key-set-up). For a more complete list of Azure services which work with Managed HSM, see [Data Encryption Models](../../security/fundamentals/encryption-models.md#supporting-services). ### Uses same API and management interfaces as Key Vault |
| key-vault | Quick Create Java | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/secrets/quick-create-java.md | The output from generating the project will look something like this: Change your directory to the newly created `akv-secrets-java/` folder. -```console +```azurecli cd akv-secrets-java ``` Open the *pom.xml* file in your text editor. Add the following dependency elemen #### Grant access to your key vault Create an access policy for your key vault that grants secret permissions to your user account. -```console +```azurecli az keyvault set-policy --name <your-key-vault-name> --upn user@domain.com --secret-permissions delete get list set purge ``` |
| key-vault | Quick Create Net | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/secrets/quick-create-net.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants secret permissions to your user account -```console +```azurecli az keyvault set-policy --name <YourKeyVaultName> --upn user@domain.com --secret-permissions delete get list set purge ``` |
| key-vault | Quick Create Python | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/key-vault/secrets/quick-create-python.md | This quickstart is using Azure Identity library with Azure CLI to authenticate u Create an access policy for your key vault that grants secret permission to your user account. -```console +```azurecli az keyvault set-policy --name <your-unique-keyvault-name> --upn user@domain.com --secret-permissions delete get list set ``` |
| lab-services | Account Setup Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/account-setup-guide.md | Title: Accelerated lab account setup guide for Azure Lab Services -description: This guide helps administrators quickly set up a lab account for use within their school. + Title: Accelerated lab account setup guide (deprecated) +description: This guide helps administrators quickly set up a lab account for use within their school. (deprecated) Previously updated : 06/26/2020 Last updated : 03/15/2022+ -# Lab account setup guide +# Lab account setup guide (deprecated) ++ If you're an administrator, before you set up your Azure Lab Services environment, you first need to create a *lab account* within your Azure subscription. A lab account is a container for one or more labs, and it takes only a few minutes to set up. This guide includes three sections:-- Prerequisites-- Plan your lab account settings-- Set up your lab account++- Prerequisites +- Plan your lab account settings +- Set up your lab account ## Prerequisites-The following sections outline what you need to do before you can set up a lab account. +The following sections outline what you need to do before you can set up a lab account. ### Access your Azure subscription-To create a lab account, you need access to an Azure subscription that's already set up for your school. Your school might have one or more subscriptions. You use a subscription to manage billing and security for all your Azure resources and services, including lab accounts. Azure subscriptions are usually managed by your IT department. For more information, see the "Subscription" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#subscription). ++To create a lab account, you need access to an Azure subscription that's already set up for your school. Your school might have one or more subscriptions. You use a subscription to manage billing and security for all your Azure resources and services, including lab accounts. Azure subscriptions are managed by your IT department. For more information, see [Azure Lab Services - Administrator guide](./administrator-guide-1.md#subscription). ### Estimate how many VMs and VM sizes you need-It's important to know how many [virtual machines (VMs) and VM sizes](./administrator-guide.md#vm-sizing) your school lab requires. ++It's important to know how many [virtual machines (VMs) and which VM sizes](./administrator-guide-1.md#vm-sizing) your school lab requires. For guidance on structuring your labs and images, see the blog post [Moving from a physical lab to Azure Lab Services](https://techcommunity.microsoft.com/t5/azure-lab-services/moving-from-a-physical-lab-to-azure-lab-services/ba-p/1654931). -For additional guidance on how to structure labs, see the "Lab" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#lab). +For more information on how to structure labs, see the "Lab" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#lab). ### Understand subscription VM limits and regional VM capacity+ After you've estimated the number of VMs and the VM sizes for your labs, you need to: - Ensure that your Azure subscription's capacity limit allows for the number of VMs and the VM size that you plan to use in your labs. For more information, see [VM subscription limits and regional capacity](https:/ ### Decide how many lab accounts to create -To get started quickly, create a single lab account within its own resource group. Later, you can create additional lab accounts and resource groups, as needed. For example, you might eventually have one lab account and resource group per department as a way to clearly separate costs. +To get started quickly, create a single lab account within its own resource group. Later, you can create more lab accounts and resource groups, as needed. For example, you might eventually have one lab account and resource group per department as a way to clearly separate costs. For more information about lab accounts, resource groups, and separating costs, see:-- The "Resource group" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#resource-group)-- The "Lab account" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#lab-account) ++- The "Resource group" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#resource-group) +- The "Lab account" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#lab-account) - [Cost management for Azure Lab Services](./cost-management-guide.md) ## Plan your lab account settings To plan your lab account settings, consider the following questions. ### Who should be the Owners and Contributors of the lab account? -Your school's IT administrators ordinarily take on the Owner and Contributor roles for a lab account. These roles are responsible for managing the policies that apply to all the labs in the lab account. The person who creates the lab account is automatically an Owner. You can add additional Owners and Contributors from the Azure Active Directory (Azure AD) tenant that's associated with your subscription. +Your school's IT administrators ordinarily take on the Owner and Contributor roles for a lab account. These roles are responsible for managing the policies that apply to all the labs in the lab account. The person who creates the lab account is automatically an Owner. You can add more Owners and Contributors from the Azure Active Directory (Azure AD) tenant that's associated with your subscription. -For more information about the lab account Owner and Contributor roles, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#manage-identity). +For more information about the lab account Owner and Contributor roles, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#manage-identity). [!INCLUDE [Select a tenant](./includes/multi-tenant-support.md)] Lab users see only a single list of the VMs that they have access to across Azur You may choose to have your IT team or faculty members create labs. To create labs, you then assign these people to the Lab Creator role within the lab account. You ordinarily assign this role from the Azure AD tenant that's associated with your school subscription. Whoever creates a lab is automatically assigned as the Owner of the lab. -For more information about the Lab Creator role, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#manage-identity). +For more information about the Lab Creator role, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#manage-identity). ### Who will be allowed to own and manage labs? -You can also choose to have IT and faculty members own\manage labs *without* giving them the ability to create labs. In this case, users from your subscription's Azure AD tenant are assigned either the Owner or Contributor for existing labs. +You can also choose to have IT and faculty members own\manage labs *without* giving them the ability to create labs. In this case, users from your subscription's Azure AD tenant are assigned either the Owner or Contributor for existing labs. -For more information about the lab Owner and Contributor roles, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#manage-identity). +For more information about the lab Owner and Contributor roles, see the "Manage identity" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#manage-identity). ### Do you want to save images and share them across labs? -Shared Image Gallery is a service that you can use for saving and sharing images. For classes that need to use the same image, Lab Creators can create the image and then export it to a shared image gallery. After an image is exported to the shared image gallery, it can be used to create new labs. +Shared Image Gallery is a service that you can use for saving and sharing images. For classes that need to use the same image, Lab Creators can create the image and then export it to a shared image gallery. After an image is exported to the shared image gallery, it can be used to create new labs. You might want to create your images in your physical environment and then import them to a shared image gallery. For more information, see the blog post [Import a custom image to a shared image gallery](https://techcommunity.microsoft.com/t5/azure-lab-services/import-custom-image-to-shared-image-gallery/ba-p/1777353). If you decide to use the Shared Image Gallery service, you'll need to create or attach a shared image gallery to your lab account. You can postpone this decision for now, because a shared image gallery can be attached to a lab account at any time. For more information, see:-- The "Shared image gallery" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#shared-image-gallery)-- The "Pricing" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#pricing)+- The "Shared image gallery" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#shared-image-gallery) +- The "Pricing" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#pricing) ### Which images in Azure Marketplace will your labs use? -Azure Marketplace provides hundreds of images that you can enable so that Lab Creators can use them for creating their labs. Some images might include everything that a lab already needs. In other cases, you might use an image as a starting point, and then the Lab Creator can customize it by installing additional applications or tools. +Azure Marketplace provides hundreds of images that you can enable so that Lab Creators can use them for creating their labs. Some images might include everything that a lab already needs. In other cases, you might use an image as a starting point, and then the Lab Creator can customize it by installing more applications or tools. -If you don't know which images you need, you can come back later to enable them. The best way to see which images are available is to first create a lab account. This gives you access so that you can review the list of available images and their contents. +If you don't know which images you need, you can come back later to enable them. The best way to see which images are available is to create a lab account. Lab account creation will also give you access to review the list of available images and their contents. For more information, see [Specify the Azure Marketplace images that are available to Lab Creators](./specify-marketplace-images.md). ### Do the lab VMs need access to other Azure or on-premises resources? -When you set up a lab account, you also can peer your lab account with a virtual network. Keep in mind that both your virtual network and the lab account must be located in the same region. To decide whether you need to peer with a virtual network, consider the following scenarios: +When you set up a lab account, you also can peer your lab account with a virtual network. Keep in mind that both your virtual network and the lab account must be located in the same region. To decide whether you need to peer with a virtual network, consider the following scenarios: - **Access to a license server** - When you use Azure Marketplace images, the cost of the operating system license is bundled into the pricing for lab services. However, you don't need to provide licenses for the operating system itself. For additional software and applications that are installed, you do need to provide a license, as appropriate. To access a license server: - - You may choose to connect to an on-premises license server. Connecting to an on-premises license server requires additional setup. - - Another option, which is faster to set up, is to create a license server that you host on an Azure VM. The Azure VM is located within a virtual network that you peer with your lab account. + When you use Azure Marketplace images, the cost of the operating system license is bundled into the pricing for lab services. However, you don't need to provide licenses for the operating system itself. For any other software and applications that are installed, you do need to provide a license, as appropriate. To access a license server: + - You may choose to connect to an on-premises license server. Connecting to an on-premises license server requires additional setup. + - Another option, which is faster to set up, is to create a license server that you host on an Azure VM. The Azure VM is located within a virtual network that you peer with your lab account. - **Access to other on-premises resources such as a file share or database** When you set up a lab account, you also can peer your lab account with a virtual - **Access to other Azure resources that are located outside a virtual network** - If you need access to Azure resources that are *not* secured within a virtual network, you can access them through the public internet, without having to do any peering. + You can access the Azure resources that *aren't* secured in a virtual network through the public internet, without having to do any virtual network peering. For more information about virtual networks, see:- - The "Virtual network" section of [Architecture fundamentals in Azure Lab Services](./classroom-labs-fundamentals.md#virtual-network) - - [Connect your lab network with a peer virtual network in Azure Lab Services](./how-to-connect-peer-virtual-network.md) - - [Create a lab with a shared resource in Azure Lab Services](./how-to-create-a-lab-with-shared-resource.md) + - The "Virtual network" section of [Architecture fundamentals in Azure Lab Services](./classroom-labs-fundamentals.md#virtual-network) + - [Connect your lab network with a peer virtual network in Azure Lab Services](./how-to-connect-peer-virtual-network.md) + - [Create a lab with a shared resource in Azure Lab Services](./how-to-create-a-lab-with-shared-resource.md) ## Set up your lab account After you've finished planning, you're ready to set up your lab account. You can apply the same steps to setting up [Azure Lab Services in Teams](./lab-services-within-teams-overview.md). 1. **Create your lab account**. For instructions, see [Create a lab account](./tutorial-setup-lab-account.md#create-a-lab-account).- - For information about naming conventions, see the "Naming" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#naming). ++ For information about naming conventions, see the "Naming" section of [Azure Lab Services - Administrator guide](./administrator-guide-1.md#naming). 1. **Add users to the Lab Creator role**. For instructions, see [Add users to the Lab Creator role](./tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role). After you've finished planning, you're ready to set up your lab account. You can To review the contents of each Azure Marketplace image, select the image name. For example, the following screenshot shows the details of the Ubuntu Data Science VM image: -  + :::image type="content" source="./media/setup-guide/review-azure-marketplace-images.png" alt-text="Screenshot of a list of images available for review in Azure Marketplace."::: If a shared image gallery is attached to your lab account, and you want to enable custom images to be shared by Lab Creators, complete similar steps as shown in the following screenshot: -  + :::image type="content" source="./media/setup-guide/enable-azure-compute-gallery-images.png" alt-text="Screenshot of a list of enabled custom images."::: ## Next steps |
| lab-services | Add Lab Creator | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/add-lab-creator.md | Title: Add a user as a lab creator in Azure Lab Services -description: This article shows how to add a user to the Lab Creator role for a lab account in Azure Lab Services. The lab creators can create labs within this lab account. +description: This article shows how to add a user to the Lab Creator role for a lab plan in Azure Lab Services. The lab creators can create labs within this lab plan. Previously updated : 07/26/2021 Last updated : 11/19/2021 -# Add lab creators to a lab account in Azure Lab Services -This article shows you how to add users as lab creators to a lab account in Azure Lab Services. These uses then can create labs in the lab account. +# Add lab creators to a lab plan in Azure Lab Services -## Add Microsoft user account to Lab Creator role -To set up a classroom lab in a lab account, the user must be a member of the **Lab Creator** role in the lab account. The account you used to create the lab account is automatically added to this role. If you are planning to use the same user account to create a classroom lab, you can skip this step. To use another user account to create a classroom lab, do the following steps: -To provide educators the permission to create labs for their classes, add them to the **Lab Creator** role: For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md). +This article shows you how to add users as lab creators to a lab account or lab plan in Azure Lab Services. These users then can create labs and manage those labs. ++## Add Azure AD user account to Lab Creator role +The user account you used to create the lab account or lab plan is automatically able to create labs. Otherwise, the user must be a member of the **Lab Creator** role. If using a lab plan, user must be a **Lab Creator** on the lab plan or the resource group that contains the lab plan. If using a lab account, the user must be a **Lab Creator** on the lab account. If you are planning to use the same user account to create a lab as you did creating the lab plan or lab account, you can skip this step. To use another user account to create a lab, do the following steps: ++To provide educators the permission to create labs for their classes, add them to the **Lab Creator** role: For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md). -1. On the **Lab Account** page, select **Access control (IAM)** +1. On the **Lab Plan** resource, select **Access control (IAM)** 1. Select **Add** > **Add role assignment (Preview)**. To provide educators the permission to create labs for their classes, add them t 1. On the **Review + assign** tab, select **Review + assign** to assign the role. --- > [!NOTE]- > If you are adding a non-Microsoft account user as a lab creator, see the [Add a non-Microsoft account user as a lab creator](#add-a-non-microsoft-account-user-as-a-lab-creator) section. + > If you are adding a non-Microsoft account user as a lab creator, see [Adding a guest user as a lab creator](#adding-a-guest-user-as-a-lab-creator). ++## Adding a guest user as a lab creator -## Add a non-Microsoft account user as a lab creator -To add a user as a lab creator, you use their email accounts. The following types of email accounts might be used: +You might need to add an external user as a lab creator. If that is the case, you'll need to add them as a guest account on the Azure AD attached to the subscription. The following types of email accounts might be used: -- An email account that's provided by your universityΓÇÖs Azure Active Directory (AAD). - A Microsoft email account, such as `@outlook.com`, `@hotmail.com`, `@msn.com`, or `@live.com`. - A non-Microsoft email account, such as one provided by Yahoo or Google. However, these types of accounts must be linked with a Microsoft account. - A GitHub account. This account must be linked with a Microsoft account. +For instructions to add someone as a guest account in Azure AD, see [Quickstart: Add guest users in the Azure portal - Azure AD](/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal). If using an email account that's provided by your universityΓÇÖs Azure AD, you don't have to add them as a guest account. ++Once the user has an Azure AD account, [add the Azure AD user account to Lab Creator role](#add-azure-ad-user-account-to-lab-creator-role). ++> [!IMPORTANT] +> Only lab creators need an account in Azure AD connected to the subscription. For account requirements for students see [Tutorial: Access a lab in Azure Lab Services](tutorial-connect-lab-virtual-machine.md). + ### Using a non-Microsoft email account-Lab creators/instructors can use non-Microsoft email accounts to register and sign in to a classroom lab. However, the sign-in to the Lab Services portal requires that instructors first create a Microsoft account that's linked to their non-Microsoft email address. -Many instructors might already have a Microsoft account linked to their non-Microsoft email addresses. For example, instructors already have a Microsoft account if they have used their email address with MicrosoftΓÇÖs other products or services, such as Office, Skype, OneDrive, or Windows. +Educators can use non-Microsoft email accounts to register and sign in to a lab. However, the sign-in to the Lab Services portal requires that educators first create a Microsoft account that's linked to their non-Microsoft email address. -When instructors sign in to the Lab Services portal, they are prompted for their email address and password. If the instructor attempts to sign in with a non-Microsoft account that does not have a Microsoft account linked, the instructor will receive the following error message: +Many educators might already have a Microsoft account linked to their non-Microsoft email addresses. For example, educators already have a Microsoft account if they have used their email address with MicrosoftΓÇÖs other products or services, such as Office, Skype, OneDrive, or Windows. - +When educators sign in to the Lab Services portal, they are prompted for their email address and password. If the educator attempts to sign in with a non-Microsoft account that does not have a Microsoft account linked, the educator will receive the following error message: -To sign up for a Microsoft account, instructors should go to [http://signup.live.com](http://signup.live.com). + +To sign up for a Microsoft account, educators should go to [http://signup.live.com](http://signup.live.com). ### Using a GitHub Account-Instructors can also use an existing GitHub account to register and sign in to a classroom lab. If the instructor already has a Microsoft account linked to their GitHub account, then they can sign in and provide their password as shown in the previous section. If they have not yet linked their GitHub account to a Microsoft account, they should select **Sign-in options**: ++Educators can also use an existing GitHub account to register and sign in to a lab. If the educator already has a Microsoft account linked to their GitHub account, then they can sign in and provide their password as shown in the previous section. If they have not yet linked their GitHub account to a Microsoft account, they should select **Sign-in options**:  On the **Sign-in options** page, select **Sign in with GitHub**.  -Finally, they are prompted to create a Microsoft account that's linked to their GitHub account. It happens automatically when the instructor selects **Next**. The instructor is then immediately signed in and connected to the classroom lab. -+Finally, they are prompted to create a Microsoft account that's linked to their GitHub account. It happens automatically when the educator selects **Next**. The educator is then immediately signed in and connected to the lab. ## Next steps+ See the following articles: -- [As a lab owner, create and manage labs](how-to-manage-classroom-labs.md)+- [As a lab owner, create and manage labs](how-to-manage-labs.md) - [As a lab owner, set up and publish templates](how-to-create-manage-template.md) - [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)-- [As a lab user, access labs](how-to-use-classroom-lab.md)+- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | Administrator Guide 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/administrator-guide-1.md | + + Title: Administrator guide (deprecated) | Microsoft Docs +description: This guide helps administrators who create and manage lab accounts by using Azure Lab Services. + Last updated : 10/20/2020+++# Azure Lab Services - Administrator guide (deprecated) +++Information technology (IT) administrators who manage a university's cloud resources are ordinarily responsible for setting up the lab account for their school. After they've set up a lab account, administrators or educators create the labs that are contained within the account. This article provides a high-level overview of the Azure resources that are involved and the guidance for creating them. ++ ++- Labs are hosted within an Azure subscription that's owned by Azure Lab Services. +- Lab accounts, a shared image gallery, and image versions are hosted within your subscription. +- You can have your lab account and the shared image gallery in the same resource group. In this diagram, they are in different resource groups. ++For more information about the architecture, see [Labs architecture fundamentals](./classroom-labs-fundamentals.md). ++## Subscription ++Your university might have one or more Azure subscriptions. You use subscriptions to manage billing and security for all Azure resources and services that are used within it, including lab accounts. ++The relationship between a lab account and its subscription is important because: ++- Billing is reported through the subscription that contains the lab account. +- You can grant users in the subscription's Azure Active Directory (Azure AD) tenant access to Azure Lab Services. You can add a user as a lab account Owner or Contributor, or as a Lab Creator or lab Owner. ++Labs and their virtual machines (VMs) are managed and hosted for you within a subscription that's owned by Azure Lab Services. ++## Resource group ++A subscription contains one or more resource groups. Resource groups are used to create logical groupings of Azure resources that are used together within the same solution. ++When you create a lab account, you must configure the resource group that contains the lab account. ++A resource group is also required when you create a [shared image gallery](#shared-image-gallery). You can place your lab account and shared image gallery in the same resource group or in two separate resource groups. You might want to take this second approach if you plan to share the image gallery across various solutions. ++When you create a lab account, you can automatically create and attach a shared image gallery at the same time. This option results in the lab account and the shared image gallery being created in separate resource groups. You'll see this behavior when you follow the steps that are described in the [Configure shared image gallery at the time of lab account creation](how-to-attach-detach-shared-image-gallery-1.md#configure-at-the-time-of-lab-account-creation) tutorial. The image at the beginning of this article uses this configuration. ++We recommend that you invest time up front to plan the structure of your resource groups, because it's *not* possible to change a lab account or shared image gallery resource group once it's created. If you need to change the resource group for these resources, you'll need to delete and re-create your lab account or shared image gallery. ++## Lab account ++A lab account serves as a container for one or more labs. When you're getting started with Azure Lab Services, it's most common to have a single lab account. As your lab usage scales up, you can choose to create more lab accounts later. ++The following list highlights scenarios where more than one lab account might be beneficial: ++- **Manage different policy requirements across labs** ++ When you set up a lab account, you set policies that apply to *all* labs under the lab account, such as: + - The Azure virtual network with shared resources that the lab can access. For example, you might have a set of labs that need access to a shared data set within a virtual network. + - The virtual machine images that the labs can use to create VMs. For example, you might have a set of labs that need access to the [Data Science VM for Linux](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) Azure Marketplace image. ++ If each of your labs has unique policy requirements, it might be beneficial to create separate lab accounts for managing each lab separately. ++- **Assign a separate budget to each lab account** + + Instead of reporting all lab costs through a single lab account, you might need a more clearly apportioned budget. For example, you can create separate lab accounts for your university's Math department, Computer Science department, and so forth, to distribute the budget across departments. You can then view the cost for each individual lab account by using [Azure Cost Management](../cost-management-billing/cost-management-billing-overview.md). ++- **Isolate pilot labs from active or production labs** + + You might have cases where you want to pilot policy changes for a lab account without potentially affecting your active or production labs. In this type of scenario, creating a separate lab account for piloting purposes allows you to isolate changes. ++## Lab ++A lab contains VMs that are each assigned to a single student. In general, you can expect to: ++- Have one lab for each class. +- Create a new set of labs for each semester, quarter, or other academic system you're using. For classes that need to use the same image, you should use a [shared image gallery](#shared-image-gallery). This way, you can reuse images across labs and academic periods. ++When you're determining how to structure your labs, consider the following points: ++- **All VMs within a lab are deployed with the same image that's published** ++ As a result, if you have a class that requires different lab images to be published at the same time, a separate lab must be created for each image. + +- **The usage quota is set at the lab level and applies to all users within the lab** ++ To set different quotas for users, you must create separate labs. However, it's possible to add more hours to specific users after you've set the quota. + +- **The startup or shutdown schedule is set at the lab level and applies to all VMs within the lab** ++ Similar to quota setting, if you need to set different schedules for users, you need to create a separate lab for each schedule. ++By default, each lab has its own virtual network. If you have virtual network peering enabled, each lab will have its own subnet peered with the specified virtual network. ++## Shared image gallery ++A shared image gallery is attached to a lab account and serves as a central repository for storing images. An image is saved in the gallery when an educator chooses to export it from a lab's template VM. Each time an educator makes changes to the template VM and exports it, new image definitions and\or versions are created in the gallery. ++Educators can publish an image version from the shared image gallery when they create a new lab. Although the gallery stores multiple versions of an image, educators can select only the most recent version during lab creation. The most recent version is chosen based on the highest value of MajorVersion, then MinorVersion, then Patch. For more information about versioning, see [Image versions](../virtual-machines/shared-image-galleries.md#image-versions). ++The shared image gallery service is an optional resource that you might not need immediately if you're starting with only a few labs. However, shared image gallery offers many benefits that are helpful as you scale up to more labs: ++- **You can save and manage versions of a template VM image** ++ It's useful to create a custom image or make changes (software, configuration, and so on) to an image from the Azure Marketplace gallery. For example, it's common for educators to require different software or tooling be installed. Rather than requiring students to manually install these prerequisites on their own, different versions of the template VM image can be exported to a shared image gallery. You can then use these image versions when you create new labs. ++- **You can share and reuse template VM images across labs** ++ You can save and reuse an image so that you don't have to configure it from scratch each time that you create a new lab. For example, if multiple classes need to use the same image, you can create it once and export it to the shared image gallery so that it can be shared across labs. ++- **You can upload your own custom images from other environments outside of labs** ++ You can [upload custom images other environments outside of the context of labs](how-to-attach-detach-shared-image-gallery-1.md). For example, you can upload images from your own physical lab environment or from an Azure VM into shared image gallery. Once an image is imported into the gallery, you can then use the images to create labs. ++To logically group shared images, you can do either of the following: ++- Create multiple shared image galleries. Each lab account can connect to only one shared image gallery, so this option also requires you to create multiple lab accounts. +- Use a single shared image gallery that's shared by multiple lab accounts. In this case, each lab account can enable only images that are applicable to the labs in that account. ++## Naming ++As you get started with Azure Lab Services, we recommend that you establish naming conventions for Azure and Azure Lab Services related resources. Although the naming conventions that you establish will be unique to the needs of your organization, the following table provides general guidelines: ++| Resource type | Role | Suggested pattern | Examples | +| - | - | -- | -- | +| Resource group | Contains one or more lab plans, labs and/or shared image galleries. |{org-name}labs-{env}-rg, {dept-name}labs-rg | contosolabs-rg, contosolabs-pilot-rg, contosolabs-prod-rg, mathdept-rg | +| Lab account | Contains one or more labs. | {org-name}-{env}-la, {dept-name}-{env}-la | contoso-la, mathdept-la, cs-pilot-la | +| Lab | Contains one or more student VMs. | {class-name}-{time}-{educator} | CS101-Fall2021, CS101-Fall2021-JohnDoe | +| Shared image gallery | Contains one or more VM image versions | {org-name}-sig, {dept-name}-sig | contoso-sig, mathdept-sig | ++In the proceeding table, we used some terms and tokens in the suggested name patterns. Let's go over those terms in a little more detail. ++| Pattern term/token | Definition | Example | +| | - | - | +| {org-name} | Token for organization short name with no spaces. | contoso | +| {dept-name} | Token for short name of department in organization. | math, bio, cs | +| {env} | Token for environment name | prod for production, pilot for small test | +| {class-name} | Token for short name or code for class being supported. | CS101, Bio101 | +| {educator} | Alias of educator running the lab. | johndoe | +| {time} | Token for short name (with no spaces) for time the class is being offered. | Spring2021, Dec 2021| +| rg | Indicates resource is a resource group. | | +| la | Indicates resource is a lab account. | | +| sig | Indicates resource is a shared image gallery. | | ++For more information about naming other Azure resources, see [Naming conventions for Azure resources](/azure/architecture/best-practices/naming-conventions). ++## Regions/locations ++When you set up your Azure Lab Services resources, you're required to provide a region or location of the datacenter that will host the resources. The next sections describe how a region or location might affect each resource that's involved with setting up a lab. ++### Resource group ++The region specifies the datacenter where information about a resource group is stored. Azure resources contained within the resource group can be in a different region from that of their parent. ++### Lab account ++A lab account's location indicates the region that a resource exists in. ++### Lab ++The location that a lab exists in varies, depending on the following factors: ++- **The lab account is peered with a virtual network** + + You can [peer a lab account with a virtual network](./how-to-connect-peer-virtual-network.md) when they're in the same region. When a lab account is peered with a virtual network, labs are automatically created in the same region as both the lab account and the virtual network. ++ > [!NOTE] + > When a lab account is peered with a virtual network, the **Allow lab creator to pick lab location** setting is disabled. For more information, see [Allow lab creator to pick location for the lab](./allow-lab-creator-pick-lab-location.md). ++- **No virtual network is peered *and* Lab Creators aren't allowed to pick the lab location** + + When *no* virtual network is peered with the lab account and [Lab Creators are *not allowed* to pick the lab location](./allow-lab-creator-pick-lab-location.md), labs are automatically created in a region that has available VM capacity. Specifically, Azure Lab Services looks for availability in [regions that are within the same geography as the lab account](https://azure.microsoft.com/global-infrastructure/regions). ++- **No virtual network is peered *and* Lab Creators are allowed to pick the lab location** ++ When *no* virtual network is peered and [Lab Creators *are allowed* to pick the lab location](./allow-lab-creator-pick-lab-location.md), the locations that can be selected by the Lab Creator depend on available capacity. ++> [!NOTE] +> To help ensure that a region has sufficient VM capacity, it's important to first request capacity through the lab account when you're creating the lab. ++A general rule is to set a resource's region to one that's closest to its users. For labs, this means creating the lab that's closest to your students. For online courses whose students are located all over the world, use your best judgment to create a lab that's centrally located. Or you can split a class into multiple labs according to your students' regions. ++## VM sizing ++When administrators or Lab Creators create a lab, they can choose from various VM sizes, depending on the needs of their classroom. Remember that the size availability depends on the region that your lab account is located in. ++In the following table, notice that several of the VM sizes map to more than one VM series. Depending on capacity availability, Lab Services may use any of the VM series that are listed for a VM size. For example, the *Small* VM size maps to using either the [Standard_A2_v2](../virtual-machines/av2-series.md) or the [Standard_A2](../virtual-machines/sizes-previous-gen.md#a-series) VM series. When you choose *Small* as the VM size for your lab, Lab Services will first attempt to use the *Standard_A2_v2* series. However, when there isn't sufficient capacity available, Lab Services will instead use the *Standard_A2* series. The pricing is determined by the VM size and is the same regardless of which VM series Lab Services uses for that specific size. For more information on pricing for each VM size, read the [Lab Services pricing guide](https://azure.microsoft.com/pricing/details/lab-services/). ++| Size | Minimum vCPUs | Minimum RAM | Series | Suggested use | +| - | -- | -- | | - | +| Small| 2 vCPUs | 3.5 GB RAM | [Standard_A2_v2](../virtual-machines/av2-series.md), [Standard_A2](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for command line, opening web browser, low-traffic web servers, small to medium databases. | +| Medium | 4 vCPUs | 7 GB RAM | [Standard_A4_v2](../virtual-machines/av2-series.md), [Standard_A3](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for relational databases, in-memory caching, and analytics. | +| Medium (nested virtualization) | 4 vCPUs | 16 GBs RAM | [Standard_D4s_v3](../virtual-machines/dv3-dsv3-series.md#dsv3-series) | Best suited for relational databases, in-memory caching, and analytics. This size also supports nested virtualization. +| Large | 8 vCPUs | 16 GB RAM | [Standard_A8_v2](../virtual-machines/av2-series.md), [Standard_A7](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. | +| Large (nested virtualization) | 8 vCPUs | 32 GB RAM | [Standard_D8s_v3](../virtual-machines/dv3-dsv3-series.md#dsv3-series) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. This size also supports nested virtualization. | +| Small GPU (visualization) | 6 vCPUs | 56 GB RAM | [Standard_NV6](../virtual-machines/nv-series.md) | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | +| Small GPU (Compute) | 6 vCPUs | 56 GB RAM | [Standard_NC6](../virtual-machines/nc-series.md), [Standard_NC6s_v3](../virtual-machines/ncv3-series.md) |Best suited for computer-intensive applications such as AI and deep learning. | +| Medium GPU (visualization) | 12 vCPUs | 112 GB RAM | [Standard_NV12](../virtual-machines/nv-series.md), [Standard_NV12s_v3](../virtual-machines/nvv3-series.md), [Standard_NV12s_v2](../virtual-machines/sizes-previous-gen.md#nvv2-series) | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | ++## Manage identity ++By using [Azure role-based access control (RBAC)](../role-based-access-control/overview.md) for access to lab accounts and labs, you can assign the following roles: ++- Lab account **Owner** ++ An administrator who creates a lab account is automatically assigned the lab account Owner role. The Owner role can: + - Change the lab account settings. + - Grant other administrators access to the lab account as an Owner or Contributor. + - Grant educators access to labs as a Creator, Owner, or Contributor. + - Create and manage all labs in the lab account. ++- Lab account **Contributor** ++ An administrator who's assigned the Contributor role can: + - Change the lab account settings. + - Create and manage all labs in the lab account. ++ However, the Contributor *can't* grant other users access to either lab accounts or labs. ++- **Lab Creator** ++ To create labs within a lab account, an educator must be a member of the Lab Creator role. An educator who creates a lab is automatically added as a lab Owner. For more information, see [Add a user to the Lab Creator role](./tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role). ++- Lab **Owner** or **Contributor** + + An educator in either a lab Owner or Contributor role can view and change a lab's settings. The person must also be a member of the lab account Reader role. ++ A key difference between the lab Owner and Contributor roles is that only an Owner can grant other users access to manage a lab. A Contributor *can't* grant other users access to manage a lab. ++- **Shared image gallery** ++ When you attach a shared image gallery to a lab account, lab account Owners and Contributors and Lab Creators, lab Owners, and lab Contributors are automatically granted access to view and save images in the gallery. ++When you're assigning roles, it helps to follow these tips: ++- Ordinarily, only administrators should be members of a lab account Owner or Contributor role. The lab account might have more than one Owner or Contributor. +- To give educators the ability to create new labs and manage the labs that they create, you need only assign them the Lab Creator role. +- To give educators the ability to manage specific labs, but *not* the ability to create new labs, assign them either the Owner or Contributor role for each lab that they'll manage. For example, you might want to allow a professor and a teaching assistant to co-own a lab. For more information, see [Add Owners to a lab](./how-to-add-user-lab-owner.md). ++## Content filtering ++Your school may need to do content filtering to prevent students from accessing inappropriate websites. For example, to comply with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act). Lab Services doesn't offer built-in support for content filtering. ++There are two approaches that schools typically consider for content filtering: ++- Configure a firewall to filter content at the network level. +- Install 3rd party software directly on each computer that performs content filtering. ++The first approach isn't currently supported by Lab Services. Lab Services hosts each lab's virtual network within a Microsoft-managed Azure subscription. As a result, you don't have access to the underlying virtual network to do content filtering at the network level. For more information on Lab Services' architecture, read the article [Architecture Fundamentals](./classroom-labs-fundamentals.md). ++Instead, we recommend the second approach which is to install 3rd party software on each lab's template VM. There are a few key points to highlight as part of this solution: ++- If you plan to use the [auto-shutdown settings](./cost-management-guide.md#automatic-shutdown-settings-for-cost-control), you will need to unblock several Azure host names with the 3rd party software. The auto-shutdown settings use a diagnostic extension that must be able to communicate back to Lab Services. Otherwise, the auto-shutdown settings will fail to enable for the lab. +- You may also want to have each student use a non-admin account on their VM so that they can't uninstall the content filtering software. By default, Lab Services creates an admin account that each student uses to sign into their VM. It is possible to add a non-admin account using a specialized image, but there are some known limitations. ++If your school needs to do content filtering, contact us via the [Azure Lab Services' forums](https://techcommunity.microsoft.com/t5/azure-lab-services/bd-p/AzureLabServices) for more information. ++## Endpoint management ++Many endpoint management tools, such as [Microsoft Endpoint Manager](https://techcommunity.microsoft.com/t5/azure-lab-services/configuration-manager-azure-lab-services/ba-p/1754407), require Windows VMs to have unique machine security identifiers (SIDs). Using SysPrep to create a *generalized* image typically ensures that each Windows machine will have a new, unique machine SID generated when the VM boots from the image. ++With Lab Services, even if you use a *generalized* image to create a lab, the template VM and student VMs will all have the same machine SID. The VMs have the same SID because the template VM's image is in a *specialized* state when it's published to create the student VMs. ++For example, the Azure Marketplace images are generalized. If you create a lab from the Win 10 marketplace image and publish the template VM, all of the student VMs within a lab will have the same machine SID as the template VM. The machine SIDs can be verified by using a tool such as [PsGetSid](/sysinternals/downloads/psgetsid). ++If you plan to use an endpoint management tool or similar software, we recommend that you test it with lab VMs to ensure that it works properly when machine SIDs are the same. ++## Pricing ++### Azure Lab Services ++To learn about pricing, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). ++### Shared Image Gallery ++You also need to consider the pricing for the Shared Image Gallery service if you plan to use shared image galleries for storing and managing image versions. ++Creating a shared image gallery and attaching it to your lab account is free. No cost is incurred until you save an image version to the gallery. The pricing for using a shared image gallery is ordinarily fairly negligible, but it's important to understand how it's calculated, because it isn't included in the pricing for Azure Lab Services. ++#### Storage charges ++To store image versions, a shared image gallery uses standard hard disk drive (HDD) managed disks by default. We recommend using HDD-managed disks when using shared image gallery with Lab Services. The size of the HDD-managed disk that's used depends on the size of the image version that's being stored. Lab Services supports image and disk sizes up to 128 GB. To learn about pricing, see [Managed disks pricing](https://azure.microsoft.com/pricing/details/managed-disks/). ++#### Replication and network egress charges ++When you save an image version by using a lab template VM, Azure Lab Services first stores it in a source region and then automatically replicates the source image version to one or more target regions. ++It's important to note that Azure Lab Services automatically replicates the source image version to all [target regions within the geography](https://azure.microsoft.com/global-infrastructure/regions/) where the lab is located. For example, if your lab is in the US geography, an image version is replicated to each of the eight regions that exist within the US. ++A network egress charge occurs when an image version is replicated from the source region to additional target regions. The amount charged is based on the size of the image version when the image's data is initially transferred outbound from the source region. For pricing details, see [Bandwidth pricing details](https://azure.microsoft.com/pricing/details/bandwidth/). ++Egress charges might be waived for [Education Solutions](https://www.microsoft.com/licensing/licensing-programs/licensing-for-industries?rtc=1&activetab=licensing-for-industries-pivot:primaryr3) customers. To learn more, contact your account manager. ++For more information, see "What data transfer programs exist for academic customers and how do I qualify?" in the FAQ section of the [Programs for educational institutions](https://azure.microsoft.com/pricing/details/bandwidth/) page. ++#### Pricing example ++Let's look at an example of the cost of saving a template VM image to a shared image gallery. Assume the following scenarios: ++- You have one custom VM image. +- You're saving two versions of the image. +- Your lab is in the US, which has a total of eight regions. +- Each image version is 32 GB in size; as a result, the HDD-managed disk price is $1.54 per month. ++The total cost per month is estimated as: ++* *Number of images × number of versions × number of replicas × managed disk price = total cost per month* ++In this example, the cost is: ++* 1 custom image (32 GB) × 2 versions × 8 US regions × $1.54 = $24.64 per month ++> [!NOTE] +> The preceding calculation is for example purposes only. It covers storage costs associated with using Shared Image Gallery and does *not* include egress costs. For actual pricing for storage, see [Managed Disks pricing](https://azure.microsoft.com/pricing/details/managed-disks/). ++#### Cost management ++It's important for lab account administrators to manage costs by routinely deleting unneeded image versions from the gallery. ++Don't delete replication to specific regions as a way to reduce the costs, though this option exists in the shared image gallery. Replication changes might have adverse effects on the ability of Azure Lab Services to publish VMs from images saved within a shared image gallery. ++## Next steps ++For more information about setting up and managing labs, see: ++- [Lab account setup guide](account-setup-guide.md) +- [Lab setup guide](setup-guide.md) +- [Cost management for labs](cost-management-guide.md) +- [Use Azure Lab Services in Teams](lab-services-within-teams-overview.md) |
| lab-services | Administrator Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/administrator-guide.md | Title: Administrator guide | Microsoft Docs -description: This guide helps administrators who create and manage lab accounts by using Azure Lab Services. +description: This guide helps administrators who create and manage lab plans by using Azure Lab Services. Previously updated : 10/20/2020 Last updated : 01/22/2022 # Azure Lab Services - Administrator guide-Information technology (IT) administrators who manage a university's cloud resources are ordinarily responsible for setting up the lab account for their school. After they've set up a lab account, administrators or educators create the labs that are contained within the account. This article provides a high-level overview of the Azure resources that are involved and the guidance for creating them. - -- Labs are hosted within an Azure subscription that's owned by Azure Lab Services.-- Lab accounts, a shared image gallery, and image versions are hosted within your subscription.-- You can have your lab account and the shared image gallery in the same resource group. In this diagram, they are in different resource groups.+> [!NOTE] +> If using a version of Azure Lab Services prior to the [April 2022 Update (preview)](lab-services-whats-new.md), see [Azure Lab Services - Administrator guide (deprecated)](administrator-guide-1.md). ++Information technology (IT) administrators who manage a university's cloud resources are ordinarily responsible for setting up the lab plan for their school. After they have set up a lab plan, administrators or educators create the labs that are associated with the lab plan. This article provides a high-level overview of the Azure resources that are involved and the guidance for creating them. ++Depending on settings chosen when creating lab plans, some resources will be hosted in your subscription and some will be hosted in a subscription managed by Azure Lab Services. ++- Lab VMs are hosted within an Azure subscription that is owned by Azure Lab Services. +- Lab plans, labs, compute galleries, and image versions and are hosted within your subscription. +- If using advanced networking, the virtual network and network-related resources for lab VMs are hosted within your subscription. Otherwise, the virtual network is hosted in a subscription managed by Azure Lab Services. +- You can have your lab plans, labs, and the compute galleries in the same or different resource group. For more information about the architecture, see [Labs architecture fundamentals](./classroom-labs-fundamentals.md). ## Subscription-Your university might have one or more Azure subscriptions. You use subscriptions to manage billing and security for all Azure resources and services that are used within it, including lab accounts. -The relationship between a lab account and its subscription is important because: +Your university might have one or more Azure subscriptions. You use subscriptions to manage billing and security for all Azure resources and services that are used within it, including lab plans and labs. -- Billing is reported through the subscription that contains the lab account.-- You can grant users in the subscription's Azure Active Directory (Azure AD) tenant access to Azure Lab Services. You can add a user as a lab account Owner or Contributor, or as a Lab Creator or lab Owner.+The relationship between a lab plan and its subscription is important because: -Labs and their virtual machines (VMs) are managed and hosted for you within a subscription that's owned by Azure Lab Services. +- Billing is reported through the subscription that contains the lab plan. +- You can grant users in the subscription's Azure Active Directory (Azure AD) tenant the ability to manage Azure Lab Services lab plans and labs. You can add someone as a lab plan owner, lab plan contributor, lab creator, or lab owner. For more information about built-in RBAC roles, see [Manage identity](#rbac-roles). ++Labs virtual machines (VMs) are managed and hosted for you within a subscription that is owned by Azure Lab Services. ## Resource group-A subscription contains one or more resource groups. Resource groups are used to create logical groupings of Azure resources that are used together within the same solution. -When you create a lab account, you must configure the resource group that contains the lab account. +A subscription contains one or more resource groups. Resource groups are used to create logical groupings of Azure resources that are used together within the same solution. -A resource group is also required when you create a [shared image gallery](#shared-image-gallery). You can place your lab account and shared image gallery in the same resource group or in two separate resource groups. You might want to take this second approach if you plan to share the image gallery across various solutions. +When you create a lab plan, you must configure the resource group that contains the lab plan. Name your resource group carefully. Labs are grouped by resource group name in the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). -When you create a lab account, you can automatically create and attach a shared image gallery at the same time. This option results in the lab account and the shared image gallery being created in separate resource groups. You'll see this behavior when you follow the steps that are described in the [Configure shared image gallery at the time of lab account creation](how-to-attach-detach-shared-image-gallery.md#configure-at-the-time-of-lab-account-creation) tutorial. The image at the beginning of this article uses this configuration. +A resource group is also required when you create an [Azure Compute Gallery](#azure-compute-gallery). You can place your lab plan and compute gallery in the same resource group or in two separate resource groups. You might want to take this second approach if you plan to share the compute gallery across various solutions. -We recommend that you invest time up front to plan the structure of your resource groups, because it's *not* possible to change a lab account or shared image gallery resource group once it's created. If you need to change the resource group for these resources, you'll need to delete and re-create your lab account or shared image gallery. +We recommend that you invest time up front to plan the structure of your resource groups. It's *not* possible to change a lab plan or compute gallery resource group once itΓÇÖs created. If you need to change the resource group for these resources, youΓÇÖll need to delete and re-create them. -## Lab account +## Lab plan -A lab account serves as a container for one or more labs. When you're getting started with Azure Lab Services, it's most common to have a single lab account. As your lab usage scales up, you can choose to create more lab accounts later. +A lab plan set of configurations that influence the creation of a lab. A lab plan can be associated with zero or more labs. When youΓÇÖre getting started with Azure Lab Services, itΓÇÖs most common to have a single lab plan. As your lab usage scales up, you can choose to create more lab plans later. -The following list highlights scenarios where more than one lab account might be beneficial: +The following list highlights scenarios where more than one lab plan might be beneficial: - **Manage different policy requirements across labs** - When you set up a lab account, you set policies that apply to *all* labs under the lab account, such as: - - The Azure virtual network with shared resources that the lab can access. For example, you might have a set of labs that need access to a shared data set within a virtual network. - - The virtual machine images that the labs can use to create VMs. For example, you might have a set of labs that need access to the [Data Science VM for Linux](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) Azure Marketplace image. + When you create a lab plan, you set policies that apply to all newly created labs, such as: - If each of your labs has unique policy requirements, it might be beneficial to create separate lab accounts for managing each lab separately. + - The Azure virtual network with shared resources that the lab can access. For example, you might have a set of labs that need access to a license server within a virtual network. + - The virtual machine images that the labs can use to create VMs. For example, you might have a set of labs that need access to the [Data Science VM for Linux](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) Azure Marketplace image. -- **Assign a separate budget to each lab account**- - Instead of reporting all lab costs through a single lab account, you might need a more clearly apportioned budget. For example, you can create separate lab accounts for your university's Math department, Computer Science department, and so forth, to distribute the budget across departments. You can then view the cost for each individual lab account by using [Azure Cost Management](../cost-management-billing/cost-management-billing-overview.md). + If each of your labs has unique policy requirements, it might be beneficial to create separate lab plans for managing each lab separately. - **Isolate pilot labs from active or production labs** - You might have cases where you want to pilot policy changes for a lab account without potentially affecting your active or production labs. In this type of scenario, creating a separate lab account for piloting purposes allows you to isolate changes. + You might have cases where you want to pilot policy changes for a lab plan without potentially affecting your active labs. In this type of scenario, creating a separate lab plan for piloting purposes allows you to isolate changes. ## Lab A lab contains VMs that are each assigned to a single student. In general, you can expect to: - Have one lab for each class.-- Create a new set of labs for each semester, quarter, or other academic system you're using. For classes that need to use the same image, you should use a [shared image gallery](#shared-image-gallery). This way, you can reuse images across labs and academic periods.+- Create a new set of labs for each semester, quarter, or other academic system youΓÇÖre using. For classes that need to use the same image, you should use a [compute gallery](#azure-compute-gallery). This way, you can reuse images across labs and academic periods. -When you're determining how to structure your labs, consider the following points: +When youΓÇÖre determining how to structure your labs, consider the following points: -- **All VMs within a lab are deployed with the same image that's published**+- **All VMs within a lab are deployed with the same image that's published.** As a result, if you have a class that requires different lab images to be published at the same time, a separate lab must be created for each image. - **The usage quota is set at the lab level and applies to all users within the lab** - To set different quotas for users, you must create separate labs. However, it's possible to add more hours to specific users after you've set the quota. + To set different quotas for users, you must create separate labs. However, itΓÇÖs possible to add more hours to specific users after you have set the quota. - **The startup or shutdown schedule is set at the lab level and applies to all VMs within the lab** Similar to quota setting, if you need to set different schedules for users, you need to create a separate lab for each schedule. -By default, each lab has its own virtual network. If you have virtual network peering enabled, each lab will have its own subnet peered with the specified virtual network. +By default, each lab has its own virtual network. If you have [advanced networking enabled](how-to-connect-vnet-injection.md), each lab will use the specified network. -## Shared image gallery +## Azure Compute Gallery -A shared image gallery is attached to a lab account and serves as a central repository for storing images. An image is saved in the gallery when an educator chooses to export it from a lab's template VM. Each time an educator makes changes to the template VM and exports it, new image definitions and\or versions are created in the gallery. +An Azure Compute Gallery is attached to a lab plan and serves as a central repository for storing images. An image is saved in the gallery when an educator chooses to export it from a lab's template VM. Each time an educator makes changes to the template VM and exports it, new image definitions and\or versions are created in the gallery. -Instructors can publish an image version from the shared image gallery when they create a new lab. Although the gallery stores multiple versions of an image, educators can select only the most recent version during lab creation. The most recent version is chosen based on the highest value of MajorVersion, then MinorVersion, then Patch. For more information about versioning, see [Image versions](../virtual-machines/shared-image-galleries.md#image-versions). +Educators can publish an image version from the compute gallery when they create a new lab. Although the gallery stores multiple versions of an image, educators can select only the most recent version during lab creation. The most recent version is chosen based on the highest value of MajorVersion, then MinorVersion, then Patch. For more information about versioning, see [Image versions](../virtual-machines/shared-image-galleries.md#image-versions). -The shared image gallery service is an optional resource that you might not need immediately if you're starting with only a few labs. However, shared image gallery offers many benefits that are helpful as you scale up to additional labs: +The compute gallery is an optional resource that you might not need immediately if youΓÇÖre starting with only a few labs. However, a compute gallery offers many benefits that are helpful as you scale up to more labs: - **You can save and manage versions of a template VM image** - It's useful to create a custom image or make changes (software, configuration, and so on) to an image from the Azure Marketplace gallery. For example, it's common for educators to require different software or tooling be installed. Rather than requiring students to manually install these prerequisites on their own, different versions of the template VM image can be exported to a shared image gallery. You can then use these image versions when you create new labs. + ItΓÇÖs useful to create a custom image or make changes (software, configuration, and so on) to an image from the Azure Marketplace gallery. For example, itΓÇÖs common for educators to require different software or tooling be installed. Rather than requiring students to manually install these prerequisites on their own, different versions of the template VM image can be exported to the compute gallery. You can then use these image versions when you create new labs. - **You can share and reuse template VM images across labs** - You can save and reuse an image so that you don't have to configure it from scratch each time that you create a new lab. For example, if multiple classes need to use the same image, you can create it once and export it to the shared image gallery so that it can be shared across labs. + You can save and reuse an image so that you donΓÇÖt have to configure it from scratch each time that you create a new lab. For example, if multiple classes need to use the same image, you can create it once and export it to the compute gallery so that it can be shared across labs. - **You can upload your own custom images from other environments outside of labs** - You can [upload custom images other environments outside of the context of labs](how-to-attach-detach-shared-image-gallery.md). For example, you can upload images from your own physical lab environment or from an Azure VM into shared image gallery. Once an image is imported into the gallery, you can then use the images to create labs. + You can [upload custom images other environments outside of the context of labs](how-to-attach-detach-shared-image-gallery.md). For example, you can upload images from your own physical lab environment or from an Azure VM into compute gallery. Once an image is imported into the gallery, you can then use the images to create labs. -To logically group shared images, you can do either of the following: +To logically group compute gallery images, you can do either of the following methods: -- Create multiple shared image galleries. Each lab account can connect to only one shared image gallery, so this option also requires you to create multiple lab accounts.-- Use a single shared image gallery that's shared by multiple lab accounts. In this case, each lab account can enable only images that are applicable to the labs in that account.+- Create multiple compute galleries. Each lab plan can connect to only one compute gallery, so this option also requires you to create multiple lab plans. +- Use a single compute gallery that is shared by multiple lab plans. In this case, each lab plan can enable only images that are applicable to the labs in that plan. ## Naming -As you get started with Azure Lab Services, we recommend that you establish naming conventions for resource groups, lab accounts, labs, and the shared image gallery. Although the naming conventions that you establish will be unique to the needs of your organization, the following table provides general guidelines: +As you get started with Azure Lab Services, we recommend that you establish naming conventions for Azure and Azure Lab Services related resources. For resource naming restrictions, see [Microsoft.LabServices naming rules and restrictions](../azure-resource-manager/management/resource-name-rules.md#microsoftlabservices). Although the naming conventions that you establish will be unique to the needs of your organization, the following table provides general guidelines: | Resource type | Role | Suggested pattern | Examples |-| - | - | -- | -- | -| Resource group | Contains one or more lab accounts and one or more shared image galleries | \<organization short name\>-\<environment\>-rg<ul><li>**Organization short name** identifies the name of the organization that the resource group supports.</li><li>**Environment** identifies the environment for the resource, such as *pilot* or *production*.</li><li>**Rg** stands for the resource type *resource group*.</li></ul> | contosouniversitylabs-rg<br/>contosouniversitylabs-pilot-rg<br/>contosouniversitylabs-prod-rg | -| Lab account | Contains one or more labs | \<organization short name\>-\<environment\>-la<ul><li>**Organization short name** identifies the name of the organization that the resource group supports.</li><li>**Environment** identifies the environment for the resource, such as *pilot* or *production*.</li><li>**La** stands for the resource type *lab account*.</li></ul> | contosouniversitylabs-la<br/>mathdeptlabs-la<br/>sciencedeptlabs-pilot-la<br/>sciencedeptlabs-prod-la | -| Lab | Contains one or more VMs |\<class name\>-\<timeframe\>-\<educator identifier\><ul><li>**Class name** identifies the name of the class that the lab supports.</li><li>**Timeframe** identifies the timeframe in which the class is offered.</li>**Educator identifier** identifies the educator who owns the lab.</li></ul> | CS1234-fall2019-johndoe<br/>CS1234-spring2019-johndoe | -| Shared image gallery | Contains one or more VM image versions | \<organization short name\>gallery | contosouniversitylabsgallery | +| - | - | -- | -- | +| Resource group | Contains one or more lab plans, labs and/or compute galleries. | rg-labs-{org-name}-{env}-{instance}, rg-labs-{dept-name}-{env}-{instance} | rg-labs-contoso-pilot, rg-labs--math-prod-001 | +| Lab plan | Template for newly created labs. | lp-{org-name}-{env}-{instance}, lp-{dept-name}-{env}-{instance} | lp-contoso, lp-contoso-pilot, lp-math-001 | +| Lab | Contains one or more student VMs. | {class-name}-{time}-{educator} | CS101-Fall2021, CS101-Fall2021-JohnDoe | +| Azure Compute Gallery | Contains one or more VM image versions | sig-{org-name}-{env}-{instance}, sig-{dept-name}-{env}-{instance} | sig-contoso-001, sig-math-prod | ++In the proceeding table, we used some terms and tokens in the suggested name patterns. Let's go over those terms in a little more detail. ++| Pattern term/token | Definition | Example | +| | - | - | +| {org-name} | Token for organization short name with no spaces. | contoso | +| {dept-name} | Token for short name of department in organization. | math, bio, cs | +| {env} | Token for environment name | prod for production, pilot for small test | +| {instance} | Number to identify instance if multiple resources created. | 001, 123 | +| {class-name} | Token for short name or code for class being supported. | CS101, Bio101 | +| {educator} | Alias of educator running the lab. | johndoe | +| {time} | Token for short name (with no spaces) for time the class is being offered. | Spring2021, Dec2021| +| rg | Indicates resource is a resource group. | | +| lp | Indicates resource is a lab plan. | | +| sig | Indicates resource is a compute gallery. | | For more information about naming other Azure resources, see [Naming conventions for Azure resources](/azure/architecture/best-practices/naming-conventions). -## Regions\locations +## Regions -When you set up your Azure Lab Services resources, you're required to provide a region or location of the datacenter that will host the resources. The next sections describe how a region or location might affect each resource that's involved with setting up a lab. +When you set up your Azure Lab Services resources, youΓÇÖre required to provide a region or location of the data center that will host the resources. Lab plans can enable one or more regions in which labs may be created. The next sections describe how a region or location might affect each resource that is involved with setting up a lab. -### Resource group +- **Resource group**. The region specifies the datacenter where information about a resource group is stored. Azure resources contained within the resource group can be in a different region from that of their parent. +- **Lab plan**. A lab plan's location indicates the region that a resource exists in. When a lab plan is connected to your own virtual network, the network must be in the same region as the lab plan. Also, labs will be created in the same Azure region as that virtual network. +- **Lab**. The location that a lab exists in varies, and doesnΓÇÖt need to be in the same location as the lab plan. Administrators control which regions labs can be created in through the lab plan settings. A general rule is to set a resource's region to one that is closest to its users. For labs, this means creating the lab that is closest to your students. For online courses whose students are located all over the world, use your best judgment to create a lab that is centrally located. Or you can split a class into multiple labs according to your students' regions. -The region specifies the datacenter where information about a resource group is stored. Azure resources contained within the resource group can be in a different region from that of their parent. +> [!NOTE] +> To help ensure that a region has sufficient VM capacity, it's important to first [request capacity](capacity-limits.md#request-a-limit-increase). -### Lab account +## VM sizing -A lab account's location indicates the region that a resource exists in. +When administrators or Lab Creators create a lab, they can choose from various VM sizes, depending on the needs of their classroom. Remember that the size availability depends on the region that your lab plan is located in. -### Lab +For information on VM sizes and their cost, see the [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). -The location that a lab exists in varies, depending on the following factors: +| Size | Minimum vCPUs | Minimum memory: GiB | Series | Suggested use | +| - | -- | -- | | - | +| Small| 2 | 4 | [Standard_F2s_v2](../virtual-machines/fsv2-series.md) | Best suited for command line, opening web browser, low-traffic web servers, small to medium databases. | +| Medium | 4 | 8 | [Standard_F4s_v2](../virtual-machines/fsv2-series.md) | Best suited for relational databases, in-memory caching, and analytics. | +| Medium (nested virtualization) | 4 | 16 | [Standard_D4s_v4](../virtual-machines/dv4-dsv4-series.md) | Best suited for relational databases, in-memory caching, and analytics. This size also supports nested virtualization. +| Large | 8 | 16 | [Standard_F8s_v2](../virtual-machines/fsv2-series.md) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. | +| Large (nested virtualization) | 8 | 32 | [Standard_D8s_v4](../virtual-machines/dv4-dsv4-series.md) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. This size also supports nested virtualization. | +| Small GPU (visualization) | 8 | 28 | [Standard_NVas_v4](../virtual-machines/nvv4-series.md) **Windows only* | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | +| Medium GPU (visualization) | 12 | 112 | [Standard_NV12s_v3](../virtual-machines/nvv3-series.md) | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | - - **The lab account is peered with a virtual network** - - You can [peer a lab account with a virtual network](./how-to-connect-peer-virtual-network.md) when they're in the same region. When a lab account is peered with a virtual network, labs are automatically created in the same region as both the lab account and the virtual network. +> [!NOTE] +> You may not see some of the expected VM sizes in the list when creating a lab. The list is populated based on the current capacity in the selected region. - > [!NOTE] - > When a lab account is peered with a virtual network, the **Allow lab creator to pick lab location** setting is disabled. For more information, see [Allow lab creator to pick location for the lab](./allow-lab-creator-pick-lab-location.md). - - - **No virtual network is peered *and* Lab Creators aren't allowed to pick the lab location** - - When *no* virtual network is peered with the lab account and [Lab Creators are *not allowed* to pick the lab location](./allow-lab-creator-pick-lab-location.md), labs are automatically created in a region that has available VM capacity. Specifically, Azure Lab Services looks for availability in [regions that are within the same geography as the lab account](https://azure.microsoft.com/global-infrastructure/regions). +## RBAC roles - - **No virtual network is peered *and* Lab Creators are allowed to pick the lab location** - - When *no* virtual network is peered and [Lab Creators *are allowed* to pick the lab location](./allow-lab-creator-pick-lab-location.md), the locations that can be selected by the Lab Creator depend on available capacity. +By using [Azure role-based access control (RBAC)](../role-based-access-control/overview.md) for access to lab plans and labs, you can assign the following roles: -> [!NOTE] -> To help ensure that a region has sufficient VM capacity, it's important to first request capacity through the lab account when you're creating the lab. +- **Owner** -A general rule is to set a resource's region to one that's closest to its users. For labs, this means creating the lab that's closest to your students. For online courses whose students are located all over the world, use your best judgment to create a lab that's centrally located. Or you can split a class into multiple labs according to your students' regions. + An administrator who creates a lab plan is automatically assigned the lab plan Owner role. The Owner role can: -## VM sizing + - Change the lab plan settings. + - Grant other administrators access to the lab plan as an Owner or Contributor. + - Grant educators access to labs as a Creator, Owner, or Contributor. + - Create and manage all labs in the lab plan. -When administrators or Lab Creators create a lab, they can choose from a variety of VM sizes, depending on the needs of their classroom. Remember that the size availability depends on the region that your lab account is located in. +- **Contributor** -In the following table, notice that several of the VM sizes map to more than one VM series. Depending on capacity availability, Lab Services may use any of the VM series that are listed for a VM size. For example, the *Small* VM size maps to using either the [Standard_A2_v2](../virtual-machines/av2-series.md) or the [Standard_A2](../virtual-machines/sizes-previous-gen.md#a-series) VM series. When you choose *Small* as the VM size for your lab, Lab Services will first attempt to use the *Standard_A2_v2* series. However, when there isn't sufficient capacity available, Lab Services will instead use the *Standard_A2* series. The pricing is determined by the VM size and is the same regardless of which VM series Lab Services uses for that specific size. For more information on pricing for each VM size, read the [Lab Services pricing guide](https://azure.microsoft.com/pricing/details/lab-services/). + An administrator who is assigned the Contributor role can: + - Change the lab plan settings. + - Create and manage all labs in the lab plan. -| Size | Minimum Specs | Series | Suggested use | -| - | -- | | - | -| Small| <ul><li>2 cores</li><li>3.5 gigabytes (GB) RAM</li> | [Standard_A2_v2](../virtual-machines/av2-series.md), [Standard_A2](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for command line, opening web browser, low-traffic web servers, small to medium databases. | -| Medium | <ul><li>4 cores</li><li>7 GB RAM</li> | [Standard_A4_v2](../virtual-machines/av2-series.md), [Standard_A3](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for relational databases, in-memory caching, and analytics. | -| Medium (nested virtualization) | <ul><li>4 cores</li><li>16 GB RAM</li></ul> | [Standard_D4s_v3](../virtual-machines/dv3-dsv3-series.md#dsv3-series) | Best suited for relational databases, in-memory caching, and analytics. This size also supports nested virtualization. -| Large | <ul><li>8 cores</li><li>16 GB RAM</li></ul> | [Standard_A8_v2](../virtual-machines/av2-series.md), [Standard_A7](../virtual-machines/sizes-previous-gen.md#a-series) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. | -| Large (nested virtualization) | <ul><li>8 cores</li><li>32 GB RAM</li></ul> | [Standard_D8s_v3](../virtual-machines/dv3-dsv3-series.md#dsv3-series) | Best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. This size also supports nested virtualization. | -| Small GPU (visualization) | <ul><li>6 cores</li><li>56 GB RAM</li> | [Standard_NV6](../virtual-machines/nv-series.md) | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | -| Small GPU (Compute) | <ul><li>6 cores</li><li>56 GB RAM</li></ul> | [Standard_NC6](../virtual-machines/nc-series.md), [Standard_NC6s_v3](../virtual-machines/ncv3-series.md) |Best suited for computer-intensive applications such as AI and deep learning. | -| Medium GPU (visualization) | <ul><li>12 cores</li><li>112 GB RAM</li></ul> | [Standard_NV12](../virtual-machines/nv-series.md), [Standard_NV12s_v3](../virtual-machines/nvv3-series.md), [Standard_NV12s_v2](../virtual-machines/sizes-previous-gen.md#nvv2-series) | Best suited for remote visualization, streaming, gaming, and encoding using frameworks such as OpenGL and DirectX. | + However, the Contributor *canΓÇÖt* grant other users access to either lab plans or labs. -## Manage identity +- **Lab Creator** -By using [Azure role-based access control (RBAC)](../role-based-access-control/overview.md) for access to lab accounts and labs, you can assign the following roles: + When set on the lab plan, this role enables the user account to create labs from the lab plan. The user account can also see existing labs that are in the same resource group as the lab plan. When applied to a resource group, this role enables the user to view existing lab and create new labs. TheyΓÇÖll have full control over any labs they create as theyΓÇÖre assigned as Owner to those created labs. For more information, see [Add a user to the Lab Creator role](./tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role). -- Lab account **Owner**+- **Lab Contributor** - An administrator who creates a lab account is automatically assigned the lab account Owner role. The Owner role can: - - Change the lab account settings. - - Grant other administrators access to the lab account as an Owner or Contributor. - - Grant educators access to labs as a Creator, Owner, or Contributor. - - Create and manage all labs in the lab account. + When applied to an existing lab, this role enables the user to fully manage the lab. When applied to a resource group, this role enables the user account to fully manage existing labs and create new labs in that resource group. -- Lab account **Contributor**+ A key difference between the lab Owner and Contributor roles is that only an Owner can grant other users access to manage a lab. A Contributor *canΓÇÖt* grant other users access to manage a lab. - An administrator who's assigned the Contributor role can: - - Change the lab account settings. - - Create and manage all labs in the lab account. +- **Lab Operator** - However, the Contributor *can't* grant other users access to either lab accounts or labs. + When applied to a resource group or a lab, this role enables the user to have limited ability to manage existing labs. This role wonΓÇÖt give the user the ability to create new labs. In an existing lab, the user can manage users, adjust individual usersΓÇÖ quota, manage schedules, and start/stop VMs. The user account will be able to publish a lab. The user wonΓÇÖt have the ability to change lab capacity or change quota at the lab level. The user wonΓÇÖt be able to change the template title or description. -- **Lab Creator**+- **Lab Assistant** - To create labs within a lab account, an educator must be a member of the Lab Creator role. An educator who creates a lab is automatically added as a lab Owner. For more information, see [Add a user to the Lab Creator role](./tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role). + When applied to a resource group or a lab, this role enables the user to view an existing lab. Lab assistants can only perform actions on the lab VMs (reset, start, stop, connect) and send invitations to the lab. They don't have the ability to change a lab, create a lab, publish a lab, change lab capacity, or manage lab quota, individual quota nor schedules. -- Lab **Owner** or **Contributor**- - An educator in either a lab Owner or Contributor role can view and change a lab's settings. The person must also be a member of the lab account Reader role. +- **Lab Services Contributor** - A key difference between the lab Owner and Contributor roles is that only an Owner can grant other users access to manage a lab. A Contributor *can't* grant other users access to manage a lab. + When applied to a resource group, enables the user to fully control all Lab Services scenarios in that resource group. -- **Shared image gallery**+- **Lab Services Reader** - When you attach a shared image gallery to a lab account, lab account Owners and Contributors and Lab Creators, lab Owners, and lab Contributors are automatically granted access to view and save images in the gallery. + When applied to a resource group, enables the user to view, but not change, all lab plans and lab resources. External resources like image galleries and virtual networks that may be connected to a lab plan arenΓÇÖt included. -When you're assigning roles, it helps to follow these tips: +When youΓÇÖre assigning roles, it helps to follow these tips: - - Ordinarily, only administrators should be members of a lab account Owner or Contributor role. The lab account might have more than one Owner or Contributor. - - To give educators the ability to create new labs and manage the labs that they create, you need only assign them the Lab Creator role. - - To give educators the ability to manage specific labs, but *not* the ability to create new labs, assign them either the Owner or Contributor role for each lab that they'll manage. For example, you might want to allow a professor and a teaching assistant to co-own a lab. For more information, see [Add Owners to a lab](./how-to-add-user-lab-owner.md). +- Ordinarily, only administrators should be members of a lab plan Owner or Contributor role. The lab plan might have more than one Owner or Contributor. +- To give educators the ability to create new labs and manage the labs that they create, you need only assign them the Lab Creator role. +- To give educators the ability to manage specific labs, but *not* the ability to create new labs, assign them either the Owner or Contributor role for each lab that theyΓÇÖll manage. For example, you might want to allow a professor and a teaching assistant to co-own a lab. ## Content filtering -Your school may need to do content filtering to prevent students from accessing inappropriate websites. For example, to comply with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act). Lab Services doesn't offer built-in support for content filtering. +Your school may need to do content filtering to prevent students from accessing inappropriate websites. For example, to comply with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act). Lab Services doesnΓÇÖt offer built-in support for content filtering. There are two approaches that schools typically consider for content filtering:+ - Configure a firewall to filter content at the network level.-- Install 3rd party software directly on each computer that performs content filtering.+- Install third-party software directly on each computer that performs content filtering. -The first approach isn't currently supported by Lab Services. Lab Services hosts each lab's virtual network within a Microsoft-managed Azure subscription. As a result, you don't have access to the underlying virtual network to do content filtering at the network level. For more information on Lab Services' architecture, read the article [Architecture Fundamentals](./classroom-labs-fundamentals.md). +By default, Azure Lab Services hosts each lab's virtual network within a Microsoft-managed Azure subscription. YouΓÇÖll need to use [advanced networking](how-to-connect-vnet-injection.md) in the lab plan. Make sure to check known limitations of VNet injection before proceeding. -Instead, we recommend the second approach which is to install 3rd party software on each lab's template VM. There are a few key points to highlight as part of this solution: -- If you plan to use the [auto-shutdown settings](./cost-management-guide.md#automatic-shutdown-settings-for-cost-control), you will need to unblock several Azure host names with the 3rd party software. The auto-shutdown settings use a diagnostic extension that must be able to communicate back to Lab Services. Otherwise, the auto-shutdown settings will fail to enable for the lab.-- You may also want to have each student use a non-admin account on their VM so that they can't uninstall the content filtering software. By default, Lab Services creates an admin account that each student uses to sign into their VM. It is possible to add a non-admin account using a specialized image, but there are some known limitations.+We recommend the second approach, which is to install third-party software on each lab's template VM. There are a few key points to highlight as part of this solution: -If your school needs to do content filtering, contact us via the [Azure Lab Services' forums](https://techcommunity.microsoft.com/t5/azure-lab-services/bd-p/AzureLabServices) for more information. +- If you plan to use the [auto-shutdown settings](./cost-management-guide.md#automatic-shutdown-settings-for-cost-control), youΓÇÖll need to unblock several Azure host names with the 3rd party software. The auto-shutdown settings use a diagnostic extension that must be able to communicate back to Lab Services. Otherwise, the auto-shutdown settings will fail to enable for the lab. +- You may also want to have each student use a non-admin account on their VM so that they canΓÇÖt uninstall the content filtering software. Adding a non-admin account must be done when creating the lab. ++If your school needs to do content filtering, contact us via the [Azure Lab Services' Q&A](https://aka.ms/azlabs/questions) for more information. ## Endpoint management Many endpoint management tools, such as [Microsoft Endpoint Manager](https://techcommunity.microsoft.com/t5/azure-lab-services/configuration-manager-azure-lab-services/ba-p/1754407), require Windows VMs to have unique machine security identifiers (SIDs). Using SysPrep to create a *generalized* image typically ensures that each Windows machine will have a new, unique machine SID generated when the VM boots from the image. -With Lab Services, even if you use a *generalized* image to create a lab, the template VM and student VMs will all have the same machine SID. The VMs have the same SID because the template VM's image is in a *specialized* state when it's published to create the student VMs. +With Lab Services, if you create a lab with a template, the lab VMs will have the same SID. Even if you use a *generalized* image to create a lab, the template VM and student VMs will all have the same machine SID. The VMs have the same SID because the template VM's image is in a *specialized* state when itΓÇÖs published to create the student VMs. -For example, the Azure Marketplace images are generalized. If you create a lab from the Win 10 marketplace image and publish the template VM, all of the student VMs within a lab will have the same machine SID as the template VM. The machine SIDs can be verified by using a tool such as [PsGetSid](/sysinternals/downloads/psgetsid). +To obtain lab VMs with unique SID, create a lab without a template VM. You must use a *generalized* image from the Azure Marketplace or an attached Azure Compute Gallery. To use your own Azure Compute Gallery, see [Attach or detach a compute gallery in Azure Lab Services](how-to-attach-detach-shared-image-gallery.md). The machine SIDs can be verified by using a tool such as [PsGetSid](/sysinternals/downloads/psgetsid). -If you plan to use an endpoint management tool or similar software, we recommend that you test it with lab VMs to ensure that it works properly when machine SIDs are the same. +If you plan to use an endpoint management tool or similar software, we recommend that you donΓÇÖt use template VMs for your labs. ## Pricing If you plan to use an endpoint management tool or similar software, we recommend To learn about pricing, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). -### Shared Image Gallery +Billing entries in Azure Cost Management are per lab VM. Tags for lab plan ID and lab name are automatically added to each entry for more flexible analysis and budgeting. ++### Azure Compute gallery -You also need to consider the pricing for the Shared Image Gallery service if you plan to use shared image galleries for storing and managing image versions. +You also need to consider the pricing for the compute gallery service if you plan to use compute galleries for storing and managing image versions. -Creating a shared image gallery and attaching it to your lab account is free. No cost is incurred until you save an image version to the gallery. The pricing for using a shared image gallery is ordinarily fairly negligible, but it's important to understand how it's calculated, because it isn't included in the pricing for Azure Lab Services. +Creating a compute gallery and attaching it to your lab plan is free. No cost is incurred until you save an image version to the gallery. The pricing for using a compute gallery is ordinarily fairly negligible, but itΓÇÖs important to understand how itΓÇÖs calculated, because it isnΓÇÖt included in the pricing for Azure Lab Services. #### Storage charges -To store image versions, a shared image gallery uses standard hard disk drive (HDD) managed disks by default. We recommend using HDD-managed disks when using shared image gallery with Lab Services. The size of the HDD-managed disk that's used depends on the size of the image version that's being stored. Lab Services supports image and disk sizes up to 128 GB. To learn about pricing, see [Managed disks pricing](https://azure.microsoft.com/pricing/details/managed-disks/). +To store image versions, a compute gallery uses standard hard disk drive (HDD) managed disks by default. We recommend using HDD-managed disks when using compute gallery with Lab Services. The size of the HDD-managed disk that is used depends on the size of the image version that is being stored. Lab Services supports image and disk sizes up to 128 GB. To learn about pricing, see [Managed disks pricing](https://azure.microsoft.com/pricing/details/managed-disks/). #### Replication and network egress charges -When you save an image version by using a lab template VM, Azure Lab Services first stores it in a source region and then automatically replicates the source image version to one or more target regions. +When you save an image version by using a lab template VM, Azure Lab Services first stores it in a source region. However, youΓÇÖll most likely need to replicate the source image version to one or more target regions. -It's important to note that Azure Lab Services automatically replicates the source image version to all [target regions within the geography](https://azure.microsoft.com/global-infrastructure/regions/) where the lab is located. For example, if your lab is in the US geography, an image version is replicated to each of the eight regions that exist within the US. +A network egress charge occurs when an image version is replicated from the source region to other target regions. The amount charged is based on the size of the image version when the image's data is initially transferred outbound from the source region. For pricing details, see [Bandwidth pricing details](https://azure.microsoft.com/pricing/details/bandwidth/). -A network egress charge occurs when an image version is replicated from the source region to additional target regions. The amount charged is based on the size of the image version when the image's data is initially transferred outbound from the source region. For pricing details, see [Bandwidth pricing details](https://azure.microsoft.com/pricing/details/bandwidth/). --Egress charges might be waived for [Education Solutions](https://www.microsoft.com/licensing/licensing-programs/licensing-for-industries?rtc=1&activetab=licensing-for-industries-pivot:primaryr3) customers. To learn more, contact your account manager. +Egress charges might be waived for [Education Solutions](https://www.microsoft.com/licensing/licensing-programs/licensing-for-industries?rtc=1&activetab=licensing-for-industries-pivot:primaryr3) customers. To learn more, contact your account manager. For more information, see "What data transfer programs exist for academic customers and how do I qualify?" in the FAQ section of the [Programs for educational institutions](https://azure.microsoft.com/pricing/details/bandwidth/) page. -#### Pricing example --Let's look at an example of the cost of saving a template VM image to a shared image gallery. Assume the following scenarios: --- You have one custom VM image.-- You're saving two versions of the image.-- Your lab is in the US, which has a total of eight regions.-- Each image version is 32 GB in size; as a result, the HDD-managed disk price is $1.54 per month.--The total cost per month is estimated as: --* *Number of images × number of versions × number of replicas × managed disk price = total cost per month* --In this example, the cost is: --* 1 custom image (32 GB) × 2 versions × 8 US regions × $1.54 = $24.64 per month --> [!NOTE] -> The preceding calculation is for example purposes only. It covers storage costs associated with using Shared Image Gallery and does *not* include egress costs. For actual pricing for storage, see [Managed Disks pricing](https://azure.microsoft.com/pricing/details/managed-disks/). +For information about costs to store images and their replications, see [billing in an Azure Compute Gallery](/azure/virtual-machines/shared-image-galleries). #### Cost management -It's important for lab account administrators to manage costs by routinely deleting unneeded image versions from the gallery. +ItΓÇÖs important for lab plan administrators to manage costs by routinely deleting unneeded image versions from the gallery. -Don't delete replication to specific regions as a way to reduce the costs, though this option exists in the shared image gallery. Replication changes might have adverse effects on the ability of Azure Lab Services to publish VMs from images saved within a shared image gallery. +Be wary of removing replication to specific regions as a way to reduce the costs. Replication changes might have adverse effects on the ability of Azure Lab Services to publish VMs from images saved within a compute gallery. ## Next steps For more information about setting up and managing labs, see: -- [Lab account setup guide](account-setup-guide.md) -- [Lab setup guide](setup-guide.md) -- [Cost management for labs](cost-management-guide.md) -- [Use Azure Lab Services in Teams](lab-services-within-teams-overview.md)+- [Configure a lab plan](lab-plan-setup-guide.md) +- [Configure a lab](setup-guide.md) +- [Manage costs for labs](cost-management-guide.md) |
| lab-services | Allow Lab Creator Pick Lab Location | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/allow-lab-creator-pick-lab-location.md | Title: Allow lab creator to pick location in Azure Lab Services + Title: Allow lab creator to pick location in Azure Lab Services (deprecated) description: This article describes how a lab account administrator can allow lab creators to pick locations for their labs. Last updated 06/26/2020 -# Allow lab creator to pick location for the lab in Azure Lab Services -In Azure Lab Services, a lab account owner can allow lab creators (educators) to pick a location for the lab they create. This location can be different from the location of the lab account. A location is a group of Azure regions. For example, United States location is a group of regions such as East US, West US, and so on. +# Allow lab creator to pick location for the lab in Azure Lab Services (deprecated) -You, as a lab account owner, can select the **Allow lab creator to pick lab location** option when you create a lab account and after you create the lab account (or an existing lab account). +In Azure Lab Services, a lab account owner can allow lab creators (educators) to pick a location for the lab they create. This location can be different from the location of the lab account. A location is a group of Azure regions. For example, United States location is a group of regions such as East US, West US, and so on. ++You, as a lab account owner, can select the **Allow lab creator to pick lab location** option when you create a lab account and after you create the lab account (or an existing lab account). ## At the time of lab account creation-When you create a lab account, you see this option on the first screen (**Basics** tab). ++When you create a lab account, you see this option on the first screen (**Basics** tab).  This option is disabled if you select a peer virtual network for your lab accoun  - ## After the lab account is created-After you create the lab account, you can enable or disable this option by following these steps: ++After you create the lab account, you can enable or disable this option by following these steps: 1. On the **Lab Account** page, select **Lab settings** on the left menu.-2. Select the **Allow lab creator to pick lab location** option if you want to allow the lab creator to select a location for the lab. If it's disabled, the labs are automatically created in the same location in which the lab account exists. - - This field is disabled when you select a virtual network for the **Peer virtual network** field. It's because labs in the lab account must be in the same region as the lab account for them to access resources in the peer virtual network. -1. Select **Save** on the toolbar. +2. Select the **Allow lab creator to pick lab location** option if you want to allow the lab creator to select a location for the lab. If it's disabled, the labs are automatically created in the same location in which the lab account exists. ++ This field is disabled when you select a virtual network for the **Peer virtual network** field. It's because labs in the lab account must be in the same region as the lab account for them to access resources in the peer virtual network. +1. Select **Save** on the toolbar.  ## No virtual network and location selection isn't allowed-In this scenario, you haven't enabled the **Allow lab creator to pick lab location** option. ++In this scenario, you haven't enabled the **Allow lab creator to pick lab location** option.  -Then, lab creators (educators) don't see an option to pick a location for the lab. They will see the price per hour for every size option available to them. When they create a lab, it will be created in an Azure region that's in the same location as the Azure region that their lab account is in. For example, if the lab account is in **West US**, then the lab might be created in **South Central US** but would not be created in **Canada East**. We don't guarantee anything about the region we choose aside from that it's in the location. If a size is currently constrained, then the lab creator will see a checkbox where they can see the sizes that we normally support but are currently unavailable. +Then, lab creators (educators) don't see an option to pick a location for the lab. They will see the price per hour for every size option available to them. When they create a lab, it will be created in an Azure region that's in the same location as the Azure region that their lab account is in. For example, if the lab account is in **West US**, then the lab might be created in **South Central US** but would not be created in **Canada East**. We don't guarantee anything about the region we choose aside from that it's in the location. If a size is currently constrained, then the lab creator will see a checkbox where they can see the sizes that we normally support but are currently unavailable. ## In virtual network and location selection isn't allowed-In this scenario, the **Allow lab creator to pick lab location** option is disabled because you have selected a peer virtual network for the lab account. Then, lab creators will see the same screen as with the previous option. Because all VMs have to be in the same Azure region as the virtual network, the lab will be created in the same Azure region that the virtual network is in. If that particular region is constrained for a size, the size will appear as unavailable. ++In this scenario, the **Allow lab creator to pick lab location** option is disabled because you have selected a peer virtual network for the lab account. Then, lab creators will see the same screen as with the previous option. Because all VMs have to be in the same Azure region as the virtual network, the lab will be created in the same Azure region that the virtual network is in. If that particular region is constrained for a size, the size will appear as unavailable. ## Location selection is enabled-When you select **Allow lab creator to pick lab location**, lab creators (educators) see an option to select a location when creating a lab. ++When you select **Allow lab creator to pick lab location**, lab creators (educators) see an option to select a location when creating a lab.  Lab creators see the range of prices for all locations that size is in, and can choose a Location. The lab will be created in any Azure region that maps to that location. -If a location is constrained, it's not shown in the list by default. Expand the drop-down list, and select **Show unavailable locations for this size**. +If a location is constrained, it's not shown in the list by default. Expand the drop-down list, and select **Show unavailable locations for this size**.  ## Cost-Earlier, the pricing was based on the VM size that you choose for the lab. Now, the price is based on the combination of Operating System (OS), Size, and location. ++Earlier, the pricing was based on the VM size that you choose for the lab. Now, the price is based on the combination of Operating System (OS), Size, and location. ## Next steps+ See the following articles: - [Connect your lab's network with a peer virtual network](how-to-connect-peer-virtual-network.md)-- [Attach a shared image gallery to a lab](how-to-attach-detach-shared-image-gallery.md)+- [Attach a shared image gallery to a lab](how-to-attach-detach-shared-image-gallery-1.md) - [Add a user as a lab owner](how-to-add-user-lab-owner.md) - [View firewall settings for a lab](how-to-configure-firewall-settings.md)-- [Configure other settings for a lab](how-to-configure-lab-accounts.md)+- [Configure other settings for a lab](how-to-configure-lab-accounts.md) |
| lab-services | Approaches For Custom Image Creation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/approaches-for-custom-image-creation.md | This article describes the following recommended approaches for creating a custo Using a lab's template VM to create and save a custom image is the simplest way to create an image because it's supported by using the Azure Lab Services portal. As a result, both IT departments and educators can create custom images by using a lab's template VM. -For example, you can start with one of the Azure Marketplace images and then install the software applications and tooling that are needed for a class. After you've finished setting up the image, you can save it in the [connected shared image gallery](how-to-attach-detach-shared-image-gallery.md) so that you and other educators can use the image to create new labs. +For example, you can start with one of the Azure Marketplace images and then install the software applications and tooling that are needed for a class. After you've finished setting up the image, you can save it in the [connected compute gallery](how-to-attach-detach-shared-image-gallery.md) so that you and other educators can use the image to create new labs. There are a few key points to be aware of with this approach: There are a few key points to be aware of with this approach: - For more advanced scenarios with setting up your image, you might find it helpful to instead create an image outside of labs by using either an Azure VM or a VHD from your physical lab environment. Read the next sections for more information. -### Use a lab's template VM to save a custom image +### Use a lab's template VM to save a custom image -You can use a lab's template VM to create either Windows or Linux custom images. For more information, see [Save the image to a shared image gallery](how-to-use-shared-image-gallery.md#save-an-image-to-the-shared-image-gallery). +You can use a lab's template VM to create either Windows or Linux custom images. For more information, see [Save an image a compute gallery](how-to-use-shared-image-gallery.md#save-an-image-to-a-compute-gallery) ## Bring a custom image from an Azure VM -Another approach is to use an Azure VM to set up a custom image. After you've finished setting up the image, you can save it to a shared image gallery so that you and your colleagues can use the image to create new labs. +Another approach is to use an Azure VM to set up a custom image. After you've finished setting up the image, you can save it to a compute gallery so that you and your colleagues can use the image to create new labs. Using an Azure VM gives you more flexibility:+ - You can create either [generalized or specialized](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) images. Otherwise, if you use a lab's template VM to [export an image](how-to-use-shared-image-gallery.md) the image is always specialized. - You have access to more advanced features of an Azure VM that might be helpful for setting up an image. For example, you can use [extensions](../virtual-machines/extensions/overview.md) to do post-deployment configuration and automation. Also, you can access the VM's [boot diagnostics](../virtual-machines/boot-diagnostics.md) and [serial console](/troubleshoot/azure/virtual-machines/serial-console-overview). Here are the high-level steps to bring a custom image from an Azure VM: 1. Create an [Azure VM](https://azure.microsoft.com/services/virtual-machines/) by using a Windows or Linux Marketplace image. 1. Connect to the Azure VM and install more software. You can also make other customizations that are needed for your lab.-1. When you've finished setting up the image, [save the VM's image to a shared image gallery](../virtual-machines/image-version.md). As part of this step, you'll also need to create the image's definition and version. +1. When you've finished setting up the image, [save the VM's image to a compute gallery](../virtual-machines/image-version.md). As part of this step, you'll also need to create the image's definition and version. 1. After the custom image is saved in the gallery, you can use your image to create new labs. The steps vary depending on if you're creating a custom Windows or Linux image. ## Bring a custom image from a VHD in your physical lab environment -The third approach to consider is to bring a custom image from a VHD in your physical lab environment to a shared image gallery. After the image is in a shared image gallery, you and other educators can use the image to create new labs. +The third approach to consider is to bring a custom image from a VHD in your physical lab environment to a compute gallery. After the image is in a compute gallery, you and other educators can use the image to create new labs. Here are a few reasons why you might want to use this approach: Here are the high-level steps to bring a custom image from a VHD: 1. Use [Windows Hyper-V](/virtualization/hyper-v-on-windows/about/) on your on-premises machine to create a Windows or Linux VHD. 1. Connect to the Hyper-V VM and install more software. You can also make other customizations that are needed for your lab. 1. When you've finished setting up the image, upload the VHD to create a [managed disk](../virtual-machines/managed-disks-overview.md) in Azure.-1. From the managed disk, create the [image's definition](../virtual-machines/shared-image-galleries.md#image-definitions) and version in a shared image gallery. +1. From the managed disk, create the [image's definition](../virtual-machines/shared-image-galleries.md#image-definitions) and version in a compute gallery. 1. After the custom image is saved in the gallery, you can use the image to create new labs. The steps vary depending on if you're creating a custom Windows or Linux image. Read the following articles for the detailed steps: The steps vary depending on if you're creating a custom Windows or Linux image. ## Next steps -* [Shared image gallery overview](../virtual-machines/shared-image-galleries.md) -* [Attach or detach a shared image gallery](how-to-attach-detach-shared-image-gallery.md) -* [Use a shared image gallery](how-to-use-shared-image-gallery.md) +* [Azure Compute gallery overview](../virtual-machines/shared-image-galleries.md) +* [Attach or detach an Azure Compute Gallery](how-to-attach-detach-shared-image-gallery.md) +* [Use an Azure Compute Gallery](how-to-use-shared-image-gallery.md) |
| lab-services | Capacity Limits | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/capacity-limits.md | Title: Capacity limits in Azure Lab Services -description: Learn about capacity limits (virtual machine limits) in Azure Lab Services. +description: Learn about VM capacity limits in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 02/01/2022 # Capacity limits in Azure Lab Services-Azure Lab Services has default capacity limits on Azure subscriptions to adhere to Azure Compute quota limitations and to mitigate fraud. All Azure subscriptions will have an initial capacity limit, which can vary based on subscription type, number of standard compute cores, and GPU cores available inside Azure Lab Services. It restricts how many virtual machines you can create inside your labs before you need to request for a limit increase. -If you are close to or have reached your subscriptionΓÇÖs virtual machine cores limit, you will see messages from Azure Lab Services when you try to perform actions that create additional virtual machines. For example: +Azure Lab Services has default capacity limits on Azure subscriptions that adhere to Azure Compute quota limitations and to mitigate fraud. All Azure subscriptions will have an initial capacity limit, which can vary based on subscription type, number of standard compute cores, and GPU cores available inside Azure Lab Services. It restricts how many virtual machines you can create inside your lab before you need to request for a limit increase. ++If youΓÇÖre close to or have reached your subscriptionΓÇÖs core limit, youΓÇÖll see messages from Azure Lab Services. Actions that are affected by core limits include: - Create a lab - Publish a lab-- Adjust lab capacity to add more virtual machines to an existing lab+- Increase lab capacity -These actions may also be disabled if you have already reached the cores limit. +These actions may be disabled if there no more cores that can be enabled for your subscription. - -## Subscriptions with default limit of zero cores -Some rare subscription types that are more commonly used for fraud can have a default limit of 0 standard cores and 0 GPU cores. If you are using one of these subscription types, the admin who creates your lab account will need to request a limit increase before you can use Azure Lab Services. +## Request a limit increase ++If you reach the cores limit, you can request a limit increase to continue using Azure Lab Services. The request process is a checkpoint to ensure your subscription isnΓÇÖt involved in any cases of fraud or unintentional, sudden large-scale deployments. ++To create a support request, you must be an [Owner](/azure/role-based-access-control/built-in-roles), [Contributor](/azure/role-based-access-control/built-in-roles), or be assigned to the [Support Request Contributor](/azure/role-based-access-control/built-in-roles) role at the subscription level. For information about creating support requests in general, see how to create a [How to create an Azure support request](/azure/azure-portal/supportability/how-to-create-azure-support-request). The admin can follow these steps to request a limit increase: -1. In your subscription, [create a lab account](tutorial-setup-lab-account.md). -2. On the **Overview** page of the lab account, click **Request limit increase** button at the top. -3. Follow the steps in the form to submit a support request to increase the limit. +1. Open your [lab plan](how-to-manage-lab-plans.md) or [lab account](how-to-manage-lab-accounts.md). +1. On the **Overview** page of the lab plan, select the **Request core limit increase** button from the menu bar at the top. +1. On the **Basics** page of **New support request** wizard, enter a short summary that will help you remember the support request in the **Summary** textbox. The issue type, subscription, and quota type information are automatically filled out for you. Select **Next: Solutions**. -## Request a limit increase -If you reach the cores limit, you can request a limit increase to continue using Azure Lab Services. The request process is a checkpoint to ensure your subscription isn't involved in any cases of fraud or unintentional, sudden large-scale deployments. + :::image type="content" source="./media/capacity-limits/new-support-request.png" alt-text="Screenshot of new support request to request more core capacity."::: ++1. The **New support request** wizard will automatically advance from the **Solutions** page to the **Details** page. +1. One the **Details** page, enter the following information in the **Description** page. + - VM size. For size details, see [VM sizing](administrator-guide.md#vm-sizing). + - Number of VMs. + - Location. Location will be a [geography](https://azure.microsoft.com/global-infrastructure/geographies/#geographies) or region, if using the [April 2022 Update (preview)](lab-services-whats-new.md). +1. Under **Advanced diagnostic information**, select **No**. +1. Under **Support method** section, select your preferred contact method. Verify contact information is correct. +1. Select **Next: Review + create** +1. On the **Review + create** page, select **Create** to submit the support request. -The messages about the virtual machine cores limit in the Azure Lab Services portal includes a link to request a limit increase. The link opens a new browser tab where you can create a new support request. The issue type, subscription, and quota type information will be automatically filled out for you as shown in the following image: +Once you submit the support request, weΓÇÖll review the request. If necessary, weΓÇÖll contact you to get more details. - +## Subscriptions with default limit of zero cores +Some rare subscription types that are more commonly used for fraud can have a default limit of zero standard cores and zero GPU cores. If youΓÇÖre using one of these subscription types, your admin needs to request a limit increase before you can use Azure Lab Services. -Then, you will be prompted to provide more information about the limit increase. In the **Description** field, provide the following details: +## Per-customer assigned capacity -- What you are trying to do (for example, creating a lab to teach a Computer Science class, run a hackathon, and so on.)-- Virtual machine size you are using for this lab-- Number of virtual machines you need+Azure Lab Services hosts lab resources, including VMs, within special Microsoft-managed Azure subscriptions that arenΓÇÖt visible to customers. With the [April 2022 Update (preview)](lab-services-whats-new.md), VM capacity is dedicated to each customer. Previous to this update, VM capacity was available from a large pool shared by customers. -Once you submit the support request, we will review the request. If necessary, we will contact you to get additional details. +Before you set up a large number of VMs across your labs, we recommend that you open a support ticket to pre-request VM capacity. Requests should include VM size, number, and location. Requesting capacity before lab creation helps us to ensure that you create your labs in a region that has a sufficient number of VM cores for the VM size that you need for your labs. ## Next steps-See the following article: -- [Administrator Guide - VM sizing](administrator-guide.md#vm-sizing).-- [Frequently asked questions](classroom-labs-faq.yml).++See the following articles: ++- [As an admin, see VM sizing](administrator-guide.md#vm-sizing). +- [Frequently asked questions](classroom-labs-faq.yml). |
| lab-services | Class Type Adobe Creative Cloud | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-adobe-creative-cloud.md | -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to set up a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. -### Lab account settings +To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings -Enable the settings described in the table below for the lab account. For more information about how to enable marketplace images, see the article on [how to specify Marketplace images available to lab creators](./specify-marketplace-images.md). +Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. -| Lab account setting | Instructions | +Enable the settings described in the table below for the lab plan. For more information about how to enable marketplace images, see the article on [how to specify Marketplace images available to lab creators](./specify-marketplace-images.md). ++| Lab plan setting | Instructions | | - | |-|Marketplace image| Enable the Windows 10 image for use within your lab account.| +| Marketplace image | Enable the Windows 10 image, if not done already.| ### Lab settings -The size of VM that you need to use for your lab depends on the types of projects that your students will create. Most [Creative Cloud apps](https://helpx.adobe.com/creative-cloud/system-requirements.html) support GPU-based acceleration and require a GPU for features to work properly. To ensure that you select the appropriate VM size, we recommend that you test the projects that your students will create to ensure adequate performance. The below table shows the recommended [VM size](./administrator-guide.md#vm-sizing) to use with Creative Cloud. +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab settings | Value/instructions | | | | |Virtual Machine Size| **Small GPU (Visualization)**. This VM is best suited for remote visualization, streaming, gaming, encoding using frameworks such as OpenGL and DirectX.| |Virtual Machine Image| Windows 10 | -> [!NOTE] +The size of VM that you need to use for your lab depends on the types of projects that your students will create. Most [Creative Cloud apps](https://helpx.adobe.com/creative-cloud/system-requirements.html) support GPU-based acceleration and require a GPU for features to work properly. To ensure that you select the appropriate VM size, we recommend that you test the projects that your students will create to ensure adequate performance. The below table shows the recommended [VM size](./administrator-guide.md#vm-sizing) to use with Creative Cloud. ++> [!WARNING] > The **Small GPU (Visualization)** virtual machine size is configured to enable a high-performing graphics experience and meets [AdobeΓÇÖs system requirements for each application](https://helpx.adobe.com/creative-cloud/system-requirements.html). Make sure to choose Small GPU (Visualization) not Small GPU (Compute). For more information about this virtual machine size, see the article on [how to set up a lab with GPUs](./how-to-setup-lab-gpu.md). -## Template virtual machine configuration +## Template machine configuration ### Creative Cloud deployment package+ Installing Creative Cloud requires the use of a deployment package. Typically, the deployment package is created by your IT department using AdobeΓÇÖs Admin Console. When IT creates the deployment package, they also have the option to enable self-service. There are a few ways to enable self-service for the deployment package:-- Create a self-service package.-- Create a managed package with self-service elevated privileges turned on.++- Create a self-service package. +- Create a managed package with self-service elevated privileges turned on. With self-service enabled, you donΓÇÖt install the entire Creative Cloud collection of apps. Instead, students can install apps themselves using the Creative Cloud desktop app. Here are some key benefits with this approach:+ - The entire Creative Cloud install is about 25 GB. If students install only the apps they need on-demand, this helps optimize disk space. Lab VMs have a disk size of 128 GB. - You can choose to install a subset of the apps on the template VM before publishing. This way the student VMs will have some apps installed by default and students can add more apps on their own as needed.-- You can avoid republishing the template VM because students can install additional apps on their VM at any point during the lifetime of the lab. Otherwise, either IT or the teacher would need to install additional apps on the template VM and republish. Republishing causes the studentsΓÇÖ VMs to be reset and any work that isnΓÇÖt saved externally is lost.+- You can avoid republishing the template VM because students can install more apps on their VM at any point during the lifetime of the lab. Otherwise, either IT or the teacher would need to install more apps on the template VM and republish. Republishing causes the studentsΓÇÖ VMs to be reset and any work that isnΓÇÖt saved externally is lost. If you use a managed deployment package with self-service disabled, students wonΓÇÖt have the ability to install their own apps. In this case, IT must specify the Creative Cloud apps that will be installed. Read [AdobeΓÇÖs steps to create a package](https://helpx.adobe.com/enterprise/admin-guide.html/enterprise/using/create-nul-packages.ug.html) for more information. ### Install Creative Cloud+ After the template machine is created, follow the steps below to set up your labΓÇÖs template virtual machine (VM) with Creative Cloud.+ 1. Start the template VM and connect using RDP. 1. To install Creative Cloud, download the deployment package given to you by IT or directly from [AdobeΓÇÖs Admin Console](https://adminconsole.adobe.com/). 1. Run the deployment package file. Depending on whether self-service is enabled or disabled, this will install Creative Cloud desktop app and\or the specified Creative Cloud apps. Read [AdobeΓÇÖs deployment steps](https://helpx.adobe.com/enterprise/admin-guide.html/enterprise/using/deploy-packages.ug.html) for more information.-1. Once the template VM is set up, [publish the template VMΓÇÖs image](how-to-create-manage-template.md) which is used to create all of the studentsΓÇÖ VMs in the lab. +1. Once the template VM is set up, [publish the template VMΓÇÖs image](how-to-create-manage-template.md) that is used to create all of the studentsΓÇÖ VMs in the lab. ### Storage-As mentioned earlier, Azure Lab VMs have a disk size of 128 GB. If your students need additional storage for saving large media assets or they need to access shared media assets, you should consider using external file storage. For more information, read the following articles: -- [Using external file storage in Lab Services](how-to-attach-external-storage.md)-- [Install and configure OneDrive](./how-to-prepare-windows-template.md#install-and-configure-onedrive)++As mentioned earlier, Azure Lab VMs have a disk size of 128 GB. If your students need extra storage for saving large media assets or they need to access shared media assets, you should consider using external file storage. For more information, read the following articles: ++- [Using external file storage in Lab Services](how-to-attach-external-storage.md) +- [Install and configure OneDrive](./how-to-prepare-windows-template.md#install-and-configure-onedrive) ### Save template VM image-Consider saving your template VM for future use. To save the template VM, see [save an image to Shared Image Gallery](./how-to-use-shared-image-gallery.md#save-an-image-to-the-shared-image-gallery). ++Consider saving your template VM for future use. To save the template VM, see [Save an image to a compute gallery](how-to-use-shared-image-gallery.md#save-an-image-to-a-compute-gallery). + - When self-service is *enabled*, the template VMΓÇÖs image will have Creative Cloud desktop installed. Teachers can then reuse this image to create labs and to choose which Creative Cloud apps to install. This helps reduce IT overhead since teachers can independently set up labs and have full control over installing the Creative Cloud apps required for their classes. - When self-service is *disabled*, the template VMΓÇÖs image will already have the specified Creative Cloud apps installed. Teachers can reuse this image to create labs; however, they wonΓÇÖt be able to install additional Creative Cloud apps. In this section, weΓÇÖll look at a possible cost estimate for this class. WeΓÇÖ ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Arcgis | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-arcgis.md | Title: Set up a lab for ArcMap\ArcGIS Desktop with Azure Lab Services | Microsof description: Learn how to set up a lab for classes using ArcGIS. Previously updated : 02/04/2021 Last updated : 02/28/2022 + # Set up a lab for ArcMap\ArcGIS Desktop -[ArcGIS](https://www.esri.com/en-us/arcgis/products/arcgis-solutions/overview) is a type of geographic information system (GIS). ArcGIS is used to make\analyze maps and work with geographic data that is provided by the [Environmental Systems Research Institute](https://www.esri.com/en-us/home) (ESRI). Although ArcGIS Desktop includes several applications, this article shows how to set up labs for using ArcMap. [ArcMap](https://desktop.arcgis.com/en/arcmap/latest/map/main/what-is-arcmap-.htm) is used to make, edit, and analyze 2D maps. -## Lab configuration +[ArcGIS](https://www.esri.com/en-us/arcgis/products/arcgis-solutions/overview) is a type of geographic information system (GIS). ArcGIS is used to make\analyze maps and work with geographic data that is provided by the [Environmental Systems Research Institute](https://www.esri.com/home) (ESRI). Although ArcGIS Desktop includes several applications, this article shows how to set up labs for using ArcMap. [ArcMap](https://desktop.arcgis.com/en/arcmap/latest/map/main/what-is-arcmap-.htm) is used to make, edit, and analyze 2D maps. -To begin setting up a lab for using ArcMap, you need an Azure subscription and lab account. If you donΓÇÖt have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. +To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. -After you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see [Set up a lab account](tutorial-setup-lab-account.md). You can also use an existing lab account. +## Licensing server -### Lab account settings +One type of licensing that ArcGIS Desktop offers is [concurrent use licenses](https://desktop.arcgis.com/en/license-manager/latest/license-manager-basics.htm). This licensing requires you to install ArcGIS License Manager on your license server. The License Manager keeps track of the number of copies of software that can be run at the same time. For more information on setting up the License Manager on your server, see the [License Manager Guide](https://desktop.arcgis.com/en/license-manager/latest/welcome.htm). -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +The license server is located in either your on-premises network or hosted on an Azure virtual machine within an Azure virtual network. After your license server is set up, you'll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) with your [lab plan](./tutorial-setup-lab-plan.md). -| Lab account setting | Instructions | -| - | | -|Marketplace image| Enable the Windows 10 Pro or Windows 10 Pro N image for use within your lab account.| +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. -### Licensing server +For more information, see [Set up a license server as a shared resource](how-to-create-a-lab-with-shared-resource.md). -One type of licensing that ArcGIS Desktop offers is [concurrent use licenses](https://desktop.arcgis.com/en/license-manager/latest/license-manager-basics.htm). This requires that you install ArcGIS License Manager on your license server. The License Manager keeps track of the number of copies of software that can be run at the same time. For more information on how to set up the License Manager on your server, see the [License Manager Guide](https://desktop.arcgis.com/en/license-manager/latest/welcome.htm). +## Lab configuration -The license server is typically located in either your on-premises network or hosted on an Azure virtual machine within an Azure virtual network. After your license server is set up, youΓÇÖll need to [peer the virtual network](./how-to-connect-peer-virtual-network.md) with your [lab account](./tutorial-setup-lab-account.md). You need to do the network peering before you create the lab so that your lab VMs can access the license server and vice versa. +When you get an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). If you're using a ArcGIS License Manager on a license server, enable [advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) when creating your lab plan. You can also use an existing lab plan. -For more information, see [Set up a license server as a shared resource](how-to-create-a-lab-with-shared-resource.md). +### Lab plan settings -### Lab settings +Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -The size of the virtual machine (VM) that we recommend using for ArcGIS Desktop depends on the applications, extensions, and the specific versions that students will use. The VM size also depends on the workloads that students are expected to perform. Refer to [ArcGIS Desktop system requirements](https://desktop.arcgis.com/en/system-requirements/latest/arcgis-desktop-system-requirements.htm) to help with identifying the VM size. Once youΓÇÖve identified the potential VM size, we recommend that you test your studentsΓÇÖ workloads to ensure adequate performance. +| Lab plan setting | Instructions | +| - | | +|Marketplace image| Enable the Windows 10 Pro or Windows 10 Pro N image, if not done already.| ++### Lab settings -In this article, we recommend using the [**Medium** VM size](administrator-guide.md#vm-sizing) for version [10.7.1 of ArcMap](https://desktop.arcgis.com/en/system-requirements/10.7/arcgis-desktop-system-requirements.htm), assuming that no other ArcGIS Desktop extensions are used. However, depending on the needs of your class, you may require a **Large** or even a **Small\Medium GPU (Visualization)** VM size. For example, the [Spatial Analyst extension](https://desktop.arcgis.com/en/arcmap/latest/tools/spatial-analyst-toolbox/gpu-processing-with-spatial-analyst.htm) that is included with ArcGIS Desktop supports a GPU for enhanced performance, but doesnΓÇÖt require using a GPU. +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab setting | Value and description | | | | |Virtual Machine Size| **Medium**. Best suited for relational databases, in-memory caching, and analytics.| -### Template machine +The recommended size of the virtual machine (VM) for using ArcGIS Desktop depends on the applications, extensions, and the specific versions that students will use. The VM size also depends on the workloads that students are expected to perform. For more information on how to identify the VM size, see [ArcGIS Desktop system requirements](https://desktop.arcgis.com/en/system-requirements/latest/arcgis-desktop-system-requirements.htm) article. When you've identified a potential VM size, we recommend that you test your students' workloads to ensure adequate performance. ++In this article, we recommend that you use [**Medium** VM size](administrator-guide.md#vm-sizing) for version [10.7.1 of ArcMap](https://desktop.arcgis.com/en/system-requirements/10.7/arcgis-desktop-system-requirements.htm), assuming that no other ArcGIS Desktop extensions are used. However, depending on the needs of your class, you might require a **Large**, **Small GPU (Visualization)**, or **Medium GPU (Visualization)** VM size. For example, the [Spatial Analyst extension](https://desktop.arcgis.com/en/arcmap/latest/tools/spatial-analyst-toolbox/gpu-processing-with-spatial-analyst.htm) that is included with ArcGIS Desktop supports a GPU for enhanced performance, but doesn't require using a GPU. ++### Auto-shutdown and disconnect settings ++A lab's [auto-shutdown and disconnect settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control) ensure a student's VM is shut down when it's not being used. These settings should be set according to the types of workloads that your student performs so that their VM doesn't shut down in the middle of their work. For example, the **Disconnect users when virtual machines are idle** setting disconnects the student from their RDP session after no mouse or keyboard inputs have been detected for a specified amount of time. This setting must allow sufficient time for workloads where the student isn't actively using the mouse or keyboard, such as to run long queries or wait for rendering. ++For ArcGIS, we recommend the following values for these settings: ++| Setting | Value | +|-|-| +| Disconnect users when virtual machines are idle | 30 minutes after idle state is detected | +| Shut down virtual machines when users disconnect | 15 minutes after user disconnects | ++## Template machine configuration The steps in this section show how to set up the template VM: -1. Start the template VM and connect to the machine using RDP. +1. Start the template VM and connect to the machine using RDP. -2. Download and install the ArcGIS Desktop components using instructions from by ESRI. These steps include assigning the license manager for concurrent use licensing: +2. Download and install the ArcGIS Desktop components using instructions from by ESRI. These steps include assigning the license manager for concurrent use licensing: - [Introduction to installing and configuring ArcGIS Desktop](https://desktop.arcgis.com/en/arcmap/latest/get-started/installation-guide/introduction.htm) -3. Set up external backup storage for students. Students can save files directly to their assigned VM since all changes that they make are saved across sessions. However, we recommend that students back up their work to storage that is external from their VM for a few reasons: +3. Set up external backup storage for students. Students can save files directly to their assigned VM since all changes that they make are saved across sessions. However, we recommend that students back up their work to storage that is external from their VM for a few reasons: - To enable students to access their work after the class and lab ends. - - In case the student gets their VM into a bad state and their image needs to be [reset](how-to-set-virtual-machine-passwords.md#reset-vms). + - In case the student gets their VM into a bad state and their image needs to be [reset](how-to-manage-vm-pool.md#reset-vms). With ArcGIS, each student should back up the following files at the end of each work session: - mxd file, which stores the layout information for a project. - File geodatabases, which store all data produced by ArcGIS.- - Any other data that the student may be using such as raster files, shapefiles, GeoTIFF, etc. -- We recommend using OneDrive for backup storage. To set up OneDrive on the template VM, follow the steps in the article [Install and configure OneDrive](how-to-prepare-windows-template.md#install-and-configure-onedrive). + - Any other data that the student might be using such as raster files, shapefiles, GeoTIFF, etc. -4. Finally, [publish](how-to-create-manage-template.md#publish-the-template-vm) the template VM to create the studentsΓÇÖ VM. --### Auto-shutdown and disconnect settings --A labΓÇÖs [auto-shutdown and disconnect settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control) help make sure that a studentΓÇÖs VM is shut down when itΓÇÖs not being used. These settings should be set according to the types of workloads that your students will perform so that their VM doesnΓÇÖt shut down in the middle of their work. For example, the **Disconnect users when virtual machines are idle** setting disconnects the student from their RDP session after no mouse or keyboard inputs have been detected for a specified amount of time. This setting must allow sufficient time for workloads where the student isn't actively using the mouse or keyboard, such as to run long queries or wait for rendering. --For ArcGIS, we recommend the following values for these settings: -- Disconnect users when virtual machines are idle- - 30 minutes after idle state is detected -- Shut down virtual machines when users disconnect- - 15 minutes after user disconnects + We recommend using OneDrive for backup storage. To set up OneDrive on the template VM, follow the steps in the article [Install and configure OneDrive](how-to-prepare-windows-template.md#install-and-configure-onedrive). ## Cost -Let's cover a possible cost estimate for this class. This estimate doesn't include the cost of running the license server. We'll use a class of 25 students. There are 20 hours of scheduled class time. Also, each student gets 10 hours quota for homework or assignments outside scheduled class time. The virtual machine size we chose was **Medium**, which is 42 lab units. +Let's cover a possible cost estimate for this class. This estimate doesn't include the cost of running the license server. We'll use a class of 25 students. There are 20 hours of scheduled class time. Also, each student gets 10 hours quota for homework or assignments outside scheduled class time. The virtual machine size we selected was **Medium**, which is 42 lab units. 25 students \* (20 scheduled hours + 10 quota hours) \* 42 Lab Units * 0.01 USD per hour = 315.00 USD ->[!IMPORTANT] +> [!IMPORTANT] > Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Autodesk | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-autodesk.md | Title: Set up a lab with Autodesk using Azure Lab Services description: Learn how to set up labs to teach engineering classes with Autodesk. Previously updated : 04/21/2021 Last updated : 02/02/2022 # Set up labs for Autodesk -This article describes how to set up Autodesk Inventor and Autodesk Revit software for engineering classes: ++This article describes how to set up Autodesk Inventor and Autodesk Revit software for engineering classes. + - [Inventor computer-aided design (CAD)](https://www.autodesk.com/products/inventor/new-features) and [computer-aided manufacturing (CAM)](https://www.autodesk.com/products/inventor-cam/overview) provide 3D modeling and are used in engineering design. - [Revit](https://www.autodesk.com/products/revit/overview) is used in architecture design for 3D building information modeling (BIM). Autodesk is commonly used in both universities and K-12 schools. For example, in K-12, AutoDesk is included in the [Project Lead the Way (PLTW)](./class-type-pltw.md) curriculum. -## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +## License server -### Lab account settings +You'll need to access a license server if you plan to use the Autodesk network licensing model. Read Autodesk's article on [Network License Administration](https://knowledge.autodesk.com/customer-service/network-license-administration/network-deployment/preparing-for-deployment/determining-installation-type) for more information. -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +To use network licensing with Autodesk software, [AutoDesk provides detailed steps](https://knowledge.autodesk.com/customer-service/network-license-administration/install-and-configure-network-license) to install Autodesk Network License Manager on your license server. This license server is ordinarily located in either your on-premises network or hosted on an Azure virtual machine (VM) within in Azure virtual network. -| Lab account setting | Instructions | -| -- | -- | -| Marketplace image | Enable the Windows 10 image for use within your lab account. | +After your license server is set up, you'll need to enable [advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) when creating your lab plan. -### Lab settings -The size of the virtual machine (VM) that we recommend depends on the types of workloads that your students need to do. We recommend using the Small GPU (Visualization) size. +Autodesk-generated license files embed the MAC address of the license server. If you decide to host your license server by using an Azure VM, itΓÇÖs important to make sure that your license serverΓÇÖs MAC address doesnΓÇÖt change. If the MAC address changes, you'll need to regenerate your licensing files. To prevent your MAC address from changing: -| Lab setting | Value and description | -| | | -| Virtual Machine Size | **Small GPU (Visualization)**<br>Best suited for remote visualization, streaming, gaming, and encoding with frameworks such as OpenGL and DirectX. | +- [Set a static private IP and MAC address](how-to-create-a-lab-with-shared-resource.md#tips) for the Azure VM that hosts your license server. +- Be sure to create both your lab plan and the license serverΓÇÖs virtual network in the same region. Also, verify the region has sufficient VM capacity so that you donΓÇÖt have to move these resources to a new region later. -> [!NOTE] -> The **Small GPU (Visualization)** virtual machine size is configured to enable a high-performing graphics experience. For more information about this virtual machine size, see the article on [how to set up a lab with GPUs](./how-to-setup-lab-gpu.md). +For more information, see [Set up a license server as a shared resource](./how-to-create-a-lab-with-shared-resource.md). -### License server -You will need to access a license server if you plan to use the Autodesk network licensing model. Read Autodesk's article on [Network License Administration](https://knowledge.autodesk.com/customer-service/network-license-administration/network-deployment/preparing-for-deployment/determining-installation-type) for more information. +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can not be added later. -To use network licensing with Autodesk software, [AutoDesk provides detailed steps](https://knowledge.autodesk.com/customer-service/network-license-administration/install-and-configure-network-license) to install Autodesk Network License Manager on your license server. This license server is ordinarily located in either your on-premises network or hosted on an Azure virtual machine (VM) within in Azure virtual network. +## Lab configuration -After your license server is set up, you'll need to [peer the virtual network](./how-to-connect-peer-virtual-network.md) with your [lab account](./tutorial-setup-lab-account.md). You need to do the network peering *before* you create the lab so that your lab VMs can access the license server and vice versa. -Autodesk-generated license files embed the MAC address of the license server. If you decide to host your license server by using an Azure VM, itΓÇÖs important to make sure that your license serverΓÇÖs MAC address doesnΓÇÖt change. If the MAC address changes, you'll need to regenerate your licensing files. To prevent your MAC address from changing, do the following: +### Lab plan settings -- [Set a static private IP and MAC address](./how-to-create-a-lab-with-shared-resource.md#static-private-ip-and-mac-address) for the Azure VM that hosts your license server.-- Be sure to set up both your lab account and the license serverΓÇÖs virtual network in a region or location that has sufficient VM capacity so that you donΓÇÖt have to move these resources to a new region or location later.+Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -For more information, see [Set up a license server as a shared resource](./how-to-create-a-lab-with-shared-resource.md). +| Lab plan setting | Instructions | +| - | | +|Marketplace image| Enable the Windows 10 Pro or Windows 10 Pro N image, if not done already.| ++### Lab settings +++| Lab setting | Value and description | +| | | +| Virtual Machine Size | **Small GPU (Visualization)**. Best suited for remote visualization, streaming, gaming, and encoding with frameworks such as OpenGL and DirectX. | > [!WARNING]-> DonΓÇÖt forget to [peer the virtual network](./how-to-connect-peer-virtual-network.md) for the lab account to the virtual network for the license server **before** creating the lab. +> The **Small GPU (Visualization)** virtual machine size is configured to enable a high-performing graphics experience and meets [AdobeΓÇÖs system requirements for each application](https://helpx.adobe.com/creative-cloud/system-requirements.html). Make sure to choose **Small GPU (Visualization)** not **Small GPU (Compute)**. For more information about this virtual machine size, see the article on [how to set up a lab with GPUs](./how-to-setup-lab-gpu.md). ++## Template machine configuration -### Template machine -The steps in this section show how to set up the template VM: 1. Start the template VM and connect to the machine. 1. Download and install Inventor and Revit using [instructions from AutoDesk](https://knowledge.autodesk.com/customer-service/download-install/install-software). When prompted, specify the computer name of your license server. -1. Finally, publish the template VM to create the studentsΓÇÖ VMs. +1. Finally, [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm) to create the studentsΓÇÖ VMs. ## Cost-LetΓÇÖs cover an example cost estimate for this class. This estimate doesnΓÇÖt include the cost of running a license server. Suppose you have a class of 25 students, each of whom has 20 hours of scheduled class time. Each student also has an additional 10 quota hours for homework or assignments outside of scheduled class time. The virtual machine size we chose was **Small GPU (Visualization)**, which is 160 lab units. ++LetΓÇÖs cover an example cost estimate for this class. This estimate doesnΓÇÖt include the cost of running a license server. Suppose you have a class of 25 students, each of whom has 20 hours of scheduled class time. Each student also has an extra 10 quota hours for homework or assignments outside of scheduled class time. The virtual machine size we chose was **Small GPU (Visualization)**, which is 160 lab units. - 25 students × (20 scheduled hours + 10 quota hours) × 160 Lab Units × USD0.01 per hour = USD1200.00 -> [!IMPORTANT] +> [!IMPORTANT] > The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Next steps -As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) -- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Big Data Analytics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-big-data-analytics.md | Title: Set up a lab to teach big data analytics using Azure Lab Services | Micro description: Learn how to set up a lab to teach the big data analytics using Docker deployment of Hortonworks Data Platform (HDP). Previously updated : 06/26/2020 Last updated : 03/08/2022+ # Set up a lab for big data analytics using Docker deployment of HortonWorks Data Platform -This article shows you how to set up a lab to teach a big data analytics class. With this type of class, students learn how to handle large volumes of data and apply machine and statistical learning algorithms to derive data insights. A key objective for students is to learn to use data analytics tools, such as [Apache Hadoop's open-source software package](https://hadoop.apache.org/) which provides tools for storing, managing, and processing big data. -In this lab, students will use a popular commercial version of Hadoop provided by [Cloudera](https://www.cloudera.com/), called [Hortonworks Data Platform (HDP)](https://www.cloudera.com/products/hdp.html). Specifically, students will use [HDP Sandbox 3.0.1](https://www.cloudera.com/tutorials/getting-started-with-hdp-sandbox/1.html) which is a simplified, easy-to-use version of the platform that is free of cost and intended for learning and experimentation. Although this class may use either Windows or Linux virtual machines (VM) with HDP Sandbox deployed, this article will show how to use Windows. +This article shows you how to set up a lab to teach a big data analytics class. A big data analytics class teaches students to learn how to handle large volumes of data. It also teaches them to apply machine and statistical learning algorithms to derive data insights. A key objective for students is to learn how to use data analytics tools, such as [Apache Hadoop's open-source software package](https://hadoop.apache.org/). The software package provides tools for storing, managing, and processing big data. -Another interesting aspect of this lab, is that we will deploy HDP Sandbox on the lab VMs using [Docker](https://www.docker.com/) containers. Each Docker container provides its own isolated environment for software applications to run inside. Conceptually, Docker containers are like nested VMs and can be used to easily deploy and run a wide variety of software applications based on container images provided on [Docker Hub](https://www.docker.com/products/docker-hub). Cloudera's deployment script for HDP Sandbox automatically pulls the [HDP Sandbox 3.0.1 Docker image](https://hub.docker.com/r/hortonworks/sandbox-hdp) from Docker Hub and runs two Docker containers: - - sandbox-hdp - - sandbox-proxy +In this lab, students will use a popular commercial version of Hadoop provided by [Cloudera](https://www.cloudera.com/), called [Hortonworks Data Platform (HDP)](https://www.cloudera.com/products/hdp.html). Specifically, students will use [HDP Sandbox 3.0.1](https://www.cloudera.com/tutorials/getting-started-with-hdp-sandbox/1.html) that's a simplified, easy-to-use version of the platform. HDP Sandbox 3.0.1 is also free of cost and is intended for learning and experimentation. Although this class may use either Windows or Linux virtual machines (VM) with HDP Sandbox deployed. This article will show you how to use Windows. ++Another interesting aspect is that we'll deploy HDP Sandbox on the lab VMs using [Docker](https://www.docker.com/) containers. Each Docker container provides its own isolated environment for software applications to run inside. Conceptually, Docker containers are like nested VMs and can be used to easily deploy and run a wide variety of software applications based on container images provided on [Docker Hub](https://www.docker.com/products/docker-hub). Cloudera's deployment script for HDP Sandbox automatically pulls the [HDP Sandbox 3.0.1 Docker image](https://hub.docker.com/r/hortonworks/sandbox-hdp) from Docker Hub and runs two Docker containers: ++- sandbox-hdp +- sandbox-proxy ## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see [Tutorial to Setup a Lab Account](tutorial-setup-lab-account.md). You can also use an existing lab account. +To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings -### Lab account settings +Once you've an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. -Enable the settings described in the table below for the lab account. For more information about how to enable marketplace images, see [Specify Marketplace images available to lab creators](./specify-marketplace-images.md). +Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -| Lab account setting | Instructions | +| Lab plan setting | Instructions | | - | |-|Marketplace image| Enable the Windows 10 Pro image for use within your lab account.| +|Marketplace image| Enable the **Windows 10 Pro** image.| ### Lab settings -Use the settings in the table below when setting up a classroom lab. For more information how to create a classroom lab, see [set up a classroom lab tutorial](tutorial-setup-classroom-lab.md). +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab settings | Value/instructions | | | |-|Virtual Machine Size| Medium (Nested Virtualization). This VM size is best suited for relational databases, in-memory caching, and analytics. This size also supports nested virtualization.| +|Virtual Machine Size| **Medium (Nested Virtualization)**. This VM size is best suited for relational databases, in-memory caching, and analytics. The size also supports nested virtualization.| |Virtual Machine Image| Windows 10 Pro| -> [!NOTE] -> We need to use Medium (Nested Virtualization) since deploying HDP Sandbox using Docker requires: -> - Windows Hyper-V with nested virtualization -> - At least 10 GB of RAM +> [!NOTE] +> We need to use Medium (Nested Virtualization) since deploying HDP Sandbox using Docker requires Windows Hyper-V with nested virtualization and at least 10 GB of RAM. ## Template machine configuration -To set up the template machine, we will: +To set up the template machine, we'll: + - Install Docker - Deploy HDP Sandbox - Use PowerShell and Windows Task Scheduler to automatically start the Docker containers ### Install Docker -The steps in this section are based on [Cloudera's instructions for deploying with Docker containers](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html). +The steps in this section are based on [Cloudera's instructions for deploying with Docker containers](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html). To use Docker containers, you must first install Docker Desktop on the template VM: -1. Follow the steps in the [Prerequisites section](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html#prerequisites) to install [Docker for Windows](https://docs.docker.com/docker-for-windows/install/). +1. Follow the steps in the [Prerequisites section](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html#prerequisites) to install [Docker for Windows](https://docs.docker.com/docker-for-windows/install/). - > [!IMPORTANT] + > [!IMPORTANT] > Ensure that the **Use Windows containers instead of Linux containers** configuration option is left unchecked. 1. Ensure that **Windows Containers and Hyper-V features** are turned on.-  ++ :::image type="content" source="./media/class-type-big-data-analytics/windows-hyperv-features.png" alt-text="Turn Windows features on or off."::: 1. Follow the steps in the [Memory for Windows](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html#memory-for-windows) section to configure Docker's memory configuration. > [!WARNING]- > If you inadvertently check the **Use Windows containers instead of Linux containers** option when installing Docker, you won't see the memory configuration settings. To fix this, you can switch to using Linux containers by [clicking on the Docker icon in Windows System tray](https://docs.docker.com/docker-for-windows/#docker-settings-dialog); when the Docker Desktop menu opens, select **Switch to Linux containers**. - + > If you inadvertently check the **Use Windows containers instead of Linux containers** option when installing Docker, you won't see the memory configuration settings. To fix this, you can switch to using Linux containers by [clicking on the Docker icon in Windows System tray](https://docs.docker.com/docker-for-windows/#docker-settings-dialog); when the Docker Desktop menu opens, select **Switch to Linux containers**. + ### Deploy HDP Sandbox -In this section, you will deploy HDP Sandbox and then also access HDP Sandbox using the browser. +In this section, you'll deploy HDP Sandbox and then access HDP Sandbox using the browser. -1. Ensure that you have installed [Git Bash](https://gitforwindows.org/) as listed in the [Prerequisites section](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html#prerequisites) of the guide since this is recommended for completing the next steps. +1. Ensure that you have installed [Git Bash](https://gitforwindows.org/) as listed in the [Prerequisites section](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html#prerequisites) of the guide. It's recommended for completing the next steps. 1. Using [Cloudera's Deployment and Install Guide for Docker](https://www.cloudera.com/tutorials/sandbox-deployment-and-install-guide/3.html), complete the steps in the following sections:- - - Deploy HDP Sandbox - - Verify HDP Sandbox - > [!WARNING] - > When you download the latest .zip file for HDP, ensure that you do *not* save the .zip file in a directory path that includes whitespace. + - Deploy HDP Sandbox + - Verify HDP Sandbox - > [!NOTE] - > If you receive an exception during deployment stating **Drive has not been shared**, you need to share your C drive with Docker so that HDP's Linux containers can access local Windows files. To fix this, [click on the Docker icon in Windows System tray](https://docs.docker.com/docker-for-windows/#docker-settings-dialog) to open the Docker Desktop menu and select **Settings**. When **Docker's Settings** dialog opens, select **Resources > File Sharing** and check the **C** drive. You can then repeat the steps to deploy HDP Sandbox. + > [!WARNING] + > When you download the latest .zip file for HDP, ensure that you *don't* save the .zip file in a directory path that includes whitespace. ++ > [!NOTE] + > If you receive an exception during deployment stating **Drive has not been shared**, you need to share your C drive with Docker so that HDP's Linux containers can access local Windows files. To fix this, [click on the Docker icon in Windows System tray](https://docs.docker.com/docker-for-windows/#docker-settings-dialog) to open the Docker Desktop menu and select **Settings**. When **Docker's Settings** dialog opens, select **Resources > File Sharing** and check the **C** drive. You can then repeat the steps to deploy HDP Sandbox. -1. Once the Docker containers for HDP Sandbox are deployed and running, you can access the environment by launching your browser and following Cloudera's instructions for opening the [Sandbox Welcome Page](https://www.cloudera.com/tutorials/learning-the-ropes-of-the-hdp-sandbox.html#welcome-page) and launching the HDP Dashboard. +1. When the Docker containers for HDP Sandbox are deployed and running, you can access the environment by launching your browser. Follow Cloudera's instructions for opening the [Sandbox Welcome Page](https://www.cloudera.com/tutorials/learning-the-ropes-of-the-hdp-sandbox.html#welcome-page) and launching the HDP Dashboard. - > [!NOTE] - > These instructions assume that you have first mapped the local IP address of the sandbox environment to the sandbox-hdp.hortonworks.com in the host file on your template VM. If you do **not** do this mapping, you can access the Sandbox Welcome page by navigating to `http://localhost:8080`. + > [!NOTE] + > These instructions assume that you have first mapped the local IP address of the sandbox environment to the sandbox-hdp.hortonworks.com in the host file on your template VM. If you **don't** do this mapping, you can access the Sandbox Welcome page by navigating to `http://localhost:8080`. ### Automatically start Docker containers when students log in -To provide an easy to use experience for students, we'll use a PowerShell script that automatically: - - Starts the HDP Sandbox Docker containers when a student starts and connects to their lab VM. - - Launches the browser and navigates to the Sandbox Welcome Page. +To provide an easy to use, experience for students, we'll use a PowerShell script that automatically: ++- Starts the HDP Sandbox Docker containers when a student starts and connects to their lab VM. +- Launches the browser and navigates to the Sandbox Welcome Page. + We'll also use Windows Task Scheduler to automatically run this script when a student logs into their VM.-To set this up, follow these steps: [Big Data Analytics scripting](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/BigDataAnalytics/). +To set up a Task Scheduler, follow these steps: [Big Data Analytics scripting](https://aka.ms/azlabs/scripts/BigDataAnalytics). ## Cost estimate -If you would like to estimate the cost of this lab, you can use the following example. +If you would like to estimate the cost of this lab, you can use the following example: For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be:- - 25 students * (20 + 10) hours * 55 Lab Units * 0.01 USD per hour = 412.50 USD + +25 students \* (20 + 10) hours \* 55 Lab Units \* 0.01 USD per hour = 412.50 USD -Further more details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +>[!IMPORTANT] +>Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion -This article walked you through the steps necessary to create a lab for a big data analytics class that using Hortonworks Data Platform deployed with Docker. The setup for this class type may be used for similar data analytics classes. This setup may also be applicable to other types of classes that use Docker for deployment. +This article walked you through the steps necessary to create a lab for a big data analytics class. The big data analytics class uses the Hortonworks Data Platform deployed with Docker. The setup for this class type might be used for similar data analytics classes. This setup might also be applicable to other types of classes that use Docker for deployment. ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Database Management | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-database-management.md | Title: Set up a lab to teach database management for relational databases | Micr description: Learn how to set up a lab to teach the management of relational databases. Previously updated : 06/26/2020 Last updated : 02/22/2022 + # Set up a lab to teach database management for relational databases -This article describes how to set up a lab for a basic databases management class in Azure Lab Services. Databases concepts are one of the introductory courses taught in most of the Computer Science departments in college. Structured Query Language (SQL) is an international standard. SQL is the standard language for relation database management including adding, accessing, and managing content in a database. It is most noted for its quick processing, proven reliability, ease, and flexibility of use. -In this article, we'll show how to set up a virtual machine template in a lab with both MySQL Database Server and SQL Server 2019 server. [MySQL](https://www.mysql.com/) is a freely available open source Relational Database Management System (RDBMS). [SQL Server 2019](https://www.microsoft.com/sql-server/sql-server-2019) is the latest version of MicrosoftΓÇÖs RDBMS. +This article describes how to set up a lab for a basic database management class in Azure Lab Services. Database concepts are one of the introductory courses taught in most of the Computer Science departments in college. Structured Query Language (SQL) is an international standard. SQL is the standard language for relation database management including adding, accessing, and managing content in a database. It's most noted for its quick processing, proven reliability, ease, and flexibility of use. ++In this article, you learn how to set up a virtual machine template in a lab with both MySQL Database Server and SQL Server 2019 server. [MySQL](https://www.mysql.com/) is a freely available open source Relational Database Management System (RDBMS). [SQL Server 2019](https://www.microsoft.com/sql-server/sql-server-2019) is the latest version of MicrosoftΓÇÖs RDBMS. ## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see [Tutorial to Setup a Lab Account](tutorial-setup-lab-account.md). You can also use an existing lab account. +To set up this lab, you need an Azure subscription and lab account. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++When you get an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. -### Lab account settings +### Lab plan settings -Enable the settings described in the table below for the lab account. For more information about how to enable marketplace images, see [Specify Marketplace images available to lab creators](./specify-marketplace-images.md). +Enable the settings described in the table below for the lab plan. For more information about enabling marketplace images, see [Specify Marketplace images available to lab creators](./specify-marketplace-images.md). -| Lab account setting | Instructions | +| Lab plan setting | Instructions | | - | |-|Marketplace image| Enable the ΓÇÿSQL Server 2019 Standard on Windows Server 2019ΓÇÖ image for use within your lab account.| +|Marketplace image| Enable the ΓÇÿSQL Server 2019 Standard on Windows Server 2019ΓÇÖ image.| ### Lab settings -Use the settings in the table below when setting up a classroom lab. For more information how to create a classroom lab, see [set up a classroom lab tutorial](tutorial-setup-classroom-lab.md). +Use the settings in the table below when setting up a lab. For more information about creating a lab, see [set up a lab tutorial](tutorial-setup-lab.md). | Lab settings | Value/instructions | | | | Use the settings in the table below when setting up a classroom lab. For more i To install MySQL on Windows Server 2019, you can follow the steps mentioned in [Install and Run MySQL Community Server on a Virtual Machine](/previous-versions/azure/virtual-machines/windows/classic/mysql-2008r2?toc=%2fazure%2fvirtual-machines%2fwindows%2fclassic%2ftoc.json#install-and-run-mysql-community-server-on-the-virtual-machine). -SQL Server 2019 is pre-installed in the virtual machine image we chose when creating the new lab. +SQL Server 2019 is pre-installed in the virtual machine image we selected when creating the new lab. ## Cost estimate Let's cover a possible cost estimate for this class. We'll use a class of 25 students. There are 20 hours of scheduled class time. Also, each student gets 10 hours quota for homework or assignments outside scheduled class time. The virtual machine size we chose was medium, which is 42 lab units. -Here is an example of a possible cost estimate for this class: +Following is an example of a possible cost estimate for this class: 25 students \* (20 scheduled hours + 10 quota hours) \* 0.42 USD per hour = 315.00 USD -Further more details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +>[!IMPORTANT] +> Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion This article walked you through the steps necessary to create a lab for basic da ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Deep Learning Natural Language Processing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-deep-learning-natural-language-processing.md | Title: Set up a lab focused on deep learning using Azure Lab Services | Microsoft Docs description: Learn how to set up a lab focused on deep learning in natural language processing (NLP) using Azure Lab Services. Previously updated : 06/26/2020 Last updated : 04/06/2022+ # Set up a lab focused on deep learning in natural language processing using Azure Lab Services -This article shows you how to set up a lab focused on deep learning in natural language processing (NLP) using Azure Lab Services. Natural language processing (NLP) is a form of artificial intelligence (AI) that enables computers with translation, speech recognition, and other language understanding capabilities. -Students taking an NLP class get a Linux virtual machine (VM) to learn how to apply neural network algorithms to develop deep learning models that are used for analyzing written human language. ++This article shows you how to set up a lab focused on deep learning in Natural Language Processing (NLP) using Azure Lab Services. NLP is a form of Artificial Intelligence (AI) that enables computers with translation, speech recognition, and other language understanding capabilities. ++Students taking an NLP class get a Linux virtual machine (VM) to learn how to apply neural network algorithms. The algorithms teach students to develop deep learning models that are used for analyzing written human language. ## Lab configuration-To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you have an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing lab account. See the following tutorial for creating a new lab account: [Tutorial to Setup a Lab Account](tutorial-setup-lab-account.md). - -After you create the lab account, enable following settings in the lab account: -| Lab account setting | Instructions | +To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++Once you have an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. ++### Lab plan settings ++Enable the settings described in the table below for the lab plan. For more information about how to enable marketplace images, see the article on [how to specify Marketplace images available to lab creators](./specify-marketplace-images.md). ++| Lab plan setting | Instructions | | -- | | -| Marketplace images | Enable the Data Science Virtual Machine for Linux (Ubuntu) image for use within your lab account. See the following article for instructions: [Specify marketplace images available to lab creators](specify-marketplace-images.md). | +| Marketplace images | Enable the Data Science Virtual Machine for Linux (Ubuntu) image. | -Follow [this tutorial](tutorial-setup-classroom-lab.md) to create a new lab and apply the following settings: +### Lab settings -| Lab settings | Value/instructions | +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab: ++| Lab settings | Value | | | | | Virtual machine (VM) size | **Small GPU (Compute)**. This size is best suited for compute-intensive and network-intensive applications like Artificial Intelligence and Deep Learning. |-| VM image | [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804). This image provides deep learning frameworks and tools for machine learning and data science. To view the full list of installed tools on this image, see the following article: [WhatΓÇÖs included on the DSVM?](../machine-learning/data-science-virtual-machine/overview.md#whats-included-on-the-dsvm). | -| Enable remote desktop connection | <p>The Data Science image is already configured to use X2Go so that teachers and students can connect using a GUI remote desktop. X2Go does *not* require the **Enable remote desktop connection** setting to be enabled. This setting only needs to be enabled if you choose to instead use RDP. +| VM image | [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804). This image provides deep learning frameworks and tools for machine learning and data science. To view the full list of installed tools on this image, see [WhatΓÇÖs included on the DSVM?](../machine-learning/data-science-virtual-machine/overview.md#whats-included-on-the-dsvm). | +| Enable remote desktop connection | Optionally, check **Enable remote desktop connection**. The Data Science image is already configured to use X2Go so that teachers and students can connect using a GUI remote desktop. X2Go *doesn't* require the **Enable remote desktop connection** setting to be enabled. | +| Template Virtual Machine Settings | Optionally, choose **Use a virtual machine image without customization**. If you're using the [April 2022 Update (preview)](lab-services-whats-new.md) and the DSVM has all the tools that your class requires, you can skip the template customization step. | ++> [!IMPORTANT] +> We recommend that you use the X2Go with the Data Science image. However, if you choose to use RDP instead, you'll need to connect to the Linux VM using SSH and install the RDP and GUI packages before publishing the lab. Then, students can connect to the Linux VM using RDP later. For more information, see [Enable graphical remote desktop for Linux VMs](how-to-enable-remote-desktop-linux.md). ->**Important**: Although we recommend using X2Go with the Data Science image, if you choose to instead use RDP, you will need to connect to the Linux VM using SSH the first time and install the RDP and GUI packages. Then, you/students can connect to the Linux VM using RDP later. For more information, see [Enable graphical remote desktop for Linux VMs](how-to-enable-remote-desktop-linux.md). +## Template machine configuration -The Data Science Virtual Machine for Linux image provides the necessary deep learning frameworks and tools required for this type of class. As a result, after the template machine creation, you don't need to customize it further. It can be published for students to use. Select the **Publish** button on template page to publish the template to the lab. +The Data Science Virtual Machine for Linux image provides the necessary deep learning frameworks and tools required for this type of class. If you chose **Use a virtual machine image without customization** when creating the lab, the ability to customize the template machine will be disabled. You can [publish the lab](tutorial-setup-lab.md#publish-a-lab) when you're ready. ## Cost-If you would like to estimate the cost of this lab, you can use the following example: -For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be - -25 students * (20 + 10) hours * 139 Lab Units * 0.01 USD per hour = 1042.5 USD +Let's cover a possible cost estimate for this class. The virtual machine size we chose was Small GPU (Compute), which is 139 lab units. ++For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the cost estimate would be: -Further more details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +25 students \* (20 scheduled hours + 10 quota hours) \* 139 Lab Units \* 0.01 USD per hour = 1042.5 USD ++>[!IMPORTANT] +> Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion-This article walked you through the steps to create a lab for natural language processing class. You can use a similar setup for other deep learning classes. -## Next steps -Next steps are common to setting up any lab: +This article walked you through the steps to create a lab for Natural Language Processing class. You can use a similar setup for other deep learning classes. -- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) -- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users). +## Next steps |
| lab-services | Class Type Ethical Hacking | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-ethical-hacking.md | Title: Set up an Ethical Hacking lab with Azure Lab Services | Microsoft Docs description: Learn how to set up a lab using Azure Lab Services to teach ethical hacking. Previously updated : 06/26/2020 Last updated : 01/04/2022 # Set up a lab to teach ethical hacking class + This article shows you how to set up a class that focuses on forensics side of ethical hacking. Penetration testing, a practice used by the ethical hacking community, occurs when someone attempts to gain access to the system or network to demonstrate vulnerabilities that a malicious attacker may exploit. In an ethical hacking class, students can learn modern techniques for defending against vulnerabilities. Each student gets a Windows Server host virtual machine that has two nested virtual machines ΓÇô one virtual machine with [Metasploitable3](https://github.com/rapid7/metasploitable3) image and another machine with [Kali Linux](https://www.kali.org/) image. The Metasploitable virtual machine is used for exploiting purposes and Kali virtual machine provides access to the tools needed to execute forensic tasks. -This article has two main sections. The first section covers how to create the classroom lab. The second section covers how to create the template machine with nested virtualization enabled and with the tools and images needed. In this case, a Metasploitable image and a Kali Linux image on a machine that has Hyper-V enabled to host the images. +This article has two main sections. The first section covers how to create the lab. The second section covers how to create the template machine with nested virtualization enabled and with the tools and images needed. In this case, a Metasploitable image and a Kali Linux image on a machine that has Hyper-V enabled to host the images. ## Lab configuration -To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing account. See the following tutorial for creating a new lab account: [Tutorial to setup a lab account](tutorial-setup-lab-account.md). +++### Lab settings -Follow [this tutorial](tutorial-setup-classroom-lab.md) to create a new lab and then apply the following settings: -| Virtual machine size | Image | -| -- | -- | -| Medium (Nested Virtualization) | Windows Server 2019 Datacenter | +| Lab settings | Value | +| | | +| Virtual machine (VM) size | Medium (Nested Virtualization) | +| VM image | Windows Server 2019 Datacenter | -## Template machine +## Template machine configuration -After the template machine is created, start the machine and connect to it to complete the following three major tasks. ++To configure the template VM, we'll complete the following three major tasks. 1. Set up the machine for nested virtualization. It enables all the appropriate windows features, like Hyper-V, and sets up the networking for the Hyper-V images to be able to communicate with each other and the internet. 2. Set up the [Kali](https://www.kali.org/) Linux image. Kali is a Linux distribution that includes tools for penetration testing and security auditing. 3. Set up the Metasploitable image. For this example, the [Metasploitable3](https://github.com/rapid7/metasploitable3) image will be used. This image is created to purposely have security vulnerabilities. -The rest of this article will cover the manual steps to completing the tasks above. Alternatively, you can run the [Lab Services Hyper-V Scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/HyperV) and [Lab Services Ethical Hacking Scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/EthicalHacking). +You can complete the tasks above by executing the [Lab Services Hyper-V Script](https://aka.ms/azlabs/scripts/hyperV) and [Lab Services Ethical Hacking Script](https://aka.ms/azlabs/scripts/EthicalHacking) PowerShell scripts on the template machine. Once scripts have been executed, continue to [Next steps](#next-steps). ++If you choose to set up the template machine manually, continue reading. The rest of this article will cover the manual completion of template configuration tasks. ### Prepare template machine for nested virtualization Kali is a Linux distribution that includes tools for penetration testing and sec 1. On the **Select destination image format** page, choose **VHD/VHDX**. Select **Next**. 1. On the **Select option for VHD/VHDX image format** page, choose **VHDX growable image**. Select **Next**. 1. On the **Select destination file name** page, accept the default file name. Select **Convert**.- 1. On the **Converting** page, wait for the image to be converted. This may take several minutes. Select **Finish** when the conversion is completed. + 1. On the **Converting** page, wait for the image to be converted. Conversion may take several minutes. Select **Finish** when the conversion is completed. 1. Create a new Hyper-V virtual machine. 1. Open **Hyper-V Manager**. 1. Choose **Action** -> **New** -> **Virtual Machine**. The Rapid7 Metasploitable image is an image purposely configured with security v 1. On the **Select destination image format** page, choose **VHD/VHDX**. Select **Next**. 1. On the **Select option for VHD/VHDX image format** page, choose **VHDX growable image**. Select **Next**. 1. On the **Select destination file name** page, accept the default file name. Select **Convert**.- 1. On the **Converting** page, wait for the image to be converted. This may take several minutes. Select **Finish** when the conversion is completed. + 1. On the **Converting** page, wait for the image to be converted. Conversion may take several minutes. Select **Finish** when the conversion is completed. 1. Create a new Hyper-V virtual machine. 1. Open **Hyper-V Manager**. 1. Choose **Action** -> **New** -> **Virtual Machine**. 1. On the **Before You Begin** page of the **New Virtual Machine Wizard**, select **Next**. 1. On the **Specify Name and Location** page, enter **Metasploitable** for the **name**, and select **Next**.--  + :::image type="content" source="./media/class-type-ethical-hacking/new-vm-wizard-1.png" alt-text="Screenshot of New Virtual Machine Wizard in Hyper V."::: 1. On the **Specify Generation** page, accept the defaults, and select **Next**. 1. On the **Assign Memory** page, enter **512 MB** for the **startup memory**, and select **Next**.--  + :::image type="content" source="./media/class-type-ethical-hacking/assign-memory-page.png" alt-text="Screenshot of Assign Memory page of New Virtual Machine Wizard in Hyper V."::: 1. On the **Configure Networking** page, leave the connection as **Not Connected**. You'll set up the network adapter later. 1. On the **Connect Virtual Hard Disk** page, select **Use an existing virtual hard disk**. Browse to the location for the **metasploitable.vhdx** file created in the previous step, and select **Next**.--  + :::image type="content" source="./media/class-type-ethical-hacking/connect-virtual-network-disk.png" alt-text="Screenshot of Connect Virtual Hard Disk page of New Virtual Machine Wizard in Hyper V."::: 1. On the **Completing the New Virtual Machine Wizard** page, and select **Finish**. 1. Once the virtual machine is created, select it in the Hyper-V Manager. Don't turn on the machine yet. 1. Choose **Action** -> **Settings**. 1. On the **Settings for Metasploitable** dialog for, select **Add Hardware**. 1. Select **Legacy Network Adapter**, and select **Add**.--  + :::image type="content" source="./media/class-type-ethical-hacking/network-adapter-page.png" alt-text="Screenshot of settings dialog for Hyper V VM."::: 1. On the **Legacy Network Adapter** page, select **LabServicesSwitch** for the **Virtual Switch** setting, and select **OK**. LabServicesSwitch was created when preparing the template machine for Hyper-V in the **Prepare Template for Nested Virtualization** section.--  + :::image type="content" source="./media/class-type-ethical-hacking/legacy-network-adapter-page.png" alt-text="Screenshot of Legacy Network adapter settings page for Hyper V VM."::: 1. The Metasploitable image is now ready for use. From **Hyper-V Manager**, choose **Action** -> **Start**, then choose **Action** -> **Connect** to connect to the virtual machine. The default username is **msfadmin** and the password is **msfadmin**. -The template is now updated and has images needed for an ethical hacking penetration testing class, an image with tools to do the penetration testing and another image with security vulnerabilities to discover. The template image can now be published to the class. Select the **Publish** button on template page to publish the template to the lab. +The template is now updated and has images needed for an ethical hacking penetration testing class, an image with tools to do the penetration testing and another image with security vulnerabilities to discover. The template image can now be [published](how-to-create-manage-template.md#publish-the-template-vm) to the class. ## Cost This article walked you through the steps to create a lab for ethical hacking cl ## Next steps -Next steps are common to setting up any lab: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users). |
| lab-services | Class Type Jupyter Notebook | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-jupyter-notebook.md | Title: Set up a lab to teach data science with Python and Jupyter Notebooks | Mi description: Learn how to set up a lab to teach data science using Python and Jupyter Notebooks. Previously updated : 09/29/2020 Last updated : 01/04/2022 # Set up a lab to teach data science with Python and Jupyter Notebooks-This article outlines how to set up a template virtual machine (VM) in Lab Services with the tools that are needed to teach students how to use [Jupyter Notebooks](http://jupyter-notebook.readthedocs.io/), and how students can connect to their notebooks on their virtual machines (VMs). + Jupyter Notebooks is an open-source project that lets you easily combine rich text and executable Python source code on a single canvas called a notebook. Running a notebook results in a linear record of inputs and outputs. Those outputs can include text, tables of information, scatter plots, and more. -## Set up the lab +This article outlines how to set up a template virtual machine (VM) in Azure Lab Services with the tools needed to teach students to use [Jupyter Notebooks](http://jupyter-notebook.readthedocs.io/). We'll also show how students can connect to their notebooks on their virtual machines (VMs). ++## Lab configuration + -### Lab configuration -To set up this lab, you need access to an Azure subscription and a lab account. Discuss with your organization's admin to see if you can get access to an existing Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. +### Lab plan settings -Once you have an Azure subscription, create a new lab account in Azure Lab Services by following instructions in the tutorial: [Setup a lab account](tutorial-setup-lab-account.md). You can also use an existing lab account. -### Lab account settings -Enable settings described in the table below for the lab account. For more information on enabling marketplace images, see [specify Marketplace images available to lab creators](specify-marketplace-images.md). +Enable settings described in the table below for the lab plan. For more information on enabling marketplace images, see [specify Marketplace images available to lab creators](specify-marketplace-images.md). -| Lab account setting | Instructions | +| Lab plan setting | Instructions | | - | |-| Marketplace image | Inside your lab account, enable one of the Azure Marketplace images based on your operating system needs: <br/><ul><li>Data Science Virtual Machine ΓÇô Windows Server 2019</li><li>Data Science Virtual Machine ΓÇô Ubuntu 18.04</li></ul> | +| Marketplace image | Inside your lab account, enable either **Data Science Virtual Machine ΓÇô Windows Server 2019** or **Data Science Virtual Machine ΓÇô Ubuntu 18.04** depending on your OS needs. | -> [!NOTE] -> This article uses the Data Science virtual machine images available on the Azure marketplace because they are preconfigured with Jupyter Notebook. These images, however, also include many other development and modeling tools for data science. If you don't want those extra tools and want a lightweight setup with just Jupyter notebooks, create a custom VM image. For an example, [Installing JupyperHub on Azure](http://tljh.jupyter.org/en/latest/install/azure.html). Once the custom image is created, you can upload it to a shared image gallery to use the image inside Azure Lab Services. Learn more about [using Shared Image Gallery in Azure Lab Services](how-to-attach-detach-shared-image-gallery.md). +This article uses the Data Science virtual machine images available on the Azure Marketplace because they are already configured with Jupyter Notebook. These images, however, also include many other development and modeling tools for data science. If you don't want those extra tools and want a lightweight setup with only Jupyter notebooks, create a custom VM image. For an example, [Installing JupyterHub on Azure](http://tljh.jupyter.org/en/latest/install/azure.html). Once the custom image is created, you can upload it to a compute gallery to use the image inside Azure Lab Services. Learn more about [using compute gallery in Azure Lab Services](how-to-attach-detach-shared-image-gallery.md). ### Lab settings-Configure **Virtual machine size** and **Virtual machine image** settings as shown in the following table when setting up a classroom lab. For instructions on creating a classroom lab, see [Set up a classroom lab](tutorial-setup-classroom-lab.md). -| Lab settings | Value/instructions | -| | | -| Virtual machine size | <p>The size you pick here depends on the workload you want to run:</p><ul><li>Small or Medium ΓÇô good for a basic setup of accessing Jupyter Notebooks</li><li>Small GPU (Compute) ΓÇô best suited for compute-intensive and network-intensive applications like Artificial Intelligence and Deep Learning</li></ul> | -| Virtual machine image | <p>Choose one of the following images based on your operating system needs:</p><ul><li>[Data Science Virtual Machine ΓÇô Windows Server 2019](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.dsvm-win-2019)</li><li>[Data Science Virtual Machine ΓÇô Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804?tab=Overview)</li></ul> | ++| Lab settings | Value | +| | | +| Virtual machine size | Select **Small** or **Medium** for a basic setup accessing Jupyter Notebooks. Select **Small GPU (Compute)** for compute-intensive and network-intensive applications used in Artificial Intelligence and Deep Learning classes. | +| Virtual machine image | Choose **[Data Science Virtual Machine ΓÇô Windows Server 2019](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.dsvm-win-2019)** or **[Data Science Virtual Machine ΓÇô Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804?tab=Overview)** depending on your OS needs. | +| Template virtual machine settings | Select **Use virtual machine without customization.**. ++When you create a lab with the **Small GPU (Compute)** size, you can [install GPU drivers](./how-to-setup-lab-gpu.md#ensure-that-the-appropriate-gpu-drivers-are-installed). This option installs recent NVIDIA drivers and Compute Unified Device Architecture (CUDA) toolkit, which is required to enable high-performance computing with the GPU. For more information, see the article [Set up a lab with GPU virtual machines](./how-to-setup-lab-gpu.md). -When you create a lab with the **Small GPU (Compute)** size, you have the option to [Install GPU drivers](./how-to-setup-lab-gpu.md#ensure-that-the-appropriate-gpu-drivers-are-installed). This option installs recent NVIDIA drivers and Compute Unified Device Architecture (CUDA) toolkit which are required to enable high-performance computing with the GPU. For more information, see the article [Set up a lab with GPU virtual machines](./how-to-setup-lab-gpu.md). +## Template machine configuration -### Template virtual machine -Once you create a lab, a template VM will be created based on the virtual machine size and image you chose. You configure the template VM with everything you want to provide to your students for this class. To learn more, see [how to manage the template virtual machine](how-to-create-manage-template.md). -The Data Science VM images by default come with many of data science frameworks and tools required for this type of class. For example, the images include: +The Data Science VM images come with many of data science frameworks and tools required for this type of class. For example, the images include: - [Jupyter Notebooks](http://jupyter-notebook.readthedocs.io/): A web application that allows data scientists to take raw data, run computations, and see the results all in the same environment. It will run locally in the template VM. - [Visual Studio Code](https://code.visualstudio.com/): An integrated development environment (IDE) that provides a rich interactive experience when writing and testing a notebook. For more information, see [Working with Jupyter Notebooks in Visual Studio Code](https://code.visualstudio.com/docs/python/jupyter-support). -If you are using the **Small GPU (Compute)** size, we recommend that you verify that the Data Science frameworks and libraries are properly set up with the GPU. To properly set up the frameworks and libraries, you may need to install a different version of the NVIDIA Drivers and CUDA toolkit. For example, to validate that the GPU is configured for TensorFlow, you can connect to the template VM and run the following Python-TensorFlow code in Jupyter Notebooks: +The **Data Science Virtual Machine ΓÇô Ubuntu** image is already provisioned with X2GO server and to enable students to use a graphical desktop experience. No further steps are required when setting up the template VM. ++### Enabling tools to use GPUs ++If you're using the **Small GPU (Compute)** size, we recommend that you verify that the Data Science frameworks and libraries are properly set up to use GPUs. You may need to install a different version of the NVIDIA drivers and CUDA toolkit. To properly configure the GPUs, you should consult the framework's or library's documentation. ++For example, to validate that the GPU is configured for TensorFlow, connect to the template VM and run the following Python-TensorFlow code in Jupyter Notebooks: ```python import tensorflow as tf from tensorflow.python.client import device_lib print(device_lib.list_local_devices()) ``` -If the output from the above code looks like the following, this means that the GPU isn't configured for TensorFlow: +If the output from the above code looks like the following, the GPU isn't configured for TensorFlow: ```python [name: "/device:CPU:0" locality { incarnation: 15833696144144374634 ] ```-To properly configure the GPU, you should consult the framework's or library's documentation. Continuing with the above example, TensorFlow provides the following guidance: -- [TensorFlow GPU Support](https://www.tensorflow.org/install/gpu) -Their guidance covers the required version of the [NVIDIA drivers](https://www.nvidia.com/drivers) and [CUDA Toolkit](https://developer.nvidia.com/cuda-toolkit-archive). Their guidance also includes installing the [NVIDIA CUDA Deep Neural Network library (cudDNN)](https://developer.nvidia.com/cudnn). +Continuing with the above example, see [TensorFlow GPU Support](https://www.tensorflow.org/install/gpu) for guidance. TensorFlow guidance covers: ++- Required version of the [NVIDIA drivers](https://www.nvidia.com/drivers) +- Required version of the [CUDA Toolkit](https://developer.nvidia.com/cuda-toolkit-archive). +- Instructions to install [NVIDIA CUDA Deep Neural Network library (cudDNN)](https://developer.nvidia.com/cudnn). -After you've followed TensorFlow's steps to configure the GPU, when you rerun the above code, you should see output similar to the following: +After you've followed TensorFlow's steps to configure the GPU, when you rerun the test code, you should see output similar to the following output. ```python [name: "/device:CPU:0" physical_device_desc: "device: 0, name: NVIDIA Tesla K80, pci bus id: 0001:00:00 ``` ### Provide notebooks for the class-The next task is to provide students with notebooks that you want them to use. To provide your own notebooks, you can save notebooks locally on the template VM. -If you want to use sample notebooks from Azure Machine Learning, see [how to configure an environment with Jupyter Notebooks](../machine-learning/how-to-configure-environment.md#jupyter). --### Optional: enable graphical desktop for Linux -The **Data Science Virtual Machine ΓÇô Ubuntu** image is already provisioned with X2GO server and is ready to accept client connections. No further steps are required when setting up the template VM. +The next task is to provide students with notebooks that you want them to use. Notebooks can be saved locally on the template VM so each student has their own copy. If you want to use sample notebooks from Azure Machine Learning, see [how to configure an environment with Jupyter Notebooks](../machine-learning/how-to-configure-environment.md#jupyter). ### Publish the template machine-When you publish the template, each student registered to your lab will get a copy of the template VM with all the local tools and notebooks youΓÇÖve set up on it. -## How students connect to Jupyter Notebooks? -Once you publish the template, each student will have access to a VM that comes with everything youΓÇÖve preconfigured for the class, including the Jupyter Notebooks. The following sections show different ways for students to connect to Jupyter Notebooks. +When you [publish the template](how-to-create-manage-template.md#publish-the-template-vm), each student registered in the lab will get a copy of the template VM with all the local tools and notebooks youΓÇÖve set up on it. -### For Windows VMs -If youΓÇÖve provided students with Windows VMs, they need to connect to their VMs and use Jupyter Notebooks that are available locally on them. +## How students connect to Jupyter Notebooks? -To connect to a Windows VM, a student can use a remote desktop connection (RDP). For detailed steps, see [how to access a classroom lab](how-to-use-classroom-lab.md). +Once you publish the template, each student will have access to a VM that comes with everything youΓÇÖve already configured for the class, including the Jupyter Notebooks. The following sections show different ways for students to connect to Jupyter Notebooks. -A student using a Mac or Chromebook can follow instructions from following articles to connect to the Data Science Windows VM. +### For Windows VMs -- [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md)-- [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md)+If youΓÇÖve provided students with Windows VMs, they need to connect to their lab VMs to use Jupyter Notebooks. To connect to a Windows VM, a student can use a remote desktop connection (RDP). For more information, see [Connect to a Windows lab VM](connect-virtual-machine.md#connect-to-a-windows-lab-vm). ### For Linux VMs-If youΓÇÖve provided students with Linux VMs, there are several options students can use to connect to their Jupyter Notebooks in the VMs: -- Access Jupyter Notebooks locally after connecting to the VM- - SSH to the VM for terminal sessions - - X2Go connection to the VM for graphical sessions -- Use SSH tunneling to connect from the studentΓÇÖs local computer directly to the Jupyter Server on the VM. --The following sections provide details about these ways to connect to Jupyter notebooks. --#### SSH to virtual machine -Students can connect via SSH to their Linux VMs from a terminal session. For detailed steps, see [how to access a classroom lab](how-to-use-classroom-lab.md). If they are using a Windows client machine, they will need to enable an SSH client by downloading [PuTTY](https://www.putty.org/) or enabling [OpenSSH in Windows](/windows-server/administration/openssh/openssh_install_firstuse) to SSH from the command prompt. --1. Start the VM. -2. Once the VM is running, click **Connect**, which will pop up a dialog box that provides the SSH command string, which will look like the following sample: - - ```shell - ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com - ``` -3. Go to your command prompt or terminal, and paste in this command, and then press **ENTER**. -4. Enter the password to sign in to the VM. +If youΓÇÖve provided students with Linux VMs, students can Access Jupyter Notebooks locally after connecting to the VM. For instructions to SSH or connect using X2Go, see [Connect to a Linux lab VM](connect-virtual-machine.md#connect-to-a-linux-lab-vm). -Once students are connected to VMs, they can access and run Jupyter Notebooks locally. +#### SSH tunnel to Jupyter server on the VM -#### X2Go to virtual machine -The **Data Science Virtual Machine ΓÇô Ubuntu** image is already provisioned with X2GO Server and is ready to accept client connections. To connect to the graphical desktop of the Linux machine, students need to follow these one-time steps to set up X2Go on their client machines: +Some students may want to connect directly from their local computer directly to the Jupyter server inside their lab VMs. The SSH protocol enables port forwarding between the local computer and a remote server (in our case, the studentΓÇÖs lab VM), so that an application running on a certain port on the server is **tunneled** to the mapping port on the local computer. Students should follow these steps to SSH tunnel to the Jupyter server on their lab VMs: -1. Download and install the [X2Go client](https://wiki.x2go.org/doku.php/doc:installation:x2goclient) for your client platform. -2. In the [Azure Lab Services portal](https://labs.azure.com), make sure that the Linux VM you want to connect to is started. -3. Once the VM is running, click **Connect**, which will pop a dialog box that provides the SSH command string, which will look like the following sample: +1. In the Lab Services web portal ([https://labs.azure.com](https://labs.azure.com)), make sure that the Linux VM that you want to connect to is [started](how-to-use-lab.md#start-or-stop-the-vm). +2. Once the VM is running, [get the SSH connection command](connect-virtual-machine.md#connect-to-a-linux-lab-vm-using-ssh) by selecting **Connect**, which will show a window that provides the SSH command string, which will look like the following string: + ```shell + ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com ```- ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com - ``` -4. Once you have this info, open the X2Go client app and create a new session. -5. Fill in the following values in the **Session Preferences** pane: - - **Session name**: It can be whatever you want, but we recommend using the name of your Lab VM. - - **Host**: `ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com` - - **Login**: student - - **SSH port**: 12345 - - **Session type**: XFCE -6. Select **OK**. -- > [!NOTE] - > When creating a new X2Go session, make sure to use the SSH port, **not** the RDP port. --Now, to connect to the VM, follow these steps: -1. In the X2Go client, double-click on the VM you want to connect to. --  -2. Enter the password to connect to the VM. (You may have to give X2Go permission to bypass your firewall to finish connecting.) -3. You should now see the graphical interface for your Ubuntu Data Science VM. +3. On your local computer, launch a terminal or command prompt, and copy the SSH connection string to it. Then, add `-L 8888:localhost:8888` to the command string, which creates the **tunnel** between the ports. The final string should look like: -#### SSH tunnel to Jupyter server on the VM -Some students may want to connect directly from their local computer directly to the Jupyter server inside their VMs. The SSH protocol enables port forwarding between the local computer and a remote server (in our case, the studentΓÇÖs lab VM), so that an application running on a certain port on the server is **tunneled** to the mapping port on the local computer. Students should follow these steps to SSH tunnel to the Jupyter server on their lab VMs: + ```shell + ssh ΓÇôL 8888:localhost:8888 -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus.cloudapp.azure.com + ``` -1. In the [Azure Lab Services portal](https://labs.azure.com), make sure that the Linux VM that you want to connect is started. -2. Once the VM is running, click **Connect**, which will pop a dialog box that provides the SSH command string, which will look like the following string: +4. Press **ENTER** to run the command. +5. When prompted, provide the password to connect to the lab VM. +6. Once youΓÇÖre connected to the VM, start the Jupyter server using this command: ```bash- ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com - ``` -3. On your local computer, launch a terminal or command prompt, and copy the SSH connection string to it. Then, add `-L 8888:localhost:8888` to the command string, which creates the **tunnel** between the ports. The final string should look like: + jupyter notebook + ``` - ```bash - ssh ΓÇôL 8888:localhost:8888 -p 12345 student@ml-lab-b720853e-570f-49ac-9cb2-bd0bd2aeec35.eastus.cloudapp.azure.com - ``` -4. Press **ENTER** to run the command. -5. When prompted, provide the password to connect to the lab VM. -6. Once youΓÇÖre connected to the VM, start the Jupyter server using this command: +7. Running the command will provide you with a URL in the terminal. The URL should look like: ```bash- jupyter notebook - ``` -7. Running the command will provide you with a URL in the terminal or command prompt. The URL should look like: + http://localhost:8888/?token=8c09ecfc93e6a8cbedf9c66dffdae19670a64acc1d37 + ``` - ```bash - http://localhost:8888/?token=8c09ecfc93e6a8cbedf9c66dffdae19670a64acc1d37 - ``` -8. Paste this URL into a browser on your local computer to connect and work on your Jupyter Notebook. +8. Paste this URL into a browser on your local computer to connect and work on your Jupyter Notebook. > [!NOTE]- > Visual Studio Code also enables a great [Jupyter Notebook editing experience](https://code.visualstudio.com/docs/python/jupyter-support). You can follow the instructions on [how to connect to a remote Jupyter server](https://code.visualstudio.com/docs/python/jupyter-support#_connect-to-a-remote-jupyter-server) and use the same URL from the previous step to connect from VS Code instead of from the browser. -+ > Visual Studio Code also enables a great [Jupyter Notebook editing experience](https://code.visualstudio.com/docs/python/jupyter-support). You can follow the instructions on [how to connect to a remote Jupyter server](https://code.visualstudio.com/docs/python/jupyter-support#_connect-to-a-remote-jupyter-server) and use the same URL from the previous step to connect from VS Code instead of from the browser. ## Cost estimate+ Let's cover a possible cost estimate for this class. We'll use a class of 25 students. There are 20 hours of scheduled class time. Also, each student gets 10 hours quota for homework or assignments outside scheduled class time. The VM size we chose was small GPU (compute), which is 139 lab units. If you want to use the Small (20 lab units) or Medium size (42 lab units), you can replace the lab unit part in the equation below with the correct number. Here is an example of a possible cost estimate for this class:-25 students * (20 scheduled hours + 10 quota hours) * 139 lab units * 0.01 USD per hour = 1042.5 USD +25 students \* (20 scheduled hours + 10 quota hours) \* 139 lab units \* 0.01 USD per hour = 1042.5 USD -Further more details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +>[!IMPORTANT] +>Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion+ In this article, we walked through the steps to create a lab for a Jupyter Notebooks class. You can use a similar setup for other machine learning classes. ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Matlab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-matlab.md | Title: Set up a lab to teach MATLAB with Azure Lab Services | Microsoft Docs description: Learn how to set up a lab to teach MATLAB with Azure Lab Services. Previously updated : 06/26/2020 Last updated : 04/06/2022+ # Setup a lab to teach MATLAB -[MATLAB](https://www.mathworks.com/products/matlab.html), which stands for Matrix laboratory, is programming platform from [MathWorks](https://www.mathworks.com/). It combines computational power and visualization making it popular tool in the fields of math, engineering, physics, and chemistry. ++[MATLAB](https://www.mathworks.com/products/matlab.html) is a programming platform from [MathWorks](https://www.mathworks.com/), which combines computational power and visualization. MATLAB is a popular tool for mathematics, engineering, physics, and chemistry. If you're using a [campus-wide license](https://www.mathworks.com/academia/tah-support-program/administrators.html), see directions at [download MATLAB installation files](https://www.mathworks.com/matlabcentral/answers/259632-how-can-i-get-matlab-installation-files-for-use-on-an-offline-machine) to download the MATLAB installer files on the template machine. -In this article, we'll show how to set up a class that uses MATLAB client software with a license server. +In this article, we'll show you how to set up a class that uses MATLAB client software with a license server. ++To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ## License server -Before modifying the template machine for your lab, you'll need to set up the server to run the [Network License Manager](https://www.mathworks.com/help/install/administer-network-licenses.html) software. These instructions are only applicable for institutions that choose the networking licensing option for MATLAB, which allows users to share a pool of license keys. You'll also need to save the license file and file installation key for later. For detailed instructions on how to download a license file, see the first step in the [install Network License Manager with internet connection](https://www.mathworks.com/help/install/ug/install-network-license-manager-with-internet-connection.html) article. +Before creating the lab plan, you'll need to set up the server to run the [Network License Manager](https://www.mathworks.com/help/install/administer-network-licenses.html) software. These instructions are only applicable for institutions that choose the networking licensing option for MATLAB, which allows users to share a pool of license keys. You'll also need to save the license file and file installation key for later. For detailed instructions on how to download a license file, see the first step in [Install Network License Manager with Internet Connection](https://www.mathworks.com/help/install/ug/install-network-license-manager-with-internet-connection.html). ++For detailed instructions on how to install a licensing server, see [Install Network License Manager with Internet Connection](https://www.mathworks.com/help/install/ug/install-network-license-manager-with-internet-connection.html). To enable borrowing, see [Borrow License](https://www.mathworks.com/help/install/license/borrow-licenses.html). -Detailed instructions to covering how to install a licensing server are available at [install Network License Manager with Internet Connection](https://www.mathworks.com/help/install/ug/install-network-license-manager-with-internet-connection.html). To enable borrowing, see the [Borrow License](https://www.mathworks.com/help/install/license/borrow-licenses.html) article. +Assuming the license server is located in an on-premise network or a private network within Azure, youΓÇÖll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) when creating your [lab plan](./tutorial-setup-lab-plan.md). -Assuming the license server is located in an on-premise network or a private network within Azure, donΓÇÖt forget to [peer the virtual network](how-to-connect-peer-virtual-network.md) to your [lab account](tutorial-setup-lab-account.md). The network peering must be done before creating the lab so the lab virtual machines can access the license server. +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. ## Lab configuration -To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing account. To create a new lab account, see the [setup a lab account tutorial](tutorial-setup-lab-account.md). +Once you have an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). If you're using a [Network License Manager](https://www.mathworks.com/help/install/administer-network-licenses.html) on a license server, enable [advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) when creating your lab plan. You can also use an existing lab plan. -To create a new lab, follow [set up a classroom lab tutorial](tutorial-setup-classroom-lab.md). Apply the following settings: +### Lab settings -| Virtual machine size | Image | -| -- | -- | -| Medium | Windows 10 | +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab: -MATLAB is supported on more operating systems. See [MATLAB system requirements](https://www.mathworks.com/support/requirements/matlab-system-requirements.html) for details. +| Lab settings | Value | +| | | +| Virtual machine (VM) size | Medium | +| VM image | Windows 10 | -> [!WARNING] -> DonΓÇÖt forget to [peer the virtual network](https://www.mathworks.com/support/requirements/matlab-system-requirements.html) for the lab account to the virtual network for the license server before creating the lab. +MATLAB is supported on more operating systems than Windows 10. For more information, see [MATLAB system requirements](https://www.mathworks.com/support/requirements/matlab-system-requirements.html). -## Template machine +## Template machine configuration -After the template machine is created, start the machine and connect to it to complete the following major tasks. +After the template machine is created, start the machine and connect to the template machine to complete the following major tasks: 1. Download the installation files for the MATLAB client software. 2. Install MATLAB using the file installation key. -Installing MATLAB will be a multi-part process. The first part will download the files for MATLAB and any other products you want installed. Using a file installation key requires that all the installation files for products to be installed are pre-downloaded. The second part will be installing the MATLAB software on the template VM and activating the software. If the template VM is configured to activate using the license server, the student VMs will do the same. +Installing MATLAB will be a multi-part process: ++1. Download the files for MATLAB and any other products you want to install. Ensure that all the installation files for products to be installed are pre-downloaded before you use a file installation key. +1. Install the MATLAB software on the template VM and activating the software. If the template VM is configured to activate using the license server, the student VMs will do the same. ### Download installation files -You must be a license administrator to download the installation files as well as get the license file and file installation key. Steps to download the installation files are below. --1. Log into your account for [https://www.mathworks.com](https://www.mathworks.com). -2. Choose **My Account**. -3. Under the **My Software** section of the account page, click on the license attached to the Network License Manager setup for the lab. -4. On the license detail page, click **Download Products**. -5. Wait for the installer to self-extract. -6. Start the installer. -7. On the **Sign in to your MathWorks Account** page, enter your MathWorks account. -8. On the **MathWorks License Agreement** page, accept the term and click the **Next** button. -9. Click the **Advanced Options** drop-down and choose **I want to download without installing**. -10. On the **Select destination folder**, click **Next**. -11. Select **Windows** as the platform of the computer you're going to be installing MATLAB. -12. On the **Select product** page, make sure MATLAB is selected along with any other MathWorks products you would like to install. -13. On the **Confirm Selections and Download** page, click **Begin Download**. -14. Wait for the selected products to download. Click **Finish**. +You must be a license administrator to get the installation files, license file, and the file installation key. Steps to download the installation files are below: ++1. Sign into your MathWorks account at https://www.mathworks.com. +1. Choose **My Account**. +1. Under the **My Software** section of the account page, select the license attached to the Network License Manager setup for the lab. +1. On the license detail page, select **Download Products**. +1. Wait for the installer to self-extract. +1. Start the installer. +1. On the **Sign in to your MathWorks Account** page, enter your MathWorks account details. +1. On the **MathWorks License Agreement** page, accept the terms and select the **Next** button. +1. Select the **Advanced Options** drop-down and choose the **I want to download without installing** option. +1. On the **Select destination folder**, select **Next**. +1. Select **Windows** as the computer platform to install MATLAB. +1. On the **Select product** page, ensure that MATLAB is selected along with any other MathWorks products you want to install. +1. On the **Confirm Selections and Download** page, select **Begin Download**. +1. Wait for the selected products to download, and then select **Finish**. You can also download an ISO image from the MathWorks website. -1. Log into your account for [https://www.mathworks.com](https://www.mathworks.com). -2. Go to [https://www.mathworks.com/downloads](https://www.mathworks.com/downloads). -3. Select the release of MATLAB you wish to install. -4. Click the ΓÇ£Get {version}.iso imageΓÇ¥ link beneath the Related links where {version} is something like R2020a. -5. Click the blue **download release** link for Windows. +1. Sign into your MathWorks account at https://www.mathworks.com. +1. Go to [https://www.mathworks.com/downloads](https://www.mathworks.com/downloads). +1. Select the MATLAB release you want to install. +1. Select the ΓÇ£Get {version}.iso imageΓÇ¥ link present below the Related links. For example, here the {version} is R2022a. +1. Select the blue **Download Release** link for Windows. ### Run installer -Once the files are downloaded, the second step is to run the installer. Once again, you must be a license administrator to complete this step. Only license administrators can install MATLAB with a file installation key. --1. Check the downloaded license file and verify the SERVER line lists the license server correctly. For information regarding how the license file should be formatted, see [update network license](https://www.mathworks.com/help/install/ug/network-license-files.html), [license borrowing](https://www.mathworks.com/help/install/license/borrow-licenses.html), and [find host ID](https://www.mathworks.com/matlabcentral/answers/101892-what-is-a-host-id-how-do-i-find-my-host-id-in-order-to-activate-my-license) articles. -2. Launch the MATLAB Installer. -3. On the **Sign in to your MathWorks Account** page, enter your MathWorks account. -4. On the **MathWorks License Agreement** page, accept the term and click the **Next** button. -5. Click the **Advanced Options** drop-down and choose **I have a File Installation Key**. -6. On the **Install using File Installation Key** page, enter the file installation key for the license server. Click **Next**. -7. On the **Select License File** page, navigate to the license file saved when downloading the installation files earlier. -8. On the **Select Destination Folder** page, click **Next**. -9. On the **Select Products** page, click **Next**. -10. On the **Select Options** page, click **Next**. -11. On the **Confirm Selections and Install** page, click **Begin Install**. -12. On the **Installation Complete** page, verify **Activate MATLAB** is checked. Click **Finish**. +Once the files are downloaded, the second step is to run the installer. Once again, you must be a license administrator to complete this step. Only the license administrators can install MATLAB with a file installation key. ++1. Check the downloaded license file and verify that the SERVER line lists the license server correctly. For more information on how to format the license file, see [update network license](https://www.mathworks.com/help/install/ug/network-license-files.html), [license borrowing](https://www.mathworks.com/help/install/license/borrow-licenses.html), and [find host ID](https://www.mathworks.com/matlabcentral/answers/101892-what-is-a-host-id-how-do-i-find-my-host-id-in-order-to-activate-my-license). +1. Launch the MATLAB Installer. +1. On the **Sign in to your MathWorks Account** page, enter your MathWorks account details. +1. On the **MathWorks License Agreement** page, accept the terms and select the **Next** button. +1. Select the **Advanced Options** drop-down and choose **I have a File Installation Key** option. +1. On the **Install using File Installation Key** page, enter the file installation key for the license server, and then select **Next**. +1. On the **Select License File** page, navigate to the license file saved while downloading the installation files earlier. +1. On the **Select Destination Folder** page, select **Next**. +1. On the **Select Products** page, select **Next**. +1. On the **Select Options** page, select **Next**. +1. On the **Confirm Selections and Install** page, select **Begin Install**. +1. On the **Installation Complete** page, verify **Activate MATLAB** is checked, and then select **Finish**. ## Cost estimate -Let's cover a possible cost estimate for this class. This estimate does not include the cost of running the license server. We'll use a class of 25 students. There are 20 hours of scheduled class time. Also, each student gets 10 hours quota for homework or assignments outside scheduled class time. The virtual machine size we chose was medium, which is 55 lab units. +Let's cover a possible cost estimate for this class. This estimate doesn't include the cost of running the license server. The virtual machine size we chose was medium, which is 55 lab units. -Here is an example of a possible cost estimate for this class: +For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the cost estimate would be: 25 students \* (20 scheduled hours + 10 quota hours) \* 55 lab units \* 0.01 USD per hour = 412.50 USD >[!IMPORTANT]-> Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +> Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Next steps -Next steps are common to setting up any lab. --- [Create, manage, and publish a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Networking Gns3 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-networking-gns3.md | -# Set up a lab to teach a networking class -This article shows you how to set up a class that focuses on allowing students to emulate, configure, test, and troubleshoot virtual and real networks using [GNS3](https://www.gns3.com/) software. +# Set up a lab to teach a networking class -This article has two main sections. The first section covers how to create the classroom lab. The second section covers how to create the template machine with nested virtualization enabled and with GNS3 installed and configured. ++This article shows you how to set up a class that focuses on allowing students to emulate, configure, test, and troubleshoot virtual and real networks using [GNS3](https://www.gns3.com/) software. ++This article has two main sections. The first section covers how to create the lab. The second section covers how to create the template machine with nested virtualization enabled and with GNS3 installed and configured. ## Lab configuration-To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing account. See the following tutorial for creating a new lab account: [Tutorial to setup a lab account](tutorial-setup-lab-account.md). -Follow [this tutorial](tutorial-setup-classroom-lab.md) to create a new lab and then apply the following settings: +++### Lab settings + -| Virtual machine size | Image | -| -- | -- | -| Large (Nested Virtualization) | Windows 10 Pro, Version 1909 | +| Lab settings | Value | +| | | +| Virtual machine (VM) size | Medium (Nested Virtualization) | +| VM image | Windows 10 Pro, Version 1909 | -## Template machine +## Template machine configuration +++To configure the template VM, we'll complete the following major tasks. -After the template machine is created, start the machine and connect to it to complete the following three major tasks. - 1. Prepare the template machine for nested virtualization. 2. Install GNS3. 3. Create nested GNS3 VM in Hyper-V. After the template machine is created, start the machine and connect to it to co 5. Add appropriate appliances. 6. Publish template. - ### Prepare template machine for nested virtualization-- Follow instructions in [this article](how-to-enable-nested-virtualization-template-vm.md) to prepare your template virtual machine for nested virtualization. ++Follow instructions to [enable nested virtualization](how-to-enable-nested-virtualization-template-vm.md) to prepare your template virtual machine for nested virtualization. ### Install GNS3+ - Follow the instructions for [installing GNS3 on Windows](https://docs.gns3.com/docs/getting-started/installation/windows). Make sure to include installing the **GNS3 VM** in the component dialog, see below.  Eventually you'll reach the GNS3 VM selection. Make sure to select the **Hyper-V  - This option will download the PowerShell script and VHD files to create the GNS3 VM in the Hyper-V manager. Continue installation using the default values. **Once the setup is complete, don't start GNS3**. + This option will download the PowerShell script and VHD files to create the GNS3 VM in the Hyper-V manager. Continue installation using the default values. ++ > [!IMPORTANT] + > Once the setup is complete, don't start GNS3. ### Create GNS3 VM+ Once the setup has completed, a zip file **"GNS3.VM.Hyper-V.2.2.17.zip"** is downloaded to the same folder as the installation file, containing the drives and the PowerShell script to create the Hyper-V vm.+ - **Extract all** on the GNS3.VM.Hyper-V.2.2.17.zip. This action will extract out the drives and the PowerShell script to create the VM.-- **Run with PowerShell** on the "create-vm.ps1" PowerShell script by right clicking on the file.+- **Run with PowerShell** on the "create-vm.ps1" PowerShell script by right-clicking on the file. - An Execution Policy Change request may show up. Enter "Y" to execute the script.  Once the setup has completed, a zip file **"GNS3.VM.Hyper-V.2.2.17.zip"** is dow - Once the script has completed, you can confirm the VM "GNS3 VM" has been created in the Hyper-V Manager. ### Configure GNS3 to use Hyper-V VM+ Now that GNS3 is installed and the GNS3 VM is added, start up GNS3 to link the two together. The [GNS3 Setup wizard will start automatically.](https://docs.gns3.com/docs/getting-started/setup-wizard-gns3-vm#local-gns3-vm-setup-wizard). -- Use the **Run appliances from virtual machine.** option. Use the defaults for the rest of the wizard until you hit the **VMware vmrun tool cannot be found.** error.++- Use the **Run appliances from virtual machine** option. Use the defaults for the rest of the wizard until you hit the **VMware vmrun tool cannot be found** error.  - Choose **Ok**, and **Cancel** out of the wizard. - To complete the connection to the Hyper-V vm, open the **Edit** -> **Preferences** -> **GNS3 VM** and select **Enable the GNS3 VM** and select the **Hyper-V** option.- +  ### Add appropriate appliances At this point, you'll want to add the appropriate [appliances for the class.](https://docs.gns3.com/docs/using-gns3/beginners/install-from-marketplace) -### Publish template +### Prepare to publish template Now that the template VM is set up properly, and ready for publishing there are a few key points to check.+ - Make sure that the GNS3 VM is shut down or turned off. Publishing while the VM is still running will corrupt the VM. - Close down GNS3, publishing while and running can lead to unintended side effects. - Clean up any installation files or other unnecessary files. +>[!IMPORTANT] +>Publishing while the VM is still running will corrupt the template VMs and create unusable lab VMs. + ## Cost -If you would like to estimate the cost of this lab, you can use the following example: - -For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be: +If you would like to estimate the cost of this lab, you can use the following example: -25 students * (20 + 10) hours * 84 Lab Units * 0.01 USD per hour = 630 USD. +For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be: -**Important:** Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +25 students \* (20 + 10) hours \* 84 Lab Units \* 0.01 USD per hour = 630 USD. ++> [!IMPORTANT] +> Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion+ This article walked you through the steps to create a lab for network configuration using GNS3. ## Next steps-Next steps are common to setting up any lab: -- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) -- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users). |
| lab-services | Class Type Pltw | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-pltw.md | Title: Set up Project Lead The Way labs with Azure Lab Services description: Learn how to set up labs to teach Project Lead The Way classes. Previously updated : 10/28/2020 Last updated : 03/02/2022+ # Set up labs for Project Lead The Way classes -[Project Lead The Way (PLTW)](https://www.pltw.org/) is a nonprofit organization that provides PreK–12 curriculum across the United States in computer science, engineering, and biomedical science. In each PLTW class, students use a variety of software applications as part of their hands-on learning experience. Many of the software applications require either a fast CPU or, in some cases, a GPU. This article shows you how to set up labs for the following PLTW classes, which are typically offered to students in grades 9–12: ++[Project Lead The Way (PLTW)](https://www.pltw.org/) is a nonprofit organization that provides PreK–12 curriculum across the United States in computer science, engineering, and biomedical science. In each PLTW class, students use various software applications as part of their hands-on learning experience. Many of the software applications require either a fast CPU or, in some cases, a GPU. This article shows you how to set up labs for the following PLTW classes. The classes are typically offered to students in grades 9–12: - **Introduction to Engineering Design** Students are introduced to the process of engineering design, which includes using [Autodesk Inventor computer-aided design (CAD)](https://www.autodesk.com/products/inventor/new-features) software for 3D modeling. - **Principles of Engineering**- - Students learn about engineering mechanisms, structural and material strength, and automation. This class uses software such as [MD Solids](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/MD+Solids/MD+Solids+Software+Installation+Guide.pdf), [West Point Bridge Designer](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/West+Point+Bridge+Builder/Installation+Guide+for+West+Point+Bridge+Designer.pdf), and [AmericaΓÇÖs Army simulation](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/America's+Army/Installation+Guide+for+Americas+Army+Simulation+17-18.pdf). ++ Students learn about engineering mechanisms, structural and material strength, and automation. This class uses software such as [MD Solids](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/MD+Solids/MD+Solids+Software+Installation+Guide.pdf), [West Point Bridge Designer](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/West+Point+Bridge+Builder/Installation+Guide+for+West+Point+Bridge+Designer.pdf), and [AmericaΓÇÖs Army simulation](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/America's+Army/Installation+Guide+for+Americas+Army+Simulation+17-18.pdf). - **Civil Engineering and Architecture** Last updated 10/28/2020 - **Computer Integrated Manufacturing** - Students explore modern manufacturing processes that involve robotics and automation. In this class, students use [Autodesk Inventor CAD](https://www.autodesk.com/products/inventor/new-features) and [Autodesk Inventor computer-aided manufacturing (CAM)](https://www.autodesk.com/products/inventor-cam/overview) software. + Students explore modern manufacturing processes that involve robotics and automation. In this class, students use [Autodesk Inventor CAD](https://www.autodesk.com/products/inventor/new-features) and [Autodesk Inventor computer-aided manufacturing (CAM)](https://www.autodesk.com/products/inventor-cam/overview) software. - **Digital Electronics** Last updated 10/28/2020 - **Engineering Design and Development** - Students contribute to an end-to-end solution by combining research, design, and testing that they present to a panel of engineers. In this class, students use [Autodesk Inventor CAD](https://www.autodesk.com/products/inventor/new-features) software. + Students contribute to an end-to-end solution by combining research, design, and testing that they present to a panel of engineers. In this class, students use [Autodesk Inventor CAD](https://www.autodesk.com/products/inventor/new-features) software. - **Computer Science Essentials** - Students are introduced to computational concepts and tools. They start with block-based programming and then move to text-based coding by using coding environments such as [VEXcode V5 blocks](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/VEXcode+V5+Blocks/VexCode+V5+Blocks+Installation+Guide.pdf). + Students are introduced to computational concepts and tools. They start with block-based programming and then move to text-based coding by using coding environments such as [VEXcode V5 blocks](https://s3.amazonaws.com/support-downloads.pltw.org/2020-21/VEXcode+V5+Blocks/VexCode+V5+Blocks+Installation+Guide.pdf). - **Computer Science Principles**- - Students grow their programming expertise with [Python](https://www.python.org/) by using the [Microsoft Visual Studio Code development environment](https://code.visualstudio.com/). ++ Students grow their programming expertise with [Python](https://www.python.org/) by using the [Microsoft Visual Studio Code development environment](https://code.visualstudio.com/). - **Computer Science A** - Students expand their programming competence in this class by learning mobile app development. In this class, they learn [Java](https://www.java.com/) by using the [Microsoft Visual Studio Code development environment](https://code.visualstudio.com/). Students also use an emulator that allows them to run and test their mobile app code. For information about how to set up an emulator in Azure Lab Services, contact us via the [Azure Lab Services' forums](https://techcommunity.microsoft.com/t5/azure-lab-services/bd-p/AzureLabServices) for more information. + Students expand their programming competence in this class by learning mobile app development. In this class, they learn [Java](https://www.java.com/) by using the [Microsoft Visual Studio Code development environment](https://code.visualstudio.com/). Students also use an emulator that allows them to run and test their mobile app code. For information about how to set up an emulator in Azure Lab Services, contact us via the [Azure Lab Services' forums](https://techcommunity.microsoft.com/t5/azure-lab-services/bd-p/AzureLabServices) for more information. For a full list of class software, go to the [PLTW site](https://www.pltw.org/pltw-software) for each class. -## Lab configuration +To begin setting up labs for PLTW, you need access to an Azure subscription and a lab plan. Discuss with your organization's admin to see if you can get access to an existing Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. -To begin setting up labs for PLTW, you need an Azure subscription and lab account. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. +## License server -After you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see [Set up a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +Most of the software that's used in the earlier-mentioned PLTW classes *don't* require access to a license server. However, you'll need to access a license server if you plan to use the Autodesk network licensing model for the following software: -After you've set up a lab account, you should create a separate lab for each PLTW class session that your school offers. We also recommend that you create separate images for each type of PLTW class. For more information about how to structure your labs and images, see the blog post [Moving from a Physical Lab to Azure Lab Services](https://techcommunity.microsoft.com/t5/azure-lab-services/moving-from-a-physical-lab-to-azure-lab-services/ba-p/1654931). +- Revit +- Inventor CAD +- Inventor CAM -### Lab account settings +To use network licensing with Autodesk software, [PLTW provides detailed steps](https://www.pltw.org/pltw-software) to install Autodesk Network License Manager on your license server. This license server is ordinarily located in either your on-premises network or hosted on an Azure virtual machine (VM) within Azure virtual network. -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +After your license server is set up, you need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) when creating your [lab plan](./tutorial-setup-lab-plan.md). -| Lab account setting | Instructions | -| -- | -- | -| Marketplace image | Enable the Windows 10 Pro image for use within your lab account. | +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. -<br> +Autodesk-generated license files embed the MAC address of the license server. If you decide to host your license server by using an Azure VM, itΓÇÖs important to ensure that your license serverΓÇÖs MAC address doesnΓÇÖt change. If the MAC address changes, you'll need to regenerate your licensing files. Following are the steps to prevent your MAC address from changing: -### Lab settings -The size of the virtual machine (VM) that we recommend using for PLTW classes depends on the types of workloads that your students are doing in the class. For the earlier-listed classes, we recommend using Small GPU (Visualization) and Large VM sizes. As you set up labs for your PLTW classes, refer to the guidance in the following table: +- [Set a static private IP and MAC address](how-to-create-a-lab-with-shared-resource.md#tips) for the Azure VM that hosts your license server. +- Ensure to set up both your lab plan and the license serverΓÇÖs virtual network are in a region or location that has sufficient VM capacity so that you donΓÇÖt have to move these resources to a new region or location later. -| Lab setting | Value and description | Class recommendation | -| | | | -| Virtual Machine Size | **Small GPU (Visualization)**<br>Best suited for remote visualization, streaming, gaming, and encoding with frameworks such as OpenGL and DirectX. | We recommend using this size for the following PLTW classes: Civil Engineering and Architecture, Digital Electronics, Computer Integrated Manufacturing, Engineering Design and Development, and Introduction to Engineering Design. -| Virtual Machine Size | **Large**<br>Best suited for applications that need faster CPUs, better local disk performance, large databases, and large memory caches. | We recommend using this size for the following PLTW classes: Principles of Engineering, Computer Science Essentials, Computer Science Principles, and Computer Science A. | +For more information, see [Set up a license server as a shared resource](./how-to-create-a-lab-with-shared-resource.md). ++## Lab configuration ++Once you have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). ++After you set up a lab plan, create a separate lab for each PLTW class session that your school offers. We also recommend that you create separate images for each type of PLTW class. For more information about how to structure your labs and images, see the blog post [Moving from a Physical Lab to Azure Lab Services](https://techcommunity.microsoft.com/t5/azure-lab-services/moving-from-a-physical-lab-to-azure-lab-services/ba-p/1654931). -<br> +### Lab plan settings -### License server -Most of the software that's used in the earlier-mentioned PLTW classes do *not* require access to a license server. However, you'll need to access a license server if you plan to use the Autodesk network licensing model for the following software: -- Revit-- Inventor CAD-- Inventor CAM+Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -To use network licensing with Autodesk software, [PLTW provides detailed steps](https://www.pltw.org/pltw-software) to install Autodesk Network License Manager on your license server. This license server is ordinarily located in either your on-premises network or hosted on an Azure virtual machine (VM) within in Azure virtual network. +| Lab account setting | Instructions | +| -- | -- | +| Marketplace image | Enable the Windows 10 Pro image for use within your lab account. | -After your license server is set up, you'll need to [peer the virtual network](./how-to-connect-peer-virtual-network.md) with your [lab account](./tutorial-setup-lab-account.md). You need to do the network peering *before* you create the lab so that your lab VMs can access the license server and vice versa. +### Lab settings -Autodesk-generated license files embed the MAC address of the license server. If you decide to host your license server by using an Azure VM, itΓÇÖs important to make sure that your license serverΓÇÖs MAC address doesnΓÇÖt change. If the MAC address changes, you'll need to regenerate your licensing files. To prevent your MAC address from changing, do the following: +The recommended size of the virtual machine (VM) for using PLTW classes depends on the types of workloads that your students are doing in the class. For the earlier-listed classes, we recommend using Small GPU (Visualization) and Large VM sizes. As you set up labs for your PLTW classes, refer to the guidance in the following table: -- [Set a static private IP and MAC address](./how-to-create-a-lab-with-shared-resource.md#static-private-ip-and-mac-address) for the Azure VM that hosts your license server.-- Be sure to set up both your lab account and the license serverΓÇÖs virtual network in a region or location that has sufficient VM capacity so that you donΓÇÖt have to move these resources to a new region or location later.+| Lab setting | Value and description | Class recommendation | +| | | | +| Virtual Machine Size | **Small GPU (Visualization)**. Best suited for remote visualization, streaming, gaming, and encoding with frameworks such as OpenGL and DirectX. | We recommend using this size for the following PLTW classes: Civil Engineering and Architecture, Digital Electronics, Computer Integrated Manufacturing, Engineering Design and Development, and Introduction to Engineering Design. +| Virtual Machine Size | **Large**. Best suited for applications that need faster CPUs, better local disk performance, large databases, and large memory caches. | We recommend using this size for the following PLTW classes: Principles of Engineering, Computer Science Essentials, Computer Science Principles, and Computer Science A. | -For more information, see [Set up a license server as a shared resource](./how-to-create-a-lab-with-shared-resource.md). +### Template machine configuration -### Template machine Some of the installation files that you need for PLTW are large. When you download the files to a lab template VM, they might take a long time to copy. -Instead of downloading installation files to the template machine and installing everything there, we recommend creating your PLTW images in your physical environment. You can then import the custom images into a shared image gallery so that you can use them to create your labs. For more information, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). +Instead of downloading installation files to the template machine and installing everything there, we recommend creating your PLTW images in your physical environment. You can then import the custom images into a compute gallery so that you can use them to create your labs. For more information, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). As you follow this recommendation, note the major tasks for setting up a lab: 1. In your physical environment, create the image for the class. - a. Use PLTWΓÇÖs detailed steps for downloading the installation files and installing the required software. -- > [!NOTE] - > When you install the Autodesk applications, the computer that you're installing them on needs to be able to communicate with your license server. The Autodesk installation wizard will prompt you to specify the computer name of the machine that the license server is hosted on. If you're hosting your license server on an Azure VM, you might need to wait to install Autodesk on the lab template VM so that the installation wizard can access your license server. + a. Use PLTWΓÇÖs detailed steps for downloading the installation files and installing the required software. - b. [Install and configure OneDrive](./how-to-prepare-windows-template.md#install-and-configure-onedrive) or other backup options that your school might use. - - c. [Install and configure Windows updates](./how-to-prepare-windows-template.md#install-and-configure-updates). + > [!NOTE] + > When you install the Autodesk applications, the computer that you're installing them on needs to be able to communicate with your license server. The Autodesk installation wizard will prompt you to specify the computer name of the machine that the license server is hosted on. If you're hosting your license server on an Azure VM, you might need to wait to install Autodesk on the lab template VM so that the installation wizard can access your license server. -1. Upload the custom image to the [shared image gallery that's attached to your lab account](./how-to-attach-detach-shared-image-gallery.md). + b. [Install and configure OneDrive](./how-to-prepare-windows-template.md#install-and-configure-onedrive) or other backup options that your school might use. + c. [Install and configure Windows updates](./how-to-prepare-windows-template.md#install-and-configure-updates). -1. Create a lab, and then select the custom image that you uploaded in the preceding step. --1. After the lab is created, start and connect to the template VM to validate that the image works as expected. --1. Finally, publish the template VM to create the studentsΓÇÖ VMs. +1. Upload the custom image to the [compute gallery that's attached to your lab account](./how-to-attach-detach-shared-image-gallery.md). +1. Create a lab, and then select the custom image that you uploaded in the preceding step. +1. After the lab is created, start and connect to the template VM to validate that the image works as expected. +1. Finally, publish the template VM to create the studentsΓÇÖ VMs. > [!NOTE]-> If your school needs to perform content filtering, such as for compliance with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act), you will need to use 3rd party software. For more information, read guidance on [content filtering with Lab Services](./administrator-guide.md#content-filtering). +> If your school needs to perform content filtering, such as for compliance with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act), you'll need to use 3rd party software. For more information, read guidance on [content filtering with Lab Services](./administrator-guide.md#content-filtering). ## Student devices+ Students can connect to their lab VMs from Windows computers, Mac, and Chromebook. For instructions, see: -- [Connect from Windows](./how-to-use-classroom-lab.md#connect-to-the-vm)+- [Connect from Windows](./how-to-use-lab.md#connect-to-the-vm) - [Connect from Mac](./connect-virtual-machine-mac-remote-desktop.md) - [Connect from Chromebook](./connect-virtual-machine-chromebook-remote-desktop.md) ## Cost-LetΓÇÖs cover an example cost estimate for the PLTW classes. This estimate doesnΓÇÖt include the cost of running a license server or using a shared image gallery. Suppose you have a class of 25 students, each of whom has 20 hours of scheduled class time. Each student also has an additional 10 quota hours for homework or assignments outside of scheduled class time. Here are the estimated costs: ++LetΓÇÖs cover an example cost estimate for the PLTW classes. This estimate doesnΓÇÖt include the cost of running a license server or using a compute gallery. ++Suppose you have a class of 25 students, each of whom has 20 hours of scheduled class time. Each student also has an extra 10 quota hours for homework or assignments outside of scheduled class time. Here are the estimated costs: - **Large VM** LetΓÇÖs cover an example cost estimate for the PLTW classes. This estimate does 25 students × (20 scheduled hours + 10 quota hours) × 160 Lab Units × USD0.01 per hour = USD1200.00 -> [!IMPORTANT] -> The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). +> [!IMPORTANT] +> The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). -> [!NOTE] -> Many of the PLTW classes use applications that are accessed via a browser, such as MIT App Inventor. These browser-based applications donΓÇÖt require a fast CPU or GPU, and you can access them from any device that has an internet connection. When students are using these types of applications, we recommend that they use the browser on their physical device instead the browser on their lab VM. Students can help keep costs down by using their lab VM only for applications that require a fast CPU or GPU. +> [!NOTE] +> Many of the PLTW classes use applications that are accessed via a browser, such as MIT App Inventor. These browser-based applications donΓÇÖt require a fast CPU or GPU, and you can access them from any device that has an internet connection. When students are using these types of applications, we recommend that they use the browser on their physical device instead the browser on their lab VM. Students can help keep costs down by using their lab VM only for applications that require a fast CPU or GPU. ## Next steps -As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) -- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type React Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-react-linux.md | Title: Set up a lab with React on Linux using Azure Lab Services description: Learn how to set up labs to React development class. Previously updated : 05/16/2021 Last updated : 04/25/2022+ # Set up lab for React on Linux + [React](https://reactjs.org/) is a popular JavaScript library for building user interfaces (UI). React is a declarative way to create reusable components for your website. There are many other popular libraries for JavaScript-based front-end development. We'll use a few of these libraries while creating our lab. [Redux](https://redux.js.org/) is a library that provides predictable state container for JavaScript apps and is often used in compliment with React. [JSX](https://reactjs.org/docs/introducing-jsx.html) is a library syntax extension to JavaScript often used with React to describe what the UI should look like. [NodeJS](https://nodejs.org/) is a convenient way to run a webserver for your React application. -This article will show how to install [Visual Studio Code](https://code.visualstudio.com/) for your development environment, the tools, and libraries needed for a React web development class. +This article shows you how to install [Visual Studio Code](https://code.visualstudio.com/) for your development environment, the tools, and libraries needed for a React web development class. ## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings -### Lab account settings +Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -| Lab account setting | Instructions | +| Lab plan setting | Instructions | | -- | | -| Marketplace images | Enable the 'Ubuntu Server 18.04 LTS' image for use within your lab account. | +| Marketplace images | Enable the 'Ubuntu Server 18.04 LTS' image. | ### Lab settings -The size of the virtual machine (VM) that we recommend depends on the types of workloads that your students need to do. +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. -| Lab setting | Value and description | +| Lab setting | Value | | | |-| Virtual Machine Size | **Small**.| +| Virtual Machine Size | **Small** | -We recommend testing your workloads to see if a larger size is needed. For more information about each size, see [VM sizing](administrator-guide.md#vm-sizing). +We recommend that you test your workloads to see if a larger size is needed. For more information about each size, see [VM sizing](administrator-guide.md#vm-sizing). ## Template machine configuration The steps in this section show how to complete the following to set up the templ 1. Install [Reactive Native Tools extension for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=msjsdiag.vscode-react-native). 1. Optionally, install extensions for development with [Redux](https://marketplace.visualstudio.com/search?term=Redux&target=VSCode&category=All%20categories&sortBy=Relevance) and [JSX](https://marketplace.visualstudio.com/search?term=JSX&target=VSCode&category=All%20categories&sortBy=Relevance). -[Create React App](https://create-react-app.dev/) is an officially supported way to create a ReactApp and requires no further configuration if using npm 5.2 and above. For instructions using Create React App, see their [getting started](https://create-react-app.dev/docs/getting-started) documentation. +[Create React App](https://create-react-app.dev/) is an officially supported way to create a React app and requires no further configuration if you're using npm 5.2 and above. For more instructions on how to use Create React App, see their [getting started](https://create-react-app.dev/docs/getting-started) documentation. Other components needed for a React-based website are installed using NPM into a specific application. For example, enter the following commands to install the Redux and JSX libraries: Install the React Developer Tools extensions for your browser so you can inspect - [React Developer Tools Chrome extension](https://chrome.google.com/webstore/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi) - [React Developer Tools FireFox add-on](https://addons.mozilla.org/firefox/addon/react-devtools/) -To run the app in development mode, use the `npm start` built-in command. The local and network urls will be listed in the command output. To use HTTPS instead of HTTP, see [create React app using https in development](https://create-react-app.dev/docs/using-https-in-development). +To run the app in development mode, use the `npm start` built-in command. The local and network urls will be listed in the command output. For more information on how to use HTTPS instead of HTTP, see [Create React App: Using HTTPS in Development](https://create-react-app.dev/docs/using-https-in-development). ### Update firewall settings -Official Ubuntu builds have [iptables](https://help.ubuntu.com/community/IptablesHowTo) installed and will allow all incoming traffic by default. However, if you're using a VM that has a more restrictive firewall, add an inbound rule to allow traffic to the NodeJS server. The example below uses [iptables](https://help.ubuntu.com/community/IptablesHowTo) to allow traffic to port 3000. +Official Ubuntu builds have [iptables](https://help.ubuntu.com/community/IptablesHowTo) installed and will allow all incoming traffic by default. However, if you're using a VM that has a more restrictive firewall, add an inbound rule to allow traffic to the NodeJS server. The example below uses [iptables](https://help.ubuntu.com/community/IptablesHowTo) to allow traffic to port 3000. ```bash sudo iptables -I INPUT -p tcp -m tcp --dport 3000 -j ACCEPT ``` >[!IMPORTANT]->Instructors must use the template VM or another lab VM to access a student's website. +>Educators must use the template VM or another lab VM to access a student's website. ## Cost -LetΓÇÖs cover an example cost estimate for this class. Suppose you have a class of 25 students. Each student has 20 hours of scheduled class time. Another 10 quota hours for homework or assignments outside of scheduled class time is given to each student. The virtual machine size we chose was **Small**, which is 20 lab units. +LetΓÇÖs cover an example cost estimate for this class. The virtual machine size we chose was **Small**, which is 20 lab units. ++For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the cost estimate would be: -- 25 students × (20 scheduled hours + 10 quota hours) × 20 Lab Units × USD0.01 per hour = 150.00 USD+25 students × (20 scheduled hours + 10 quota hours) × 20 Lab Units × USD0.01 per hour = 150.00 USD > [!IMPORTANT]-> The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). +> The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Next steps -The template image can now be published to the lab. See [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm) for further instructions. --As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type React Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-react-windows.md | -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +To set up this lab, you need an Azure subscription and lab plan to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings -### Lab account settings +Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). | Lab account setting | Instructions | | -- | -- |-| Marketplace image | Enable 'Visual Studio 2019 Community (latest release) on Windows Server 2019 (x64)' image for use within your lab account. | +| Marketplace image | Enable 'Visual Studio 2019 Community (latest release) on Windows Server 2019 (x64)' image. | ### Lab settings -The size of the virtual machine (VM) that we recommend depends on the types of workloads that your students need to do. +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. -| Lab setting | Value and description | +| Lab setting | Value | | | | | Virtual Machine Size | **Medium** | To create your first Node.js with React app in Visual Studio, see [Tutorial: Cre Install the React Developer Tools extensions for your browser so you can inspect React components and record performance information. -- [React Developer Tools Edge add-on](https://microsoftedge.microsoft.com/addons/detail/react-developer-tools/gpphkfbcpidddadnkolkpfckpihlkkil)+- [React Developer Tools add-on for Microsoft Edge](https://microsoftedge.microsoft.com/addons/detail/react-developer-tools/gpphkfbcpidddadnkolkpfckpihlkkil) - [React Developer Tools Chrome extension](https://chrome.google.com/webstore/detail/react-developer-tools/fmkadmapgofadopljbjfkapdkoienihi) - [React Developer Tools FireFox add-on](https://addons.mozilla.org/firefox/addon/react-devtools/) New-NetFirewallRule -DisplayName "Allow access to Port 1337" -Direction Inbound ``` >[!IMPORTANT]->Instructors must use the template VM or another lab VM to access a student's website. +>Educators must use the template VM or another lab VM to access a student's website. ## Cost LetΓÇÖs cover an example cost estimate for this class. Suppose you have a class ## Next steps -The template image can now be published to the lab. See [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm) for further instructions. --As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Rstudio Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-rstudio-linux.md | -## Lab Account configuration +## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +To set up this lab, you need an Azure subscription and lab plan to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. -### Lab account settings +### External resource configuration -Enable your lab account settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). +Some classes require files, such as large data files, to be stored externally. See [use external file storage in Azure Lab Services](how-to-attach-external-storage.md) for options and setup instructions. -| Lab account setting | Instructions | -| -- | -- | -| Marketplace images | Ubuntu Server 18.04 LTS | -| [Enable peer virtual network](how-to-connect-peer-virtual-network.md) | Enable if:<ul><li>Class requires a shared R Server.</li><li>Class requires large data files that you want to store externally and not on the student VM.</li></ul> | +If you choose to have a shared R Server for the students, the server should be set up before the lab is created. For more information on how to set up a shared server, see [how to create a lab with a shared resource in Azure Lab Services](how-to-create-a-lab-with-shared-resource.md). For instructions to create an RStudio Server, see [Download RStudio Server for Debian & Ubuntu](https://www.rstudio.com/products/rstudio/download-server/debian-ubuntu/) and [Accessing RStudio Server Open-Source](https://support.rstudio.com/hc/en-us/articles/200552306-Getting-Started). ++If you choose to use any external resources, youΓÇÖll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) with your [lab plan](./tutorial-setup-lab-plan.md) > [!IMPORTANT]-> If you choose to enable peer virtual network, this must be done before the lab is created. +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. -## Lab configuration +### Lab plan settings ++Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. ++Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -For instructions to create a new lab and apply the needed settings, see [Tutorial: Set up a classroom lab](tutorial-setup-classroom-lab.md). When creating the lab, apply the following settings: +| Lab plan setting | Instructions | +| -- | -- | +| Marketplace images | Enable **Ubuntu Server 18.04 LTS** image. | ++### Lab settings ++For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab setting | Value and description | | | | | Virtual Machine Size | Small GPU (Compute)| | VM image | Ubuntu Server 18.04 LTS |-| Enable remote desktop connection | This setting should be enabled if you choose to use RDP. This setting isn't needed if you choose [X2Go to connect to lab machines](how-to-use-remote-desktop-linux-student.md). You'll need to connect to the Linux VM using SSH the first time and install the RDP/X2Go and GUI packages. For more information, see [enable graphical remote desktop for Linux VMs](how-to-enable-remote-desktop-linux.md). | +| Enable remote desktop connection | This setting should be enabled if you choose to use RDP. This setting isn't needed if you choose [X2Go to connect to lab machines](connect-virtual-machine-linux-x2go.md). | -## External resource configuration --Some classes require files, such as large data files, to be stored externally. See [use external file storage in Azure Lab Services](how-to-attach-external-storage.md) for options and setup instructions. --If you choose to have a shared R Server for the students, the server should be set up before the lab is created. For more information on how to set up a shared server, see [how to create a lab with a shared resource in Azure Lab Services](how-to-create-a-lab-with-shared-resource.md). For instructions to create an RStudio Server, see [Download RStudio Server for Debian & Ubuntu](https://www.rstudio.com/products/rstudio/download-server/debian-ubuntu/) and [Accessing RStudio Server Open-Source](https://support.rstudio.com/hc/en-us/articles/200552306-Getting-Started). +If you choose to instead use RDP, you will need to connect to the Linux VM using SSH and install the RDP and GUI packages before publishing the lab. Then, students can connect to the Linux VM using RDP later. For more information, see [Enable graphical remote desktop for Linux VMs](how-to-enable-remote-desktop-linux.md). ## Template configuration sudo apt upgrade ### Install X2Go Server -If you choose to use X2Go, install the server. You'll first need to [connect using ssh](how-to-use-remote-desktop-linux-student.md#connect-to-the-student-vm-using-ssh) to install the server component. Once that is completed, the rest of the setup can be completed after [connecting using the X2Go client](how-to-use-remote-desktop-linux-student.md). +If you choose to use X2Go, [install the server](https://aka.ms/azlabs/scripts/LinuxDesktop). You'll first need to [Connect to a Linux lab VM using SSH](connect-virtual-machine.md#connect-to-a-linux-lab-vm-using-ssh) to install the server component. Once that is completed, the rest of the setup can be completed after [connecting using the X2Go client](connect-virtual-machine-linux-x2go.md). The default installation of X2Go isn't compatible with RStudio. To work around this issue, update the x2goagent options file. LetΓÇÖs cover an example cost estimate for this class. Suppose you have a class ## Next steps -The template image can now be published to the lab. See [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm) for further instructions. --As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Rstudio Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-rstudio-windows.md | -[R](https://www.r-project.org/https://docsupdatetracker.net/about.html) is an open-source language used for statistical computing and graphics. It's used in the statistical analysis of genetics to natural language processing to analyzing financial data. R provides an [interactive command line](https://cran.r-project.org/doc/manuals/r-release/R-intro.html#Invoking-R-from-the-command-line) experience. [RStudio](https://www.rstudio.com/products/rstudio/) is an interactive development environment (IDE) available for the R language. The free version provides code editing tools, an integrated debugging experience, and package development tools. ++[R](https://www.r-project.org/https://docsupdatetracker.net/about.html) is an open-source language used for statistical computing and graphics. It's used in the statistical analysis of genetics to natural language processing to analyzing financial data. R provides an [interactive command line](https://cran.r-project.org/doc/manuals/r-release/R-intro.html#Invoking-R-from-the-command-line) experience. [RStudio](https://www.rstudio.com/products/rstudio/) is an interactive development environment (IDE) available for the R language. The free version provides code-editing tools, an integrated debugging experience, and package development tools. This article will focus on solely RStudio and R as a building block for a class that requires the use of statistical computing. The [deep learning](class-type-deep-learning-natural-language-processing.md) and [Python and Jupyter Notebooks](class-type-jupyter-notebook.md)-class types setup RStudio differently. Each article describes how to use the [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/en-US/marketplace/apps/microsoft-dsvm.ubuntu-1804) marketplace image, which has many [data science related tools](../machine-learning/data-science-virtual-machine/tools-included.md), including RStudio, pre-installed. +class types set up RStudio differently. Each article describes how to use the [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/en-US/marketplace/apps/microsoft-dsvm.ubuntu-1804) marketplace image, which has many [data science related tools](../machine-learning/data-science-virtual-machine/tools-included.md), including RStudio, pre-installed. ++## Lab configuration -## Lab Account configuration +To set up this lab, you need an Azure subscription and lab plan to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. +### External resource configuration -### Lab account settings +Some classes require files, such as large data files, to be stored externally. See [use external file storage in Azure Lab Services](how-to-attach-external-storage.md) for options and setup instructions. -Enable your lab account settings as described in the following table. +If you choose to have a shared R Server for the students, the server should be set up before the lab is created. For more information on how to set up a shared server, see [how to create a lab with a shared resource in Azure Lab Services](how-to-create-a-lab-with-shared-resource.md). For instructions to create an RStudio Server, see [Download RStudio Server for Debian & Ubuntu](https://www.rstudio.com/products/rstudio/download-server/debian-ubuntu/) and [Accessing RStudio Server Open-Source](https://support.rstudio.com/hc/en-us/articles/200552306-Getting-Started). -| Lab account setting | Instructions | -| -- | -- | -| [Enable peer virtual network](how-to-connect-peer-virtual-network.md) | Enable if:<ul><li>Class requires a shared R Server.</li><li>Class requires large data files that you want to store externally and not on the student VM.</li></ul> | +If you choose to use any external resources, youΓÇÖll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) with your [lab plan](./tutorial-setup-lab-plan.md) > [!IMPORTANT]-> If you choose to enable peer virtual network, this must be done before the lab is created. +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. -## Lab configuration +### Lab plan settings ++Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. ++### Lab settings -For instructions to create a new lab and apply the needed settings, see [Tutorial: Set up a classroom lab](tutorial-setup-classroom-lab.md). When creating the lab, apply the following settings: +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab setting | Value and description | | | | | Virtual Machine Size | Small GPU (Compute)| | VM image | Windows 10 Pro. Version 2004 | -## External resource configuration --Some classes require files, such as large data files, to be stored externally. See [use external file storage in Azure Lab Services](how-to-attach-external-storage.md) for options and setup instructions. --If you choose to have a shared RStudio Server for the students, the server should be set up before the lab is created. For more information on how to set up a shared server, see [how to create a lab with a shared resource in Azure Lab Services](how-to-create-a-lab-with-shared-resource.md). For instructions to create an RStudio Server, see [Download RStudio Server for Debian & Ubuntu](https://www.rstudio.com/products/rstudio/download-server/debian-ubuntu/) and [Accessing RStudio Server Open-Source](https://support.rstudio.com/hc/en-us/articles/200552306-Getting-Started). - ## Template configuration After the template machine is created, start the machine, and connect to it to [install R](https://docs.rstudio.com/resources/install-r/) and [RStudio Desktop](https://www.rstudio.com/products/rstudio/download/). LetΓÇÖs cover an example cost estimate for this class. Suppose you have a class ## Next steps -The template image can now be published to the lab. See [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm) for further instructions. --As you set up your lab, see the following articles: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quotas](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Shell Scripting Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-shell-scripting-linux.md | Title: Set up a Linux shell scripting lab with Azure Lab Services | Microsoft Docs description: Learn how to set up a lab to teach shell scripting on Linux. Previously updated : 06/26/2020 Last updated : 03/10/2022+ # Set up a lab to teach shell scripting on Linux -This article shows you how to set up a lab to teach shell scripting on Linux. Scripting is a useful part of system administration that allows administrators to avoid repetitive tasks. In this sample scenario, the class covers traditional bash scripts and enhanced scripts. Enhanced scripts are scripts that combine bash commands and Ruby. This approach allows Ruby to pass data around and bash commands to interact with the shell. +++This article shows you how to set up a lab to teach shell scripting on Linux. Scripting is a useful part of system administration that allows administrators to avoid repetitive tasks. In this sample scenario, the class covers traditional bash scripts and enhanced scripts. Enhanced scripts are scripts that combine bash commands and Ruby. This approach lets Ruby pass the data around and bash commands to interact with the shell. Students taking these scripting classes get a Linux virtual machine to learn the basics of Linux, and also get familiar with the bash shell scripting. The Linux virtual machine comes with remote desktop access enabled and with [gedit](https://help.gnome.org/users/gedit/stable/) and [Visual Studio Code](https://code.visualstudio.com/) text editors installed. ## Lab configuration-To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you have an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing lab account. See the following tutorial for creating a new lab account: [Tutorial to Setup a Lab Account](tutorial-setup-lab-account.md). -After you create the lab account, enable following settings in the lab account: +To set up the lab, you need access to an Azure subscription and a lab account. Discuss with your organization's admin to see if you can get access to an existing Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings -| Lab account setting | Instructions | +When you have an Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. ++Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). ++| Lab plan setting | Instructions | | -- | | -| Marketplace images | Enable the Ubuntu Server 18.04 LTS image for use within your lab account. For more information, see [Specify Marketplace images available to lab creators](specify-marketplace-images.md). | +| Marketplace images | Enable the 'Ubuntu Server 18.04 LTS' image. | ++### Lab settings -Follow [this tutorial](tutorial-setup-classroom-lab.md) to create a new lab and apply the following settings: +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. -| Lab settings | Value/instructions | +| Lab settings | Value/instructions | | | | | Virtual machine (VM) size | Small | | VM image | Ubuntu Server 18.04 LTS|-| Enable remote desktop connection | Enable. <p>Enabling this setting will allow teachers and students to connect to their VMs using the remote desktop (RDP). For more information, see [Enable remote desktop for Linux virtual machines in a lab in Azure Lab Services](how-to-enable-remote-desktop-linux.md). </p>| +| Enable remote desktop connection | **Enable**. Enabling this setting will allow teachers and students to connect to their VMs using the remote desktop (RDP). For more information, see [Enable remote desktop for Linux virtual machines in a lab in Azure Lab Services](how-to-enable-remote-desktop-linux.md). </p>| -## Install desktop and RDP -The Ubuntu Server 18.04 LTS image doesn't have the RDP remote desktop server installed by default. Follow instructions in the [Install and configure Remote Desktop to connect to a Linux VM in Azure](../virtual-machines/linux/use-remote-desktop.md) article to install the packages that are needed on the template machine to connect via remote desktop protocol (RDP). +## Template machine configuration ++### Install desktop and RDP ++The Ubuntu Server 18.04 LTS image doesn't have the RDP remote desktop server installed by default. To install the packages that are needed on the template machine to connect via remote desktop protocol (RDP), follow instructions in the [Install and configure Remote Desktop to connect to a Linux VM in Azure](../virtual-machines/linux/use-remote-desktop.md) article. ++### Install Ruby -## Install Ruby Ruby is an open-source dynamic language that can be combined with bash scripts. This section shows how to use `apt-get` to install the latest version of [Ruby](https://www.ruby-lang.org/). 1. Install updates by running the following commands: Ruby is an open-source dynamic language that can be combined with bash scripts. sudo apt-get update sudo apt-get upgrade ```-2. Install [Ruby](https://www.ruby-lang.org/). Ruby is an open-source dynamic language that can be combined with bash scripts. - ++1. Install [Ruby](https://www.ruby-lang.org/). Ruby is an open-source dynamic language that can be combined with bash scripts. + ```bash sudo apt-get install ruby-full ``` -## Install development tools +1. When prompted, type **Y** and press **Enter** to confirm the installation. ++### Install development tools + This section shows you how to install a couple of text editors. Gedit is the default text editor for the gnome desktop environment. It's designed as a general-purpose text editor. Visual Studio Code is a text editor that includes support for debugging and source control integration. > [!NOTE] This section shows you how to install a couple of text editors. Gedit is the def ```bash sudo apt-get install gedit ```-1. Install [Visual Studio Code](https://code.visualstudio.com/). Visual Studio code can be installed using the Snap Store. For alternate installation options, see [Visual Studio Code alternate downloads](https://code.visualstudio.com/#alt-downloads). ++1. Install [Visual Studio Code](https://code.visualstudio.com/). Visual Studio code can be installed using the Snap Store. For alternate installation options, see [Visual Studio Code alternate downloads](https://code.visualstudio.com/#alt-downloads). ```bash sudo snap install vscode --classic This section shows you how to install a couple of text editors. Gedit is the def The template is now updated and has both the programming language and development tools needed to complete the lab. The template image can now be published to the lab. Select the **Publish** button on template page to publish the template to the lab. -## Cost +## Cost + If you would like to estimate the cost of this lab, you can use the following example:- -For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be: -25 students * (20 + 10) hours * 20 Lab Units * 0.01 USD per hour = 150 USD +For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be: ++25 students \* (20 + 10) hours \* 20 Lab Units \* 0.01 USD per hour = 150 USD -For more information on the pricing can be found in the following document: [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/). +> [!IMPORTANT] +> The cost estimate is for example purposes only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). ## Conclusion+ This article walked you through the steps to create a lab for scripting classes. While this article focused on setting up Ruby scripting tools on Linux machine, same setup can be used for other scripting classes like Python on Linux. ## Next steps-Next steps are common to setting up any lab: --- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) -- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users). ---- |
| lab-services | Class Type Solidworks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-solidworks.md | Title: Set up a SOLIDWORKS lab for engineering with Azure Lab Services | Microso description: Learn how to set up a lab for engineering courses using SOLIDWORKS. Previously updated : 06/26/2020 Last updated : 01/05/2022 # Set up a lab for engineering classes using SOLIDWORKS + [SOLIDWORKS](https://www.solidworks.com/) provides a 3D computer-aided design (CAD) environment for modeling solid objects and is used in different kinds of engineering fields. With SOLIDWORKS, engineers can easily create, visualize, simulate, and document their designs. A licensing option commonly used by universities is SOLIDWORKSΓÇÖ Network Licensing. With this option, users share a pool of licenses that are managed by a licensing server. This type of license is sometimes called a ΓÇ£floatingΓÇ¥ license because you only need to have enough licenses for the number of concurrent users. When a user is done using SOLIDWORKS, their license goes back into the centrally managed license pool so that it can be reused by another user. In this article, weΓÇÖll show how to set up a class that uses SOLIDWORKS 2019 an ## License server -SOLIDWORKS Network Licensing requires that you have SolidNetWork License Manager installed and activated on your license server. This license server is typically located in either your on-premise network or a private network within Azure. For more information on how to set up SolidNetWork License Manager on your server, see [Installing and Activating a License Manager](https://help.solidworks.com/2019/English/Installation/install_guide/t_installing_snl_lic_mgr.htm) in the SOLIDWORKS install guide. When setting this up, remember the **port number** and [**serial number**](https://help.solidworks.com/2019/english/installation/install_guide/r_hid_state_serial_number.htm) that are used since they'll be needed in later steps. +SOLIDWORKS Network Licensing requires that you have SolidNetWork License Manager installed and activated on your license server. This license server is typically located in either your on-premise network or a private network within Azure. For more information on how to set up SolidNetWork License Manager on your server, see [Installing and Activating a License Manager](https://help.solidworks.com/2019/English/Installation/install_guide/t_installing_snl_lic_mgr.htm) in the SOLIDWORKS install guide. Remember the **port number** and [**serial number**](https://help.solidworks.com/2019/english/installation/install_guide/r_hid_state_serial_number.htm) that are used since they'll be needed in later steps. ++After your license server is set up, youΓÇÖll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) in your [lab plan](./tutorial-setup-lab-plan.md) -After your license server is set up, you'll need to peer the [virtual network (VNet)](./how-to-connect-peer-virtual-network.md) to your [lab account](./tutorial-setup-lab-account.md). The network peering must be done before creating the lab so that lab virtual machines can access the license server and the other way around. +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. > [!NOTE]-> You should verify that the appropriate ports are opened on your firewalls to allow communication between the lab virtual machines and the license server. For example, see the instructions on [Modifying License Manager Computer Ports for Windows Firewall](http://help.solidworks.com/2019/english/installation/install_guide/t_mod_ports_on_lic_mgr_for_firewall.htm) that show how to add inbound and outbound rules to the license server's firewall. You may also need to open up ports to the lab virtual machines. Follow the steps in the article on [firewall settings for labs](./how-to-configure-firewall-settings.md) for more information on this, including how to get the lab's public IP address. +> You should verify that the appropriate ports are opened on your firewalls to allow communication between the lab virtual machines and the license server. ++See the instructions on [Modifying License Manager Computer Ports for Windows Firewall](http://help.solidworks.com/2019/english/installation/install_guide/t_mod_ports_on_lic_mgr_for_firewall.htm) that show how to add inbound and outbound rules to the license server's firewall. You may also need to open up ports to the lab virtual machines. Follow more information on firewall settings and finding the lab's public IP, see [firewall settings for labs](./how-to-configure-firewall-settings.md). ## Lab configuration -To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see the tutorial on [how to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. ++### Lab plan settings -### Lab account settings -Enable the settings described in the table below for the lab account. For more information about how to enable marketplace images, see the article on [how to specify Marketplace images available to lab creators](./specify-marketplace-images.md). +Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). -| Lab account setting | Instructions | +| Lab plan setting | Instructions | | - | |-|Marketplace image| Enable the Windows 10 Pro image for use within your lab account.| +|Marketplace image| Enable the **Windows 10 Pro** image.| -> [!NOTE] -> In addition to Windows 10, SOLIDWORKS supports other versions of Windows. See [SOLIDWORKS system requirements](https://www.solidworks.com/sw/support/SystemRequirements.html) for details. +SOLIDWORKS supports other versions of Windows besides Windows 10. See [SOLIDWORKS system requirements](https://www.solidworks.com/sw/support/SystemRequirements.html) for details. ### Lab settings -Use the settings in the table below when setting up a classroom lab. For more information on how to create a classroom lab, see set up a classroom lab tutorial. +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab settings | Value/instructions | | | |-|Virtual Machine Size| **Small GPU (Visualization)**. This VM is best suited for remote visualization, streaming, gaming, encoding using frameworks such as OpenGL and DirectX.| -|Virtual Machine Image| Windows 10 Pro| +| Virtual Machine Size | **Small GPU (Visualization)**. This VM is best suited for remote visualization, streaming, gaming, encoding using frameworks such as OpenGL and DirectX.| +| Virtual Machine Image | Windows 10 Pro | > [!NOTE] > The **Small GPU (Visualization)** virtual machine size is configured to enable a high-performing graphics experience. For more information about this virtual machine size, see the article on [how to set up a lab with GPUs](./how-to-setup-lab-gpu.md). -> [!WARNING] -> DonΓÇÖt forget to [peer the virtual network](./how-to-connect-peer-virtual-network.md) for the lab account to the virtual network for the license server **before** creating the lab. --## Template virtual machine configuration +## Template configuration The steps in this section show how to set up your template virtual machine by downloading the SOLIDWORKS installation files and installing the client software: Let's cover a possible cost estimate for this class. This estimate doesn't inclu ## Next steps -Next steps are common to setting up any lab. --- [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Type Sql Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-type-sql-server.md | -This article describes how to set up a lab for a basic SQL Server management and development class in Azure Lab Services. Database concepts are one of the introductory courses taught in most of the Computer Science departments in college. Structured Query Language (SQL) is an international standard. SQL is the standard language for relation database management including adding, accessing, and managing content in a database. It is most noted for its quick processing, proven reliability, ease, and flexibility of use. --In this article, we'll show how to set up a virtual machine template in a lab with [Visual Studio 2019](https://visualstudio.microsoft.com/vs/), [SQL Server Management Studio](/sql/ssms/download-sql-server-management-studio-ssms), and [Azure Data Studio](https://github.com/microsoft/azuredatastudio). For this lab, we will use one shared [SQL Server Database](../azure-sql/database/sql-database-paas-overview.md) for the entire lab. [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) is Platform as a Service (PaaS) Database Engine offering from Azure. --## Lab configuration --To set up this lab, you need an Azure subscription and lab account to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can create a new lab account in Azure Lab Services. For more information about creating a new lab account, see [tutorial to setup a lab account](./tutorial-setup-lab-account.md). You can also use an existing lab account. -### Lab account settings --Enable the settings described in the table below for the lab account. For more information about how to enable marketplace images, see [Specify Marketplace images available to lab creators](specify-marketplace-images.md). +This article describes how to set up a lab for a basic SQL Server management and development class in Azure Lab Services. Database concepts are one of the introductory courses taught in most of the Computer Science departments in college. Structured Query Language (SQL) is an international standard. SQL is the standard language for relation database management including adding, accessing, and managing content in a database. It is most noted for its quick processing, proven reliability, ease, and flexibility of use. -| Lab account setting | Instructions | -| - | | -| Marketplace image | Enable the 'Visual Studio 2019 Community (latest release) on Windows 10 Enterprise N (x64)' image for use within your lab account. | +In this article, we'll show how to set up a virtual machine template in a lab with [Visual Studio 2019](https://visualstudio.microsoft.com/vs/), [SQL Server Management Studio](/sql/ssms/download-sql-server-management-studio-ssms), and [Azure Data Studio](https://github.com/microsoft/azuredatastudio). For this lab, we will use one shared [SQL Server Database](/azure/azure-sql/database/sql-database-paas-overview) for the entire lab. [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) is Platform as a Service (PaaS) Database Engine offering from Azure. -### Shared resource configuration +## External resource configuration To use a shared resource in Lab Services, you first need to create the virtual network and the resources itself. To create the virtual network and connect it to the lab, follow [how to create a lab with a shared resource in Azure Lab Services](how-to-create-a-lab-with-shared-resource.md). Remember, any resources external to Lab Services will be billed separately and will not be included in lab cost estimates. ->[!WARNING] ->Shared resources for a lab should be setup before the lab is created. If the vnet is not [peered to the lab account](how-to-connect-peer-virtual-network.md) *before* the lab is created, the lab will not have access to the shared resource. +To use any external resources, youΓÇÖll need to [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) with your [lab plan](./tutorial-setup-lab-plan.md) -Now that the networking side of things is handled, lets create a SQL Server Database. We are going to create a [single database](../azure-sql/database/single-database-create-quickstart.md?tabs=azure-portal) as it is the quickest deployment option for Azure SQL Database. For other deployment options, create an [elastic pool](../azure-sql/database/elastic-pool-overview.md#create-a-new-sql-database-elastic-pool-by-using-the-azure-portal), [managed instance](../azure-sql/managed-instance/instance-create-quickstart.md), or [SQL virtual machine](../azure-sql/virtual-machines/windows/sql-vm-create-portal-quickstart.md). +> [!IMPORTANT] +> [Advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) must be enabled during the creation of your lab plan. It can't be added later. ++Now that the networking side of things is handled, lets create a SQL Server Database. We are going to create a [single database](/azure/azure-sql/database/single-database-create-quickstart?tabs=azure-portal) as it is the quickest deployment option for Azure SQL Database. For other deployment options, create an [elastic pool](/azure/azure-sql/database/elastic-pool-overview#create-a-new-sql-database-elastic-pool-by-using-the-azure-portal), [managed instance](/azure/azure-sql/managed-instance/instance-create-quickstart), or [SQL virtual machine](/azure/azure-sql/virtual-machines/windows/sql-vm-create-portal-quickstart). 1. From the Azure portal menu, choose **Create new resource**.-2. Choose **SQL Database** and click the **Create** button. +2. Choose **SQL Database** and select the **Create** button. 3. On the **Basics** tab of the **Create SQL database** form, select the resource group for the database. We will use *sqldb-rg*. 4. For **Database name**, enter *classlabdb*.-5. Under the **Server** setting, click **Create new** to create a new server to hold the database. -6. On the **New server** flyout, enter the Server name. We will use *classlabdbserver*. The server name must be globally unique. +5. Under the **Server** setting, select **Create new** to create a new server to hold the database. +6. On the **New server** flyout, enter the Server name. We'll use *classlabdbserver*. The server name must be globally unique. 7. Enter *azureuser* for the **Server admin login**. 8. Enter a memorable password. Password must be at least eight characters in length and contain special characters. 9. Choose region for the **location**. If possible, enter the same location as the lab account and peered vnet to minimize latency.-10. Click **OK** to return to the **Create SQL Database** form. -11. Click **Configure database** link under the **Compute + storage** setting. -12. Modify database settings as needed for the class. You can choose between Provisioned and Serverless options. For this example, we'll use the autoscaled Serverless option with max vCores of 4, min vCores of 1. We'll keep the autopause setting at the minimum of 1 hour. Click **Apply**. -13. Click **Next: Networking** button. +10. Select **OK** to return to the **Create SQL Database** form. +11. Select **Configure database** link under the **Compute + storage** setting. +12. Modify database settings as needed for the class. You can choose between Provisioned and Serverless options. For this example, we'll use the autoscaled Serverless option with max vCores of 4, min vCores of 1. We'll keep the autopause setting at the minimum of 1 hour. Select **Apply**. +13. Select **Next: Networking** button. 14. On the Networking tab, choose Private endpoint for the **Connectivity method**.-15. Under the **Private endpoints** section, click **Add private endpoint**. +15. Under the **Private endpoints** section, Select **Add private endpoint**. 16. On the **Create private endpoint** flyout, choose the same resource group as your virtual network peered to the lab account. 17. For **Location**, choose the same location as the virtual network. 18. For **Name**, enter *labsql-endpt*. Now that the networking side of things is handled, lets create a SQL Server Data 20. For **Virtual network**, choose the same virtual network peered to the lab account. 21. For **Subnet**, choose subnet you want the endpoint hosted in. The IP assigned to the endpoint will be from the range assigned to that subnet. 22. Set **Integrate with private DNS** to **No**. For simplicity, we'll use Azure's DNS over own private DNS zone or our own DNS servers.-23. Click **OK**. -24. Click **Next: Additional settings**. +23. Select **OK**. +24. Select **Next: Additional settings**. 25. For the **Use existing data** setting, choose **Sample**. The data from the AdventureWorksLT database will be used when the database is created.-26. Click **Review + create**. -27. Click **Create**. +26. Select **Review + create**. +27. Select **Create**. Once the SQL Database deployment successfully completes, we can create the lab and install software on the lab template machine. +## Lab configuration ++To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++### Lab plan settings ++Once you get have Azure subscription, you can create a new lab plan in Azure Lab Services. For more information about creating a new lab plan, see the tutorial on [how to set up a lab plan](./tutorial-setup-lab-plan.md). You can also use an existing lab plan. ++Enable your lab plan settings as described in the following table. For more information about how to enable Azure Marketplace images, see [Specify the Azure Marketplace images available to lab creators](./specify-marketplace-images.md). ++| Lab plan setting | Instructions | +| - | | +| Marketplace image | Enable the 'Visual Studio 2019 Community (latest release) on Windows 10 Enterprise N (x64)' image. | + ### Lab settings -Use the settings in the table below when setting up a classroom lab. For more information how to create a classroom lab, see [set up a classroom lab tutorial](tutorial-setup-classroom-lab.md). +For instructions on how to create a lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). Use the following settings when creating the lab. | Lab settings | Value/instructions | | | | Use the settings in the table below when setting up a classroom lab. For more in Now that our lab is created, let's modify the template machine with the software we need. -## Visual Studio +## Template configuration ++### Visual Studio The image chosen above includes [Visual Studio 2019 Community](https://visualstudio.microsoft.com/vs/community/). All workloads and tool sets are already installed on the image. Use the Visual Studio Installer to [install any optional tools](/visualstudio/install/modify-visual-studio?view=vs-2019&preserve-view=true) you may want. [Sign in to Visual Studio](/visualstudio/ide/signing-in-to-visual-studio?view=vs-2019&preserve-view=true#how-to-sign-in-to-visual-studio) to unlock the community edition. -Visual Studio includes the **Data storage and processing** tool set, which includes SQL Server Data Tools (SSDT). For more information about SSDT's capabilities, see [SQL Server Data Tools overview](/sql/ssdt/sql-server-data-tools). To verify connection to the shared SQL Server for the class will be successful, see [connect to a database and browse existing objects](/sql/ssdt/how-to-connect-to-a-database-and-browse-existing-objects). If prompted add the template machine IP to the [list of allowed computers](../azure-sql/database/firewall-configure.md) that can connect to your SQL Server instance. +Visual Studio includes the **Data storage and processing** tool set, which includes SQL Server Data Tools (SSDT). For more information about SSDT's capabilities, see [SQL Server Data Tools overview](/sql/ssdt/sql-server-data-tools). To verify connection to the shared SQL Server for the class will be successful, see [connect to a database and browse existing objects](/sql/ssdt/how-to-connect-to-a-database-and-browse-existing-objects). If prompted add the template machine IP to the [list of allowed computers](/azure/azure-sql/database/firewall-configure) that can connect to your SQL Server instance. Visual Studio supports several workloads including **Web & cloud** and **Desktop & mobile** workloads. Both of these workloads support SQL Server as a data source. For more information using ASP.NET Core to SQL Server, see [build an ASP.NET Core and SQL Database app in Azure App Service](../app-service/tutorial-dotnetcore-sqldb-app.md) tutorial. Use [System.Data.SqlClient](/dotnet/api/system.data.sqlclient) library to connect to a SQL Database from a [Xamarin](/xamarin) app. -## Install Azure Data Studio +### Install Azure Data Studio [Azure Data Studio](https://github.com/microsoft/azuredatastudio) is a multi-database, cross-platform desktop environment for data professionals using the family of on-premises and cloud data platforms on Windows, macOS, and Linux. 1. Download the [Azure Data Studio *system* installer for Windows](https://go.microsoft.com/fwlink/?linkid=2127432). To find installers for other supported operating systems, go to the [Azure Data Studio](/sql/azure-data-studio/download) download page.-2. On the **License Agreement** page, select **I accept the agreement**. Click **Next**. -3. On the **Select Destination Location** page, click **Next**. -4. On the **Select Start Menu Folder** page, click **Next**. -5. On the **Select Additional Tasks** page, check **Create a desktop icon** if you want a desktop icon. Click **Next**. -6. On the **Ready to Install**, click **Next**. -7. Wait for the installer to run. Click **Finish**. +2. On the **License Agreement** page, select **I accept the agreement**. Select **Next**. +3. On the **Select Destination Location** page, elect **Next**. +4. On the **Select Start Menu Folder** page, select **Next**. +5. On the **Select Additional Tasks** page, check **Create a desktop icon** if you want a desktop icon. Select **Next**. +6. On the **Ready to Install**, select **Next**. +7. Wait for the installer to run. Select **Finish**. Now that we have Azure Data Studio installed, let's setup the connection to Azure SQL Database. -1. On the **Welcome** page for Azure Data Studio, click the **New Connection** link. +1. On the **Welcome** page for Azure Data Studio, select the **New Connection** link. 2. In the **Connection Details** box, fill in necessary information. - Set **Server** to *classlabdbserver.database.windows.net* - Set **User** name to *azureuser* - Set **Password** to password used to create the database. - Check **Remember Password**. - For **Database**, select *classlabdb*.-3. Click **Connect**. +3. Select **Connect**. -## Install SQL Server Management Studio +### Install SQL Server Management Studio [SQL Server Management Studio (SSMS)](/sql/ssms/download-sql-server-management-studio-ssms) is an integrated environment for managing any SQL infrastructure. SSMS is a tool used by database administrators to deploy, monitor, and upgrade data infrastructure. 1. [Download Sql Server Management Studio](https://aka.ms/ssmsfullsetup). Once downloaded, start the installer.-2. On the **Welcome** page, click **Install**. -3. On the **Setup Completed** page, click **Close**. +2. On the **Welcome** page, select **Install**. +3. On the **Setup Completed** page, select **Close**. 4. Start Sql Server Management Studio. -5. On the **Dependency Configuration process** page, click **Close**. +5. On the **Dependency Configuration process** page, select **Close**. Not that SSMS is installed, you can [connect and query a SQL Server](/sql/ssms/tutorials/connect-query-sql-server). When setting up the connection, use the following values: Here is an example of a possible cost estimate for this class: ## Next steps -Next steps are common to setting up any lab. --- [Create, manage, and publish a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | Class Types | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/class-types.md | Title: Example class types on Azure Lab Services | Microsoft Docs description: Provides some types of classes for which you can set up labs using Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/04/2020 # Class types overview - Azure Lab Services -Azure Lab Services enables you to quickly set up classroom lab environments in the cloud. Articles in this section provide guidance on how to set up several types of labs using Azure Lab Services. +Azure Lab Services enables you to quickly set up lab environments in the cloud. Articles in this section provide guidance on how to set up several types of labs using Azure Lab Services. ## Adobe Creative Cloud For detailed information on how to set up this type of lab, see [Setup a lab for ## ArcGIS -[ArcGIS](https://www.esri.com/en-us/arcgis/products/arcgis-solutions/overview) is a type of geographic information system (GIS). You can set up a lab that uses ArcGIS Desktop's various applications, such as [ArcMap](https://desktop.arcgis.com/en/arcmap/latest/map/main/what-is-arcmap-.htm) to make, edit, and analyze 2D maps. +[ArcGIS](https://www.esri.com/en-us/arcgis/products/arcgis-solutions/overview) is a type of geographic information system (GIS). You can set up a lab that uses ArcGIS Desktop's various applications. For example, [ArcMap](https://desktop.arcgis.com/en/arcmap/latest/map/main/what-is-arcmap-.htm) can make, edit, and analyze 2D maps. For detailed information on how to set up this type of lab, see [Setup a lab for ArcMap\ArcGIS Desktop](class-type-arcgis.md). For detailed information on how to set up this type of lab, see [Setup a lab for [Autodesk](https://www.autodesk.com/) offers software solutions in architecture, engineering, construction, design, manufacturing, and more. These solutions are commonly used in engineering classes and in the [Project Lead the Way](class-type-pltw.md) curriculum. -For detailed information on how to set up this type of lab, see [Autodesk](class-type-autodesk.md). +For detailed information on how to set up this type of lab, see [Set up a lab for Autodesk](class-type-autodesk.md). ## Big data analytics -You can set up a GPU lab to teach a big data analytics class. With this type of class, students learn how to handle large volumes of data, and apply machine and statistical learning algorithms to derive data insights. A key objective for students is to learn to use data analytics tools, such as Apache Hadoop's open-source software package that provides tools for storing, managing, and processing big data. +You can set up a GPU lab to teach a big data analytics class. With this type of class, students learn how to handle large volumes of data, and apply machine and statistical learning algorithms to derive data insights. A key goal for students is to learn to use data analytics tools, such as Apache Hadoop's open-source software package that provides tools for storing, managing, and processing big data. For detailed information on how to set up this type of lab, see [Set up a lab for big data analytics using Docker deployment of HortonWorks Data Platform](class-type-big-data-analytics.md). For detailed information on how to set up this type of lab, see [Setup a lab to ## Networking with GNS3 -You can set up a lab for a class that focuses on allowing students to emulate, configure, test, and troubleshoot virtual and real networks using [GNS3](https://www.gns3.com/) software. +You can set up a lab for a class that focuses on allowing students to emulate, configure, test, and troubleshoot virtual and real networks using [GNS3](https://www.gns3.com/) software. For detailed information on how to set up this type of lab, see [Setup a lab to teach a networking class](class-type-networking-gns3.md). For detailed information on how to set up this type of lab, see [Set up a lab to [React](https://reactjs.org/) is a popular JavaScript library for building user interfaces (UI). React is a declarative way to create reusable components for your website. There are many popular libraries for JavaScript-based front-end development. We'll use a few of these libraries while creating our lab. [Redux](https://redux.js.org/) is a library that provides predictable state container for JavaScript apps and is often used in compliment with React. [JSX](https://reactjs.org/docs/introducing-jsx.html) is a library syntax extension to JavaScript often used with React to describe what the UI should look like. [NodeJS](https://nodejs.org/) is a convenient way to run a webserver for your React application. -For detailed information on how to set up this type of lab on Linux using [Visual Studio Code](https://code.visualstudio.com/) for your development environment, see [Set up lab for React on Windows](class-type-react-linux.md). For detailed information on how to set up this type of lab on Windows using [Visual Studio 2019](https://visualstudio.microsoft.com/vs/) for your development environment, see [Set up lab for React on Windows](class-type-react-windows.md). +For detailed information on how to set up this type of lab on Linux using [Visual Studio Code](https://code.visualstudio.com/) for your development environment, see [Set up lab for React on Linux](class-type-react-linux.md). For detailed information on how to set up this type of lab on Windows using [Visual Studio 2019](https://visualstudio.microsoft.com/vs/) for your development environment, see [Set up lab for React on Windows](class-type-react-windows.md). ## RStudio -[R](https://www.r-project.org/https://docsupdatetracker.net/about.html) is an open-source language used for statistical computing and graphics. It's used in the statistical analysis of genetics, natural language processing, analyzing financial data, and more. R provides an [interactive command line](https://cran.r-project.org/doc/manuals/r-release/R-intro.html#Invoking-R-from-the-command-line) experience. [RStudio](https://www.rstudio.com/products/rstudio/) is an interactive development environment (IDE) available for the R language. The free version provides code editing tools, an integrated debugging experience, and package development tools. This class type will focus on solely RStudio and R as a building block for a class that requires the use of statistical computing. +[R](https://www.r-project.org/https://docsupdatetracker.net/about.html) is an open-source language used for statistical computing and graphics. It's used in the statistical analysis of genetics, natural language processing, analyzing financial data, and more. R provides an [interactive command line](https://cran.r-project.org/doc/manuals/r-release/R-intro.html#Invoking-R-from-the-command-line) experience. [RStudio](https://www.rstudio.com/products/rstudio/) is an interactive development environment (IDE) available for the R language. The free version provides code-editing tools, an integrated debugging experience, and package development tools. This class type will focus on solely RStudio and R as a building block for a class that requires the use of statistical computing. For detailed information on how to set up this type of lab, see [Set up a lab to teach R on Linux](class-type-rstudio-linux.md) or [Set up a lab to teach R on Windows](class-type-rstudio-windows.md). You can set up a lab to teach shell scripting on Linux. Scripting is a useful pa Students taking these scripting classes get a Linux virtual machine to learn the basics of Linux, and also get familiar with the bash shell scripting. The Linux virtual machine comes with remote desktop access enabled and with [Gedit](https://help.gnome.org/users/gedit/stable/) and [Visual Studio Code](https://code.visualstudio.com/) text editors installed. -For detailed information on how to set up this type of lab, see [Shell scripting on Linux](class-type-shell-scripting-linux.md). +For detailed information on how to set up this type of lab, see [Set up a lab for Shell scripting on Linux](class-type-shell-scripting-linux.md). ## SolidWorks computer-aided design (CAD) -You can set up a GPU lab that gives engineering students access to [SolidWorks](https://www.solidworks.com/). SolidWorks provides a 3D CAD environment for modeling solid objects. With SolidWorks, engineers can easily create, visualize, simulate and document their designs. +You can set up a GPU lab that gives engineering students access to [SolidWorks](https://www.solidworks.com/). SolidWorks provides a 3D CAD environment for modeling solid objects. With SolidWorks, engineers can easily create, visualize, simulate, and document their designs. For detailed information on how to set up this type of lab, see [Set up a lab for engineering classes using SolidWorks](class-type-solidworks.md). |
| lab-services | Classroom Labs Concepts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/classroom-labs-concepts.md | Title: Labs concepts - Azure Lab Services | Microsoft Docs description: Learn the basic concepts of Lab Services, and how it can make it easy to create and manage labs. Previously updated : 06/26/2020 Last updated : 01/27/2022 # Labs concepts -The following list contains key Lab Services concepts and definitions: +This article describes key Azure Lab Services concepts and definitions. ++## Schedules ++Schedules are the time slots that an educator creates so the lab VMs are available for class time. Schedules can be one-time or recurring. Any scheduled time doesn't count against extra time students may be given to complete homework. A lab can use [quota](#quota) time, scheduled time, or a combination of both. ++Scheduled time is commonly used when students are following the educator's directions during class hours. For more information about schedules, see [Create and manage schedules for labs in Azure Lab Services](how-to-create-schedules.md). ++All the student VMs are started with schedules. (Unclaimed VMs aren't started when schedules run.) VMs are started even if a student doesn't sign into a VM. To help reduce likelihood of accruing costs when a VM isn't being used, see [Configure automatic shutdown of VMs for a lab](how-to-enable-shutdown-disconnect.md). ++There are two types of schedules. ++- **Standard**. This schedule will start all student VMs at the specified start time and shut down all lab VMs at the specified stop time. +- **Stop only**. This schedule will stop all lab VMs at the specified time, even if the VM was manually started by an educator or student. ## Quota -Quota is the time limit (in hours) that an educator can set for a student to use a lab VM. It can be set to 0, or a specific number of hours. If the quota is set to 0, a student can only use the virtual machine when a schedule is running or when an educator manually turns on the virtual machine for the student. +Quota is the limit of time a student may use their VM outside of class. Allowing time for homework is done by using quota hours. If no quota is assigned, students can only use their VM during scheduled time or if the educator starts the VM for them. Quota hours are counted when the student starts the lab VM themselves. If an educator manually starts the lab VM for a student, quota hours aren't used for that student. -## Schedules +A lab can use either quota time, [scheduled time](#schedules), or a combination of both. ++## Automatic shut-down -Schedules are the time slots that an educator can create for the class so the student VMs are available for class time. Schedules can be one-time or recurring. Quota hours aren't used when a schedule is running. +Anytime a machine is **Running**, costs are being incurred, even if no one is connected to the VM. You can enable several auto-shutdown features to avoid extra costs when the VMs aren't being used. The are three auto-shutdown policies available in Azure Lab Services. -There are three types of schedules: Standard, Start only and Stop only. +- Disconnect idle virtual machines. +- Shut down virtual machines when students disconnect from the virtual machine. +- Shut down virtual machines when students don't connect a recently started virtual machine. -- **Standard**. This schedule will start all student VMs at the specified start time and shutdown all student VMs at the specified stop time.-- **Start only**. This schedule will start all student VMs at the specified time. Student VMs won't be stop until a student stops the their VM through the Azure Lab Services portal or a stop only schedule occurs.-- **Stop only**. This schedule will stop all student VMs at the specified time. +For more information, see [Configure automatic shutdown of VMs for a lab plan](how-to-configure-auto-shutdown-lab-plans.md). ## Template virtual machine -A template virtual machine in a lab is a base virtual machine image from which all usersΓÇÖ virtual machines are created. Trainers/lab creators set up the template virtual machine and configure it with the software that they want to provide to training attendees to do labs. When you publish a template VM, Azure Lab Services creates or updates lab VMs based on the template VM. +A template VM in a lab is a base image from which all students' VMs are created. Educators configure the template VM with the software needed to complete the lab. When educators [publish a template VM](tutorial-setup-lab.md#publish-a-lab), Azure Lab Services creates or updates student lab VMs to match the template VM. ++Labs can be created without needing a template VM, if using the [April 2022 Update (preview)](lab-services-whats-new.md). The Marketplace or Azure Compute Gallery image is used as-is to create the student's VMs. ++## Lab plans ++Lab plans are an Azure resource and contain settings used when creating new labs. Lab plans control the networking setup, which VM images are available and if [Canvas integration](lab-services-within-canvas-overview.md) can be used for a lab. To create a lab plan, see [Quickstart: Create a lab plan using the Azure portal](quick-create-lab-plan-portal.md). ## User profiles -This article describes different user profiles in Azure Lab Services. +Azure Lab Services was designed with three major personas in mind: administrators, educators, and students. You'll see these three roles mentioned throughout Azure Lab Services documentation. This section describes each persona and the tasks theyΓÇÖre typically responsible for. -### Lab account owner +### Administrator -Typically, an IT administrator of organization's cloud resources, who owns the Azure subscription acts as a lab account owner and does the following tasks: +An IT administrator for organization is typically the lab plan owner. The lab plan owner is often the one owns the Azure subscription and does the following tasks: -- Sets up a lab account for your organization.+- Creates and organizes resource groups to contain lab plans and labs. +- Creates lab plans for your organization. - Manages and configures policies across all labs.-- Gives permissions to people in the organization to create a lab under the lab account.+- Gives permissions to educators in the organization to create a lab using the lab plan. ### Educator -Typically, users such as a teacher or an online trainer creates labs under a lab account. An educator does the following tasks: +Educators, often a teacher or an online trainer, creates labs using a pre-created lab plan. An educator does the following tasks: ++- Creates a lab. +- Installs the appropriate software on virtual machines template. +- Publishes the lab to create VMs for the students. +- Specifies which students can access the lab. +- Sends registration link to the lab to students, if necessary. +- Use the lab to teach their course. -- Creates a classroom lab.-- Creates virtual machines in the lab.-- Installs the appropriate software on virtual machines.-- Specifies who can access the lab.-- Provides registration link to the lab to students.+Some organizations may opt to have their administrators complete the previous tasks to create and manage labs on behalf of the educators. ### Student A student does the following tasks: -- Uses the registration link that the lab user receives from a lab creator to register with the lab.-- Connects to a virtual machine in the lab and use it for doing class work, assignments, and projects.+- Registers for the lab, if needed. +- Connects to a VM in the lab and uses it for completing assigned work. ## Next steps -Get started with setting up a lab account that's required to create a classroom lab using Azure Lab +The first action to take to use Azure Lab Services is to create a lab plan. Labs can be created only after a lab plan is created. -- [Set up a lab account](tutorial-setup-lab-account.md)+- [As an admin, create a lab plan](tutorial-setup-lab-plan.md) +- [As an educator, create a lab](tutorial-setup-lab.md) |
| lab-services | Classroom Labs Fundamentals | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/classroom-labs-fundamentals.md | Title: Architecture Fundamentals in Azure Lab Services | Microsoft Docs description: This article will cover the fundamental resources used by Lab Services and basic architecture of a lab. Previously updated : 09/16/2020 Last updated : 11/19/2021 # Architecture Fundamentals in Azure Lab Services -Azure Lab Services is a SaaS (software as a service) solution, which means that the resources needed by Lab Services are handled for you. This article will cover the fundamental resources used by Lab Services and basic architecture of a lab. -Azure Lab Services does provide a couple of areas that allow you to use your own resources in conjunction with Lab Services. For more information about using VMs on your own network, see how to [peer a virtual network](how-to-connect-peer-virtual-network.md). To reuse images from a Shared Image Gallery, see how to [attach a Shared Image Gallery](how-to-attach-detach-shared-image-gallery.md). +Azure Lab Services is a SaaS (software as a service) solution, which means that the resources needed by Lab Services are handled for you. This article will cover the fundamental resources used by Lab Services and basic architecture of a lab. -Below is the basic architecture of a classroom lab. The lab account is hosted in your subscription. The student VMs, along with the resources needed to support the VMs are hosted in a subscription owned by Lab Services. LetΓÇÖs talk about what is in Lab Service's subscriptions in more detail. +Azure Lab Services does provide a couple of areas that allow you to use your own resources in conjunction with Lab Services. For more information about using VMs on your own network, see how to [peer a virtual network](how-to-connect-peer-virtual-network.md). If using the April 2022 Update, see [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) to use virtual network injection instead of virtual network peering. To reuse images from an Azure Compute Gallery, see how to [attach a compute gallery](how-to-attach-detach-shared-image-gallery.md). ++Below is the basic architecture of a lab. The lab account or lab plan is hosted in your subscription. The student VMs, along with the resources needed to support the VMs are hosted in a subscription owned by Azure Lab Services. LetΓÇÖs talk about what is in Azure Lab Service's subscriptions in more detail.  ## Hosted Resources -The resources required to run a classroom lab are hosted in one of the Microsoft-managed Azure subscriptions. Resources include a template virtual machine for the instructor, virtual machine for each student, and network-related items such as a load balancer, virtual network, and network security group. These subscriptions are monitored for suspicious activity. It is important to note that this monitoring is done externally to the virtual machines through VM extension or network pattern monitoring. If [shutdown on disconnect](how-to-enable-shutdown-disconnect.md) is enabled, a diagnostic extension is enabled on the virtual machine. The extension allows Lab Services to be informed of the remote desktop protocol (RDP) session disconnect event. +The resources required to run a lab are hosted in one of the Microsoft-managed Azure subscriptions. Resources include a template virtual machine for the educator, virtual machine for each student, and network-related items such as a load balancer, virtual network, and network security group. These subscriptions are monitored for suspicious activity. It is important to note that this monitoring is done externally to the virtual machines through VM extension or network pattern monitoring. If [shutdown on disconnect](how-to-enable-shutdown-disconnect.md) is enabled, a diagnostic extension is enabled on the virtual machine. The extension allows Lab Services to be informed of the remote desktop protocol (RDP) session disconnect event. ## Virtual Network +> [!NOTE] +> For the latest experience in Azure Lab Services using your virtual network, see [Connect to your virtual network](how-to-connect-vnet-injection.md). This experience replaces the peer virtual network experience. + Each lab is isolated by its own virtual network. If the lab has a [peered virtual network](how-to-connect-peer-virtual-network.md), then each lab is isolated by its own subnet. Students connect to their virtual machine through a load balancer. No student virtual machines have a public IP address; they only have a private ip address. The connection string for the student will be the public IP address of the load balancer and a random port between 49152 and 65535. Inbound rules on the load balancer forward the connection, depending on the operating system, to either port 22 (SSH) or port 3389 (RDP) of the appropriate virtual machine. An NSG prevents outside traffic on any other ports. ## Access control to the virtual machines Lab Services handles the studentΓÇÖs ability to perform actions like start and s Lab Services also handles the registration of students to the service. There are currently two different access settings: restricted and nonrestricted. For more information, see the [manage lab users](how-to-configure-student-usage.md#send-invitations-to-users) article. Restricted access means Lab Services verifies that the students are added as user before allowing access. Nonrestricted means any user can register as long as they have the registration link and there is capacity in the lab. Nonrestricted can be useful for hackathon events. -Student VMs that are hosted in the classroom lab have a username and password set by the creator of the lab. Alternately, the creator of the lab can allow registered students to choose their own password on first sign-in. +Student VMs that are hosted in the lab have a username and password set by the creator of the lab. Alternately, the creator of the lab can allow registered students to choose their own password on first sign-in. ## Next steps |
| lab-services | Classroom Labs Scenarios | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/classroom-labs-scenarios.md | Title: Use labs for trainings - Azure Lab Services description: This article describes how to use Azure DevTest Labs for creating labs on Azure for training scenarios. Previously updated : 06/26/2020 Last updated : 01/04/2022 # Use labs for trainings -Azure Labs Services allows educators (teachers, professors, trainers, or teaching assistants, etc.) to quickly and easily create an online lab to provision pre-configured learning environments for the trainees. Each trainee would be able use identical and isolated environments for the training. Policies can be applied to ensure that the training environments are available to each trainee only when they need them and contain enough resources - such as virtual machines - required for the training. - -labs meets the following requirements that are required to conduct training in any virtual environment: +Azure Labs Services allows educators (teachers, professors, trainers, or teaching assistants, etc.) to quickly and easily create an online lab to provision pre-configured learning environments for the trainees. Each trainee would be able use identical and isolated environments for the training. Policies can be applied to ensure that the training environments are available to each trainee only when they need them and contain enough resources - such as virtual machines - required for the training. ++ ++Labs meet the following requirements that are required to conduct training in any virtual environment: - Trainees can quickly provision their training environments - Every training machine should be identical-- Trainees cannot see VMs created by other trainees+- Trainees can't see VMs created by other trainees - Control cost by ensuring that trainees cannot get more VMs than they need for the training and also shutdown VMs when they are not using them - Easily share the training lab with each trainee - Reuse the training lab again and again In this article, you learn about various Azure Lab Services features that can be used to meet the previously described training requirements and detailed steps that you can follow to set up a lab for training. -## Create the lab account as a lab account administrator -The first step in using Azure Lab Services is to create a lab account in the Azure portal. After a lab account administrator creates the lab account, the admin adds users who want to create labs to the **Lab Creator** role. The educators create labs with virtual machines for students to do exercises for the course they are teaching. For details, see [Create and manage lab account](how-to-manage-lab-accounts.md). +## Create the lab plan as a lab plan administrator ++The first step in using Azure Lab Services is to create a lab plan in the Azure portal. After a lab plan administrator creates the lab plan, the admin adds users who want to create labs to the **Lab Creator** role. The educators create labs with virtual machines for students to do exercises for the course they are teaching. For details, see [Create and manage lab plan](how-to-manage-lab-plans.md). ## Create and manage labs-An educator, who is a member of the Lab Creator role in a lab account, can create one or more labs in the lab account. You create and configure a template VM with all the required software for doing exercises in your course. You pick a ready-made image from the available images for creating a classroom lab and then customize it by installing the software required for the lab. For details, see [Create and manage labs](how-to-manage-classroom-labs.md). ++An educator, who is a member of the Lab Creator role in a lab plan, can create one or more labs in the lab plan. You create and configure a template VM with all the required software for doing exercises in your course. You pick a ready-made image from the available images for creating a lab and then optionally customize it by installing the software required for the lab. For details, see [Create and manage labs](how-to-manage-labs.md). ++## Set up and publish a template VM ++A template in a lab is a base virtual machine image from which all usersΓÇÖ virtual machines are created. Set up the template VM so that it is configured with exactly what you want to provide to the training attendees. You can provide a name and description of the template that the lab users see. Then, you publish the template to make instances of the template VM available to your lab users. When you publish a template, Azure Lab Services creates VMs in the lab by using the template. The number of VMs created in this process is same as the maximum number of users allowed into the lab, which you can set in the usage policy of the lab. All virtual machines have the same configuration as the template. For details, see [Set up and publish template virtual machines](how-to-create-manage-template.md). ## Configure usage settings and policies+ The lab creator can add or remove users to the lab, get registration link to send to lab users, set up policies such as setting individual quotas per user, update the number of VMs available in the lab, and more. For details, see [Configure usage settings and policies](how-to-configure-student-usage.md). ## Create and manage schedules-Schedules allow you to configure a classroom lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. For details, see [Create and manage schedules for labs](how-to-create-schedules.md). -## Set up and publish a template VM -A template in a lab is a base virtual machine image from which all usersΓÇÖ virtual machines are created. Set up the template VM so that it is configured with exactly what you want to provide to the training attendees. You can provide a name and description of the template that the lab users see. Then, you publish the template to make instances of the template VM available to your lab users. When you publish a template, Azure Lab Services creates VMs in the lab by using the template. The number of VMs created in this process is same as the maximum number of users allowed into the lab, which you can set in the usage policy of the lab. All virtual machines have the same configuration as the template. For details, see [Set up and publish template virtual machines](how-to-create-manage-template.md). +Schedules allow you to configure a lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. For details, see [Create and manage schedules for labs](how-to-create-schedules.md). -## Use VMs in the classroom lab -A student or training attendee registers to the lab, and connects to the VM to do exercises for the course. For details, see [How to access a classroom lab](how-to-use-classroom-lab.md). +## Use VMs in the lab ++A student or training attendee registers to the lab, and connects to the VM to do exercises for the course. For details, see [How to access a lab](how-to-use-lab.md). ## Next steps-Start with creating a lab account in labs by following instructions in the article: [Tutorial: Setup a lab account with Azure Lab Services](tutorial-setup-lab-account.md). ++Start with creating a lab plan in labs by following instructions in the article: [Tutorial: Setup a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). |
| lab-services | Connect Virtual Machine Chromebook Remote Desktop | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/connect-virtual-machine-chromebook-remote-desktop.md | Title: How to connect to an Azure Lab Services VM from Chromebook | Microsoft Docs description: Learn how to connect from a Chromebook to a virtual machine in Azure Lab Services.-+ Previously updated : 06/26/2020 Last updated : 01/27/2022 # Connect to a VM using Remote Desktop Protocol on a Chromebook -This section shows how a student can connect to a classroom lab VM from a Chromebook by using RDP. +This section shows how a student can connect to a lab VM from a Chromebook by using Remote Desktop Protocol (RDP). ## Install Microsoft Remote Desktop on a Chromebook 1. Open the App Store on your Chromebook, and search for **Microsoft Remote Desktop**. -  - -1. Install the latest version of Microsoft Remote Desktop. + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/install-remote-desktop-chromebook.png" alt-text="Screenshot of Microsoft Remote Desktop app."::: ++1. Install the latest version of **Remote Desktop** by Microsoft Corporation. ## Access the VM from your Chromebook using RDP -1. Open the **RDP** file that's downloaded on your computer with **Microsoft Remote Desktop** installed. It should start connecting to the VM. +1. On the tile for your VM, ensure the [VM is running](how-to-use-lab.md#start-or-stop-the-vm) and select the **Connect** icon. -  + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/connect-vm.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The connect icon button on the VM tile is highlighted."::: +1. If youΓÇÖre connecting *to a Linux VM*, you'll see two options to connect to the VM: SSH and RDP. Select the **Connect via RDP** option. If you're connecting *to a Windows VM*, you don't need to choose an connection option. The RDP file will automatically start downloading. -1. When prompted, enter your password. + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/student-vm-connect-options.png" alt-text="Screenshot that shows V M tile for student. The R D P and S S H connection options are highlighted."::: +1. Open the **RDP** file that's downloaded on your computer with **Microsoft Remote Desktop** installed. It should start connecting to the VM. -  + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/connect-vm-chromebook.png" alt-text="Screenshot of the Microsoft Remote Desktop app connecting to V M."::: +1. When prompted, enter your password. -1. Select **Continue** if you receive the following warning. + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/password-chromebook.png" alt-text="Screenshot that shows the Logon screen where you enter your username and password."::: +1. Select **Continue** if you receive a warning about the certificate not being verified. -  + :::image type="content" source="./media/connect-virtual-machine-chromebook-remote-desktop/certificate-error-chromebook.png" alt-text="Screenshot that shows certificate warning when connecting to lab V M."::: -1. You should see the desktop of the VM that you are connecting to. +1. Once the connection is complete you'll see the desktop of your lab VM. ## Next steps -To learn more about connecting to Linux VMs, see [Connect to Linux virtual machines](how-to-use-remote-desktop-linux-student.md) -+- As an educator, [configure RDP for Linux VMs](how-to-enable-remote-desktop-linux.md#rdp-setup) +- As a student, [stop the VM](how-to-use-lab.md#start-or-stop-the-vm) |
| lab-services | Connect Virtual Machine Linux X2go | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/connect-virtual-machine-linux-x2go.md | + + Title: Connect to a Linux VM using X2Go in Azure Lab Services | Microsoft Docs +description: Learn how to use X2Go for Linux virtual machines in a lab in Azure Lab Services. + Last updated : 02/01/2022+++# Connect to a VM using X2Go ++Students can use X2Go to connect to their Linux VMs after their educator sets up their lab with X2Go and the GUI packages for a Linux graphical desktop environment ++Students need to find out from their educator which Linux graphical desktop environment their educator has installed. This information is needed in the next steps to connect using the X2Go client. ++## Install X2Go client ++Install the [X2Go client](https://wiki.x2go.org/doku.php/doc:installation:x2goclient) on your local computer. Follow the instructions that match the client OS you are using. ++## Connect to the VM using X2Go client ++1. Copy SSH connection information for VM. For instructions to get the SSH command, see [Connect to a Linux lab VM Using SSH](connect-virtual-machine.md#connect-to-a-linux-lab-vm-using-ssh). You need this information to connect using the X2Go client. ++1. Once you have the SSH connection information, open the X2Go client and select **Session** > **New Session**. ++ :::image type="content" source="./media/how-to-use-classroom-lab/x2go-new-session.png" alt-text="Screenshot of X 2 Go client Session menu."::: ++1. Enter the values in the **Session Preferences** pane based on your SSH connection information. For example, your connection information will look similar to following command. ++ ```bash + ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com + ``` ++ Using this example, the following values are entered: ++ - **Session name** - Specify a name, such as the name of your VM. + - **Host** - The ID of your VM; for example, **`ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com`**. + - **Login** - The username for your VM; for example, **student**. + - **SSH port** - The unique port assigned to your VM; for example, **12345**. + - **Session type** - Select the Linux graphical desktop environment that your educator configured your VM. You need to get this information from your educator. For example, select `XFCE` if you're using either XFCE or Xubuntu graphical desktop environments. ++ Finally, select **OK** to create the session. ++ :::image type="content" source="./media/how-to-use-classroom-lab/x2go-session-preferences.png" alt-text="Screenshot of new session window in X 2 Go client. The session name, server information and session type settings are highlighted."::: ++1. Select on your session in the right-hand pane. ++ :::image type="content" source="./media/how-to-use-classroom-lab/x2go-start-session.png" alt-text="Screenshot of X 2 Go with saved session."::: ++ > [!NOTE] + > If you are prompted with a message about authenticity, select **yes** to continue to entering your password. Message will be similar to "The authenticity of host '[`00000000-0000-0000-0000-000000000000.eastus2.cloudapp.eastus.cloudapp.azure.com`]:12345' can't be established. ECDSA key fingerprint is SHA256:00000000000000000000000000000000000000000000.Are you sure you want to continue connecting (yes/no)?" ++1. When prompted, enter your password and select **OK**. You'll now be remotely connected to your VM's GUI desktop environment. ++## Next steps ++- [As an educator, configure X2Go on a template VM](how-to-enable-remote-desktop-linux.md#x2go-setup) +- [As a student, stop the VM](how-to-use-lab.md#start-or-stop-the-vm) |
| lab-services | Connect Virtual Machine Mac Remote Desktop | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/connect-virtual-machine-mac-remote-desktop.md | Title: How to connect to an Azure Lab Services VM from Mac | Microsoft Docs description: Learn how to connect from a Mac to a virtual machine in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/04/2020 # Connect to a VM using Remote Desktop Protocol on a Mac -This section shows how a student can connect to a classroom lab VM from a Mac by using RDP. ++This section shows how a student can connect to a lab VM from a Mac by using RDP. ## Install Microsoft Remote Desktop on a Mac-1. Open the App Store on your Mac, and search for **Microsoft Remote Desktop**. -  -1. Install the latest version of Microsoft Remote Desktop. +1. Open the App Store on your Mac, and search for **Microsoft Remote Desktop**. + :::image type="content" source="./media/connect-virtual-machine-mac-remote-desktop\install-remote-desktop.png" alt-text="Screenshot of Microsoft Remote Desktop app in the App Store."::: +1. Install the latest version of Microsoft Remote Desktop. ## Access the VM from your Mac using RDP-1. Open the **RDP** file that's downloaded on your computer with **Microsoft Remote Desktop** installed. It should start connecting to the VM. -  -1. Select **Continue** if you receive the following warning. +1. On the tile for your VM, ensure the [VM is running](how-to-use-lab.md#start-or-stop-the-vm) and select the **Connect** icon. -  -1. You should see the VM. + :::image type="content" source="./media/connect-virtual-machine-mac-remote-desktop/connect-vm.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The connect icon button on the VM tile is highlighted."::: +1. If youΓÇÖre connecting *to a Linux VM*, you'll see two options to connect to the VM: SSH and RDP. Select the **Connect via RDP** option. If you're connecting *to a Windows VM*, you don't need to choose an connection option. The RDP file will automatically start downloading. - > [!NOTE] - > The following example is for a CentOS Linux VM. + :::image type="content" source="./media/connect-virtual-machine-mac-remote-desktop/student-vm-connect-options.png" alt-text="Screenshot that shows V M tile for student. The R D P and S S H connection options are highlighted."::: +1. Open the **RDP** file that's downloaded on your computer with **Microsoft Remote Desktop** app previously installed. It should start connecting to the VM. -  + :::image type="content" source="./media/how-to-use-classroom-lab/connect-linux-vm.png" alt-text="Screenshot of Microsoft Remote Desktop app connecting to a remote VM."::: +1. Select **Continue** if you receive the following warning. + :::image type="content" source="./media/how-to-use-classroom-lab/certificate-error.png" alt-text="Screenshot of certificate error for Microsoft Remote Desktop app."::: +1. You should see the VM desktop. The following example is for a CentOS Linux VM. -## Next steps -To learn how to connect to Linux VMs using RDP, see [Use remote desktop for Linux virtual machines](how-to-use-remote-desktop-linux-student.md) + :::image type="content" source="./media/how-to-use-classroom-lab/vm-ui.png" alt-text="Screenshot of desktop for CentOs Linux VM."::: +## Next steps +- As a student, learn to [connect to a VM using X2Go](connect-virtual-machine-linux-x2go.md). +- As a student, [stop the VM](how-to-use-lab.md#start-or-stop-the-vm). |
| lab-services | Connect Virtual Machine Windows Rdp | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/connect-virtual-machine-windows-rdp.md | + + Title: Connect to a VM using Remote Desktop Protocol on Windows in Azure Lab Services | Microsoft Docs +description: Learn how to connect from Windows to a Linux VM using Remote Desktop Protocol + Last updated : 02/01/2022+++# Connect to a VM using Remote Desktop Protocol on Windows ++This article shows how a student can connect from Windows to a lab VM using Remote Desktop Protocol (RDP). ++## Connect to VM from Windows using RDP ++Students can use RDP to connect to their lab VMs. If the lab VM is a Windows VM, no extra configuration is required by the educator. If the lab VM is a Linux VM, the educator must [enable RDP](how-to-enable-remote-desktop-linux.md) and install GUI packages for a Linux graphical desktop. ++Typically, the [Remote Desktop client](/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients) is already installed and configured on Windows. As a result, all you need to do is select on the RDP file to open it and start the remote session. ++1. On the tile for your VM, ensure the [VM is running](how-to-use-lab.md#start-or-stop-the-vm) and select the **Connect** icon. ++ :::image type="content" source="./media/connect-virtual-machine-windows-rdp/connect-vm.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The connect icon button on the VM tile is highlighted."::: +1. If youΓÇÖre connecting *to a Linux VM*, you'll see two options to connect to the VM: SSH and RDP. Select the **Connect via RDP** option. If you're connecting *to a Windows VM*, you don't need to choose a connection option. The RDP file will automatically start downloading. ++ :::image type="content" source="./media/connect-virtual-machine-windows-rdp/student-vm-connect-options.png" alt-text="Screenshot that shows V M tile for student. The R D P and S S H connection options are highlighted."::: +1. When the RDP file is downloaded onto your machine, open it to launch the RDP client. +1. After adjusting RDP connection settings as needed, select **Connect** to start the remote session. ++## Optimize RDP client settings ++The RDP client includes various settings that can be adjusted to optimize the user's connection experience. Typically, these settings don't need to be changed. By default, the settings are already configured to choose the right experience based on your network connection. For more information on these settings, see [RDP client's **Experience** settings](/windows-server/administration/performance-tuning/role/remote-desktop/session-hosts#client-experience-settings). ++If your educator has configured the GNOME graphical desktop on a Linux VM with the RDP client, we recommend the following settings to optimize performance: ++- Under the **Display** tab, set the color depth to **High Color (15 bit)**. ++ :::image type="content" source="./media/connect-virtual-machine-windows-rdp/rdp-display-settings.png" alt-text="Screenshot of display tab of the Windows R D P client. The color depth setting is highlighted."::: +- Under the **Experience** tab, set the connection speed to **Modem (56 kbps)**. ++ :::image type="content" source="./media/connect-virtual-machine-windows-rdp/rdp-experience-settings.png" alt-text="Screenshot of experience tab of the Windows R D P client. The connection speed setting is highlighted."::: ++## Next steps ++- [As an educator, enabled RDP on Linux](how-to-enable-remote-desktop-linux.md#rdp-setup) +- [As a student, stop the VM](how-to-use-lab.md#start-or-stop-the-vm) |
| lab-services | Connect Virtual Machine | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/connect-virtual-machine.md | + + Title: How to connect to an Azure Lab Services VM | Microsoft Docs +description: Learn how to connect to a VM in Azure Lab Services ++ Last updated : 02/1/2022+++# Connect to a lab VM ++As a student, you'll need to [start](how-to-use-lab.md#start-or-stop-the-vm) and then connect to your lab VM to complete your lab work. How you connect to your VM will depend on the operating system (OS) of the machine your using and the OS of the VM your connecting to. ++## Connect to a Windows lab VM ++If connecting *to a Windows VM*, follow the instructions based on the type of OS you're using. ++| Client OS | Instructions | +| | | +| Windows | [Connect to a VM using RDP on Windows](connect-virtual-machine-windows-rdp.md). | +| Mac | [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md). | +| Chromebook | [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md). | ++## Connect to a Linux lab VM ++This section shows students how to connect to a Linux VM in a lab using secure shell protocol (SSH), remote desktop protocol (RDP), or X2Go. ++SSH is configured automatically for Linux VMs. Both students and educators can SSH into Linux VMs without any extra setup. However, if students need to connect to using a GUI, the educators may need to do extra setup on the template VM. ++> [!WARNING] +> If you need to use [GNOME](https://www.gnome.org/) or [MATE](https://mate-desktop.org/) you should coordinate with your educator to ensure your lab VM is properly configured. For details, see [Using GNOME or MATE graphical desktops](how-to-enable-remote-desktop-linux.md#using-gnome-or-mate-graphical-desktops). ++### Connect to a Linux lab VM Using RDP ++An educator must first [enable remote desktop connection for Linux VMs](how-to-enable-remote-desktop-linux.md#rdp-setup). ++To connect *to a Linux VM using RDP*, follow the instructions based on the type of OS you're using. ++| Client OS | Instructions | +| | | +| Windows | [Connect to a VM using RDP on Windows](connect-virtual-machine-windows-rdp.md). | +| Mac | [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md).| +| Chromebook | [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md). | ++### Connect to a Linux lab VM Using X2Go ++Linux VMs can have X2Go enabled and a graphical desktop installed. For more information, see [X2Go Setup](how-to-enable-remote-desktop-linux.md#x2go-setup) and [Using GNOME or MATE graphical desktops](how-to-enable-remote-desktop-linux.md#using-gnome-or-mate-graphical-desktops). ++For instructions to connect *to a Linux VM using X2Go*, see [Connect to a VM using X2Go](connect-virtual-machine-linux-x2go.md). ++### Connect to a Linux lab VM using SSH ++By default Linux VMs have SSH installed. To connect *to a Linux VM using SSH*, do the following actions: ++1. If using a Windows machine to connect to a Linux VM, first install an ssh client like [PuTTY](https://www.putty.org/) or enable [OpenSSH in Windows](/windows-server/administration/openssh/openssh_install_firstuse). +1. [Start the VM](how-to-use-lab.md#start-or-stop-the-vm), if not done already. +1. Once the VM is running, select **Connect**, which will show a dialog box that provides the SSH command string. The connection command will look like the following sample: ++ ```bash + ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com + ``` ++1. Copy the command. +1. Go to your command prompt or terminal, paste in the command, and then press **ENTER**. +1. Enter the password to sign in to the lab VM. ++## Next steps ++- [As a student, stop the VM](how-to-use-lab.md#start-or-stop-the-vm) |
| lab-services | Cost Management Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/cost-management-guide.md | Title: Cost management guide for Azure Lab Services description: Understand the different ways to view costs for Lab Services. Previously updated : 08/16/2020 Last updated : 02/03/2022 For Azure Lab Services, cost management can be broken down into two distinct are ## Estimate the lab costs -Each lab dashboard has a **Costs & Billing** section that lays out a rough estimate of what the lab will cost for the month. The cost estimate summarizes the hour usage with the maximum number of users by the estimated cost per hour. To get the most accurate estimate, set up the lab, including the [schedule](how-to-create-schedules.md). The dashboard will reflect the estimated cost. +Each lab dashboard has a **Costs & Billing** section that lays out a rough estimate of what the lab will cost for the lab. The estimate uses the number [schedules](classroom-labs-concepts.md#schedules), [quota hours](classroom-labs-concepts.md#quota), [extra quota for individual students](how-to-configure-student-usage.md#set-additional-quotas-for-specific-users), and [lab capacity](how-to-manage-vm-pool.md#set-lab-capacity) when calculating the cost estimate. Changes to the number of quota hours, schedules or lab capacity will affect the cost estimate value. This estimate might not show all the possible costs. A few resources aren't included: -- The template preparation cost. It can vary significantly in the amount of time needed to create the template. The cost to run the template is the same as the overall lab cost per hour.-- Any [shared image gallery](how-to-use-shared-image-gallery.md) costs, because a gallery can be shared among multiple labs.-- Hours incurred when the lab creator starts a virtual machine (VM).+- The [template VM preparation](how-to-create-manage-template.md#update-a-template-vm) cost. It can vary significantly in the amount of time needed to create the template. The cost to run the template is the same as running any lab VM. +- Any [compute gallery](how-to-use-shared-image-gallery.md) costs. Compute galleries can be shared among multiple labs. +- Cost incurred when the lab creator starts a virtual machine (VM). +- Networking costs if the lab is using [advanced networking](how-to-connect-vnet-injection.md). -> [!div class="mx-imgBorder"] ->  -## Analyze the previous month's usage +## Cost analysis -The cost analysis is for reviewing the previous month's usage to help you determine any adjustments for the lab. You can find the breakdown of past costs in the [subscription cost analysis](../cost-management-billing/costs/quick-acm-cost-analysis.md). In the Azure portal, you can enter **Subscriptions** in the search box and then select the **Subscriptions** option. +The cost analysis is for reviewing the previous month's usage to help you determine any adjustments you need to make for a lab. You can find the breakdown of past costs in the [subscription cost analysis](../cost-management-billing/costs/quick-acm-cost-analysis.md). -> [!div class="mx-imgBorder"] ->  +1. In the [Azure portal](https://portal.azure.com), select **All services**. Select **Cost management** from the quick access list or select **Cost management + billing** from the **General** category. -Select the specific subscription that you want to review. + :::image type="content" source="./media/cost-management-guide/all-services-cost-management.png" alt-text="Screenshot that shows the All services page. The Cost management icon and Cost manage plus billing icon are highlighted."::: +1. Select the **Subscription** page and select subscription you wish to analyze. -> [!div class="mx-imgBorder"] ->  + :::image type="content" source="./media/cost-management-guide/subscription-select.png" alt-text="Screenshot that shows the Subscriptions page in Cost Management + Billing. The Subscriptions menu is highlighted."::: -Select **Cost Analysis** in the left pane under **Cost Management**. +1. Select **Cost analysis** in the left pane under the **Cost management** heading. -> [!div class="mx-imgBorder"] ->  + :::image type="content" source="./media/cost-management-guide/subscription-cost-analysis.png" alt-text="Screenshot that shows a subscription cost analysis on a graph."::: -This dashboard allows in-depth cost analysis, including the ability to export to different file types on a schedule. For more information, see [Cost Management + Billing overview](../cost-management-billing/cost-management-billing-overview.md). +The Cost analysis dashboard allows in-depth cost analysis, including the ability to export to different file types on a schedule. For more information, see [Cost Management + Billing overview](../cost-management-billing/cost-management-billing-overview.md). -You can filter by resource type. Using `microsoft.labservices/labaccounts` will show only the cost associated with Lab Services. +You can filter by service or resource type. To see only costs associated with Azure Lab Services, set the **service name** filter equal to **azure lab services**. If filtering on **resource type**, include `Microsoft.Labservices/labaccounts` resource type. If using the [April 2022 Update (preview)](lab-services-whats-new.md), also include the `Microsoft.LabServices/labs` resource type. -## Understand the usage +### Understand the entries -The following screenshot is an example of a cost analysis. +Changing the view on **Cost Analysis** page to **Cost by resource** shows the individual charges. By default, there are six columns: **Resource**, **Resource type**, **Location**, **Resource group name**, **Tags**, and **Cost**. The **Resource** column contains the information about the lab plan, lab name, and VM. If the cost is associated with a template VM, the resource will be in the form `{lab account}/{lab name}/default`. If the cost is associated with a student lab VM, the resource will be in the form `{lab account}/{lab name}/default/{vm name}`. -> [!div class="mx-imgBorder"] ->  +In this example, adding the first and second rows (both start with "aaalab / dockerlab") will give you the total cost for the lab "dockerlab" in the "aaalab" lab account or lab plan. -By default, there are six columns: **Resource**, **Resource type**, **Location**, **Resource group name**, **Tags**, and **Cost**. The **Resource** column contains the information about the lab account, lab name, and VM. The rows that show the lab account, lab name, and default (second and third rows) are the cost for the lab. The used VMs have a cost that you can see for the rows that show the lab account, lab name, default, and VM name. -In this example, adding the first and second rows (both start with **aaalab / dockerlab**) will give you the total cost for the lab "dockerlab" in the "aaalab" lab account. +If you're using the [April 2022 Update (preview)](lab-services-whats-new.md), the entries in are formatted differently. The **Resource** column will show entries in the form `{lab name}/{number}` for Azure Lab Services. Some tags are added automatically to each entry when using the April 2022 Update. -To get the overall cost for the image gallery, change the resource type to `Microsoft.Compute/Galleries`. A shared image gallery might not show up in the costs, depending on where the gallery is stored. +| Tag name | Value | +| -- | -- | +| ms-istemplate | Set to true if cost associated with a template VM in a lab. Set to false, otherwise. | +| ms-labname | Name of the lab. | +| ms-labplanid | Full resource ID of the lab plan used when creating the lab. | -> [!NOTE] -> A shared image gallery is connected to the lab account. That means multiple labs can use the same image. --## Separate the costs --Some universities have used the lab account and the resource group as ways to separate the classes. Each class has its own lab account and resource group. --In the cost analysis pane, add a filter based on the resource group name with the appropriate resource group name for the class. Then, only the costs for that class will be visible. This allows a clearer delineation between the classes when you're viewing the costs. You can use the [scheduled export](../cost-management-billing/costs/tutorial-export-acm-data.md) feature of the cost analysis to download the costs of each class in separate files. --## Manage costs --Depending on the type of class, there are ways to manage costs to reduce instances of VMs that are running without a student using them. -### Automatic shutdown settings for cost control --Automatic shutdown features enable you to prevent wasted VM usage hours in the labs. The following settings catch most of the cases where users accidentally leave their virtual machines running: --> [!div class="mx-imgBorder"] ->  --You can configure these settings at both the lab account level and the lab level. If you enable them at the lab account level, they're applied to all labs within the lab account. For all new lab accounts, these settings are turned on by default. --#### Automatically disconnect users from virtual machines that the OS deems idle +To get the cost for the entire lab, don't forget to include external resources. Azure Compute Gallery related charges are under the `Microsoft.Compute` namespace. The advanced networking charges are under the `Microsoft.Network` namespace. > [!NOTE]-> This setting is available only for Windows virtual machines. --When the **Disconnect users when virtual machines are idle** setting is turned on, the user is disconnected from any machines in the lab when the Windows OS deems the session to be idle (including the template virtual machines). The [Windows OS definition of idle](/windows/win32/taskschd/task-idle-conditions#detecting-the-idle-state) uses two criteria: --- User absence: no keyboard or mouse input.-- Lack of resource consumption: All the processors and all the disks were idle for a certain percentage of time.--Users will see a message like this in the VM before they're disconnected: +> A compute gallery and virtual network can be connected to multiple labs. -> [!div class="mx-imgBorder"] ->  +### Separate the costs -The virtual machine is still running when the user is disconnected. If the user reconnects to the virtual machine by signing in, windows or files that were open or work that was unsaved before the disconnect will still be there. In this state, because the virtual machine is running, it still counts as active and accrues cost. +Since cost entries are tied to the lab account, some schools use the lab account and the resource group as ways to separate the classes. Each class has its own lab plan and resource group. -To automatically shut down idle Windows virtual machines that are disconnected, use the combination of **Disconnect users when virtual machines are idle** and **Shut down virtual machines when users disconnect** settings. +In the cost analysis pane, add a filter based on the resource group name for the class. Then, only the costs for that class will be visible. Grouping by resource group allows a clearer delineation between the classes when you're viewing the costs. You can use the [scheduled export](../cost-management-billing/costs/tutorial-export-acm-data.md) feature of the cost analysis to download the costs of each class in separate files. -For example, if you configure the settings as follows: +In the [April 2022 Update (preview)](lab-services-whats-new.md): -- **Disconnect users when virtual machines are idle**: 15 minutes after the idle state is detected.-- **Shut down virtual machines when users disconnect**: 5 minutes after the user disconnects.+- Cost entries are tied to a lab VM, *not* the lab plan. +- Cost entries get tagged with the name of the lab the VM is tied to. You can filter by the lab name tag to view total cost across VM in that lab. +- Cost entries get tagged with the ID of the lab plan when creating the lab. You can filter by the lab plan tag to view total cost across labs created from a lab plan. +- You can set custom tags on labs or resource groups containing the labs to organize and analyze cost. -The Windows virtual machines will automatically shut down 20 minutes after the user stops using them. --> [!div class="mx-imgBorder"] ->  --#### Automatically shut down virtual machines when users disconnect --The **Shut down virtual machines when users disconnect** setting supports both Windows and Linux virtual machines. When this setting is on, automatic shutdown will occur when: --- For Windows, a Remote Desktop (RDP) connection is disconnected.-- For Linux, a SSH connection is disconnected.--> [!IMPORTANT] -> Only [specific distributions and versions of Linux](../virtual-machines/extensions/diagnostics-linux.md#supported-linux-distributions) are supported. Shutdown settings are not supported by the [Data Science Virtual Machine - Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) image. --You can specify how long the virtual machines should wait for the user to reconnect before automatically shutting down. --#### Automatically shut down virtual machines that are started but users don't connect --In a lab, a user might start a virtual machine but never connect to it. For example: --- A schedule in the lab starts all virtual machines for a class session, but some students don't show up and don't connect to their machines.-- A user starts a virtual machine but forgets to connect.--The **Shut down virtual machines when users do not connect** setting will catch these cases and automatically shut down the virtual machines. --For information on how to configure and enable automatic shutdown of VMs on disconnect, see these articles: --- [Configure automatic shutdown of VMs for a lab account](how-to-configure-lab-accounts.md)-- [Configure automatic shutdown of VMs for a lab](how-to-enable-shutdown-disconnect.md)--### Scheduled time vs. quota time +## Manage costs -Understanding [scheduled time](classroom-labs-concepts.md#schedules) and [quota time](classroom-labs-concepts.md#quota) will help you to configure a lab to better fit the needs of the professor and the students. +Depending on the type of class, there are ways to manage costs to reduce instances of VMs that are running without a student using them. -Scheduled time is a set time where all the student VMs have been started and are available for connection. Scheduled time is commonly used when all the students have their own VMs and are following the professor's directions at a set time during the day (like class hours). The downside is that all the student VMs are started and are accruing costs, even if a student doesn't log in to a VM. +### Automatic shutdown settings for cost control -Quota time is time allocated to each student for use at their discretion and is often used for independent studying. The VMs aren't started until the student starts the VM. +Automatic shutdown features enable you to prevent wasted VM usage hours in the labs. To configure automatic shutdown for a lab plan, see [Configure automatic shutdown of VMs for a lab plan](how-to-configure-auto-shutdown-lab-plans.md). You can configure these settings at both the lab plan/lab account level and the lab level. -A lab can use either quota time or scheduled time, or a combination of both. If a class doesn't need scheduled time, then use only quota time for the most effective use of the VMs. +### Scheduled time and quota time -### Scheduled event: stop only +[Schedules](classroom-labs-concepts.md#schedules) and [Quota](classroom-labs-concepts.md#quota) are two ways of allowing access to the lab VMs. -In the schedule, you can add a stop-only event type that will stop all machines at a specific time. Some lab owners have set a stop-only event for every day at midnight to reduce the cost and quota usage when a student forgets to shut down the VM they're using. The downside to this type of event is that all VMs will be shut down, even if a student is using a VM. +In the schedule, you can add a stop-only event type that will stop all machines at a specific time. Some lab owners have set a stop-only event for every day at midnight to reduce the cost and quota usage. The downside to this type of event is that all VMs will be shut down, even if a student is using a VM. ### Other costs related to labs -Some costs aren't rolled into Lab Services but can be tied to a lab service. You can connect a shared image gallery to a lab, but it won't show under the Lab Services costs and does have costs. To help keep overall costs down, you should remove any unused images from the gallery because the images have an inherent storage cost. +Some costs aren't rolled into Lab Services but can be tied to a lab service. You can [connect a compute gallery](how-to-attach-detach-shared-image-gallery.md) to a lab, but it won't show under the Lab Services costs and does have costs. To help keep overall costs down, you should remove any unused images from the gallery because the images have associated storage costs. -Labs can have connections to other Azure resources through a virtual network. When a lab is removed, you should remove the virtual network and the other resources. +Labs can have connections to other Azure resources through a virtual network is using [advanced networking](how-to-connect-vnet-injection.md). When a lab is removed, you should remove the virtual network and the other resources. ## Conclusion |
| lab-services | Get Started Manage Labs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/get-started-manage-labs.md | - Title: Get started with Azure Lab Services -description: This article describes how to get started with Azure Lab Services. - Previously updated : 11/18/2020---# Get started with Lab Services --Azure Lab Services provides students and teachers with access to virtual computer labs directly from their own computers. --Teachers need to know how to teach students/parents to utilize Lab Services in their instruction through one-to-one student issued hardware. As a result, students would be able to access industry-standard software required for their programs of study through Virtual Machines (VM). --A VM is a virtual environment that acts as a virtual computer. VMs have their own processor, memory, and storage. VMs provide a substitute for a real machine and can give users access to operating systems and software without the need to have them on their own device. Azure Lab Services provides a tool for students to access and navigate VMs and for staff to manage their virtual computer labs. --This article provides information for teaching staff on how to access, manage, and teach students/parent to utilize Azure Lab Services. --## Key concepts --### Quota hours --Students can access their VMs at any time during scheduled class time without impacting their quota hours. Quota hours are set for the entire semester and determine the number of hours a student can use their VM outside of regularly scheduled class time. --8 Hrs per week, resets on Sunday - not cumulative. --For more information, see [Set quota](how-to-configure-student-usage.md#set-quotas-for-users). --### Automatic shut-down --To help keep down costs and save students' quota hours, automatic shutdowns are enabled for the labs. Auto-shutdowns will turn VMs off after a period of inactivity (no mouse or keyboard inputs). Auto-shutdowns work in two stages, first a student will be disconnected from the VM after a period of inactivity. At this point, the VM is still **Running** and the students are able to connect. After another period of inactivity once disconnected, the VM will shut itself down. --Auto-shutdowns are an important cost-saving tool, however they do present a challenge for students in regard to saving their work and rendering large project files. If your students are frequently being disconnected or VMs are turning off too quickly, reach out to your CTE administrator. --For more information, see [Configure automatic shutdown of VMs for a lab account](how-to-configure-lab-accounts.md). --### Managing Virtual Machines --Managing the lab allows teachers to control things like lab capacity (the number of VMs available for students) and manually starting, stopping, or resetting VMs. teachers can also connect to VMs to experience student interface, access files and troubleshoot issues with software or the VM itself. --The most important thing to remember when managing the VMs is that anytime a machine is **Running**, we are incurring costs, even if no one is connected to the VM. --## Lab dashboards --### Overview --Dashboards for labs in Azure Lab Services provide a snapshot of different aspects of a particular lab including, VM information, number of assigned and unassigned VMs, number of registered and unregistered users and information about lab schedules. --> [!NOTE] -> While most administrative aspects of the dashboard and the [Azure Lab Services website](https://labs.azure.com/) will be visible to teachers, permissions specific to your role may impact your ability to modify certain criteria in the dashboard. If you encounter an issue with your particular lab set-up, reach out to your CTE administrator. ---### Examine a dashboard --1. Navigate and sign in to the [Azure Lab Services website](https://labs.azure.com/). -1. Select your lab. -1. You will see a **Dashboard** on the left-hand side of the window. Click on **Dashboard** and you will see a number of tiles in your dashboard. -1. Below the **Costs & Billing** tile, there are also tiles for Templates, Virtual Machine Pools, Users, and Schedules, which allow you to modify aspects and view more details on the Classroom Lab. -- * Template - describes the date the template was created, and last published. - * Virtual Machine Pool - number of assigned and unassigned VMs. - * Users - number of registered users and users who have been added to the lab, but not registered. - * Schedules - displays upcoming scheduled events for the lab and a link to view more events. --For more information, see [Use dashboard](use-dashboard.md). --### Manually starting VMs --1. From the **Virtual machine pool** page, you can start all VMs in a lab by clicking the **Start all** button at the top of the page. -- :::image type="content" source="./media/how-to-set-virtual-machine-passwords/start-all-vms-button.png" alt-text="Start your VMs"::: -1. Individual VMs can be started by clicking the state toggle. -- The toggle will read **Starting** as the VM starts up, and then **Running** once the VM has started. -1. You can also select a number of VMs using the checks to the left of the **Name** column. -- Once you have selected the desired VMs, click the **Start** button at the top of the screen. -1. Once started, you can click the **Stop all** button to stop all of the VMs. -- :::image type="content" source="./media/how-to-set-virtual-machine-passwords/stop-all-vms-button.png" alt-text="Stop your VMs"::: --### Stopping and resetting VMs --* You can stop individual VMs by clicking the state toggle. -* You can also stop multiple VMs by using the checks and clicking the ΓÇ£StopΓÇ¥ button at the top of the screen. --If a student is experiencing difficulties connecting to the VM, or the VM needs to be reset for any other reason, you can use the reset function. -1. To reset one or more VMs, select them using the checks, then click the **Reset** button at the top of the page. -1. In the pop-up window, click **Reset**. -- :::image type="content" source="./media/how-to-set-virtual-machine-passwords/reset-vms-dialog.png" alt-text="Reset your VM"::: -- > [!NOTE] - > Turning on a student VM will not affect the quota for the student. Quotas for users specifies the number of lab hours available to the user outside of the scheduled class time. --### Connect to VMs --Teachers are able to connect to a student VM as long as it is turned on, and the student is NOT connected to the VM. By connecting to the VM, you will be able to access local files on the VM and help students troubleshoot issues. --1. To connect to the student VM, hover the mouse on the VM in the list and click the **Connect** button. -1. Then follow the getting started guide for students for either Chromebooks, Macs or PCs ---## Manage users in a lab --Teachers are able to add student users to a lab and monitor their hour quotas. For details on how to add users by email address or by using a spreadsheet list and register users, see [Add and manage lab users](how-to-configure-student-usage.md). --After you have invited users or shared the link, you will be able to monitor which users have registered successfully in the **Users** page in the **Status** column. --## Clean up resources --If you're not going to continue to use resources that you created in this quickstart, delete the resources. --## Next steps --[Set up a lab account](tutorial-setup-lab-account.md) |
| lab-services | Hackathon Labs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/hackathon-labs.md | Title: Use Azure Lab Services for hackathon description: This article describes how to use Azure Lab Services for creating labs that you can use for running hackathons. Previously updated : 06/26/2020 Last updated : 11/19/2021 # Use Azure Lab Services for your next hackathon -Azure Lab Services is designed to be lightweight and easy to use so that you can quickly spin up a new lab of virtual machines (VMs) for your hackathon. Use the following checklist to ensure that your hackathon goes as smoothly as possible. This checklist should be completed by your IT department or faculty who are responsible for creating and managing your hackathon lab. -To use Lab Services for your hackathon, ensure that both lab account and your lab are created at least a few days before the start of your hackathon. Also, follow the guidance below: ++Azure Lab Services is designed to be lightweight and easy to use so that you can quickly spin up a new lab of virtual machines (VMs) for your hackathon. Use the following checklist to ensure that your hackathon goes as smoothly as possible. This checklist should be completed by your IT department or faculty who are responsible for creating and managing your hackathon lab. ++To use Lab Services for your hackathon, ensure that both lab plan and your lab are created at least a few days before the start of your hackathon. Also, follow the guidance below: ## Guidance -- **Create the lab in a region or location that's closest to participants**. +- **Create the lab in a region or location that's closest to participants**. To reduce latency, create your lab in a region that's closest to your hackathon participants. If your participants are located all over the world, you need to use your best judgment to create a lab that is centrally located. Or, split the hackathon to use multiple labs based on the locations where your participants are located. - **Choose a compute size best suited for usage needs**. To use Lab Services for your hackathon, ensure that both lab account and your la If your hackathon uses Linux VMs, ensure that remote desktop is enabled so that your participants can use either RDP (remote desktop protocol) or SSH (secure shell) to connect to their VMs. This step is only required for Linux VMs and must be enabled when creating the lab. Also, for RDP, you may need to install and configure the RDP server and GUI packages on the template VM before publishing. For more information, see the [how-to guide on enabling remote desktop for Linux](how-to-enable-remote-desktop-linux.md). -- **Install and stop Windows updates**. +- **Install and stop Windows updates**. - If you're using a Windows image, we recommend that you install the latest Windows updates on the labΓÇÖs [template VM](how-to-create-manage-template.md) before you publish it to create labsΓÇÖ VMs. It's for security purposes and to prevent participants from being disrupted during the hackathon to install updates, which can also cause their VMs to restart. You might also consider turning off Windows updates to prevent any future interruptions. See the [how-to guide on installing and configuring Windows updates](how-to-prepare-windows-template.md#install-and-configure-updates). -- **Decide how students will back up their work**. + If you're using a Windows image, we recommend you install the latest Windows updates on the labΓÇÖs [template VM](how-to-create-manage-template.md) before you publish it to create labsΓÇÖ VMs. It's for security purposes and to prevent participants from being disrupted during the hackathon to install updates, which can also cause their VMs to restart. You might also consider turning off Windows updates to prevent any future interruptions. See the [how-to guide on installing and configuring Windows updates](how-to-prepare-windows-template.md#install-and-configure-updates). +- **Decide how students will back up their work**. Students are each assigned a virtual machine for the lifetime of the hackathon. They can save their work directly to the machine, but itΓÇÖs recommended that students back up their work so that they have access to it after the hackathon is over. For example, they should save to an external location, such as OneDrive, GitHub, and so on. To use OneDrive, you may choose to configure it automatically for students on their lab virtual machines. See the [how-to guide to install and configure OneDrive](how-to-prepare-windows-template.md#install-and-configure-onedrive).-- **Set VM capacity according to number of participants**. +- **Set VM capacity according to number of participants**. - Ensure that your labΓÇÖs virtual machine capacity is set based on the number of participants you expect at your hackathon. When you publish the template virtual machine, it can take several hours to create all of the machines in the lab. That's why we recommend that you do it well in advance to the start of the hackathon. For more information, see the [how-to guide on updating lab capacity](how-to-set-virtual-machine-passwords.md#update-the-lab-capacity). + Ensure that your labΓÇÖs virtual machine capacity is set based on the number of participants you expect at your hackathon. When you publish the template virtual machine, it can take several hours to create all of the machines in the lab. That's why we recommend that you do it well in advance to the start of the hackathon. For more information, see [Set lab capacity](how-to-manage-vm-pool.md#set-lab-capacity). -- **Decide whether to restrict lab access**. +- **Decide whether to restrict lab access**. When adding users to the lab, there is a restrict access option that's enabled by default. This feature requires you to add all of your hackathon participantsΓÇÖ emails to the list before they can register and access the lab using the registration link. If you have a hackathon where you donΓÇÖt know who the participants will be before the event, you can choose to disable the restrict access option, which allows anyone to register to the lab using the registration link. For more information, see the [how-to guide on adding users](how-to-configure-student-usage.md). -- **Verify schedule, quota, and autoshutdown settings**. +- **Verify schedule, quota, and autoshutdown settings**. Lab Services provides several cost controls to limit usage of VMs. However, if these settings are misconfigured, they can cause your labΓÇÖs virtual machines to unexpectedly shut down. To ensure that these settings are configured appropriately for your hackathon, verify the following settings: - **Schedule**: A [schedule](how-to-create-schedules.md) allows you to automatically control when your labsΓÇÖ machines are started and shut down. By default, no schedule is configured when you create a new lab. However, you should ensure that your labΓÇÖs schedule is set according to what makes sense for your hackathon. As an example, if your hackathon starts on Saturday at 8:00 AM and ends on Sunday at 5:00 PM ΓÇô you could create a schedule that automatically starts the machine at 7:30 AM on Saturday (about 30 minutes before the start of the hackathon) and shuts it down at 5:00 PM on Sunday. Instead, you may also decide not to use a schedule at all. + **Schedule**: A [schedule](how-to-create-schedules.md) allows you to automatically control when your labsΓÇÖ machines are started and shut down. By default, no schedule is configured when you create a new lab. However, you should ensure that your labΓÇÖs schedule is set according to what makes sense for your hackathon. For example, if your hackathon starts on Saturday at 8:00 AM and ends on Sunday at 5:00 PM, create a schedule that automatically starts the machine at 7:30 AM on Saturday (about 30 minutes before the start of the hackathon) and shuts it down at 5:00 PM on Sunday. You may also decide not to use a schedule at all and rely on quota time. **Quota**: The [quota](how-to-configure-student-usage.md#set-quotas-for-users) controls the number of hours that participants will have access to a virtual machine outside of the scheduled hours. If the quota is reached while a participant is using it, the machine is automatically shut down and the participant won't be able to restart it unless the quota is increased. By default, when you create a lab, the quota is set to 10 hours. Again, you should be sure to set the quota so that it allows enough time for the hackathon, which is especially important if you haven't created a schedule. **Autoshutdown**: When enabled, the [autoshutdown](how-to-enable-shutdown-disconnect.md) setting causes Windows virtual machines to automatically shut down after a certain period of time once a student has disconnected from their RDP session. By default, this setting is disabled. -- **Configure firewall settings to allow connections to lab VMs**. +- **Configure firewall settings to allow connections to lab VMs**. Ensure that your schoolΓÇÖs or organizationΓÇÖs firewall settings allow connecting to lab VMs using RDP\SSH. For more information, see the [how-to guide on configuring your networkΓÇÖs firewall settings](how-to-configure-firewall-settings.md). -- **Install RDP\SSH client on participantsΓÇÖ tablets, Macs, PCs, and so on**.+- **Install RDP/SSH client on participantsΓÇÖ tablets, Macs, PCs, and so on**. - Hackathon participants must have an RDP and/or SSH client installed on their tablets or laptops that they'll use to connect to lab VMs. You may choose from different RDP or SSH clients, such as: + Hackathon participants must have an RDP and/or SSH client installed on their tablets or laptops that they'll use to connect to lab VMs. For more information about required software and how to connect to lab VMs, see [Connect to a lab VM](connect-virtual-machine.md). - - MicrosoftΓÇÖs **Remote Desktop Connection** app for RDP connections. The Remote Desktop Connection app is supported on different kinds of platforms, including Chromebooks and [Mac](https://techcommunity.microsoft.com/t5/azure-lab-services/connecting-to-azure-lab-services-environments-on-your-macos/ba-p/1290162). - - [Putty](https://techcommunity.microsoft.com/t5/azure-lab-services/connecting-to-azure-lab-services-environments-on-your-macos/ba-p/1290162) for using SSH to connect to a Linux VM. -- **Verify lab virtual machines**. +- **Verify lab virtual machines**. Once youΓÇÖve published lab VMs, you should verify they're configured properly. You only need to do this verification for one of the participantΓÇÖs lab virtual machines: To use Lab Services for your hackathon, ensure that both lab account and your la 3. Walk through a few basic scenarios that are representative of the activities that participants will do to ensure VM performance is adequate based on the selected compute size. ## On the day of hackathon+ This section outlines the steps to complete the day of your hackathon. 1. **Start lab VMs**. Depending on your OS, your lab machine may take up to 30 minutes to start. As a result, itΓÇÖs important to start machines before the hackathon starts so that your participants donΓÇÖt have to wait. If you're using a schedule, ensure that the VMs are automatically started at least 30 minutes earlier as well.-2. **Invite students to register and access their lab virtual machine**. +2. **Invite students to register and access their lab virtual machine**. - Provide your participants with the following information so that participants can access their lab VMs. + Provide your participants with the following information so that participants can access their lab VMs. - - The labΓÇÖs registration link. - - Credentials that should be used to connect to the machine. This step applies only if your lab uses a Windows-based image and you configured all VMs to use the same password. - - Instructions on how participants SSH and\or RDP to their machines. -- For more information, See [how-to guide on sending invitations to users](how-to-configure-student-usage.md#send-invitations-to-users) and [connecting to Linux VMs](how-to-use-remote-desktop-linux-student.md). + - The labΓÇÖs registration link. For more information, See [how-to guide on sending invitations to users](how-to-configure-student-usage.md#send-invitations-to-users). + - Credentials that should be used to connect to the machine. This step applies only if your lab has configured all VMs to use the same password. + - Instructions to connect to their VM. For OS-specific instructions connection to a lab VM, see [Connect to a lab VM](connect-virtual-machine.md). ## Next steps-Start with creating a lab account in labs by following instructions in the article: [Tutorial: Setup a lab account with Azure Lab Services](tutorial-setup-lab-account.md). ++Start with creating a lab plan in labs by following instructions in the article: [Tutorial: Setup a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). |
| lab-services | How To Access Vm For Students Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-access-vm-for-students-within-canvas.md | + + Title: Access a VM (student view) in Azure Lab Services from Canvas +description: Learn how to access a VM (student view) in Azure Lab Services from Canvas. + Last updated : 11/01/2021+++# Access a VM (student view) in Azure Lab Services from Canvas +++When a lab is created within [Canvas](https://www.instructure.com/canvas), students can view and access all the VMs provisioned by the course educator. Once the lab is published and VMs are created, students will be automatically assigned a VM. Students can view and access the VMs assigned to them by selecting the tab containing **Azure Lab Services** app. ++Students must access their VMs through Canvas. Their Canvas credentials will be used to log into Azure Lab Services. For further instructions about connecting to your VM, see [Tutorial: Access a lab in Azure Lab Services](tutorial-connect-lab-virtual-machine.md) ++Azure Lab Services supports test users in Canvas and the ability for the educator to act as another user. ++## Lab unavailable ++If the lab hasn't been published or a synced in a while, students may see a message indicating the lab isn't available yet. Educators should [publish](tutorial-setup-lab.md#publish-a-lab) and [sync users](how-to-manage-user-lists-within-canvas.md#sync-users) to solve the problem. +++## Next steps ++For more information, see the following articles: ++- [Use Azure Lab Services within Canvas overview](lab-services-within-canvas-overview.md) +- [Get started and create a lab within Canvas](how-to-get-started-create-lab-within-canvas.md) +- [Manage lab user lists within Canvas](how-to-manage-user-lists-within-canvas.md) +- [Manage lab's VM pool within Canvas](how-to-manage-vm-pool-within-canvas.md) +- [Create and manage lab schedules within Canvas](how-to-create-schedules-within-canvas.md) |
| lab-services | How To Access Vm For Students Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-access-vm-for-students-within-teams.md | Title: Access a VM (student view) in Azure Lab from Teams description: Learn how to access a VM (student view) in Azure Lab from Teams. Previously updated : 10/07/2020 Last updated : 03/01/2022+ # Access a VM (student view) in Azure Lab from Teams -When a lab is created within Teams, users can view and access all the VMs provisioned by the team owner. Once the lab is published and VMs are created, users will be automatically registered to the lab and assigned a VM on their first login to Azure Lab Services. Users can view and access the VM's assigned to them by selecting the tab containing **Azure Lab Services** app. +When a lab is created within Teams, users can view and access all the VMs provisioned by the team owner. When the lab is published and VMs are created, users are automatically registered to the lab. A VM will be assigned when they first sign into Azure Lab Services. Users can view and access the VMs assigned to them by selecting the tab containing **Azure Lab Services** app. -If the lab is yet to be published or a sync is yet to be triggered after they are added to the team, similar messaging will be shown to the students. -> [!div class="mx-imgBorder"] -> :::image type="content" source="./media/how-to-access-vm-for-students-within-teams/not-published-lab.png" alt-text="Not published Azure Lab Services lab"::: +Students see a message if the lab hasn't been published yet. Lab is also seen as unable if sync is yet to be triggered after they're added to the team. -## Next steps -For more information, see the following articles: +## Next steps -- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Get started and create a lab within Teams](how-to-get-started-create-lab-within-teams.md)-- [Manage lab user lists within Teams](how-to-manage-user-lists-within-teams.md)-- [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md)-- [Create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md)+- As a student, [start the VM](tutorial-connect-lab-virtual-machine.md#start-the-vm). +- As a student, [connect to a lab VM](connect-virtual-machine.md). |
| lab-services | How To Add User Lab Owner | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-add-user-lab-owner.md | Title: How to add additional owners to a lab in Azure Lab Services + Title: How to add additional owners to a lab in Azure Lab Services (deprecated) description: This article shows you how an administrator can add a user as an owner to a lab in Azure Lab Services. Last updated 08/03/2021 -# How to add additional owners to an existing lab in Azure Lab Services +# How to add additional owners to an existing lab in Azure Lab Services (deprecated) This article shows you how you, as an administrator, can add additional owners to an existing lab. ## Add user to the reader role for the lab account |
| lab-services | How To Attach Detach Shared Image Gallery 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-attach-detach-shared-image-gallery-1.md | + + Title: Attach or detach a shared image gallery in Azure Lab Services (deprecated) | Microsoft Docs +description: This article describes how to attach a shared image gallery to a lab in Azure Lab Services. (deprecated) + Last updated : 09/11/2020+++# Attach or detach a shared image gallery in Azure Lab Services (deprecated) ++This article shows you how to attach or detach a shared image gallery to a lab account. ++> [!NOTE] +> When you save a template image of a lab in Azure Lab Services to a shared image gallery, the image is uploaded to the gallery as a specialized image. [Specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) keep machine-specific information and user profiles. You can still directly upload a generalized image to the gallery outside of Azure Lab Services. +> +> A lab creator can create a template VM based on both generalized and specialized images in Azure Lab Services. ++## Scenarios ++Here are the couple of scenarios supported by this feature: ++- A lab account admin attaches a shared image gallery to the lab account. The VM image is uploaded to the shared image gallery outside the context of a lab. The lab admin has to enable the use of the image on the lab account. Lab creators can use that image from the shared image gallery when creating labs. +- A lab account admin attaches a shared image gallery to the lab account. A lab creator (educator) saves the customized image of their lab to the shared image gallery. Then, other lab creators can select this image from the shared image gallery to create a template for their labs. ++ When an image is saved to a shared image gallery, Azure Lab Services replicates the saved image to other regions available in the same [geography](https://azure.microsoft.com/global-infrastructure/geographies/). It ensures that the image is available for labs created in other regions in the same geography. Saving images to a shared image gallery incurs an additional cost, which includes cost for all replicated images. This cost is separate from the Azure Lab Services usage cost. For more information about Shared Image Gallery pricing, see [Shared Image Gallery ΓÇô Billing](../virtual-machines/shared-image-galleries.md#billing). ++> [!IMPORTANT] +> While using a Shared Image Gallery, Azure Lab Services supports only images with less than 128 GB of OS Disk Space. Images with more than 128 GB of disk space or multiple disks will not be shown in the list of virtual machine images during lab creation. ++## Configure at the time of lab account creation ++When you are creating a lab account, you can attach a shared image gallery to the lab account. You can select an existing shared image gallery from the drop-down list or create a new one. To create and attach a shared image gallery to the lab account, select **Create new**, enter a name for the gallery, and enter **OK**. ++ ++## Configure after the lab account is created ++After the lab account is created, you can do the following tasks: ++- Create and attach a shared image gallery +- Attach a shared image gallery to the lab account +- Detach a shared image gallery from the lab account ++## Create and attach a shared image gallery ++1. Sign in to the [Azure portal](https://portal.azure.com). +2. Select **All Services** on the left menu. Select **Lab Services** in the **DEVOPS** section. If you select star (`*`) next to **Lab Services**, it's added to the **FAVORITES** section on the left menu. From the next time onwards, you select **Lab Services** under **FAVORITES**. ++  +3. Select your lab account to see the **Lab Account** page. +4. Select **Shared image gallery** on the left menu, and select **+ Create** on the toolbar. ++  +5. In the **Create shared image gallery** window, enter a **name** for the gallery, and enter **OK**. ++  ++ Azure Lab Services creates the shared image gallery and attached it to the lab account. All labs created in this lab account have access to the attached shared image gallery. ++  ++ In the bottom pane, you see images in the shared image gallery. There will be no images initially. When you upload images to the gallery, you see them on this page. ++ All images in the attached shared image gallery are enabled by default. You can enable or disable selected images by selecting them in the list and using the **Enable selected images** or **Disable selected images** button. ++## Attach an existing shared image gallery ++The following procedure shows you how to attach an existing shared image gallery to a lab account. ++1. On the **Lab Account** page, select **Shared image gallery** on the left menu, and select **Attach** on the toolbar. ++  +2. On the **Attach an existing Shared Image Gallery** page, select your shared image gallery, and select **OK**. ++  +3. You see the following screen: ++  ++ In this example, there are no images in the shared image gallery yet. ++ Azure Lab Services identity is added as a contributor to the shared image gallery that is attached to the lab. It allows educators/IT admins to save virtual machine images to the shared image gallery. All labs created in this lab account have access to the attached shared image gallery. ++ All images in the attached shared image gallery are enabled by default. You can enable or disable selected images by selecting them in the list and using the **Enable selected images** or **Disable selected images** button. ++## Detach a shared image gallery ++Only one shared image gallery can be attached to a lab. If you would like to attach another shared image gallery, detach the current one before attaching the new one. To detach a shared image gallery from your lab, select **Detach** on the toolbar, and confirm the detach operation. ++ ++## Next steps ++To learn about how to save a lab image to the shared image gallery or use an image from the shared image gallery to create a VM, see [How to use shared image gallery](how-to-use-shared-image-gallery.md). ++To explore other options for bringing custom images to shared image gallery outside of the context of a lab, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). ++For more information about shared image galleries in general, see [shared image gallery](../virtual-machines/shared-image-galleries.md). |
| lab-services | How To Attach Detach Shared Image Gallery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-attach-detach-shared-image-gallery.md | Title: Attach or detach a shared image gallery in Azure Lab Services | Microsoft Docs -description: This article describes how to attach a shared image gallery to a classroom lab in Azure Lab Services. + Title: Attach or detach an Azure Compute Gallery in Azure Lab Services | Microsoft Docs +description: This article describes how to attach an Azure Compute Gallery to a lab in Azure Lab Services. Previously updated : 09/11/2020 Last updated : 04/06/2022+ -# Attach or detach a shared image gallery in Azure Lab Services -This article shows you how to attach or detach a shared image gallery to a lab account. +# Attach or detach a compute gallery in Azure Lab Services + > [!NOTE]-> When you [save a template image of a lab](how-to-use-shared-image-gallery.md#save-an-image-to-the-shared-image-gallery) in Azure Lab Services to a shared image gallery, the image is uploaded to the gallery as a specialized image. [Specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) keep machine-specific information and user profiles. You can still directly upload a generalized image to the gallery outside of Azure Lab Services. -> -> A lab creator can create a template VM based on both generalized and specialized images in Azure Lab Services. +> If using a version of Azure Lab Services prior to the [April 2022 Update (preview)](lab-services-whats-new.md), see [Attach or detach a shared image gallery in Azure Lab Services (deprecated)](how-to-attach-detach-shared-image-gallery-1.md). ++This article shows you how to attach or detach an Azure Compute Gallery to a lab plan. ++> [!IMPORTANT] +> Lab plan administrators must manually [replicate images](/azure/virtual-machines/shared-image-galleries) to other regions in the compute gallery. Replicate an Azure Compute Gallery image to the same region as the lab plan to be shown in the list of virtual machine images during lab creation. ++Saving images to a compute gallery and replicating those images incurs additional cost. This cost is separate from the Azure Lab Services usage cost. For more information about Azure Compute Gallery pricing, see [Azure Compute Gallery ΓÇô Billing](../virtual-machines/shared-image-galleries.md#billing). ## Scenarios-Here are the couple of scenarios supported by this feature: -- A lab account admin attaches a shared image gallery to the lab account, and uploads an image to the shared image gallery outside the context of a lab. Then, lab creators can use that image from the shared image gallery to create labs. -- A lab account admin attaches a shared image gallery to the lab account. A lab creator (instructor) saves the customized image of his/her lab to the shared image gallery. Then, other lab creators can select this image from the shared image gallery to create a template for their labs. +Here are a couple of scenarios supported by attaching a compute gallery. - When an image is saved to a shared image gallery, Azure Lab Services replicates the saved image to other regions available in the same [geography](https://azure.microsoft.com/global-infrastructure/geographies/). It ensures that the image is available for labs created in other regions in the same geography. Saving images to a shared image gallery incurs an additional cost, which includes cost for all replicated images. This cost is separate from the Azure Lab Services usage cost. For more information about Shared Image Gallery pricing, see [Shared Image Gallery ΓÇô Billing](../virtual-machines/shared-image-galleries.md#billing). +- A lab plan admin attaches a compute gallery to the lab plan. An image is uploaded to the compute gallery outside the context of a lab. The image is enabled on the lab plan by the lab plan admin. Then, lab creators can use that image from the compute gallery to create labs. +- A lab plan admin attaches a compute gallery to the lab plan. A lab creator (educator) saves the customized image of their lab to the compute gallery. Then, other lab creators can select this image from the compute gallery to create a template for their labs. ++When you [save a template image of a lab](how-to-use-shared-image-gallery.md#save-an-image-to-a-compute-gallery) in Azure Lab Services, the image is uploaded to the compute gallery as a specialized image. [Specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) keep machine-specific information and user profiles. You can still directly upload a generalized image to the gallery outside of Azure Lab Services. ++A lab creator can create a template VM based on both generalized and specialized images in Azure Lab Services. > [!IMPORTANT]-> While using a Shared Image Gallery, Azure Lab Services supports only images with less than 128 GB of OS Disk Space. Images with more than 128 GB of disk space or multiple disks will not be shown in the list of virtual machine images during lab creation. +> While using an Azure Compute Gallery, Azure Lab Services supports only images that use less than 128 GB of disk space on their OS drive. Images with more than 128 GB of disk space or multiple disks won't be shown in the list of virtual machine images during lab creation. -## Configure at the time of lab account creation -When you are creating a lab account, you can attach a shared image gallery to the lab account. You can either select an existing shared image gallery from the drop-down list or create a new one. To create and attach a shared image gallery to the lab account, select **Create new**, enter a name for the gallery, and enter **OK**. +## Create and attach a compute gallery - +> [!IMPORTANT] +> Your user account must have permission to create a new Azure Compute Gallery. -## Configure after the lab account is created -After the lab account is created, you can do the following tasks: +1. Open your lab plan in the [Azure portal](https://portal.azure.com). +1. Select **Azure compute gallery** on the menu. +1. Select the **Create Azure compute gallery** button. -- Create and attach a shared image gallery-- Attach a shared image gallery to the lab account-- Detach a shared image gallery from the lab account+ :::image type="content" source="./media/how-to-attach-detach-shared-image-gallery/no-gallery-create-new.png" alt-text="Screenshot of the Create Azure compute gallery button."::: -## Create and attach a shared image gallery -1. Sign in to the [Azure portal](https://portal.azure.com). -2. Select **All Services** on the left menu. Select **Lab Services** in the **DEVOPS** section. If you select star (`*`) next to **Lab Services**, it's added to the **FAVORITES** section on the left menu. From the next time onwards, you select **Lab Services** under **FAVORITES**. +1. In the **Create Azure compute gallery** window, enter a **name** for the gallery, and then select **Create**. -  -3. Select your lab account to see the **Lab Account** page. -4. Select **Shared image gallery** on the left menu, and select **+ Create** on the toolbar. + :::image type="content" source="./media/how-to-attach-detach-shared-image-gallery/create-azure-compute-gallery-window.png" alt-text="Screenshot of the Create compute gallery window."::: -  -5. In the **Create shared image gallery** window, enter a **name** for the gallery, and enter **OK**. +Azure Lab Services creates the compute gallery and attaches it to the lab plan. All labs created using this lab plan can now use images from the attached compute gallery. -  +In the bottom pane, you see images in the compute gallery. There are no images in this new gallery. When you upload images to the gallery, you see them on this page. - Azure Lab Services creates the shared image gallery and attached it to the lab account. All labs created in this lab account have access to the attached shared image gallery. -  +## Attach an existing compute gallery - In the bottom pane, you see images in the shared image gallery. In this new gallery, there are no images. When you upload images to the gallery, you see them on this page. +The following procedure shows you how to attach an existing compute gallery to a lab plan. - All images in the attached shared image gallery are enabled by default. You can enable or disable selected images by selecting them in the list and using the **Enable selected images** or **Disable selected images** button. +1. Open your lab plan in the [Azure portal](https://portal.azure.com). +1. Select **Azure compute gallery** on the menu. +1. Select the **Attach existing gallery** button. -## Attach an existing shared image gallery -The following procedure shows you how to attach an existing shared image gallery to a lab account. + :::image type="content" source="./media/how-to-attach-detach-shared-image-gallery/no-gallery-attach-existing.png" alt-text="Screenshot of the Attach existing gallery button."::: -1. On the **Lab Account** page, select **Shared image gallery** on the left menu, and select **Attach** on the toolbar. +1. On the **Attach an existing compute gallery** page, select your compute gallery, and then select the **Select** button. -  -5. On the **Attach an existing Shared Image Gallery** page, select your shared image gallery, and select **OK**. + :::image type="content" source="./media/how-to-attach-detach-shared-image-gallery/attach-existing-compute-gallery.png" alt-text="Azure compute gallery page for lab plan when gallery has been attached."::: -  -6. You see the following screen: +> [!NOTE] +> The **Azure Lab Services** app must be assigned the **Owner** role on the compute gallery to show in the list. -  - - In this example, there are no images in the shared image gallery yet. +All labs created using this lab plan can now use images from the attached compute gallery. - Azure Lab Services identity is added as a contributor to the shared image gallery that is attached to the lab. It allows educators/IT admins to save virtual machine images to the shared image gallery. All labs created in this lab account have access to the attached shared image gallery. +## Enable and disable images - All images in the attached shared image gallery are enabled by default. You can enable or disable selected images by selecting them in the list and using the **Enable selected images** or **Disable selected images** button. +All images in the attached compute gallery are disabled by default. To enable selected images: -## Detach a shared image gallery -Only one shared image gallery can be attached to a lab. If you would like to attach another shared image gallery, detach the current one before attaching the new one. To detach a shared image gallery from your lab, select **Detach** on the toolbar, and confirm the detach operation. +1. Check images you want to enable. +1. Select **Enable image** button. +1. Select **Apply**. - ++To disable selected images: ++1. Check images you want to disable. +1. Select **Disable image** button. +1. Select **Apply**. ++## Detach a compute gallery ++To detach a compute gallery from your lab, select **Detach** on the toolbar. Confirm the detach operation. ++Only one Azure Compute Gallery can be attached to a lab. To attach another compute gallery, follow the below steps: ++1. Select **Change gallery** on the toolbar. +1. Confirm the change operation. +1. On the **Attach an existing compute gallery** page, select your compute gallery, and then select the **Select** button. + ## Next steps-To learn about how to save a lab image to the shared image gallery or use an image from the shared image gallery to create a VM, see [How to use shared image gallery](how-to-use-shared-image-gallery.md). -To explore other options for bringing custom images to shared image gallery outside of the context of a lab, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). +To learn how to save a template image to the compute gallery or use an image from the compute gallery, see [How to use a compute gallery](how-to-use-shared-image-gallery.md). ++To explore other options for bringing custom images to compute gallery outside of the context of a lab, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). -For more information about shared image galleries in general, see [shared image gallery](../virtual-machines/shared-image-galleries.md). +For more information about compute galleries in general, see [compute gallery](../virtual-machines/shared-image-galleries.md). |
| lab-services | How To Attach External Storage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-attach-external-storage.md | Azure Files shares are accessed by using a public or private endpoint. Mount the If you're using a public endpoint to the Azure Files share, it's important to remember the following: -- The virtual network for the storage account doesn't have to be peered to the lab account. The file share can be created anytime before the template VM is published.+- The virtual network for the storage account doesn't have to be connected to the lab virtual network. You can create the file share anytime before the template VM is published. - The file share can be accessed from any machine if a user has the storage account key. - Linux students can see the storage account key. Credentials for mounting an Azure Files share are stored in `{file-share-name}.cred` on Linux VMs, and are readable by sudo. Because students are given sudo access by default in Azure Lab Services VMs, they can read the storage account key. If the storage account endpoint is public, students can get access to the file share outside of their student VM. Consider rotating the storage account key after class has ended, and using private file shares. If you're using a private endpoint to the Azure Files share, it's important to r - Access is restricted to traffic originating from the private network, and canΓÇÖt be accessed through the public internet. Only VMs in the private virtual network, VMs in a network peered to the private virtual network, or machines connected to a VPN for the private network, can access the file share. - Linux students can see the storage account key. Credentials for mounting an Azure Files share are stored in `{file-share-name}.cred` on Linux VMs, and are readable by sudo. Because students are given sudo access by default in Azure Lab Services VMs, they can read the storage account key. Consider rotating the storage account key after class has ended.-- This approach requires the file share virtual network to be peered to the lab account. The virtual network for the Azure Storage account must be peered to the virtual network for the lab account before the lab is created.+- This approach requires the file share virtual network to be connected to the lab. To enable advanced networking for labs, see [Connect to your virtual network in Azure Lab Services using vnet injection](how-to-connect-vnet-injection.md). VNet injection must be done during lab plan creation. > [!NOTE] > By default, standard file shares can span up to 5 TiB. See [Create an Azure file share](../storage/files/storage-how-to-create-file-share.md) for information on how to create file shares than span up to 100 TiB. Follow these steps to create a VM connected to an Azure file share. If you use the default instructions to mount an Azure Files share, the file share will seem to disappear on student VMs after the template is published. The following modified script addresses this issue. For file share with a public endpoint:+ ```bash #!/bin/bash sudo mount -t cifs //$storage_account_name.file.core.windows.net/$fileshare_name ``` For file share with a private endpoint:+ ```bash #!/bin/bash Keep in mind the following important points: - You can set permissions on a directory or file level. - You can use current user credentials to authenticate to the file share. -For a public endpoint, the virtual network for the storage account doesn't have to peer to the lab account. You can create the file share anytime before the template VM is published. +For a public endpoint, the virtual network for the storage account doesn't have to be connected to the lab virtual network. You can create the file share anytime before the template VM is published. For a private endpoint: - Access is restricted to traffic originating from the private network, and canΓÇÖt be accessed through the public internet. Only VMs in the private virtual network, VMs in a network peered to the private virtual network, or machines connected to a VPN for the private network, can access the file share. -- This approach requires the file share virtual network to be peered to the lab account. The virtual network for the Azure Storage account must be peered to the virtual network for the lab account before the lab is created.+- This approach requires the file share virtual network to be connected to the lab. To enable advanced networking for labs, see [Connect to your virtual network in Azure Lab Services using vnet injection](how-to-connect-vnet-injection.md). VNet injection must be done during lab plan creation. To create an Azure Files share that's enabled for Active Directory authentication, and to domain-join the lab VMs, follow these steps: To create an Azure Files share that's enabled for Active Directory authenticatio - **Storage File Data SMB Share Contributor** role should be assigned to students who need to add or edit files on the file share. - **Storage File Data SMB Share Reader** role should be assigned to students who only need to read the files from the file share. 6. Set up directory-level and/or file-level permissions for the file share. You must set up permissions from a domain-joined machine that has network access to the file share. To modify directory-level and/or file-level permissions, mount the file share by using the storage key, not your Azure AD credentials. To assign permissions, use the [Set-Acl](/powershell/module/microsoft.powershell.security/set-acl) PowerShell command, or [icacls](/windows-server/administration/windows-commands/icacls) in Windows.-7. [Peer the virtual network](how-to-connect-peer-virtual-network.md) for the storage account to the lab account. -8. [Create the classroom lab](how-to-manage-classroom-labs.md). +7. [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md). +8. [Create the lab](how-to-manage-labs.md). 9. Save a script on the template VM that students can run to connect to the network drive. To get example script: 1. Open the storage account in the Azure portal. 1. Under **File Service**, select **File Shares**. 1. Find the share that you want to connect to, select the ellipses button on the far right, and choose **Connect**. 1. You'll see instructions for Windows, Linux, and macOS. If you're using Windows, set **Authentication method** to **Active Directory**. 1. Copy the code in the example, and save it on the template machine in a `.ps1` file for Windows, or an `.sh` file for Linux.-10. On the template machine, download and run the script to [join student machines to the domain](https://github.com/Azure/azure-devtestlab/blob/master/samples/ClassroomLabs/Scripts/ActiveDirectoryJoin/README.md#usage). The `Join-AzLabADTemplate` script [publishes the template VM](how-to-create-manage-template.md#publish-the-template-vm) automatically. +10. On the template machine, download and run the script to [join student machines to the domain](https://aka.ms/azlabs/scripts/ActiveDirectoryJoin). The `Join-AzLabADTemplate` script [publishes the template VM](how-to-create-manage-template.md#publish-the-template-vm) automatically. > [!NOTE]- > The template machine isn't domain-joined. To view files on the share, instructors need to use a student VM for themselves. + > The template machine isn't domain-joined. To view files on the share, educators need to use a student VM for themselves. 11. Students using Windows can connect to the Azure Files share by using [File Explorer](../storage/files/storage-how-to-use-files-windows.md) with their credentials, after they've been given the path to the file share. Alternately, students can run the preceding script to connect to the network drive. For students who are using Linux, run the preceding script. ## Azure NetApp Files with NFS volumes To create an Azure Files share that's enabled for Active Directory authenticatio - Permission policies are IP-based for each volume. - If students need their own volume that other students don't have access to, permission policies must be assigned after the lab is published. - In the context of Azure Lab Services, only Linux machines are supported.-- The virtual network for the Azure NetApp Files capacity pool must be peered to the virtual network for the lab account **before** the lab is created.+- The virtual network for the Azure NetApp Files capacity pool must be connected to the lab. To enable advanced networking for labs, see [Connect to your virtual network in Azure Lab Services using vnet injection](how-to-connect-vnet-injection.md). VNet injection must be done during lab plan creation. To use an Azure NetApp Files share in Azure Lab 1. To create an Azure NetApp Files capacity pool and one or more NFS volumes, see [set up Azure NetApp Files and NFS volume](../azure-netapp-files/azure-netapp-files-quickstart-set-up-account-create-volumes.md). For information about service levels, see [Service levels for Azure NetApp Files](../azure-netapp-files/azure-netapp-files-service-levels.md).-2. [Peer the virtual network](how-to-connect-peer-virtual-network.md) for the Azure NetApp Files capacity pool to the lab account. -3. [Create the classroom lab](how-to-manage-classroom-labs.md). +2. [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md) +3. [Create the lab](how-to-manage-labs.md). 4. On the template VM, install the components necessary to use NFS file shares. - Ubuntu: To use an Azure NetApp Files share in Azure Lab These steps are common to setting up any lab. - [Create and manage a template](how-to-create-manage-template.md)-- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)+- [Add users](tutorial-setup-lab.md#add-users-to-the-lab) - [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)+- [Set a schedule](tutorial-setup-lab.md#set-a-schedule-for-the-lab) - [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | How To Bring Custom Linux Image Azure Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-bring-custom-linux-image-azure-vm.md | -The steps in this article show how to import a custom image that starts from an [Azure virtual machine (VM)](https://azure.microsoft.com/services/virtual-machines/). With this approach, you set up an image on an Azure VM and import the image into a shared image gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. +The steps in this article show how to import a custom image that starts from an [Azure virtual machine (VM)](https://azure.microsoft.com/services/virtual-machines/). With this approach, you set up an image on an Azure VM and import the image into a compute gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. ## Prerequisites You'll need permission to create an Azure VM in your school's Azure subscription Create a specialized image if you want to maintain machine-specific information and user profiles. For more information about the differences between generalized and specialized images, see [Generalized and specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images). -## Import the custom image into a shared image gallery +## Import the custom image into a compute gallery -1. In a shared image gallery, [create an image definition](../virtual-machines/image-version.md) or choose an existing image definition. +1. In a compute gallery, [create an image definition](../virtual-machines/image-version.md) or choose an existing image definition. - Choose **Gen 1** for the **VM generation**. - Choose whether you're creating a **specialized** or **generalized** image for the **Operating system state**. You'll need permission to create an Azure VM in your school's Azure subscription You can also choose to use an existing image definition and create a new version for your custom image. 1. [Create an image version](../virtual-machines/image-version.md).- - The **Version number** property uses the following format: *MajorVersion.MinorVersion.Patch*. + - The **Version number** property uses the following format: *MajorVersion.MinorVersion.Patch*. - For the **Source**, select **Disks and/or snapshots** from the dropdown list. - For the **OS disk** property, choose your Azure VM's disk that you created in previous steps. -You can also automate the preceding steps by using PowerShell. For more information, see the script and ReadMe in [Bring image to a shared image gallery script](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/BringImageToSharedImageGallery/). - ## Create a lab -[Create the lab](tutorial-setup-classroom-lab.md) in Lab Services, and select the custom image from the shared image gallery. +[Create the lab](tutorial-setup-lab.md) in Lab Services, and select the custom image from the compute gallery. ## Next steps -* [Shared image gallery overview](../virtual-machines/shared-image-galleries.md) -* [Attach or detach a shard image gallery](how-to-attach-detach-shared-image-gallery.md) -* [Use a shared image gallery](how-to-use-shared-image-gallery.md) +- [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md) +- [Attach or detach a compute gallery](how-to-attach-detach-shared-image-gallery.md) +- [Use a compute gallery](how-to-use-shared-image-gallery.md) |
| lab-services | How To Bring Custom Linux Image Vhd | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-bring-custom-linux-image-vhd.md | -The steps in this article show how to import a Linux custom image that starts from your physical lab environment. With this approach, you create a VHD from your physical environment and import the VHD into a shared image gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide which approach is best for your scenario. +The steps in this article show how to import a Linux custom image that starts from your physical lab environment. With this approach, you create a VHD from your physical environment and import the VHD into a compute gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide which approach is best for your scenario. Azure endorses a variety of [distributions and versions](../virtual-machines/linux/endorsed-distros.md#supported-distributions-and-versions). The steps to bring a custom Linux image from a VHD varies for each distribution. Every distribution is different because each one has unique prerequisites that must be set up to run on Azure. The following steps show how to create an Ubuntu 18.04\20.04 image from a Hyper- 1. Download the official [Linux Ubuntu Server](https://ubuntu.com/server/docs) image to your Windows host machine that you'll use to set up the custom image on a Hyper-V VM. - If you are using Ubuntu 18.04 LTS, we recommend using an image that does *not* have the [GNOME](https://www.gnome.org/) or [MATE](https://mate-desktop.org/) graphical desktops installed. GNOME and MATE currently have a networking conflict with the Azure Linux Agent which is needed for the image to work properly in Azure Lab Services. Instead, use an Ubuntu Server image and install a different graphical desktop, such as [XFCE](https://www.xfce.org/). Another option is to install [GNOME\MATE](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/LinuxGraphicalDesktopSetup/GNOME_MATE/ReadMe.md) using a lab's template VM. + If you are using Ubuntu 18.04 LTS, we recommend using an image that does *not* have the [GNOME](https://www.gnome.org/) or [MATE](https://mate-desktop.org/) graphical desktops installed. GNOME and MATE currently have a networking conflict with the Azure Linux Agent which is needed for the image to work properly in Azure Lab Services. Instead, use an Ubuntu Server image and install a different graphical desktop, such as [XFCE](https://www.xfce.org/). Another option is to install [GNOME\MATE](https://aka.ms/azlabs/scripts/LinuxDesktop-GnomeMate) using a lab's template VM. Ubuntu also publishes prebuilt [Azure VHDs for download](https://cloud-images.ubuntu.com/). These VHDs are intended for creating custom images from a Linux host machine and hypervisor, such as KVM. These VHDs require that you first set the default user password, which can only be done by using Linux tooling, such as qemu, which isn't available for Windows. As a result, when you create a custom image by using Windows Hyper-V, you won't be able to connect to these VHDs to make image customizations. For more information about the prebuilt Azure VHDs, read [Ubuntu's documentation](https://help.ubuntu.com/community/UEC/Images?_ga=2.114783623.1858181609.1624392241-1226151842.1623682781#QEMU_invocation). To help with resizing the VHD and converting to a VHDX, you can also use the fol - [Resize-VHD](/powershell/module/hyper-v/resize-vhd) - [Convert-VHD](/powershell/module/hyper-v/convert-vhd) -## Upload the custom image to a shared image gallery +## Upload the custom image to a compute gallery 1. Upload the VHD to Azure to create a managed disk. 1. You can use either Azure Storage Explorer or AzCopy from the command line, as shown in [Upload a VHD to Azure or copy a managed disk to another region](../virtual-machines/windows/disks-upload-vhd-to-managed-disk-powershell.md). To help with resizing the VHD and converting to a VHDX, you can also use the fol You can use the Azure portal's **Size+Performance** tab for the managed disk to change your disk size. As mentioned before, the size must *not* be greater than 128 GB. -1. In a shared image gallery, create an image definition and version: +1. In a compute gallery, create an image definition and version: 1. [Create an image definition](../virtual-machines/image-version.md): - Choose **Gen 1** for the **VM generation**. - Choose **Linux** for the **Operating system**. To help with resizing the VHD and converting to a VHDX, you can also use the fol ## Create a lab -[Create the lab](tutorial-setup-classroom-lab.md) in Lab Services and select the custom image from the shared image gallery. +[Create the lab](tutorial-setup-lab.md) in Lab Services and select the custom image from the compute gallery. If you expanded the disk *after* the OS was installed on the original Hyper-V VM, you might also need to extend the partition in Linux's filesystem to use the unallocated disk space. Log in to the lab's template VM and follow steps similar to what is shown in [Expand a disk partition and filesystem](../virtual-machines/linux/expand-disks.md#expand-a-disk-partition-and-filesystem). The OS disk typically exists on the **/dev/sad2** partition. To view the current ## Next steps -- [Shared image gallery overview](../virtual-machines/shared-image-galleries.md)-- [Attach or detach a shard image gallery](how-to-attach-detach-shared-image-gallery.md)-- [Use a shared image gallery](how-to-use-shared-image-gallery.md)+- [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md) +- [Attach or detach a compute gallery](how-to-attach-detach-shared-image-gallery.md) +- [Use a compute gallery](how-to-use-shared-image-gallery.md) |
| lab-services | How To Bring Custom Windows Image Azure Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-bring-custom-windows-image-azure-vm.md | -The steps in this article show how to import a custom image that starts from an [Azure virtual machine (VM)](https://azure.microsoft.com/services/virtual-machines/). With this approach, you set up an image on an Azure VM and import the image into a shared image gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. +The steps in this article show how to import a custom image that starts from an [Azure virtual machine (VM)](https://azure.microsoft.com/services/virtual-machines/). With this approach, you set up an image on an Azure VM and import the image into a compute gallery so that it can be used within Azure Lab Services. Before you use this approach for creating a custom image, read [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. ## Prerequisites You'll need permission to create an Azure VM in your school's Azure subscription Create a specialized image if you want to maintain machine-specific information and user profiles. For more information about the differences between generalized and specialized images, see [Generalized and specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images). -## Import the custom image into a shared image gallery +## Import the custom image into a compute gallery -1. In a shared image gallery, [create an image definition](../virtual-machines/image-version.md) or choose an existing image definition. +1. In a compute gallery, [create an image definition](../virtual-machines/image-version.md) or choose an existing image definition. - Choose **Gen 1** for the **VM generation**. - Choose whether you're creating a **specialized** or **generalized** image for the **Operating system state**. - For more information about the values you can specify for an image definition, see [Image definitions](../virtual-machines/shared-image-galleries.md#image-definitions). - + For more information about the values you can specify for an image definition, see [Image definitions](../virtual-machines/shared-image-galleries.md#image-definitions). + You can also choose to use an existing image definition and create a new version for your custom image.- + 1. [Create an image version](../virtual-machines/image-version.md).- - The **Version number** property uses the following format: *MajorVersion.MinorVersion.Patch*. + - The **Version number** property uses the following format: *MajorVersion.MinorVersion.Patch*. - For the **Source**, select **Disks and/or snapshots** from the dropdown list. - For the **OS disk** property, choose your Azure VM's disk that you created in previous steps. - You can also import your custom image from an Azure VM to a shared image gallery by using PowerShell. For more information, see the script and ReadMe in [Bring image to shared image gallery script](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/BringImageToSharedImageGallery/). - ## Create a lab -[Create the lab](tutorial-setup-classroom-lab.md) in Lab Services, and select the custom image from the shared image gallery. +[Create the lab](tutorial-setup-lab.md) in Lab Services, and select the custom image from the compute gallery. ## Next steps -* [Shared image gallery overview](../virtual-machines/shared-image-galleries.md) -* [Attach or detach a shared image gallery](how-to-attach-detach-shared-image-gallery.md) -* [Use a shared image gallery](how-to-use-shared-image-gallery.md) +- [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md) +- [Attach or detach a compute gallery](how-to-attach-detach-shared-image-gallery.md) +- [Use a compute gallery](how-to-use-shared-image-gallery.md) |
| lab-services | How To Configure Auto Shutdown Lab Plans | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-configure-auto-shutdown-lab-plans.md | + + Title: Configure automatic shutdown of VMs in Azure Lab Services +description: This article describes how to configure automatic shutdown of VMs in the lab plan. + Last updated : 11/13/2021+++# Configure automatic shutdown of VMs for a lab plan ++You can enable several auto-shutdown cost control features to avoid extra costs when the virtual machines aren't being used. ++- Disconnect idle virtual machines. +- Shutdown virtual machines when users disconnect +- Shutdown virtual machines when users don't connect ++The **disconnect idle virtual machines** has two settings. Both settings use a VM extension to detect idle. ++- **Detect idle based on user absence**. Idle detection examines only mouse/keyboard input (user absence). +- **Detect idle based on user absence and resource usage**. Idle detection examines both mouse/keyboard input (user absence) and disk/CPU usage (resource usage). By selecting resource usage, that is, disk/CPU usage, operations such as long-running queries are accounted for. ++Review more details about the auto-shutdown features in the [Maximize cost control with auto-shutdown settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control) section. ++## Enable automatic shutdown ++1. In the [Azure portal](https://portal.azure.com/), navigate to the **Lab Plan** page. +1. Select **Labs settings** on the left menu. +1. Select the auto-shutdown setting(s) that is appropriate for your scenario. ++ :::image type="content" source="./media/how-to-configure-lab-plan/automatic-shutdown-vm-disconnect.png" alt-text="Automatic shutdown setting at lab plan"::: ++ The setting(s) apply to all the labs associated with the lab plan. A lab creator (educator) can override this setting at the lab level. The change to this setting at the lab plan will only affect labs that are created after the change is made. ++ To disable the setting(s), uncheck the checkbox(s) on this page. ++## Next steps ++To learn about how a lab owner can configure or override this setting at the lab level, see [Configure automatic shutdown of VMs for a lab](how-to-enable-shutdown-disconnect.md) |
| lab-services | How To Configure Firewall Settings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-configure-firewall-settings.md | Title: Firewall settings for Azure Lab Services -description: Learn how to determine the public IP address and port number range of virtual machines in a lab so information can be added to firewall rules. +description: Learn how to determine the public IP address of VMs in a lab so information can be added to firewall rules. Previously updated : 06/26/2020 Last updated : 02/01/2022 # Firewall settings for Azure Lab Services -Each organization or school will set up their own network in a way that best fits their needs. Sometimes that includes setting firewall rules that block Remote Desktop Protocol (rdp) or Secure Shell (ssh) connections to machines outside their own network. Because Azure Lab Services runs in the public cloud, some extra configuration maybe needed to allow students to access their VM when connecting from the campus network. +Each organization or school will configure their own network in a way that best fits their needs. Sometimes that includes setting firewall rules that block Remote Desktop Protocol (RDP) or Secure Shell (SSH) connections to machines outside their own network. Because Azure Lab Services runs in the public cloud, some extra configuration maybe needed to allow students to access their VM when connecting from the campus network. -Each lab uses single public IP address and multiple ports. All VMs, both the template VM and student VMs, will use this public IP address. The public IP address will not change for the life of lab. However, each VM will have a different port number. The port numbers range from 49152 to 65535. The combination of public IP address and port number is used to connect instructor and students to the correct VM. This article will cover how to find the specific public IP address used by a lab. That information can be used to update inbound and outbound firewall rules so students can access their VMs. +Each lab uses single public IP address and multiple ports. All VMs, both the template VM and student VMs, will use this public IP address. The public IP address wonΓÇÖt change for the life of lab. Each VM will have a different port number. The port numbers range is 49152 - 65535. The combination of public IP address and port number is used to connect educators and students to the correct VM. This article will cover how to find the specific public IP address used by a lab. That information can be used to update inbound and outbound firewall rules so students can access their VMs. >[!IMPORTANT] >Each lab will have a different public IP address. Each lab uses single public IP address and multiple ports. All VMs, both the te ## Find public IP for a lab -The public IP addresses for each lab are listed in the **All labs** page of the Lab Services lab account. For directions how to find the **All labs** page, see [View labs in a lab account](manage-labs.md#view-labs-in-a-lab-account). +The public IP addresses for each lab are listed in the **All labs** page of the Lab Services lab account. For directions how to find the **All labs** page, see [View labs in a lab account](manage-labs-1.md#view-labs-in-a-lab-account). -> [!div class="mx-imgBorder"] ->  >[!NOTE] >You wonΓÇÖt see the public IP address if the template machine for your lab isnΓÇÖt published yet. ## Conclusion -Now we know the public IP address for the lab. Inbound and outbound rules can be created for the organization's firewall for the public ip address and the port range 49152-65535. Once the rules are updated, students can access their VMs without the network firewall blocking access. +Now we know the public IP address for the lab. Inbound and outbound rules can be created for the organization's firewall for the public ip address and the port range 49152 - 65535. Once the rules are updated, students can access their VMs without the network firewall blocking access. ## Next steps-See the following articles: --- [Allow lab creator to pick lab location](allow-lab-creator-pick-lab-location.md)-- [Connect your lab's network with a peer virtual network](how-to-connect-peer-virtual-network.md)-- [Attach a shared image gallery to a lab](how-to-attach-detach-shared-image-gallery.md)-- [Add a user as a lab owner](how-to-add-user-lab-owner.md)-- [View firewall settings for a lab](how-to-configure-firewall-settings.md)-- [Configure other settings for a lab](how-to-configure-lab-accounts.md)++- As an admin, [enable labs to connect your vnet](how-to-connect-vnet-injection.md). +- As an educator, work with your admin to [create a lab with a shared resource](how-to-create-a-lab-with-shared-resource.md). |
| lab-services | How To Configure Lab Accounts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-configure-lab-accounts.md | Title: Configure automatic shutdown of VMs in Azure Lab Services + Title: Configure automatic shutdown of VMs in Azure Lab Services (deprecated) description: This article describes how to configure automatic shutdown of VMs in the lab account. Last updated 08/17/2020 -# Configure automatic shutdown of VMs for a lab account +# Configure automatic shutdown of VMs for a lab account (deprecated) You can enable several auto-shutdown cost control features to proactively prevent additional costs when the virtual machines are not being actively used. The combination of the following three automatic shutdown and disconnect features catches most of the cases where users accidentally leave their virtual machines running:-  + - Automatically disconnect users from virtual machines that the OS deems idle. - Automatically shut down virtual machines when users disconnect. - Automatically shut down virtual machines that are started but users don't connect. Review more details about the auto-shutdown features in the [Maximize cost contr > [!div class="mx-imgBorder"] > - + The setting(s) apply to all the labs created in the lab account. A lab creator (educator) can override this setting at the lab level. The change to this setting at the lab account will only affect labs that are created after the change is made. To disable the setting(s), uncheck the checkbox(s) on this page. |
| lab-services | How To Configure Student Usage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-configure-student-usage.md | Title: Configure usage settings in labs of Azure Lab Services description: Learn how to configure the number of students for a lab, get them registered with the lab, control the number of hours they can use the VM, and more. Previously updated : 12/01/2020 Last updated : 01/05/2022 # Add and manage lab users -This article describes how to add student users to a lab, register them with the lab, control the number of additional hours they can use the virtual machine (VM), and more. +This article describes how to add student users to a lab, register them with the lab, control the number of additional hours they can use the virtual machine (VM), and more. -When you add users, by default, the **Restrict access** option is turned on and, unless they're in the list of users, students can't register with the lab even if they have a registration link. Only listed users can register with the lab by using the registration link you send. You can turn off **Restrict access**, which allows students to register with the lab as long as they have the registration link. +When you add users, by default, the **Restrict access** option is turned on and, unless they're in the list of users, students can't register with the lab even if they have a registration link. Only listed users can register with the lab by using the registration link you send. You can turn off **Restrict access**, which allows students to register with the lab as long as they have the registration link. This article shows how to add users to a lab. This article shows how to add users to a lab. ### Overview -You can now sync a lab user list to an existing Azure Active Directory (Azure AD) group so that you do not have to manually add or delete users. +You can now sync a lab user list to an existing Azure Active Directory (Azure AD) group so that you don't have to manually add or delete users. -An Azure AD group can be created within your organization's Azure Active Directory to manage access to organizational resources and cloud-based apps. To learn more, see [Azure AD groups](../active-directory/fundamentals/active-directory-manage-groups.md). If your organization uses Microsoft Office 365 or Azure services, your organization will already have admins who manage your Azure Active Directory. +An Azure AD group can be created within your organization's Azure Active Directory to manage access to organizational resources and cloud-based apps. To learn more, see [Azure AD groups](../active-directory/fundamentals/active-directory-manage-groups.md). If your organization uses Microsoft Office 365 or Azure services, your organization will already have admins who manage your Azure Active Directory. ### Sync users with Azure AD group > [!IMPORTANT]-> Make sure the user list is empty. If there are existing users inside a lab that you added manually or through importing a CSV file, the option to sync the lab to an existing group will not appear. +> Make sure the user list is empty. If there are existing users inside a lab that you added manually or through importing a CSV file, the option to sync the lab to an existing group will not appear. 1. Sign in to the [Azure Lab Services website](https://labs.azure.com/). 1. Select the lab you want to work with.-1. In the left pane, select **Users**. -1. Click **Sync from group**. +1. In the left pane, select **Users**. +1. Select **Sync from group**. :::image type="content" source="./media/how-to-configure-student-usage/add-users-sync-group.png" alt-text="Add users by syncing from an Azure AD group":::- -1. You will be prompted to pick an existing Azure AD group to sync your lab to. - ++1. You'll be prompted to pick an existing Azure AD group to sync your lab to. + If you don't see an Azure AD group in the list, could be because of the following reasons: - - If you are a guest user for an Azure Active Directory (usually if you're outside the organization that owns the Azure AD), and you are not able to to search for groups inside the Azure AD. In this case, you wonΓÇÖt be able to add an Azure AD group to the lab in this case. - - Azure AD groups created through Teams do not show up in this list. You can add the Azure Lab Services app inside Teams to create and manage labs directly from within it. See more information about [managing a labΓÇÖs user list from within Teams](how-to-manage-user-lists-within-teams.md). -1. Once you picked the Azure AD group to sync your lab to, click **Add**. -1. Once a lab is synced, it will pull everyone inside the Azure AD group into the lab as users, and you will see the user list updated. Only the people in this Azure AD group will have access to your lab. The user list will refresh every 24 hours to match the latest membership of the Azure AD group. You can also click on the Sync button in the Users tab to manually sync to the latest changes in the Azure AD group. -1. Invite the users to your lab by clicking on the **Invite All** button, which will send an email to all users with the registration link to the lab. + - If you are a guest user for an Azure Active Directory (usually if you're outside the organization that owns the Azure AD), and you are not able to search for groups inside the Azure AD. In this case, you can't add an Azure AD group to the lab in this case. + - Azure AD groups created through Teams don't show up in this list. You can add the Azure Lab Services app inside Teams to create and manage labs directly from within it. See more information about [managing a labΓÇÖs user list from within Teams](how-to-manage-user-lists-within-teams.md). +1. Once you picked the Azure AD group to sync your lab to, select **Add**. +1. Once a lab is synced, it will pull everyone inside the Azure AD group into the lab as users, and you will see the user list updated. Only the people in this Azure AD group will have access to your lab. The user list will refresh every 24 hours to match the latest membership of the Azure AD group. You can also select the Sync button in the Users tab to manually sync to the latest changes in the Azure AD group. +1. Invite the users to your lab by clicking on the **Invite All** button, which will send an email to all users with the registration link to the lab. -### Automatic management of virtual machines based on changes to the Azure AD group +### Automatic management of virtual machines based on changes to the Azure AD group -Once the lab is synced to an Azure AD group, the number of virtual machines in the lab will automatically match the number of users in the group. You will no longer be able to manually update the lab capacity. When a user is added to the Azure AD group, a lab will automatically add a virtual machine for that user. When a user is deleted from the Azure AD group, a lab will automatically delete the userΓÇÖs virtual machine from the lab. +Once the lab is synced to an Azure AD group, the number of virtual machines in the lab will automatically match the number of users in the group. You will no longer be able to manually update the lab capacity. When a user is added to the Azure AD group, a lab will automatically add a virtual machine for that user. When a user is deleted from the Azure AD group, a lab will automatically delete the userΓÇÖs virtual machine from the lab. ## Add users manually from email(s) or CSV file -In this section, you add students manually (by email address or by uploading a CSV file). +In this section, you add students manually (by email address or by uploading a CSV file). ### Add users by email address -1. In the left pane, select **Users**. -1. Click **Add users manually**. +1. In the left pane, select **Users**. +1. Select **Add users manually**. :::image type="content" source="./media/how-to-configure-student-usage/add-users-manually.png" alt-text="Add users manually":::-1. Select **Add by email address** (default), enter the students' email addresses on separate lines or on a single line separated by semicolons. +1. Select **Add by email address** (default), enter the students' email addresses on separate lines or on a single line separated by semicolons. :::image type="content" source="./media/how-to-configure-student-usage/add-users-email-addresses.png" alt-text="Add users' email addresses":::-1. Select **Save**. +1. Select **Save**. - The list displays the email addresses and statuses of the current users, whether they're registered with the lab or not. + The list displays the email addresses and statuses of the current users, whether they're registered with the lab or not. :::image type="content" source="./media/how-to-configure-student-usage/list-of-added-users.png" alt-text="Users list"::: > [!NOTE]- > After the students are registered with the lab, the list displays their names. The name that's shown in the list is constructed by using the first and last names of the students in Azure Active Directory. + > After the students are registered with the lab, the list displays their names. ### Add users by uploading a CSV file -You can also add users by uploading a CSV file that contains their email addresses. +You can also add users by uploading a CSV file that contains their email addresses. A CSV text file is used to store comma-separated (CSV) tabular data (numbers and text). Instead of storing information in columns fields (such as in spreadsheets), a CSV file stores information separated by commas. Each line in a CSV file will have the same number of comma-separated "fields." You can use Excel to easily create and edit CSV files. -1. In Microsoft Excel, create a CSV file that lists students' email addresses in one column. +1. Using Microsoft Excel, create a CSV file that lists students' email addresses in one column. :::image type="content" source="./media/how-to-configure-student-usage/csv-file-with-users.png" alt-text="List of users in a CSV file"::: 1. At the top of the **Users** pane, select **Add users**, and then select **Upload CSV**.-1. Select the CSV file that contains the students' email addresses, and then select **Open**. -- The **Add users** window displays the email address list from the CSV file. -1. Select **Save**. -1. In the **Users** pane, view the list of added students. +1. Select the CSV file that contains the students' email addresses, and then select **Open**. The **Add users** window displays the email address list from the CSV file. +1. Select **Save**. +1. In the **Users** pane, view the list of added students. :::image type="content" source="./media/how-to-configure-student-usage/list-of-added-users.png" alt-text="List of added users in the Users pane"::: ## Send invitations to users -To send a registration link to new users, use one of the following methods. +To send a registration link to new users, use one of the following methods. -If the **Restrict access** option is enabled for the lab, only listed users can use the registration link to register to the lab. This option is enabled by default. +If the **Restrict access** option is enabled for the lab, only listed users can use the registration link to register to the lab. This option is enabled by default. ### Invite all users This method shows you how to send email with a registration link and an optional message to all listed students. -1. In the **Users** pane, select **Invite all**. +1. In the **Users** pane, select **Invite all**. -  +  -1. In the **Send invitation by email** window, enter an optional message, and then select **Send**. +1. In the **Send invitation by email** window, enter an optional message, and then select **Send**. - The email automatically includes the registration link. To get and save the registration link separately, select the ellipsis (**...**) at the top of the **Users** pane, and then select **Registration link**. + The email automatically includes the registration link. To get and save the registration link separately, select the ellipsis (**...**) at the top of the **Users** pane, and then select **Registration link**. -  +  - The **Invitation** column of the **Users** list displays the invitation status for each added user. The status should change to **Sending** and then to **Sent on \<date>**. + The **Invitation** column of the **Users** list displays the invitation status for each added user. The status should change to **Sending** and then to **Sent on \<date>**. ### Invite selected users This method shows you how to invite only certain students and get a registration link that you can share with other people. -1. In the **Users** pane, select a student or multiple students in the list. +1. In the **Users** pane, select a student or multiple students in the list. -1. In the row for the student you've selected, select the **envelope** icon or, on the toolbar, select **Invite**. +1. In the row for the student you've selected, select the **envelope** icon or, on the toolbar, select **Invite**.  -1. In the **Send invitation by email** window, enter an optional **message**, and then select **Send**. +1. In the **Send invitation by email** window, enter an optional **message**, and then select **Send**.  This method shows you how to invite only certain students and get a registration ## Get the registration link -In this section, you can get the registration link from the portal and send it by using your own email application. +In this section, you can get the registration link from the portal and send it by using your own email application. 1. In the **Users** pane, select **Registration link**.  -1. In the **User registration** window, select **Copy**, and then select **Done**. +1. In the **User registration** window, select **Copy**, and then select **Done**.  - The link is copied to the clipboard. - -1. In your email application, paste the registration link, and then send the email to a student so that the student can register for the class. + The link is copied to the clipboard. ++1. In your email application, paste the registration link, and then send the email to a student so that the student can register for the class. ## View registered users -1. Go to the [Azure Lab Services](https://labs.azure.com) website. +1. Go to the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). 1. Select **Sign in**, and then enter your credentials. Azure Lab Services supports organizational accounts and Microsoft accounts.-1. On the **My labs** page, select the lab whose usage you want to track. -1. In the left pane, select **Users**, or select the **Users** tile. -- The **Users** pane displays a list of students who have registered with your lab. +1. On the **My labs** page, select the lab whose usage you want to track. +1. In the left pane, select **Users**, or select the **Users** tile. The **Users** pane displays a list of students who have registered with your lab.  - > [!NOTE] - > If you [republish a lab](how-to-create-manage-template.md#publish-the-template-vm) or [reset student VMs](how-to-set-virtual-machine-passwords.md#reset-vms), the students will remain registered for the labs' VMs. However, the contents of the VMs will be deleted and the VMs will be recreated with the template VM's image. + > [!NOTE] + > If you [republish a lab](how-to-create-manage-template.md#publish-the-template-vm) or [Reset VMs](how-to-manage-vm-pool.md#reset-vms), the students will remain registered for the labs' VMs. However, the contents of the VMs will be deleted and the VMs will be recreated with the template VM's image. ## Set quotas for users -You can set an hour quota for each student by doing the following: +You can set an hour quota for a student one of two ways: -1. In the **Users** pane, select **Quota per user: \<number> hour(s)** on the toolbar. +1. In the **Users** pane, select **Quota per user: \<number> hour(s)** on the toolbar. 1. In the **Quota per user** window, specify the number of hours you want to give to each student outside the scheduled class time, and then select **Save**. -  +  The changed values are now displayed on the **Quota per user: \<number of hours>** button on the toolbar and in the users list, as shown here: -  +  > [!IMPORTANT]- > The [scheduled running time of VMs](how-to-create-schedules.md) does not count against the quota that's allotted to a student. The quota is for the time outside of scheduled hours that a student spends on VMs. + > The [scheduled running time of VMs](how-to-create-schedules.md) does not count against the quota that's allotted to a student. The quota is for the time outside of scheduled hours that a student spends on VMs. ## Set additional quotas for specific users -You can specify quotas for certain students beyond the common quotas that were set for all users in the preceding section. For example, if you, as an instructor, set the quota for all students to 10 hours and set an additional quota of 5 hours for a specific student, that student gets 15 (10 + 5) hours of quota. If you change the common quota later to, say, 15, the student gets 20 (15 + 5) hours of quota. Remember that this overall quota is outside the scheduled time. The time that a student spends on a lab VM during the scheduled time does not count against this quota. +You can specify quotas for certain students beyond the common quotas that were set for all users in the preceding section. For example, if you, as an educator, set the quota for all students to 10 hours and set an additional quota of 5 hours for a specific student, that student gets 15 (10 + 5) hours of quota. If you change the common quota later to, say, 15, the student gets 20 (15 + 5) hours of quota. Remember that this overall quota is outside the scheduled time. The time that a student spends on a lab VM during the scheduled time does not count against this quota. To set additional quotas, do the following: -1. In the **Users** pane, select a student from the list, and then select **Adjust quota** on the toolbar. +1. In the **Users** pane, select a student from the list, and then select **Adjust quota** on the toolbar.  -1. In the **Adjust quota for \<selected user or users email address>**, enter the number of additional lab hours you want to grant to the selected student or students, and then select **Apply**. +1. In the **Adjust quota for \<selected user or users email address>**, enter the number of additional lab hours you want to grant to the selected student or students, and then select **Apply**.  - The **Usage** column displays the updated quota for the selected students. + The **Usage** column displays the updated quota for the selected students.  ## Student accounts -To add students to a classroom lab, you use their email accounts. Students might have the following types of email accounts: +To add students to a lab, you use their email accounts. Students might have the following types of email accounts: - A student email account that's provided by your university's Azure Active Directory instance. - A Microsoft-domain email account, such as *outlook.com*, *hotmail.com*, *msn.com*, or *live.com*. To add students to a classroom lab, you use their email accounts. Students might ### Use a non-Microsoft email account -Students can use non-Microsoft email accounts to register and sign in to a classroom lab. However, the registration requires that they first create a Microsoft account that's linked to their non-Microsoft email address. +Students can use non-Microsoft email accounts to register and sign in to a lab. However, the registration requires that they first create a Microsoft account that's linked to their non-Microsoft email address. Many students might already have a Microsoft account that's linked to their non-Microsoft email address. For example, students already have a Microsoft account if they've used their email address with other Microsoft products or services, such as Office, Skype, OneDrive, or Windows. -When students use the registration link to sign in to a classroom, they're prompted for their email address and password. Students who attempt to sign in with a non-Microsoft account that's not linked to a Microsoft account will receive the following error message: +When students use the registration link to sign in to a classroom, they're prompted for their email address and password. Students who attempt to sign in with a non-Microsoft account that's not linked to a Microsoft account will receive the following error message:  Here's a link for students to [sign up for a Microsoft account](http://signup.live.com). > [!IMPORTANT]-> When students sign in to a classroom lab, they aren't given the option to create a Microsoft account. For this reason, we recommend that you include this sign-up link, http://signup.live.com, in the classroom lab registration email that you send to students who are using non-Microsoft accounts. +> When students sign in to a lab, they aren't given the option to create a Microsoft account. For this reason, we recommend that you include this sign-up link, <http://signup.live.com>, in the lab registration email that you send to students who are using non-Microsoft accounts. ### Use a GitHub account -Students can also use an existing GitHub account to register and sign in to a classroom lab. If they already have a Microsoft account linked to their GitHub account, students can sign in and provide their password as shown in the preceding section. +Students can also use an existing GitHub account to register and sign in to a lab. If they already have a Microsoft account linked to their GitHub account, students can sign in and provide their password as shown in the preceding section. If they haven't yet linked their GitHub account to a Microsoft account, they can do the following: If they haven't yet linked their GitHub account to a Microsoft account, they can  - At the prompt, students then create a Microsoft account that's linked to their GitHub account. The linking happens automatically when they select **Next**. They're then immediately signed in and connected to the classroom lab. + At the prompt, students then create a Microsoft account that's linked to their GitHub account. The linking happens automatically when they select **Next**. They're then immediately signed in and connected to the lab. ## Export a list of users to a CSV file 1. Go to the **Users** pane.-1. On the toolbar, select the ellipsis (**...**), and then select **Export CSV**. +1. On the toolbar, select the ellipsis (**...**), and then select **Export CSV**.  If they haven't yet linked their GitHub account to a Microsoft account, they can See the following articles: -- For administrators: [Create and manage lab accounts](how-to-manage-lab-accounts.md)-- For lab owners: [Create and manage labs](how-to-manage-classroom-labs.md) and [Set up and publish templates](how-to-create-manage-template.md)-- For lab users: [Access labs](how-to-use-classroom-lab.md)+- For administrators: [Create and manage lab plans](how-to-manage-lab-plans.md) +- For lab owners: [Create and manage labs](how-to-manage-labs.md) and [Set up and publish templates](how-to-create-manage-template.md) +- For lab users: [Access labs](how-to-use-lab.md) |
| lab-services | How To Connect Peer Virtual Network | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-connect-peer-virtual-network.md | Title: Connect to a peer network in Azure Lab Services | Microsoft Docs + Title: Connect to a peer network in Azure Lab Services(deprecated) | Microsoft Docs description: Learn how to connect your lab network with another network as a peer. For example, connect your on-premises organization/university network with Lab's virtual network in Azure. Last updated 06/26/2020 -# Connect your lab's network with a peer virtual network in Azure Lab Services +# Connect your lab's network with a peer virtual network in Azure Lab Services (deprecated) This article provides information about peering your labs network with another network. You may need to connect your lab's network with a peer virtual network in some s Certain on-premises networks are connected to Azure Virtual Network either through [ExpressRoute](../expressroute/expressroute-introduction.md) or [Virtual Network Gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md). These services must be set up outside of Azure Lab Services. To learn more about connecting an on-premises network to Azure using ExpressRoute, see [ExpressRoute overview](../expressroute/expressroute-introduction.md). For on-premises connectivity using a Virtual Network Gateway, the gateway, specified virtual network, and the lab account must all be in the same region. > [!NOTE]-> When creating a Azure Virtual Network that will be peered with a lab account, it's important to understand how the virtual network's region impacts where labs are created. For more information, see the administrator guide's section on [regions\locations](./administrator-guide.md#regionslocations). +> When creating a Azure Virtual Network that will be peered with a lab account, it's important to understand how the virtual network's region impacts where labs are created. For more information, see the administrator guide's section on [regions/locations](./administrator-guide-1.md#regionslocations). > [!NOTE] > If your school needs to perform content filtering, such as for compliance with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act), you will need to use 3rd party software. For more information, read guidance on [content filtering with Lab Services](./administrator-guide.md#content-filtering). Here are some restrictions when specifying the address range that you should kee See the following articles: - [Allow lab creator to pick lab location](allow-lab-creator-pick-lab-location.md)-- [Attach a shared image gallery to a lab](how-to-attach-detach-shared-image-gallery.md)+- [Attach a compute gallery to a lab](how-to-attach-detach-shared-image-gallery-1.md) - [Add a user as a lab owner](how-to-add-user-lab-owner.md) - [View firewall settings for a lab](how-to-configure-firewall-settings.md) - [Configure other settings for a lab](how-to-configure-lab-accounts.md) |
| lab-services | How To Connect Vnet Injection | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-connect-vnet-injection.md | + + Title: Connect to your virtual network in Azure Lab Services | Microsoft Docs +description: Learn how to connect a lab to one of your networks. + Last updated : 2/11/2022+++# Connect to your virtual network in Azure Lab Services +++This article provides information about connecting a [lab plan](tutorial-setup-lab-plan.md) to your virtual network. ++Some organizations have advanced network requirements and configurations that they want to apply to labs. For example, network requirements can include a network traffic control, ports management, access to resources in an internal network, etc. ++In the Azure Lab Services [April 2022 Update (preview)](lab-services-whats-new.md), customers may take control of the network for the labs using virtual network (VNet) injection. You can now tell us which virtual network to use, and weΓÇÖll inject the necessary resources into your network. VNet injection replaces the [peering to your virtual network](how-to-connect-peer-virtual-network.md), as was done in previous versions. ++With VNet injection, you can connect to on premise resources such as licensing servers and use user defined routes (UDRs). ++## Overview ++You can connect to your own virtual network to your lab plan when you create the lab plan. ++> [!IMPORTANT] +> VNet injection must be configured when creating a lab plan. It can't be added later. ++Before you configure VNet injection for your lab plan: ++- [Create a virtual network](/azure/virtual-network/quick-create-portal). The virtual network must be in the same region as the lab plan. +- [Create a subnet](/azure/virtual-network/virtual-network-manage-subnet) for the virtual network. +- [Create a network security group (NSG)](/azure/virtual-network/manage-network-security-group) and apply it to the subnet. +- [Delegate the subnet](#delegate-the-virtual-network-subnet-for-use-with-a-lab-plan) to **Microsoft.LabServices/labplans**. ++Certain on-premises networks are connected to Azure Virtual Network either through [ExpressRoute](../expressroute/expressroute-introduction.md) or [Virtual Network Gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md). These services must be set up outside of Azure Lab Services. To learn more about connecting an on-premises network to Azure using ExpressRoute, see [ExpressRoute overview](../expressroute/expressroute-introduction.md). For on-premises connectivity using a Virtual Network Gateway, the gateway, specified virtual network, network security group, and the lab plan all must be in the same region. ++> [!NOTE] +> If your school needs to perform content filtering, such as for compliance with the [Children's Internet Protection Act (CIPA)](https://www.fcc.gov/consumers/guides/childrens-internet-protection-act), you will need to use 3rd party software. For more information, read guidance on [content filtering with Lab Services](./administrator-guide.md#content-filtering). ++## Delegate the virtual network subnet for use with a lab plan ++After you create a subnet for your virtual network, you must [delegate the subnet](/azure/virtual-network/subnet-delegation-overview) for use with Azure Lab Services. ++Only one lab plan at a time can be delegated for use with one subnet. ++1. Create a [virtual network](/azure/virtual-network/manage-virtual-network), [subnet](/azure/virtual-network/virtual-network-manage-subnet), and [network security group (NSG)](/azure/virtual-network/manage-network-security-group) if not done already. +1. Open the **Subnets** page for your virtual network. +1. Select the subnet you wish to delegate to Lab Services to open the property window for that subnet. +1. For the **Delegate subnet to a service** property, select **Microsoft.LabServices/labplans**. Select **Save**. ++ :::image type="content" source="./media/how-to-connect-vnet-injection/delegate-subnet-for-azure-lab-services.png" alt-text="Screenshot of properties windows for subnet. The Delegate subnet to a service property is highlighted and set to Microsoft dot Lab Services forward slash lab plans."::: +1. For the **Network security group** property, select the NSG you created earlier. ++ > [!WARNING] + > An NSG is required to allow access to the template and lab VMs. For more information about Lab Services architecture, see [Architecture Fundamentals in Azure Lab Services](classroom-labs-fundamentals.md). ++ :::image type="content" source="./media/how-to-connect-vnet-injection/subnet-select-nsg.png" alt-text="Screenshot of properties windows for subnet. The Network security group property is highlighted."::: ++1. Verify the lab plan service appears in the **Delegated to** column. Verify the NSG appears in the **Security group** column. ++ :::image type="content" source="./media/how-to-connect-vnet-injection/delegated-subnet.png" alt-text="Screenshot of list of subnets for a virtual network. The Delegated to and Security group columns are highlighted." lightbox="./media/how-to-connect-vnet-injection/delegated-subnet.png"::: ++## Connect the virtual network during lab plan creation ++1. Sign in to the [Azure portal](https://portal.azure.com). +1. Select **Create a resource** in the upper left-hand corner of the Azure portal. +1. Search for **lab plan**. (**Lab plan (preview)** can also be found under the **DevOps** category.) +1. Enter required information on the **Basics** tab of the **Create a lab plan** page. For more information, see [Tutorial: Create a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). +1. From the **Basics** tab of the **Create a lab plan** page, select **Next: Networking** at the bottom of the page. +1. Select **Enable advanced networking**. ++ 1. For **Virtual network**, select an existing virtual network for the lab network. For a virtual network to appear in this list, it must be in the same region as the lab plan. + 2. Specify an existing **subnet** for VMs in the lab. For subnet requirements, see [Delegate the virtual network subnet for use with a lab plan](#delegate-the-virtual-network-subnet-for-use-with-a-lab-plan). ++ :::image type="content" source="./media/how-to-connect-vnet-injection/create-lab-plan-advanced-networking.png" alt-text="Screenshot of the Networking tab of the Create a lab plan wizard."::: ++Once you have a lab plan configured with advanced networking, all labs created with this lab plan use the specified subnet. ++## Known issues ++- Deleting your virtual network or subnet will cause the lab to stop working +- Changing the DNS label on the public IP will cause the **Connect** button for lab VMs to stop working. +- Azure Firewall isnΓÇÖt currently supported. ++## Next steps ++See the following articles: ++- As an admin, [attach a compute gallery to a lab plan](how-to-attach-detach-shared-image-gallery.md). +- As an admin, [configure automatic shutdown settings for a lab plan](how-to-configure-auto-shutdown-lab-plans.md). +- As an admin, [add lab creators to a lab plan](add-lab-creator.md). |
| lab-services | How To Create A Lab With Shared Resource 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-a-lab-with-shared-resource-1.md | + + Title: How to Create a Lab with a Shared Resource (deprecated) | Azure Lab Services +description: Learn how to create a lab that requires a resource shared among the students. (deprecated) ++ Last updated : 03/03/2022+++++# How to create a lab with a shared resource in Azure Lab Services (deprecated) +++When you're creating a lab, there might be some resources that need to be shared among all the students in a lab. For example, you have a licensing server or SQL Server for a database class. This article will discuss the steps to enable the shared resource for a lab. WeΓÇÖll also talk about how to limit access to the shared resource. ++## Architecture ++As shown in the diagram below we'll have a lab account with a lab. The lab account will have the vnet peering settings so the virtual network for the lab is connected to the network of the shared resource. In the diagram below, there are two virtual networks with non-overlapping IP ranges. These IP ranges are just example ranges. Also, the shared resource virtual network is in the same subscription as the lab account. +++## Set up shared resource ++The virtual network for the shared resource must be created before the lab is created. For more information on how to create a virtual network, see [create a virtual network](../virtual-network/quick-create-portal.md). Planning out virtual network ranges so they donΓÇÖt overlap with the ip address of the lab machines is important. For more information about planning your network, see the [plan virtual networks](../virtual-network/virtual-network-vnet-plan-design-arm.md) article. In the example, the shared resource is in a virtual network with the range 10.2.0.0/16. If not done already, [create a subnet](../virtual-network/virtual-network-manage-subnet.md#add-a-subnet) to hold the shared resource. In the example, we use the 10.2.0.0/24 range, but your range might be different depending on the needs of your network. ++The shared resource can be software running on a virtual machine or an Azure provided service. The shared resource should be available through private IP address. By making the shared resource available through private IP only, you limit access to that shared resource. ++The diagram also shows a network security group (NSG) which can be used to restrict traffic coming from the student VM. For example, you can write a security rule that states traffic from the student VM's IP addresses can only access one shared resource and nothing else. For more information on how to set security rules, see [manage network security group](../virtual-network/manage-network-security-group.md#work-with-security-rules). If you want to restrict access, to a shared resource of a specific lab, get the IP address for the lab from the [lab settings of the lab](manage-labs.md#view-labs). And then, set an inbound rule to allow access only from that IP address. DonΓÇÖt forget to allow ports 49152 to 65535 for that IP address. Optionally, you can find the private IP address of the studentΓÇÖs VMs by using the [virtual machine pool page](how-to-set-virtual-machine-passwords.md). ++If your shared resource is an Azure virtual machine running necessary software, you might have to modify the default firewall rules for the virtual machine. ++### Tips for shared resources - License server ++One of the most common shared resources is a License server, here are a few tips on how to be successful with setting one up. ++#### Server region ++The License server must be connected to the virtual network that is peered to the lab. As the license server needs to be located in the same region as the lab account. ++#### Static private IP and MAC address ++By default virtual machines have a dynamic private ip. [Before you setup any software, set the private ip to static](../virtual-network/ip-services/virtual-networks-static-private-ip-arm-pportal.md). The private IP and the MAC address are now set to be static. ++#### Control Access ++Controlling access to the license server is key. When the VM is set up, access will still be needed for maintenance, troubleshooting, and updating. Following are a few ways for controlling access: ++- [Setting up Just in Time (JIT) access within Microsoft Defender for Cloud.](../security-center/security-center-just-in-time.md?tabs=jit-config-asc%252cjit-request-asc) +- [Setting up a Network Security Group to restrict access.](../virtual-network/network-security-groups-overview.md) +- [Setup Bastion to allow secure access to the license server.](https://azure.microsoft.com/services/azure-bastion/) ++## Lab Account ++To use a shared resource, the lab account must be set up to use a [peered virtual network](how-to-connect-peer-virtual-network.md). In this case, we'll be peering to the virtual network that holds the shared resource. ++>[!WARNING] +>The lab for your class must be created **after** the lab account is peered to the shared resource virtual network. ++## Template machine ++When your lab plan/lab account is set to use advanced networking, the template machine should now have access to the shared resource. You might have to update the firewall rules, depending on the shared resource being accessed. ++## Next steps ++As an administrator, [configure virtual network peering on your lab account](how-to-connect-peer-virtual-network.md). |
| lab-services | How To Create A Lab With Shared Resource | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-a-lab-with-shared-resource.md | Title: How to Create a Lab with a Shared Resource | Azure Lab Services description: Learn how to create a lab that requires a resource shared among the students. Previously updated : 06/26/2020 Last updated : 03/03/2022+ # How to create a lab with a shared resource in Azure Lab Services -Sometimes when creating a classroom lab, there may be some resources that need to be shared among all the students in a lab. For example, you have a licensing server or SQL Server for a database class. This article will discuss the steps to enable the shared resource for a lab. WeΓÇÖll also talk about how to limit access to that shared resource. ++> [!NOTE] +> If using a version of Azure Lab Services prior to the [April 2022 Update (preview)](lab-services-whats-new.md), see [How to create a lab with a shared resource in Azure Lab Services (deprecated)](how-to-create-a-lab-with-shared-resource-1.md). ++When you're creating a lab, there might be some resources that need to be shared among all the students in a lab. For example, you have a licensing server or SQL Server for a database class. This article will discuss the steps to enable the shared resource for a lab. WeΓÇÖll also talk about how to limit access to the shared resource. ## Architecture -As shown in the diagram below we'll have a lab account with a lab. The lab account will have the vnet peering settings so the virtual network for the lab is connected to the network of the shared resource. In the diagram below there are two virtual networks with non-overlapping IP ranges. These IP ranges are just example ranges. Also note that the shared resource virtual network is in the same subscription as the lab account. +As shown in the diagram below we'll have a lab plan with a lab. The lab plan will have advanced networking enabled. In our example, the virtual network for the lab is the same network of the shared resource. Optionally, routing maybe used to connect lab VMs to shared resources in other subnets. The lab VMs can connect using the private IP of the shared server. Also, the virtual network is in the same region as the lab plan and lab. +++## Set up shared resource - +The virtual network for the shared resource must be created before the lab plan or lab is created. For more information on how to create a virtual network and subnets, see [create a virtual network](../virtual-network/quick-create-portal.md) and [create a subnet](../virtual-network/virtual-network-manage-subnet.md#add-a-subnet). Planning out virtual network ranges is an important step when designing your network. For more information about planning your network, see the [plan virtual networks](../virtual-network/virtual-network-vnet-plan-design-arm.md) article. -## Setup shared resource +The shared resource can be software running on a virtual machine or an Azure provided service. The shared resource should be available through private IP address. By making the shared resource available through private IP only, you limit access to that shared resource. -The virtual network for the shared resource must be created before the lab is created. For more information on how to create a virtual network, see [create a virtual network](../virtual-network/quick-create-portal.md). Planning out virtual network ranges so they donΓÇÖt overlap with the ip address of the lab machines is important. For more information about planning your network, see the [plan virtual networks](../virtual-network/virtual-network-vnet-plan-design-arm.md) article. In our example, the shared resource is in a virtual network with the range 10.2.0.0/16. If not done already, [create a subnet](../virtual-network/virtual-network-manage-subnet.md#add-a-subnet) to hold the shared resource. In the example, we use the 10.2.0.0/24 range, but your range may be different depending on the needs of your network. +The diagram also shows a network security group (NSG) which can be used to restrict traffic coming from the student VM. For example, you can write a security rule that states traffic from the student VM's IP addresses can only access one shared resource and nothing else. For more information on how to set security rules, see [manage network security group](../virtual-network/manage-network-security-group.md#work-with-security-rules). -The shared resource can be software running on a virtual machine or an Azure provided service. The shared resource should be available through private IP address. By making the shared resource available through private IP only, you limit access to that shared resource. +If your shared resource is an Azure virtual machine running necessary software, you might have to modify the default firewall rules for the virtual machine. -The diagram also shows a network security group (NSG) which can be used to restrict traffic coming from the student VM. For example, you can write a security rule that states traffic from the student VM's IP addresses can only access one shared resource and nothing else. For more information how to set security rules, see [manage network security group](../virtual-network/manage-network-security-group.md#work-with-security-rules). If you want to restrict access to a shared resource to a specific lab, get the IP address for the lab from the [lab settings from the lab account](manage-labs.md#view-labs-in-a-lab-account) and set an inbound rule to allow access only from that IP address. DonΓÇÖt forget to allow ports 49152 to 65535 for that IP address. Optionally you can find the private IP address of the studentΓÇÖs VMs by using the [virtual machine pool page](how-to-set-virtual-machine-passwords.md). +## Lab plan -If your shared resource is an Azure virtual machine running necessary software, you may have to modify the default firewall rules for the virtual machine. +To use a shared resource, the lab plan must be set up to use advanced networking. For more information, see [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md). In this case, Lab Services will inject lab VM networking resources into the virtual network that holds the shared resource. -### Tips for shared resources - License server -One of the more common shared resources is a License server, here are a few tips on how to be successful with setting one up. -#### Server region -The License server will need to be connected to the virtual network that is peered to the lab, so the license server needs to be located in the same region as the lab account. +> [!WARNING] +> Advanced networking must be enabled during lab plan creation. It can't be added later. -#### Static private IP and MAC address -By default virtual machines have a dynamic private ip, [before you setup any software set the private ip to static](../virtual-network/ip-services/virtual-networks-static-private-ip-arm-pportal.md). This sets the private IP and the MAC address to be static. +When your lab plan is set to use advanced networking, the template VM and student VMs should now have access to the shared resource. You might have to update the virtual network's [network security group](/azure/virtual-network/network-security-groups-overview), virtual network's [user-defined routes](/azure/virtual-network/virtual-networks-udr-overview#user-defined) or server's firewall rules. -#### Control Access -Controlling access to the license server is key. Once the VM is setup access will still be needed for maintenance, troubleshooting, and updating. Here are a few different ways to do this. -- [Setting up Just in Time (JIT) access within Microsoft Defender for Cloud.](../security-center/security-center-just-in-time.md?tabs=jit-config-asc%252cjit-request-asc)-- [Setting up a Network Security Group to restrict access.](../virtual-network/network-security-groups-overview.md)-- [Setup Bastion to allow secure access to the license server.](https://azure.microsoft.com/services/azure-bastion/)+## Tips -## Lab Account +One of the most common shared resources is a license server. The following list has a few tips to successfully configure a server. -To use a shared resource, the lab account must be set up to use a [peered virtual network](how-to-connect-peer-virtual-network.md). In this case, we will be peering to the virtual network that holds the shared resource. +- Advanced networking must be enabled when the lab plan is created. +- The license server needs to be located in the same region as the lab plan and virtual network. +- By default virtual machines have a dynamic private ip. [Before you setup any software, set the private ip to static](../virtual-network/ip-services/virtual-networks-static-private-ip-arm-pportal.md). +- Controlling access to the license server is key. When the VM is set up, access will still be needed for maintenance, troubleshooting, and updating. Following are a few ways for controlling access: ->[!WARNING] ->The lab for your class must be created **after** the lab account is peered to the shared resource virtual network. + - [Setting up Just in Time (JIT) access within Microsoft Defender for Cloud.](../security-center/security-center-just-in-time.md?tabs=jit-config-asc%252cjit-request-asc) + - [Setting up a Network Security Group to restrict access.](../virtual-network/network-security-groups-overview.md) + - [Setup Bastion to allow secure access to the server.](https://azure.microsoft.com/services/azure-bastion/) -## Template machine +## Next steps -Once your lab account is peered to the virtual network, the template machine should now have access to the shared resource. You may have to update the firewall rules, depending on the shared resource being accessed. +As an administrator, [create a lab plan with advanced networking](how-to-connect-vnet-injection.md). |
| lab-services | How To Create Manage Template | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-manage-template.md | Title: Manage a template of a classroom lab in Azure Lab Services | Microsoft Docs -description: Learn how to create and manage a classroom lab template in Azure Lab Services. + Title: Manage a template of a lab in Azure Lab Services | Microsoft Docs +description: Learn how to create and manage a lab template in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/31/2022 -# Create and manage a classroom template in Azure Lab Services -A template in a lab is a base virtual machine image from which all usersΓÇÖ virtual machines are created. Set up the template virtual machine so that it is configured with exactly what you want to provide to the lab users. You can provide a name and description of the template that the lab users see. Then, you publish the template to make instances of the template VM available to your lab users. When you publish a template, Azure Lab Services creates VMs in the lab by using the template. The number of VMs created in this process is same as the maximum number of users allowed into the lab, which you can set in the usage policy of the lab. All virtual machines have the same configuration as the template. +# Create and manage a template in Azure Lab Services -This article describes how to create and manage a template virtual machine in a classroom lab of Azure Lab Services. +A template in a lab is a base VM image from which all usersΓÇÖ virtual machines are created. Modify the template VM so that itΓÇÖs configured with exactly what you want to provide to the lab users. You can provide a name and description of the template that the lab users see. Then, you publish the template to make instances of the template VM available to your lab users. When you publish a template, Azure Lab Services creates VMs in the lab using the template. The number of VMs created during publish equals lab capacity. If using [Teams integration](lab-services-within-teams-overview.md), or [Canvas integration](lab-services-within-canvas-overview.md), the number of VMs created during publish equals the number of users in the lab. All virtual machines have the same configuration as the template. -> [!NOTE] -> When you create a lab, the template VM is created but itΓÇÖs not started. You can start it, connect to it, and install any pre-requisite software for the lab, and then publish it. When you publish the template VM, itΓÇÖs is automatically shut down for you if you havenΓÇÖt done so. -> -> Template VMs incur **cost** when running, so ensure that the template VM is shutdown when you donΓÇÖt need it to be running. +When you create a lab, the template VM is created but itΓÇÖs not started. You can start it, connect to it, and install any pre-requisite software for the lab, and then publish it. When you publish the template VM, itΓÇÖs automatically shut down for you if you havenΓÇÖt done so. This article describes how to manage a template VM of a lab. +> [!NOTE] +> Template VMs incur cost when running, so ensure that the template VM is shutdown when you aren't using it. ## Set or update template title and description-Use the following steps to set title and description for the first time, and update them later. ++Use the following steps to set title and description for the lab. Educators and students will see the title and description on the tiles of the [My Virtual Machines](instructor-access-virtual-machines.md) page. 1. On the **Template** page, enter the new **title** for the lab. -2. Enter the new **description** for the template. When you move the focus out of the text box, it's automatically saved. +2. Enter the new **description** for the template. When you move the focus out of the text box, it's automatically saved.  ## Update a template VM+ Use the following steps to update a template VM. -1. Wait until the template VM is started, and then select **Connect to template** on the toolbar to connect to the template VM, and follow instructions. If it's a Windows machine, you will see an option to download the RDP file. -1. Once you connect to the template and make changes, it will no longer have the same setup as the virtual machines last published to your users. Template changes will not be reflected on your users' existing virtual machines until after you publish again. +1. On the **Template** page for the lab, select **Start template** on the toolbar. +1. Wait until the template VM is started, and then select **Connect to template** on the toolbar to connect to the template VM. Depending on the setting for the lab, you'll connect using Remote Desktop Protocol (RDP) or Secure Shell (SSH). +1. Once you connect to the template and make changes, it will no longer have the same setup as the virtual machines last published to your users. Template changes wonΓÇÖt be reflected on your students' existing virtual machines until after you publish again. - -1. Install any software that's required for students to do the lab (for example, Visual Studio, Azure Storage Explorer, etc.). -1. Disconnect (close your remote desktop session) from the template VM. -1. **Stop** the template VM by selecting **Stop template**. -1. Follow steps in the next section to **Publish** the updated template VM. -## Publish the template VM -In this step, you publish the template VM. When you publish the template VM, Azure Lab Services creates VMs in the lab by using the template. All virtual machines have the same configuration as the template. +1. Install any software that's required for students to do the lab (for example, Visual Studio, Azure Storage Explorer, etc.). +1. Disconnect (close your remote desktop session) from the template VM. +1. **Stop** the template VM by selecting **Stop template**. +1. Follow steps in the next section to **Publish** the updated template VM. +## Publish the template VM -1. On the **Template** page, select **Publish** on the toolbar. +In this step, you publish the template VM. When you publish the template VM, Azure Lab Services creates VMs in the lab by using the template. All virtual machines have the same configuration as the template. ++1. On the **Template** page, select **Publish** on the toolbar. -  +  > [!WARNING]- > Once you publish, you can't unpublish. -2. On the **Publish template** page, enter the number of virtual machines you want to create in the lab, and then select **Publish**. + > Publishing is a permanent action. It can't be undone. ++2. On the **Publish template** page, enter the number of virtual machines you want to create in the lab, and then select **Publish**. -  -3. You see the **status of publishing** the template on page. This process can take up to an hour. +  +3. You see the **status of publishing** the template on page. This process can take up to an hour. -  -4. Wait until the publishing is complete and then switch to the **Virtual machines pool** page by selecting **Virtual machines** on the left menu or by selecting **Virtual machines** tile. Confirm that you see virtual machines that are in **Unassigned** state. These VMs are not assigned to students yet. They should be in **Stopped** state. You can start a student VM, connect to the VM, stop the VM, and delete the VM on this page. You can start them in this page or let your students start the VMs. +  +4. Wait until the publishing is complete and then switch to the **Virtual machines pool** page by selecting **Virtual machines** on the left menu or by selecting **Virtual machines** tile. Confirm that you see virtual machines that are in **Unassigned** state. These VMs arenΓÇÖt assigned to students yet. They should be in **Stopped** state. You can start a student VM, connect to the VM, stop the VM, and delete the VM on this page. You can start them in this page or let your students start the VMs. ++  -  ## Next steps+ See the following articles: -- [As an admin, create and manage lab accounts](how-to-manage-lab-accounts.md)-- [As a lab owner, create and manage labs](how-to-manage-classroom-labs.md)+- [As an admin, create and manage lab plans](how-to-manage-lab-plans.md) +- [As a lab owner, create and manage labs](how-to-manage-labs.md) - [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)-- [As a lab user, access labs](how-to-use-classroom-lab.md)+- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | How To Create Schedules Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-schedules-within-canvas.md | + + Title: Create Azure Lab Services schedules within Canvas +description: Learn how to create Lab Services schedules within Canvas. + Last updated : 01/22/2022+++# Create and manage Lab Services schedules within Canvas +++Schedules allow you to configure a lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. ++Here is how schedules affect lab VM: ++- Template virtual machine is not included in schedules. +- Only assigned virtual machines are started. If a machine is not claimed by a student, the VM will not start when a schedule runs. +- All virtual machines (whether claimed by a user or not) are stopped based on the schedule. ++The scheduled running time of VMs does not count against the [quota](classroom-labs-concepts.md#quota) given to a user. The quota is for the time outside of schedule hours that a student spends on VMs. ++Educators can create, edit, and delete lab schedules within Canvas as in the Azure Lab Services portal. For more information on scheduling, see [Creating and managing schedules](how-to-create-schedules-within-canvas.md). ++> [!IMPORTANT] +> Schedules will apply at the course level. If you have many sections of a course, consider using [automatic shutdown policies](how-to-configure-auto-shutdown-lab-plans.md) and/or [quotas hours](how-to-configure-student-usage.md#set-quotas-for-users). ++## Next steps ++See the following articles: ++- [Use Azure Lab Services within Canvas overview](lab-services-within-canvas-overview.md) +- [Get started and create a lab within Canvas](how-to-get-started-create-lab-within-canvas.md) +- [Manage lab user lists within Canvas](how-to-manage-user-lists-within-canvas.md) +- [Manage lab's VM pool within Canvas](how-to-manage-vm-pool-within-canvas.md) +- [Access a VM within Canvas ΓÇô Student view](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | How To Create Schedules Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-schedules-within-teams.md | Title: Create Azure Lab Services schedules within Teams description: Learn how to create Lab Services schedules within Teams. Previously updated : 10/07/2020 Last updated : 02/05/2022 # Create and manage Lab Services schedules within Teams -Schedules allow you to configure a classroom lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. The following procedures give you steps to create and manage schedules for a classroom lab: +Schedules allow you to configure a lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. The article covers the procedures to create and manage schedules for a lab. -Here's how schedules affect lab virtual machines: +Here's how schedules affect lab virtual machines: -- Template virtual machine is not included in schedules. -- Only assigned virtual machines are started. This means, if a machine is not claimed by an end user (student), the machine will not start on the scheduled hours. -- All virtual machines (whether claimed by a user or not) are stopped based on the lab schedule. +- Template virtual machine isn't included in schedules. +- Only assigned virtual machines are started. If a machine is not claimed by user (student), the machine won't start on the scheduled hours. +- All virtual machines (whether claimed by a user or not) are stopped based on the lab schedule. > [!IMPORTANT]-> The scheduled running time of VMs does not count against the quota allotted to a user. The quota is for the time outside of schedule hours that a student spends on VMs. +> The scheduled running time of VMs does not count against the quota allotted to a user. The quota is for the time outside of schedule hours that a student spends on VMs. -Users can create, edit, and delete lab schedules within Teams just as in the [labs website](https://labs.azure.com). Refer to the article on [creating and managing schedules](how-to-create-schedules-within-teams.md). +Users can create, edit, and delete lab schedules within Teams as in the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). For more information, see [creating and managing schedules](how-to-create-schedules-within-teams.md). ## Automatic shutdown and disconnect settings -You can enable several autoshutdown cost control features to proactively prevent additional costs when the virtual machines are not being actively used. The combination of the following three automatic shutdown and disconnect features catches most of the cases where users accidentally leave their virtual machines running: -  -- Automatically disconnect users from virtual machines that the OS deems idle.+You can enable several automatic shutdown cost control features to prevent extra costs when the VMs aren't being actively used. The combination of the following three automatic shutdown and disconnect features catches most of the cases where users accidentally leave their virtual machines running: ++- Automatically disconnect users from virtual machines that the OS considers idle. - Automatically shut down virtual machines when users disconnect. - Automatically shut down virtual machines that are started but users don't connect. -For more details, refer to the article on [configuring auto-shutdown settings for a lab](how-to-enable-shutdown-disconnect.md). +For more information, see the article on [configuring auto-shutdown settings for a lab](how-to-enable-shutdown-disconnect.md). ## Next steps -See the following articles: - - [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Get started and create a lab within Teams](how-to-get-started-create-lab-within-teams.md)-- [Manage lab user lists within Teams](how-to-manage-user-lists-within-teams.md)-- [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md)-- [Access a VM within Teams – Student view](how-to-access-vm-for-students-within-teams.md)+- As an educator, [manage the VM pool within Teams](how-to-manage-vm-pool-within-teams.md). +- As an educator, [manage lab user lists from Teams](how-to-manage-user-lists-within-teams.md). +- As an admin or educator, [delete labs within Teams](how-to-delete-lab-within-teams.md) +- As student, [access a VM within Teams](how-to-access-vm-for-students-within-teams.md) |
| lab-services | How To Create Schedules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-create-schedules.md | -# Create and manage schedules for labs in Azure Lab Services -Schedules allow you to configure a classroom lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. The following procedures give you steps to create and manage schedules for a classroom lab: +# Create and manage schedules for labs in Azure Lab Services ++Schedules allow you to configure a lab such that VMs in the lab automatically start and shut down at a specified time. You can define a one-time schedule or a recurring schedule. The following procedures give you steps to create and manage schedules for a lab: > [!IMPORTANT]-> The scheduled running time of VMs does not count against the [quota allotted to a user](how-to-configure-student-usage.md#set-quotas-for-users). The quota is for the time outside of schedule hours that a student spends on VMs. +> The scheduled running time of VMs does not count against the [quota allotted to a user](how-to-configure-student-usage.md#set-quotas-for-users). The quota is for the time outside of schedule hours that a student spends on VMs. ## Set a schedule for the lab-Create a scheduled event for the lab so that VMs in the lab are automatically started/stopped at specific times. The user quota you specified earlier is the additional time assigned to each user outside this scheduled time. ++Create a scheduled event for the lab so that VMs in the lab are automatically started/stopped at specific times. The user quota you specified earlier is the additional time assigned to each user outside this scheduled time. > [!NOTE]-> Before we get started, here's how schedules affect lab virtual machines: ->- Template virtual machine is not included in schedules. ->- Only assigned virtual machines are started. This means, if a machine is not claimed by an end user (student), the the machine will not start on the scheduled hours. ->- All virtual machines (whether claimed by a user or not) are stopped based on the lab schedule. +> Before we get started, here's how schedules affect lab virtual machines: +> +>- Template virtual machine is not included in schedules. +>- Only assigned virtual machines are started. This means, if a machine is not claimed by an end user (student), the the machine will not start on the scheduled hours. +>- All virtual machines (whether claimed by a user or not) are stopped based on the lab schedule. -1. Switch to the **Schedules** page, and select **Add scheduled event** on the toolbar. +1. Switch to the **Schedules** page, and select **Add scheduled event** on the toolbar. -2. Confirm that **Standard** is selected the **Event type**. You select **Start only** to specify only the start time for the VMs. You select **Stop only** to specify only the stop time for the VMs. -7. In the **Repeat** section, select the current schedule. +2. Confirm that **Standard** is selected the **Event type**. You select **Start only** to specify only the start time for the VMs. You select **Stop only** to specify only the stop time for the VMs. +7. In the **Repeat** section, select the current schedule.  5. On the **Repeat** dialog box, do the following steps:- 1. Confirm that **every week** is set for the **Repeat** field. + 1. Confirm that **every week** is set for the **Repeat** field. 3. Specify the **start date**. 4. Specify the **start time** at which you want the VMs to be started.- 5. Specify the **stop time** on which the VMs are to be shut down. - 6. Specify the **time zone** for the start and stop times you specified. - 2. Select the days on which you want the schedule to take effect. In the following example, Monday-Thursday is selected. - 8. Select **Save**. + 5. Specify the **stop time** on which the VMs are to be shut down. + 6. Specify the **time zone** for the start and stop times you specified. + 2. Select the days on which you want the schedule to take effect. In the following example, Monday-Thursday is selected. + 8. Select **Save**.  -3. Now, on the **Add scheduled event** page, for **Notes (optional)**, enter any description or notes for the schedule. -4. On the **Add scheduled event** page, select **Save**. +3. Now, on the **Add scheduled event** page, for **Notes (optional)**, enter any description or notes for the schedule. +4. On the **Add scheduled event** page, select **Save**.  ## View schedules in calendar+ You can see the scheduled dates and times highlighted in the calendar view as shown in the following image:  -Select the **Today** button in the top-right corner to switch to current date in the calendar. Select **left arrow** to switch to the previous week and **right arrow** to switch to the next week in the calendar. +Select the **Today** button in the top-right corner to switch to current date in the calendar. Select **left arrow** to switch to the previous week and **right arrow** to switch to the next week in the calendar. ## Edit a schedule-When you select a highlighted schedule in the calendar, you see buttons to **edit** or **delete** the schedule. ++When you select a highlighted schedule in the calendar, you see buttons to **edit** or **delete** the schedule.  -On the **Edit scheduled event** page, you can update the schedule, and select **Save**. +On the **Edit scheduled event** page, you can update the schedule, and select **Save**. ## Delete a schedule 1. To delete a schedule, select a highlighted schedule in the calendar, and select the trash icon (delete) button: -2. On the **Delete scheduled event** dialog box, select **Yes** to confirm the deletion. --+2. On the **Delete scheduled event** dialog box, select **Yes** to confirm the deletion. ## Next steps+ See the following articles: -- [As an admin, create and manage lab accounts](how-to-manage-lab-accounts.md)-- [As a lab owner, create and manage labs](how-to-manage-classroom-labs.md)+- [As an admin, create and manage lab plans](how-to-manage-lab-plans.md) +- [As a lab owner, create and manage labs](how-to-manage-labs.md) - [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)-- [As a lab user, access labs](how-to-use-classroom-lab.md)+- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | How To Delete Lab Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-delete-lab-within-canvas.md | + + Title: Delete an Azure Lab Services lab from Canvas +description: Learn how to delete an Azure Lab Services lab from Canvas. + Last updated : 01/22/2022+++# Delete labs within Canvas +++This article shows how to delete a lab from the **Azure Lab Services** app. ++## Prerequisites ++* [Create a Lab Plan](tutorial-setup-lab-plan.md#create-a-lab-plan) in the Azure portal. +* [Get started and create a Lab Services lab within Canvas](how-to-get-started-create-lab-within-canvas.md). ++## Delete labs ++A lab created within Canvas can be deleted in the [Lab Services website](https://labs.azure.com) by deleting the lab directly, as described in [Manage labs in Azure Lab Services](how-to-manage-labs.md). ++> [!IMPORTANT] +> Uninstalling the Azure Lab Services app from the course will not result in deletion of the lab. Deletion of the course won't cause deletion of the lab. ++## Next steps ++* [Use Azure Lab Services within Canvas overview](lab-services-within-canvas-overview.md) +* [Manage lab user lists within Canvas](how-to-manage-user-lists-within-canvas.md) +* [Manage lab's VM pool within Canvas](how-to-manage-vm-pool-within-canvas.md) +* [Create and manage lab schedules within Canvas](how-to-create-schedules-within-canvas.md) +* [Access a VM within Canvas ΓÇô Student view](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | How To Delete Lab Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-delete-lab-within-teams.md | Title: Delete an Azure Lab Services lab from Teams description: Learn how to delete an Azure Lab Services lab from Teams. Previously updated : 10/12/2020 Last updated : 02/05/2022 # Delete labs within Teams This article shows how to delete a lab from the **Azure Lab Services** app. + ## Prerequisites -* [Create a Lab Services account](tutorial-setup-lab-account.md#create-a-lab-account) in the Azure portal. -* [Get started and create a Lab Services lab within Teams](how-to-get-started-create-lab-within-teams.md). +* [Create a lab plan](tutorial-setup-lab-plan.md). +* [Create a lab within Teams](how-to-get-started-create-lab-within-teams.md). ## Delete labs -A lab created within Teams can be deleted in the [Lab Services website](https://labs.azure.com) by deleting the lab directly, as described in [Manage labs in Azure Lab Services](how-to-manage-classroom-labs.md). +A lab created within Teams can be deleted in the [Lab Services portal](https://labs.azure.com) directly. For more information, see [Delete a lab](manage-labs.md#delete-a-lab). -Lab deletion is also triggered when the team is deleted. If the team in which the lab is created gets deleted, lab would be automatically deleted 24 hours after the automatic user list sync is triggered. +Lab deletion is also triggered when the team is deleted. If the associated team is deleted, the lab will be automatically deleted 24 hours later when the automatic user list sync is triggered. > [!IMPORTANT]-> Deletion of the tab or uninstalling the app will not result in deletion of the lab. +> Deletion of the tab or uninstalling the app will not result in deletion of the lab. -If the tab is deleted, users on the team membership list will still be able to access the VMs on the [Lab Services website](https://labs.azure.com) unless the lab deletion is explicitly triggered by deleting the lab on website or deleting the team. +If the *tab* is deleted in Teams, users can still access the lab VMs on the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). When the team is deleted or the lab is explicitly deleted, users can no longer access their VMs through the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). ## Next steps -- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Manage lab user lists within Teams](how-to-manage-user-lists-within-teams.md)-- [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md)-- [Create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md)-- [Access a VM within Teams ΓÇô Student view](how-to-access-vm-for-students-within-teams.md)-+- As an educator, [create a lab within Teams](how-to-get-started-create-lab-within-teams.md). +- As an educator, [manage the VM pool within Teams](how-to-manage-vm-pool-within-teams.md). +- As an educator, [create and manage schedules within Teams](how-to-create-schedules-within-teams.md). +- As an educator, [manage lab user lists from Teams](how-to-manage-user-lists-within-teams.md). +- As student, [access a VM within Teams](how-to-access-vm-for-students-within-teams.md) |
| lab-services | How To Enable Nested Virtualization Template Vm Ui | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-enable-nested-virtualization-template-vm-ui.md | Title: Enable nested virtualization on a template VM in Azure Lab Services (UI) description: Learn how to create a template VM with multiple VMs inside. In other words, enable nested virtualization on a template VM in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/27/2022 -# Enable nested virtualization on a template virtual machine in Azure Lab Services manually +# Enable nested virtualization manually on a template VM in Azure Lab Services -Nested virtualization enables you to create a multi-VM environment inside a lab's template virtual machine. Publishing the template will provide each user in the lab with a virtual machine set up with multiple VMs within it. For more information about nested virtualization and Azure Lab Services, see [Enable nested virtualization on a template virtual machine in Azure Lab Services](how-to-enable-nested-virtualization-template-vm.md). +Nested virtualization enables you to create a multi-VM environment inside a lab's template VM. Publishing the template will provide each user in the lab with a virtual machine set up with multiple VMs within it. For more information about nested virtualization and Azure Lab Services, see [Enable nested virtualization on a template virtual machine in Azure Lab Services](how-to-enable-nested-virtualization-template-vm.md). -This article covers how to set up nested virtualization on a template machine in Azure Lab Services using Windows roles and tools directly. There are a few things needed to enable a class to use nested virtualization. The steps below will describe how to manually set up a Lab Services machine template with Hyper-V. Steps are intended for Windows Server 2016 or Windows Server 2019. +This article covers how to set up nested virtualization on a template machine in Azure Lab Services using Windows roles and tools directly. There are a few things needed to enable a class to use nested virtualization. The following steps describe how to manually set up a Lab Services machine template with Hyper-V. Steps are intended for Windows Server 2016 or Windows Server 2019. ->[!IMPORTANT] ->Select **Large (nested virtualization)** or **Medium (nested virtualization)** for the virtual machine size when creating the lab. Nested virtualization will not work otherwise. +> [!IMPORTANT] +> Select **Large (nested virtualization)** or **Medium (nested virtualization)** for the virtual machine size when creating the lab. Nested virtualization will not work otherwise. ## Enable Hyper-V role -The following steps describe actions needed to enable Hyper-V on Windows Server using either Server Manager. Once the installation is successful, Hyper-V manager will be available to add, modify, and delete client virtual machines. +The following steps describe actions needed to enable Hyper-V on Windows Server using Server Manager. Once the installation is successful, Hyper-V manager will be available to add, modify, and delete client VMs. -1. In **Server Manager**, on the Dashboard page, click **Add Roles and Features**. -2. On the **Before you begin** page, click **Next**. -3. On the **Select installation type** page, keep the default selection of Role-based or feature-based installation and then click **Next**. -4. On the **Select destination server** page, select Select a server from the server pool. The current server will already be selected. Click Next. +1. In **Server Manager**, on the Dashboard page, select **Add Roles and Features**. +2. On the **Before you begin** page, select **Next**. +3. On the **Select installation type** page, keep the default selection of Role-based or feature-based installation and then select **Next**. +4. On the **Select destination server** page, select Select a server from the server pool. The current server will already be selected. Select Next. 5. On the **Select server roles** page, select **Hyper-V**. -6. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Click the **Add Features** button. -7. On the **Select server roles** page, click **Next**. -8. On the **Select features page**, click **Next**. -9. On the **Hyper-V** page, click **Next**. -10. On the **Create Virtual Switches** page, accept the defaults, and click **Next**. -11. On the **Virtual Machine Migration** page, accept the defaults, and click **Next**. -12. On the **Default Stores** page, accept the defaults, and click **Next**. +6. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Select the **Add Features** button. +7. On the **Select server roles** page, select **Next**. +8. On the **Select features page**, select **Next**. +9. On the **Hyper-V** page, select **Next**. +10. On the **Create Virtual Switches** page, accept the defaults, and select **Next**. +11. On the **Virtual Machine Migration** page, accept the defaults, and select **Next**. +12. On the **Default Stores** page, accept the defaults, and select **Next**. 13. On the **Confirm installation selections** page, select **Restart the destination server automatically if required**.-14. When the **Add Roles and Features Wizard** pop-up appears, click **Yes**. -15. Click **Install**. +14. When the **Add Roles and Features Wizard** pop-up appears, select **Yes**. +15. Select **Install**. 16. Wait for the **Installation progress** page to indicate that the Hyper-V role is complete. The machine may restart in the middle of the installation.-17. Click **Close**. +17. Select **Close**. ## Enable DHCP role -Any Hyper-V client virtual machines created, needs an IP address in the NAT network. We'll create the NAT network later. One way to assign IP addresses is to set up the host, in this case the lab virtual machine template, as a DHCP server. Below are the steps required to enable the DHCP role. +Any Hyper-V client VM created, needs an IP address in the NAT network. We'll create the NAT network later. One way to assign IP addresses is to set up the host, in this case the lab VM template, as a DHCP server. Let's enable the DHCP role on the template VM. -1. In **Server Manager**, on the **Dashboard** page, click **Add Roles and Features**. -2. On the **Before you begin** page, click **Next**. -3. On the **Select installation type** page, select **Role-based or feature-based installation** and then click **Next**. -4. On the **Select destination server** page, select the current server from the server pool and then click **Next**. +1. In **Server Manager**, on the **Dashboard** page, select **Add Roles and Features**. +2. On the **Before you begin** page, select **Next**. +3. On the **Select installation type** page, select **Role-based or feature-based installation** and then select **Next**. +4. On the **Select destination server** page, select the current server from the server pool and then select **Next**. 5. On the **Select server roles** page, select **DHCP Server**. -6. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Click **Add Features**. +6. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Select **Add Features**. >[!NOTE] >You may see a validation error stating that no static IP addresses were found. This warning can be ignored for our scenario. -7. On the **Select server roles** page, click **Next**. -8. On the **Select features** page, click **Next**. -9. On the **DHCP Server** page, click **Next**. -10. On the **Confirm installation selections** page, click **Install**. +7. On the **Select server roles** page, select **Next**. +8. On the **Select features** page, select **Next**. +9. On the **DHCP Server** page, select **Next**. +10. On the **Confirm installation selections** page, select **Install**. 11. Wait for the **Installation progress page** to indicate that the DHCP role is complete.-12. Click Close. +12. Select Close. ## Enable Routing and Remote Access role -1. In **Server Manager**, on the **Dashboard** page, click **Add Roles and Features**. -2. On the **Before you begin** page, click **Next**. -3. On the **Select installation type** page, select **Role-based or feature-based installation** and then click **Next**. -4. On the **Select destination server** page, select the current server from the server pool and then click **Next**. -5. On the **Select server roles** page, select **Remote Access**. Click **OK**. -6. On the **Select features** page, click **Next**. -7. On the **Remote Access** page, click **Next**. +1. In **Server Manager**, on the **Dashboard** page, select **Add Roles and Features**. +2. On the **Before you begin** page, select **Next**. +3. On the **Select installation type** page, select **Role-based or feature-based installation** and then select **Next**. +4. On the **Select destination server** page, select the current server from the server pool and then select **Next**. +5. On the **Select server roles** page, select **Remote Access**. Select **OK**. +6. On the **Select features** page, select **Next**. +7. On the **Remote Access** page, select **Next**. 8. On the **Role Services** page, select **Routing**.-9. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Click **Add Features**. -10. Click **Next**. -11. On the **Web Server Role (IIS)** page, click **Next**. -12. On the **Select role services** page, click **Next**. -13. On the **Confirm installation selections** page, click **Install**. +9. The **Add Roles and Features Wizard** pop-up will appear. Select **Include management tools (if applicable)**. Select **Add Features**. +10. Select **Next**. +11. On the **Web Server Role (IIS)** page, select **Next**. +12. On the **Select role services** page, select **Next**. +13. On the **Confirm installation selections** page, select **Install**. 14. Wait for the **Installation progress** page to indicate that the Remote Access role is complete. -15. Click **Close**. +15. Select **Close**. ## Create virtual NAT network Now that all the necessary roles have been installed, it's time to create the NA 1. Open **Hyper-V Manager** from Windows Administrative Tools. 2. Select the current server in the left-hand navigation menu.-3. Click **Virtual Switch Manager…** from the **Actions** menu on the right-hand side of the **Hyper-V Manager**. -4. On the **Virtual Switch Manager** pop-up, select **Internal** for the type of switch to create. Click **Create Virtual Switch**. -5. For the newly created virtual switch, set the name to something memorable. For this example, we'll use 'LabServicesSwitch'. Click **OK**. -6. A new network adapter will be created. The name will be similar to 'vEthernet (LabServicesSwitch)'. To verify open the **Control Panel**, click **Network and Internet**, click **View network status and tasks**. On the left, click **Change adapter settings**. +3. Select **Virtual Switch Manager…** from the **Actions** menu on the right-hand side of the **Hyper-V Manager**. +4. On the **Virtual Switch Manager** pop-up, select **Internal** for the type of switch to create. Select **Create Virtual Switch**. +5. For the newly created virtual switch, set the name to something memorable. For this example, we'll use 'LabServicesSwitch'. Select **OK**. +6. A new network adapter will be created. The name will be similar to 'vEthernet (LabServicesSwitch)'. To verify open the **Control Panel**, select **Network and Internet**, select **View network status and tasks**. On the left, select **Change adapter settings**. ### Create a NAT network 1. Open the **Routing and Remote Access** tool from Windows Administrative Tools. 2. Select the local server in the left navigation page. 3. Choose **Action** -> **Configure and Enable Routing and Remote Access**.-4. When **Routing and Remote Access Server Setup Wizard** appears, click **Next**. -5. On the **Configuration** page, select **Network address translation (NAT)** configuration. Click **Next**. +4. When **Routing and Remote Access Server Setup Wizard** appears, select **Next**. +5. On the **Configuration** page, select **Network address translation (NAT)** configuration. Select **Next**. >[!WARNING] >Do not choose the 'Virtual private network (VPN) access and NAT' option. -6. On **NAT Internet Connection** page, choose 'Ethernet'. Don't choose the 'vEthernet (LabServicesSwitch)' connection we created in Hyper-V Manager. Click **Next**. -7. Click **Finish** on the last page of the wizard. -8. When the **Start the service** dialog appears, click **Start Service**. +6. On **NAT Internet Connection** page, choose 'Ethernet'. Don't choose the 'vEthernet (LabServicesSwitch)' connection we created in Hyper-V Manager. Select **Next**. +7. Select **Finish** on the last page of the wizard. +8. When the **Start the service** dialog appears, select **Start Service**. 9. Wait until service is started. ## Update network adapter settings -The network adapter will be associated with the IP used for the default gateway IP for the NAT network created earlier. In this example, we create an IP address of 192.168.0.1 with a subnet mask of 255.255.255.0. We will use the virtual switch created earlier. +The network adapter will be associated with the IP used for the default gateway IP for the NAT network created earlier. In this example, we create an IP address of 192.168.0.1 with a subnet mask of 255.255.255.0. We’ll use the virtual switch created earlier. -1. Open the **Control Panel**, click **Network and Internet**, click **View network status and tasks**. -2. On the left, click **Change adapter settings**. +1. Open the **Control Panel**, select **Network and Internet**, select **View network status and tasks**. +2. On the left, select **Change adapter settings**. 3. In the **Network Connections** window, double-click on 'vEthernet (LabServicesSwitch)' to show the **vEthernet (LabServicesSwitch) Status** details dialog.-4. Click the **Properties** button. -5. Select **Internet Protocol Version 4 (TCP/IPv4)** item and click the **Properties** button. +4. Select the **Properties** button. +5. Select **Internet Protocol Version 4 (TCP/IPv4)** item and select the **Properties** button. 6. In the **Internet Protocol Version 4 (TCP/IPv4) Properties** dialog, select **Use the following IP address**. For the ip address, enter 192.168.0.1. For the subnet mask, enter 255.255.255.0. Leave the default gateway blank. Leave the DNS servers blank as well. >[!NOTE] > Our range for our NAT network will be, in CIDR notation, 192.168.0.0/24. This creates a range of usable IP addresses from 192.168.0.1 to 192.168.0.254. By convention, gateways have the first IP address in a subnet range. -7. Click OK. +7. Select OK. ## Create DHCP Scope -The following steps are instruction to add DHCP scope. In this article, our NAT network is 192.168.0.0/24 in CIDR notation. This creates a range of usable IP addresses from 192.168.0.1 to 192.168.0.254. The scope created must be in that range of usable addresses excluding the IP address already created earlier. +The following steps are instructions to add DHCP scope. In this article, our NAT network is 192.168.0.0/24 in CIDR notation. This creates a range of usable IP addresses from 192.168.0.1 to 192.168.0.254. The scope created must be in that range of usable addresses excluding the IP address already created earlier. 1. Open **Administrative Tools** and open the **DHCP** administrative tool. 2. In the **DHCP** tool, expand the node for the current server and select **IPv4**.-3. From the Action menu, choose **New Scope…** -4. When the **New Scope Wizard** appears, click **Next** on the **Welcome** page. -5. On the **Scope Name** page, enter 'LabServicesDhcpScope' or something else memorable for the name. Click **Next**. +3. From the Action menu, choose **New Scope…**. +4. When the **New Scope Wizard** appears, select **Next** on the **Welcome** page. +5. On the **Scope Name** page, enter 'LabServicesDhcpScope' or something else memorable for the name. Select **Next**. 6. On the **IP Address Range** page, enter the following values. - 192.168.0.100 for the Start IP address The following steps are instruction to add DHCP scope. In this article, our NAT - 24 for the Length - 255.255.255.0 for the Subnet mask -7. Click **Next**. -8. On the **Add Exclusions and Delay** page, click **Next**. -9. On the **Lease Duration** page, click **Next**. -10. On the **Configure DHCP Options** page, select **Yes, I want to configure these options now**. Click **Next**. +7. Select **Next**. +8. On the **Add Exclusions and Delay** page, select **Next**. +9. On the **Lease Duration** page, select **Next**. +10. On the **Configure DHCP Options** page, select **Yes, I want to configure these options now**. Select **Next**. 11. On the **Router (Default Gateway)**-12. Add 192.168.0.1, if not done already. Click **Next**. -13. On the **Domain Name and DNS Servers** page, add 168.63.129.16 as a DNS server IP address, if not done already. 168.63.129.16 is the IP address for an Azure static DNS server. Click **Next**. -14. On the **WINS Servers** page, click **Next**. -15. One the **Activate Scope** page, select **Yes, I want to activate this scope now**. Click **Next**. -16. On the **Completing the New Scope Wizard** page, click **Finish**. +12. Add 192.168.0.1, if not done already. Select **Next**. +13. On the **Domain Name and DNS Servers** page, add 168.63.129.16 as a DNS server IP address, if not done already. 168.63.129.16 is the IP address for an Azure static DNS server. Select **Next**. +14. On the **WINS Servers** page, select **Next**. +15. One the **Activate Scope** page, select **Yes, I want to activate this scope now**. Select **Next**. +16. On the **Completing the New Scope Wizard** page, select **Finish**. ## Conclusion Now your template machine is ready to create Hyper-V virtual machines. See [Cr Next steps are common to setting up any lab. -- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)-- [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)-- [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users)+- [As an educator, add students to a lab](tutorial-setup-lab.md#add-users-to-the-lab) +- [As an educator, set quota for students](how-to-configure-student-usage.md#set-quotas-for-users) +- [As an educator, set a schedule for the lab](tutorial-setup-lab.md#set-a-schedule-for-the-lab) +- [As an educator, publish a lab](tutorial-setup-lab.md#publish-a-lab) |
| lab-services | How To Enable Nested Virtualization Template Vm Using Script | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-enable-nested-virtualization-template-vm-using-script.md | The steps in this article focus on setting up nested virtualization for Windows ## Run script -1. If you're using Internet Explorer, you may have to add `https://github.com` to the trusted sites list. - 1. Open Internet Explorer. - 1. Select the gear icon, and choose **Internet options**. - 1. When the **Internet Options** dialog appears, select **Security**, select **Trusted Sites**, click **Sites** button. - 1. When the **Trusted sites** dialog appears, add `https://github.com` to the trusted websites list, and select **Close**. --  --1. Download the Git repository files as outlined in the following steps. - 1. Go to https://github.com/Azure/azure-devtestlab/archive/refs/heads/master.zip or [https://github.com/Azure/azure-devtestlab/](https://github.com/Azure/azure-devtestlab/). - 1. Click the **Clone or Download** button. - 1. Click **Download ZIP**. - 1. Extract the ZIP file -- >[!TIP] - >You can also clone the Git repository at [https://github.com/Azure/azure-devtestlab.git](https://github.com/Azure/azure-devtestlab.git). - 1. Launch **PowerShell** in **Administrator** mode.-1. In the PowerShell window, navigate to the folder with the downloaded script. If you're navigating from the top folder of the repository files, the script is located at `azure-devtestlab\samples\ClassroomLabs\Scripts\HyperV\`. 1. You may have to change the execution policy to successfully run the script. Run the following command: ```powershell Set-ExecutionPolicy bypass -force ``` -1. Run the script: +1. Download and run the script: ```powershell+ Invoke-WebRequest 'https://aka.ms/azlabs/scripts/hyperV-powershell' -Outfile SetupForNestedVirtualization.ps1 .\SetupForNestedVirtualization.ps1 ``` Now your template machine is ready to create Hyper-V virtual machines. See [Crea Next steps are common to setting up any lab. -- [Add users](tutorial-setup-classroom-lab.md#add-users-to-the-lab)+- [Add users](tutorial-setup-lab.md#add-users-to-the-lab) - [Set quota](how-to-configure-student-usage.md#set-quotas-for-users)-- [Set a schedule](tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab)+- [Set a schedule](tutorial-setup-lab.md#set-a-schedule-for-the-lab) - [Email registration links to students](how-to-configure-student-usage.md#send-invitations-to-users) |
| lab-services | How To Enable Nested Virtualization Template Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-enable-nested-virtualization-template-vm.md | Title: Enable nested virtualization on a template VM in Azure Lab Services | Microsoft Docs -description: In this article, learn how to how to set up nested virtualization on a template machine in Azure Lab Services. +description: In this article, learn how to set up nested virtualization on a template machine in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/04/2022 # Enable nested virtualization on a template virtual machine in Azure Lab Services -Currently, Azure Lab Services enables you to set up one template virtual machine in a lab and make a single copy available to each of your users. If you're an educator teaching networking, security, or IT classes, you may need to provide each of your students with an environment in which multiple virtual machines can talk to each other over a network. +Azure Lab Services enables you to set up one template virtual machine in a lab and make a single copy available to each of your students. Teaching a networking, security of IT class can require an environment with multiple VMs. The VMs also need to communicate with each other. Nested virtualization enables you to create a multi-VM environment inside a lab's template virtual machine. Publishing the template will provide each user in the lab with a virtual machine set up with multiple VMs within it. This article covers how to set up nested virtualization on a template machine in Azure Lab Services. For more information about nested virtualization, see the following articles: Before setting up a lab with nested virtualization, here are a few things to take into consideration. -- When creating a new lab, select **Medium (Nested virtualization)** or **Large (Nested virtualization)** sizes for the virtual machine size. These virtual machine sizes support nested virtualization.-- Choose a size that will provide good performance for both the host and client virtual machines. Remember, when using virtualization, the size you choose must be adequate for not just one machine, but the host as well as any Hyper-V machines running concurrently.+- When creating a new lab, select **Medium (Nested virtualization)** or **Large (Nested virtualization)** sizes for the virtual machine size. +- Choose a size that will provide good performance for both the host and client virtual machines. Make sure the size you choose can run the host VM and any Hyper-V machines at the same time. - Client virtual machines won't have access to Azure resources, such as DNS servers, on the Azure virtual network.-- Host virtual machine requires setup to allow for the client machine to have internet connectivity.-- Client virtual machines are licensed as independent machines. See [Microsoft Licensing](https://www.microsoft.com/licensing/default) for information about licensing for Microsoft operation systems and products. Check licensing agreements for any other software being used before setting up the template machine.+- The host virtual machine requires setup to allow for the client machine to have internet connectivity. +- Hyper-V client virtual machines are licensed as independent machines. For information about licensing for Microsoft operation systems and products, see [Microsoft Licensing](https://www.microsoft.com/licensing/default). Check licensing agreements for any other software being used before installing it on the template virtual machine or client virtual machines. ## Enable nested virtualization on a template VM -This article assumes that you have created a lab account and lab. For more information about creating a new lab account, see [tutorial to set up a Lab Account](tutorial-setup-lab-account.md). For more information how to create lab, see [set up a classroom lab tutorial](tutorial-setup-classroom-lab.md). +This article assumes that you've created a lab account/lab plan and lab. For more information about creating a new lab plan, see [Tutorial: Set up a lab plan](tutorial-setup-lab-plan.md). For more information how to create lab, see [Tutorial: Set up a lab](tutorial-setup-lab.md). >[!IMPORTANT] >Select **Large (nested virtualization)** or **Medium (nested virtualization)** for the virtual machine size when creating the lab. Nested virtualization will not work otherwise. -To connect to the template machine, see [create and manage a classroom template](how-to-create-manage-template.md). +To connect to the template machine, see [Create and manage a template in Azure Lab Services](how-to-create-manage-template.md). To enable nested virtualization, there are a few tasks to accomplish. -- **Enable Hyper-V role**. Hyper-V role must be enabled for the creation and running of Hyper-V virtual machines on the Lab Services virtual machine.+- **Enable Hyper-V role**. Hyper-V role must be enabled for the creation and running of Hyper-V virtual machines. - **Enable DHCP**. When the Lab Services virtual machine has the DHCP role enabled, the Hyper-V virtual machines can automatically be assigned an IP address. - **Create NAT network for Hyper-V VMs**. The NAT network is set up to allow the Hyper-V virtual machines to have internet access. The Hyper-V virtual machines can communicate with each other. >[!NOTE]->The NAT network created on the Lab Services VM will allow a Hyper-V VM to access the internet and other Hyper-V VMs on the same Lab Services VM. The Hyper-V VM won't be able to access Azure resources, such as DNS servers, on the Azure virtual network. +>The NAT network created on the Lab Services VM will allow a Hyper-V VM to access the internet and other Hyper-V VMs on the same Lab Services VM. The Hyper-V VM won't be able to access Azure resources, such as DNS servers, on an Azure virtual network. Accomplishing the tasks listed above can be done using a script or using Windows tools. Read the sections below for further details. ### Using script to enable nested virtualization -To use the automated setup for nested virtualization with Windows Server 2016 or Windows Server 2019, see [Enable nested virtualization on a template virtual machine in Azure Lab Services using a script](how-to-enable-nested-virtualization-template-vm-using-script.md). You will use scripts from [Lab Services Hyper-V scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/HyperV) to install the Hyper-V role. The scripts will also set up networking so the Hyper-V virtual machines can have internet access. +To use the automated setup for nested virtualization with Windows Server 2016 or Windows Server 2019, see [Enable nested virtualization on a template virtual machine in Azure Lab Services using a script](how-to-enable-nested-virtualization-template-vm-using-script.md). You'll use scripts from [Lab Services Hyper-V scripts](https://aka.ms/azlabs/scripts/hyperV) to install the Hyper-V role. The scripts will also set up networking so the Hyper-V virtual machines can have internet access. ### Using Windows tools to enable nested virtualization -The setup nested virtualization for Windows Server 2016 or Windows Server 2019 using Windows roles and administrative tools, see [Enable nested virtualization on a template virtual machine in Azure Lab Services manually](how-to-enable-nested-virtualization-template-vm-ui.md). Instructions will also cover how to set up networking so the Hyper-V virtual machines can have internet access. +To configure nested virtualization for Windows Server 2016 or 2019 manually, see [Enable nested virtualization on a template virtual machine in Azure Lab Services manually](how-to-enable-nested-virtualization-template-vm-ui.md). Instructions will also cover configuring networking so the Hyper-V VMs have internet access. |
| lab-services | How To Enable Remote Desktop Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-enable-remote-desktop-linux.md | Title: Enable graphical remote desktop for Linux in Azure Lab Services | Microsoft Docs description: Learn how to enable remote desktop for Linux virtual machines in a lab in Azure Lab Services. Previously updated : 06/26/2020 Last updated : 01/04/2022 # Enable graphical remote desktop for Linux virtual machines in Azure Lab Services -This article shows you how to do the following tasks: -- Enable graphical remote desktop sessions for a Linux VM-- How to connect to a Linux VM using RDP (Remote Desktop Protocol) or X2Go remote desktop clients+When a lab is created from a **Linux** image, **SSH** (Secure Shell) access is automatically configured so that the educator can connect to the template VM from the command line. When the template VM is published, students can also connect to their VMs using SSH. -## Set up graphical remote desktop solution -When a lab is created from a **Linux** image, **SSH** (Secure Shell) access is automatically configured so that the instructor can connect to the template VM from the command line using SSH. Likewise, when the template VM is published, students can also connect to their VMs using SSH. --To connect to a Linux VM using a **GUI** (graphical user interface), we recommend using either **RDP** or **X2Go**. The rest of this article shows the steps to set up RDP or X2Go on a lab's template VM. +You can also connect to a Linux VM using a **GUI** (graphical user interface). This article shows the steps to set up GUI connections using **Remote Desktop Protocol (RDP)** and **X2Go** . > [!NOTE] > Linux uses an open-source version of RDP called, [Xrdp](https://en.wikipedia.org/wiki/Xrdp). For simplicity, we use the term RDP throughout this article. -### RDP Setup -To use RDP, the instructor must: - - Enable remote desktop connection; this is specifically needed to open the VM's port for RDP. - - Install the RDP remote desktop server. - - Install a Linux graphical desktop environment. +In some cases, such as with Ubuntu LTS 18.04, X2Go provides better performance. If you use RDP and notice latency when interacting with the graphical desktop environment, consider trying X2Go since it may improve performance. -### X2Go Setup -To use X2Go, the instructor must: -- Install the X2Go remote desktop server.-- Install a Linux graphical desktop environment.+> [!IMPORTANT] +> Some marketplace images already have a graphical desktop environment and remote desktop server installed. For example, the [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) already has [XFCE and X2Go Server installed and configured to accept client connections](../machine-learning/data-science-virtual-machine/dsvm-ubuntu-intro.md#x2go). -X2Go uses the same port that is already enabled for SSH. As a result, no extra configuration required to open a port on the VM for X2Go. +> [!WARNING] +> If you need to use [GNOME](https://www.gnome.org/) or [MATE](https://mate-desktop.org/), ensure your lab VM is properly configured. There is a known networking conflict that can occur with the Azure Linux Agent which is needed for the VMs to work properly in Azure Lab Services. Instead, we recommend using a different graphical desktop environment, such as [XFCE](https://www.xfce.org/). -> [!NOTE] -> In some cases, such as with Ubuntu LTS 18.04, X2Go provides better performance. If you use RDP and notice latency when interacting with the graphical desktop environment, consider trying X2Go since it may improve performance. +## X2Go Setup -> [!IMPORTANT] -> Some marketplace images already have a graphical desktop environment and remote desktop server installed. For example, the [Data Science Virtual Machine for Linux (Ubuntu)](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) already has [XFCE and X2Go Server installed and configured to accept client connections](../machine-learning/data-science-virtual-machine/dsvm-ubuntu-intro.md#x2go). +To use X2Go, the educator must: -## Enable remote desktop connection for RDP +- Install the X2Go remote desktop server. +- Install a Linux graphical desktop environment. -This step is only needed to connect using RDP. If instead you plan to use X2Go, you can skip to the next section since X2Go uses the SSH port. +X2Go uses the same port that is already enabled for SSH. As a result, no extra configuration is required during lab creation. -1. During lab creation, the instructor has the option to **Enable Remote Desktop Connection**. The instructor must **enable** this option to open the port on the Linux VM that is needed for an RDP remote desktop session. Otherwise, if this option is left **disabled**, only the port for SSH is opened. - -  +> [!NOTE] +> In some cases, such as with Ubuntu LTS 18.04, X2Go provides better performance. If you use RDP and notice latency when interacting with the graphical desktop environment, consider trying X2Go since it may improve performance. -2. On the **Enabling Remote Desktop Connection** message box, select **Continue with Remote Desktop**. +### Install X2Go Server on the template VM -  +To set up X2Go on a template VM, first follow instructions to [update the template VM](how-to-create-manage-template.md#update-a-template-vm). -## Install RDP or X2Go +For optimal performance, we typically recommend using the XFCE graphical desktop and for users to connect to the desktop using X2Go. To set up XFCE with X2Go on Ubuntu, see [Install and configure X2Go](https://aka.ms/azlabs/scripts/LinuxDesktop-Xfce). -After the lab is created, the instructor needs to ensure that a graphical desktop environment and remote desktop server are installed on the template VM. The instructor must first connect to the template VM using SSH to install the packages for: -- Either the RDP or X2Go remote desktop server.-- A graphical desktop environment, such as [GNOME](https://www.gnome.org/), [MATE](https://mate-desktop.org/), [XFCE](https://www.xfce.org/), [Xubuntu](https://xubuntu.org/), etc.+To manually install X2Go Server, see [X2Go Server Installation](https://wiki.x2go.org/doku.php/doc:installation:x2goserver). There are many graphical desktop environments available for Linux. Some options include [GNOME](https://www.gnome.org/), [MATE](https://mate-desktop.org/), [XFCE](https://www.xfce.org/), and [Xubuntu](https://xubuntu.org/). -After this is set up, the instructor can connect to the template VM using either the **Microsoft Remote Desktop (RDP)** client or **X2Go** client. +## Connect using X2Go client -Follow the below steps to set up the template VM: +Educators and students use X2Go client is used to connect to a VM that has X2Go configured. Using the VM's SSH connection information, follow the steps in the how-to article [Connect to a VM using X2Go](connect-virtual-machine-linux-x2go.md). -1. If you see **Customize template** on the toolbar, select it. Then, select **Continue** on the **Customize template** dialog box. This action starts the template VM. +## RDP Setup -  -1. After the template VM is started, you can select **Connect template** and then **Connect via SSH** on the toolbar. +To use RDP, the educator must: -  -1. You see the following **Connect to your virtual machine** dialog box. Select the **Copy** button next to the text box to copy it to the clipboard. Save the SSH connection information. Use this connection information from an SSH terminal (like [Putty](https://www.putty.org/)) to connect to the virtual machine. - -  +- Enable remote desktop connection in Azure Lab Services +- Install the RDP remote desktop server. +- Install a Linux graphical desktop environment. -1. Finally, install either RDP or X2Go along with the graphical desktop environment of your choice. +### Enable RDP connection in a lab - For optimal performance, we typically recommend using the XFCE graphical desktop and for users to connect to the desktop using X2Go. To set up XFCE with X2Go on Ubuntu, use the following instructions: - - [Install and configure X2Go](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Scripts/LinuxGraphicalDesktopSetup/XFCE_Xubuntu/ReadMe.md) +This step is needed so Azure Lab Services opens port 3389 for RDP to the Linux VMs. By default, Linux VMs only have the SSH port opened. - In cases where you instead need to have users connect to the graphical desktop with RDP, use the following instructions for Ubuntu: - - [Install and configure RDP](../virtual-machines/linux/use-remote-desktop.md) +1. During lab creation, the educator can **Enable Remote Desktop Connection**. The educator must **enable** this option to open the port on the Linux VM that is needed for an RDP remote desktop session. Otherwise, if this option is left **disabled**, only the port for SSH is opened. + + :::image type="content" source="./media/how-to-enable-remote-desktop-linux/enable-rdp-option.png" alt-text="Screenshot that shows the New lab window with the Enable Remote Desktop Connection option."::: +1. On the **Enabling Remote Desktop Connection** message box, select **Continue with Remote Desktop**. + + :::image type="content" source="./media/how-to-enable-remote-desktop-linux/enabling-remote-desktop-connection-dialog.png" alt-text="Screenshot that shows the Enable Remote Desktop Connection confirmation window."::: -### Using GNOME or MATE graphical desktops +### Install RDP on the template VM -For the GNOME or MATE graphical desktop environments, you may encounter a networking conflict with the Azure Linux Agent which is needed for the VMs to work properly in Azure Lab Services. This networking conflict causes the following side effects when Ubuntu 18.04 LTS is used with either GNOME or MATE installed: +If you want to set up the GNOME with RDP on Ubuntu, see [Install and configure GNOME/RDP](https://aka.ms/azlabs/scripts/LinuxDesktop-GnomeMate). These instructions handle known issues with that configuration. -We recommend using the following instructions to set up the GNOME or MATE graphical desktops on Ubuntu. These instructions include a fix for the networking conflict that exists with Ubuntu 18.04 LTS. They also support installing GNOME and MATE on Ubuntu 20.04 LTS and 21.04 LTS: +To install the RDP package on the template VM, see [Install and configure RDP](../virtual-machines/linux/use-remote-desktop.md). There are many graphical desktop environments available for Linux. Some options include [GNOME](https://www.gnome.org/), [MATE](https://mate-desktop.org/), [XFCE](https://www.xfce.org/), and [Xubuntu](https://xubuntu.org/). -## Connect to the template VM via the GUI +## Connect using RDP client -After the template VM is set up, the instructor can connect via the GUI using either the **Microsoft Remote Desktop (RDP)** client or **X2Go** client. The client that you use depends on if RDP or X2Go is configured as the remote desktop server on the template VM. +The Microsoft RDP client is used to connect to a template VM that has RDP configured. The Remote Desktop client can be used on Windows, Chromebooks, Macs and more. For more information, see [Remote Desktop clients](/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). -### Microsoft Remote Desktop (RDP) client +For OS-specific instructions for connecting to a lab VM using RDP, see [Connect to a Linux lab VM using RDP](connect-virtual-machine.md#connect-to-a-linux-lab-vm-using-rdp). -The Microsoft Remote Desktop (RDP) client is used to connect to a template VM that has RDP configured. The Remote Desktop client can be used on Windows, Chromebooks, Macs and more. Refer to the article on [Remote Desktop clients](/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients) for further details. +## Troubleshooting -Follow the below steps based on the type of computer used to connect to the template VM: +### Using GNOME or MATE graphical desktops -- Windows- 1. Click **Connect to template** on your lab's toolbar and select **Connect via RDP** to connect to the template VM. - 1. Save the RDP file and use it to connect to the template VM using the Remote Desktop client. - 1. Typically, the Remote Desktop client is already installed and configured on Windows. As a result, all you need to do is click on the RDP file to open it and start the remote session. +For the GNOME or MATE graphical desktop environments, you may come across a networking conflict with the Azure Linux Agent. The Azure Linux Agent is needed for the VMs to work properly in Azure Lab Services. This networking conflict causes the following side effects when Ubuntu 18.04 LTS is used with either GNOME or MATE installed: -- Mac- 1. Click **Connect to template** on your lab's toolbar and then select **Connect via RDP** to save the RDP file. - 1. Then, refer to the how-to article [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md). +- Lab creation using the image will fail with the error message, **Communication could not be established with the VM agent. Please verify that the VM agent is enabled and functioning.** +- Publishing student VMs will stop responding if the auto-shutdown settings are enabled. +- Resetting the student VM password will stop responding. -- Chromebook- 1. Click **Connect to template** on your lab's toolbar and then select **Connect via RDP** to save the RDP file. - 1. Then, refer to the how-to article [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md). +To set up the GNOME or MATE graphical desktops on Ubuntu, see [Install and configure GNOME/RDP and MATE/X2go](https://aka.ms/azlabs/scripts/LinuxDesktop-GnomeMate). These instructions include a fix for the networking conflict that exists with Ubuntu 18.04 LTS. The scripts also support installing GNOME and MATE on Ubuntu 20.04 LTS and 21.04 LTS: -### X2Go client +### Using RDP with Ubuntu -The X2Go client is used to connect to a template VM that has X2Go configured. Using the template VM's SSH connection information, follow the steps in the how-to article [Connect to a VM using X2Go](how-to-use-remote-desktop-linux-student.md#connect-to-the-student-vm-using-x2go). +In some cases, such as with Ubuntu LTS 18.04, X2Go provides better performance. If you use RDP and notice latency when interacting with the graphical desktop environment, consider trying [X2Go](#x2go-setup) since it may improve performance. ## Next steps-After an instructor sets up either RDP or X2Go on their template VM and publishes, students can connect to their VMs via the GUI remote desktop or SSH. -For more information, see: +After an educator configures either RDP or X2Go on their template VM, they can [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm). |
| lab-services | How To Enable Shutdown Disconnect | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-enable-shutdown-disconnect.md | Title: Configure automatic shutdown of VMs for a lab in Azure Lab Services description: Learn how to enable or disable automatic shutdown of VMs when a remote desktop connection is disconnected. Previously updated : 10/01/2020 Last updated : 02/04/2022 # Configure automatic shutdown of VMs for a lab -This article shows you how you can configure automatic shutdown of VMs for a lab. +This article shows you how you can configure [automatic shut-down](classroom-labs-concepts.md#automatic-shut-down) of VMs for a lab. To learn more about the benefits of auto-shutdown policies, see [Maximize cost control with auto-shutdown settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control). -You can enable several autoshutdown cost control features to proactively prevent additional costs when the virtual machines are not being actively used. The combination of the following three automatic shutdown and disconnect features catches most of the cases where users accidentally leave their virtual machines running: -  -* Automatically disconnect users from virtual machines that the OS deems idle. -* Automatically shut down virtual machines when users disconnect. -* Automatically shut down virtual machines that are started but users don't connect. --Review more details about the autoshutdown features in the [Maximize cost control with autoshutdown settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control) section. --A lab account administrator can configure this setting for the lab account in which you create labs. For more information, see [Configure automatic shutdown of VMs for a lab account](how-to-configure-lab-accounts.md). As a lab owner, you can override the setting when creating a lab or after the lab is created. +A lab plan administrator can configure automatic shutdown policies for the lab plan that you use create labs. For more information, see [Configure automatic shutdown of VMs for a lab plan](how-to-configure-auto-shutdown-lab-plans.md). As a lab owner, you can override the settings when creating a lab or after the lab is created. > [!IMPORTANT]-> Linux labs only support automatic shut down when users disconnect and when VMs are started but users don't connect. Support also varies depending on [specific distributions and versions of Linux](../virtual-machines/extensions/diagnostics-linux.md#supported-linux-distributions). Shutdown settings are not supported by the [Data Science Virtual Machine - Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) image. +> Prior to the [April 2022 Update (preview)](lab-services-whats-new.md), Linux labs only support automatic shut down when users disconnect and when VMs are started but users don't connect. Support also varies depending on [specific distributions and versions of Linux](../virtual-machines/extensions/diagnostics-linux.md#supported-linux-distributions). Shutdown settings are not supported by the [Data Science Virtual Machine - Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) image. ## Configure for the lab level -You can configure the autoshutdown setting in the [Azure Lab Services](https://labs.azure.com/). +You can configure the auto-shutdown settings when you create a lab or after it's created. To configure policies during lab creation see, [Tutorial: Create and publish a lab](tutorial-setup-lab.md). To modify automatic shutdown settings after lab creation, go to the **Settings** page for the lab. -* When creating a lab (in **Lab policies**), or -* After the lab is created (in **Settings**) -> [!div class="mx-imgBorder"] ->  --Make sure to review details about the autoshutdown in the [Maximize cost control with autoshutdown settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control) section. > [!WARNING]-> If you shutdown the Linux or Windows operating system (OS) on a VM before disconnecting an RDP session to the VM, the autoshutdown feature will not work properly. +> If you shutdown the Linux or Windows operating system (OS) on a VM before disconnecting an RDP session to the VM, the auto-shutdown feature will not work properly. For more information, see [Guide to controlling Windows shutdown behavior](how-to-windows-shutdown.md). + ## Next steps -[Dashboard for labs](use-dashboard.md) +- As an educator, learn about the different [shut-down policies](classroom-labs-concepts.md#automatic-shut-down) available. +- As an educator, see the [dashboard for labs](use-dashboard.md). +- As an admin, [maximize cost control with auto-shutdown settings](cost-management-guide.md#automatic-shutdown-settings-for-cost-control). |
| lab-services | How To Get Started Create Lab Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-get-started-create-lab-within-canvas.md | + + Title: Get started and create an Azure Lab Services lab within Canvas +description: Learn how to get started and create an Azure Lab Services lab within Canvas. + Last updated : 01/21/2022+++# Get started and create an Azure Lab Services lab within Canvas +++This article shows you how to add the Azure Lab Services app to [Canvas](https://www.instructure.com/canvas). It will also show how to create a lab within the Canvas environment. The Azure Lab Services app will be an inherited app in Canvas. ++To use Azure Lab Services in Canvas, two tasks must be completed. The first is to enable the Azure Lab Services app in your school's Canvas instance. The second is to connect the Canvas instance to a lab plan resource in Azure. ++## Prerequisites ++- Canvas administrator permissions. +- Write access to [lab plan](tutorial-setup-lab-plan.md) to be linked to Canvas. ++## Enable Azure Lab Services app in Canvas ++First, let us turn on Azure Lab Services developer key for Canvas. ++1. Select **Admin** page in Canvas. +1. Select **Developer Keys** in the menu bar. +1. When the **Developer Keys** page appears, select **Inherited** view of the developer keys. +1. Change the **Azure Lab Services** entry to **On**. The Azure Lab Services developer key is **170000000000711**. +++### Link lab plans to Canvas ++Now that Azure Lab Services app is enabled in Canvas, we need to link the lab plans to Canvas. Linking lab plans to Canvas must be done by a Canvas administrator. The Canvas administrator must have the following permissions on the lab plan. ++- **Reader** role on the subscription. +- **Contributor** role on the resource group that contains your lab plan. ++Only linked lab plans will be available for Canvas educators to use when creating labs. ++1. [Add Azure Lab Services to a course in Canvas](#add-azure-lab-services-app-to-a-course). Canvas administrator will need to add Azure Lab Services to the course *only* if there are no other courses with Azure Lab Services. If there's already a course with the Azure Lab Services app, navigate to that course in Canvas and skip this step. +2. [Create a lab plan in Azure](./tutorial-setup-lab-plan.md) if you haven't already. +3. Open the Azure Lab Services app in the course. +4. Select the tool icon in the upper right to see the list all the lab plans. +5. Choose which lab plans to link. ++6. Select **Save**. ++If you view the lab plan in the [Azure portal](https://portal.azure.com), the **LMS settings** page will show the lab plan has been successfully linked. ++### Add Azure Lab Services app to an account ++Canvas administrators may choose to enable the Azure Lab Services app for an account. Enabling an app at the account allows educators to enable or disable navigation to the Azure Lab Services app per course. Educators can avoid adding the app for each individual course. ++1. In Canvas, select the **Admin** menu. +1. Select the account that you want to add the Azure Lab Services app to. Alternatively, select **All Accounts** to add the Azure Lab Services app to all accounts for the Canvas LMS instance. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-admin-choose-account.png" alt-text="Screenshot that shows the Admin menu and accounts list in Canvas."::: ++1. Choose **Settings**, then select the **Apps** tab. +1. Select **View App Configurations** button at the top right of the page. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-admin-settings.png" alt-text="Screenshot that shows the App tab of the admin settings page in Canvas."::: ++1. Select the blue **+ App** button at the top right of the page. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-add-app.png" alt-text="Screenshot that shows Add app button in the admin settings page."::: ++1. On the **Add App** dialog, in the **Configuration Type** dropdown, choose **By Client ID**. Enter the Azure Lab Services client ID, which is **170000000000711**, into the **Client ID** field. Select the **Submit** button. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/enable-lab-services.png" alt-text="Screenshot that shows Add by Client ID dialog in Canvas admin settings page."::: ++1. When the **Add App** dialog asks *Tool "Azure Lab Services" found for client ID 170000000000711. Would you like to install it?* select **Install**. ++The Azure Lab Services app will now be available for all courses in that account. The app won't show in course navigation by default. Educators must first enable the app in course navigation before it can be used. ++### Add Azure Lab Services app to a course ++If the Azure Lab Services app has already been [added at the account level](#add-azure-lab-services-app-to-an-account), the educator must enable the app in the course navigation. ++1. In Canvas, go to the course that will use Azure Lab Services. +1. Choose **Settings**, then select the **Navigation** tab. +1. Find the **Azure Lab Services** entry, select the three vertical dots, then select **Enable**. ++ :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-enable-lab-services-app-in-course-navigation.png" alt-text="Screenshot of enabling Lab Services app in course navigation."::: ++1. Select **Save**. ++If the Azure Lab Services app hasn't been added at the account level, use the following instructions to add the app at the course level. ++1. In Canvas, go to the course that will use Azure Lab Services. +1. Choose **Settings**, then select the **Apps** tab. +1. Select **View App Configurations** button at the top right of the page. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-settings-apps.png" alt-text="Screenshot that shows the App tab of the settings page for a course in Canvas."::: ++1. Select the blue **+ App** button at the top right of the page. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/canvas-add-app.png" alt-text="Screenshot that shows Add app button in Canvas."::: ++1. On the **Add App** dialog, in the **Configuration Type** dropdown, choose **By Client ID**. Enter the Azure Lab Services client ID, which is **170000000000711**, into the **Client ID** field. Select the **Submit** button. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/enable-lab-services.png" alt-text="Screenshot that shows Add by Client I D dialog in Canvas."::: ++1. When the **Add App** dialog asks *Tool "Azure Lab Services" found for client ID 170000000000711. Would you like to install it?* select **Install**. +1. The Azure Lab Services app will take a few moments to show in the course navigation list. ++## Create labs in Canvas ++Once Azure Lab Services is added to your course, you'll see **Azure Lab Services** in the course navigation menu. If you're authenticated in Canvas as an educator, you'll see this sign in screen before you can use the service. You'll need to sign in here with an Azure AD account or Microsoft account that has been added as a Lab Creator. + :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/welcome-to-lab-services.png" alt-text="Canvas -> Welcome"::: ++For instructions to create a lab, see [Create a lab](quick-create-lab-portal.md). Make sure to verify the resource group to use before creating the lab. ++> [!IMPORTANT] +> Labs must be created using the Azure Lab Services app in Canvas. Labs created from the Azure Lab Services portal aren't visible from Canvas. ++The student list for the course is automatically synced with the course roster. For more information, see [Manage Lab Services user lists from Canvas](how-to-manage-user-lists-within-canvas.md). A lab VM will also be created for the course educator. ++## Troubleshooting ++This section outlines common error messages that you may see, along with the steps to resolve them. ++- Student sees warning that the lab isn't available yet. ++ In Canvas, you'll see the following message if the educator hasn't published the lab yet. Educators must [publish the lab](tutorial-setup-lab.md#publish-a-lab) and [sync users](how-to-manage-user-lists-within-canvas.md#sync-users) for students to have access to a lab. ++ :::image type="content" source="./media/how-to-get-started-create-labs-within-canvas/troubleshooting-lab-isnt-available-yet.png" alt-text="Troubleshooting -> This lab is not available yet"::: ++- Insufficient permissions to create lab. ++ In Canvas, an educator will see a message indicating that they don't have sufficient permission. Educators should contact their Azure admin so they can be [added as a **Lab Creator**](tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role). ++- Message that there isn't enough capacity to create lab VMs. ++ [Request a limit increase](capacity-limits.md#request-a-limit-increase). ++## Next steps ++See the following articles: ++- [Manage user lists from Canvas](how-to-manage-user-lists-within-canvas.md) +- [Create schedules from Canvas](how-to-create-schedules-within-canvas.md) +- [Access a VM (student view) from Canvas](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | How To Get Started Create Lab Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-get-started-create-lab-within-teams.md | Title: Get started and create an Azure Lab Services lab within Teams description: Learn how to get started and create an Azure Lab Services lab within Teams. Previously updated : 10/08/2020 Last updated : 02/05/2022 # Get started and create a Lab Services lab within Teams This article shows how to add the **Azure Lab Services** app to a Team and then how to create a lab within MS Teams environment. + ## Prerequisites -In this tutorial you set up a lab with virtual machines for your team. To set up a lab in a lab account, you must be a member of one of these roles in the lab account: Owner, Lab Creator, or Contributor. The account you used to create a lab account is automatically added to the owner role. So, you can use the user account that you used to create a lab account to create a lab. +In this tutorial, you set up a lab with virtual machines for your team. To set up a lab, you must be an Owner, Lab Creator, or Contributor on the lab plan. The user account that you used to create a lab plan can create a lab. -Here is the typical workflow when using Azure Lab Services within Teams +Here's the typical workflow when using Azure Lab Services within Teams -1. User [creates a Lab Account](tutorial-setup-lab-account.md#create-a-lab-account) on the Azure portal. -1. A [lab account creator adds other users](tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role) to the **Lab Creator** role. For example, the lab account creator/admin adds educators to the **Lab Creator** role so that they can create labs for their classes. -1. Then, the educators create labs, pre-configures the template VM and publishes the lab to provision VM's to everyone on the team. -1. Once the lab is published, a VM is assigned to everyone on the team membership list on their first login to Azure Lab Services, either by clicking on the tab containing **Azure Lab Services** App within Teams(SSO) or by accessing the [labs website](https://labs.azure.com). Users can then use the VM to do the class work and homework. +1. Create a lab plan in the Azure portal. For information, see [Tutorial: Set up a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). +1. The lab plan owner [adds educators to the Lab Creator role](tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role) so they can create labs for their classes. +1. Then, the educators create labs, pre-configures the template VM and publishes the lab to create VMs to everyone on the team. +1. Once the lab is published, a VM is assigned to everyone on the team membership list on their first sign into Azure Lab Services. Team members select on the tab containing **Azure Lab Services** App within Teams or by accessing the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). Team members can then use the VM to do the class work and homework. > [!IMPORTANT]-> Azure Lab Services can be used within Teams only if the lab accounts are created in the same tenant as Teams. +> Azure Lab Services can be used within Teams only if the lab plans are created in the same tenant as Teams. ## Add Azure Lab Services app as a tab to a Team You, as a Team owner, can add **Azure Lab Services** app directly in your Teams channels, and then the app is available for everyone in the team to use. Follow the below three steps: -1. Navigate to the Teams channel where you want to add the app and select **+** to add a tab. -1. Search for **Azure Lab Services** from the tab options and add this app. +1. Navigate to the Teams channel where you want to add the app and select **+** to add a tab. +1. Search for **Azure Lab Services** from the tab options and add this app. > [!NOTE] > Only Team **Owners** will be able to create labs for the team. - > [!div class="mx-imgBorder"] - > :::image type="content" source="./media/integrate-with-teams/add.png" alt-text="Add a tab"::: -1. Select a Lab Services account, which you would like to use for creating labs in this team. -- Azure Lab Services uses single sign-on into the [Azure Lab Services website](https://labs.azure.com) and pulls all the lab accounts that you have access to. + :::image type="content" source="./media/integrate-with-teams/add.png" alt-text="Screenshot of Add a tab in teams."::: +1. Select a resource group, containing one or more lab plans, that you would like to use for creating labs in this team. - The accounts that are in the same tenant as Teams and for which you have **Owner**, **Contributor**, or **Creator** access are displayed. + Azure Lab Services uses single sign-on into the Lab Services web portal ([https://labs.azure.com](https://labs.azure.com)) and pulls all the lab plans that you have access to. The resource groups with lab plans that are in the same tenant as Teams and for which you have **Owner**, **Contributor**, or **Creator** access are displayed. - > [!div class="mx-imgBorder"] - > :::image type="content" source="./media/integrate-with-teams/welcome.png" alt-text="Welcome to ALS"::: -1. Press **Save** and the tab gets added to the channel. + :::image type="content" source="./media/integrate-with-teams/welcome.png" alt-text="Screenshot of Welcome to Azure Lab Services dialog."::: +1. Press **Save**. The Azure Lab Services tab is added to the channel. - > [!div class="mx-imgBorder"] - > :::image type="content" source="./media/integrate-with-teams/created.png" alt-text="Created the ALS tab"::: + :::image type="content" source="./media/integrate-with-teams/created.png" alt-text="Screenshot of Azure Lab Service home screen. The Azure Lab Services tab is highlighted."::: Now you can select the **Azure Lab Services** tab from your channel and start managing labs as described in the following articles. -After the lab account is selected, Team owners will be able to create labs for the team. The entire lab creation process and all the tasks at the lab level can be performed within Teams. Users will have the option to create multiple labs within the same team and the Team owner, with appropriate access at the lab account level, will see only the labs associated with the specific team. +After the lab plan is selected, Team owners can create labs for the team. The entire lab creation process and all the tasks at the lab level can be performed within Teams. Educators can [create multiple labs](tutorial-setup-lab.md) within Teams at the same team. The Team owner, with appropriate access at the lab plan level, will see only the labs associated with the specific team. ## Next steps -When a lab is created within Teams, the lab user list is automatically populated and synced with the team membership. Everyone on the team, including Owners, Members and Guests will be automatically added to the lab user list. Azure lab Services will maintain a sync with the team membership and an automatic sync is triggered every 24 hours. For details, see: --[Manage Lab Services user lists within Teams](how-to-manage-user-lists-within-teams.md) +When a lab is created within Teams, the lab user list is automatically synced with the team membership. Everyone on the team, including owners, members, and guests will be automatically added to the lab user list. Azure lab Services will maintain a sync with the team membership. An automatic sync is triggered every 24 hours. For more information, see [Manage Lab Services user lists within Teams](how-to-manage-user-lists-within-teams.md) ### See also Also see the following articles: -- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md)-- [Create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md)-- [Access a VM within Teams ΓÇô Student view](how-to-access-vm-for-students-within-teams.md)-- [Delete labs within Teams](how-to-delete-lab-within-teams.md)+- As an educator, [manage the VM pool within Teams](how-to-manage-vm-pool-within-teams.md). +- As an educator, [create and manage schedules within Teams](how-to-create-schedules-within-teams.md). +- As an educator, [manage lab user lists from Teams](how-to-manage-user-lists-within-teams.md). +- As an admin or educator, [delete labs within Teams](how-to-delete-lab-within-teams.md) +- As student, [access a VM within Teams](how-to-access-vm-for-students-within-teams.md) |
| lab-services | How To Manage Classroom Labs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-classroom-labs.md | Title: Manage labs in Azure Lab Services | Microsoft Docs -description: Learn how to create and configure a classroom lab, view all the labs, share the registration link with a lab user, or delete a lab. + Title: Manage labs in Azure Lab Services (deprecated) | Microsoft Docs +description: Learn how to create and configure a lab, view all the labs, share the registration link with a lab user, or delete a lab. (deprecated) Previously updated : 06/26/2020 Last updated : 11/12/2021 -# Manage labs in Azure Lab Services -This article describes how to create and delete a classroom lab. It also shows you how to view all the labs in a lab account. +# Manage labs in Azure Lab Services (deprecated) ++This article describes how to create and delete a lab. It also shows you how to view all the labs in a lab account. ## Prerequisites-To set up a classroom lab in a lab account, you must be a member of the **Lab Creator** role in the lab account. The account you used to create a lab account is automatically added to this role. A lab owner can add other users to the Lab Creator role by using steps in the following article: [Add a user to the Lab Creator role](tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role). --## Create a classroom lab --1. Navigate to [Azure Lab Services website](https://labs.azure.com). -1. Select **Sign in** and enter your credentials. Select or enter a **user ID** that is a member of the **Lab Creator** role in the lab account, and enter password. Azure Lab Services supports organizational accounts and Microsoft accounts. -1. Select **New lab**. - -  -1. In the **New Lab** window, do the following actions: - 1. Specify a **name** for your lab. - 1. Select the **size of the virtual machines** you need for the class. For the list of sizes available, see the [VM Sizes](#vm-sizes) section. - 1. Select the **virtual machine image** that you want to use for the classroom lab. If you select a Linux image, you see an option to **enable remote desktop connection**. For details, see [Enable remote desktop connection for Linux](how-to-enable-remote-desktop-linux.md). -- If you signed in using lab account owner credentials, you will see an option to enable more images for the lab. For more information, see [Enable images at the time of lab creation](specify-marketplace-images.md#enable-images-at-the-time-of-lab-creation). - 1. Review the **total price per hour** displayed on the page. ++To set up a lab in a lab account, you must be a member of the **Lab Creator** role in the lab account. The account you used to create a lab account is automatically added to this role. A lab owner can add other users to the Lab Creator role by using steps in the following article: [Add a user to the Lab Creator role](tutorial-setup-lab-account.md#add-a-user-to-the-lab-creator-role). ++## Create a lab ++1. Navigate to Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). +2. Select **Sign in** and enter your credentials. Select or enter a **user ID** that is a member of the **Lab Creator** role in the lab account, and enter password. Azure Lab Services supports organizational accounts and Microsoft accounts. +3. Select **New lab**. ++  +4. In the **New Lab** window, do the following actions: + 1. Specify a **name** for your lab. + 1. Select the **size of the virtual machines** you need for the class. For the list of sizes available, see the [VM Sizes](#vm-sizes) section. + 1. Select the **virtual machine image** that you want to use for the lab. If you select a Linux image, you see an option to **enable remote desktop connection**. For details, see [Enable remote desktop connection for Linux](how-to-enable-remote-desktop-linux.md). ++ 1. Review the **total price per hour** displayed on the page. 1. Select **Save**. -  +  > [!NOTE]- > You see an option to select a location for your lab if the lab account was configured to [allow lab creator to pick lab location](allow-lab-creator-pick-lab-location.md) option. -4. On the **Virtual machine credentials** page, specify default credentials for all VMs in the lab. + > You see an option to select a location for your lab if the lab account was configured to [allow lab creator to pick lab location](allow-lab-creator-pick-lab-location.md) option. +5. On the **Virtual machine credentials** page, specify default credentials for all VMs in the lab. 1. Specify the **name of the user** for all VMs in the lab.- 2. Specify the **password** for the user. + 2. Specify the **password** for the user. > [!IMPORTANT] > Make a note of user name and password. They won't be shown again.- 3. Disable **Use same password for all virtual machines** option if you want students to set their own passwords. This step is **optional**. + 3. Disable **Use same password for all virtual machines** option if you want students to set their own passwords. This step is **optional**. An educator can choose to use the same password for all the VMs in the lab, or allow students to set passwords for their VMs. By default, this setting is enabled for all Windows and Linux images except for Ubuntu. When you select **Ubuntu** VM, this setting is disabled, so the students will be prompted to set a password when they sign in for the first time. -  - 4. Then, select **Next** on the **Virtual machine credentials** page. -5. On the **Lab policies** page, do the following steps: - 1. Enter the number of hours allotted for each user (**quota for each user**) outside the scheduled time for the lab. +  + 4. Then, select **Next** on the **Virtual machine credentials** page. +6. On the **Lab policies** page, do the following steps: + 1. Enter the number of hours allotted for each user (**quota for each user**) outside the scheduled time for the lab. 2. For the **Auto-shutdown of virtual machines** option, specify whether you want the VM to be automatically shutdown when user disconnects. You can also specify how long the VM should wait for the user to reconnect before automatically shutting down.. For more information, see [Enable automatic shutdown of VMs on disconnect](how-to-enable-shutdown-disconnect.md).- 3. Then, select **Finish**. + 3. Then, select **Finish**. -  - -5. You should see the following screen that shows the status of the template VM creation. The creation of the template in the lab takes up to 20 minutes. +  -  +7. You should see the following screen that shows the status of the template VM creation. The creation of the template in the lab takes up to 20 minutes. ++  8. On the **Template** page, do the following steps: These steps are **optional** for the tutorial. - 1. Connect to the template VM by selecting **Connect**. If it's a Linux template VM, you choose whether you want to connect using SSH or a GUI remote desktop. Additional setup is required to use a GUI remote desktop. See [Enable graphical remote desktop for Linux virtual machines](how-to-use-remote-desktop-linux-student.md) for more information. - 1. Select **Reset password** to reset the password for the VM. - 1. Install and configure software on your template VM. + 1. Start the template VM. + 1. Connect to the template VM by selecting **Connect**. If it's a Linux template VM, you choose whether you want to connect using SSH or a GUI remote desktop. Additional setup is required to use a GUI remote desktop. For more information, see [Enable graphical remote desktop for Linux virtual machines in Azure Lab Services](how-to-enable-remote-desktop-linux.md). + 1. Select **Reset password** to reset the password for the VM. The VM must be running before the reset password button is available. + 1. Install and configure software on your template VM. 1. **Stop** the VM. - 1. Enter a **description** for the template -9. On **Template** page, select **Publish** on the toolbar. -  +9. On **Template** page, select **Publish** on the toolbar. ++  > [!WARNING]- > Once you publish, you can't unpublish. -10. On the **Publish template** page, enter the number of virtual machines you want to create in the lab, and then select **Publish**. + > Once you publish, you can't unpublish. +10. On the **Publish template** page, enter the number of virtual machines you want to create in the lab, and then select **Publish**. ++  +11. You see the **status of publishing** the template on page. This process can take up to an hour. -  -11. You see the **status of publishing** the template on page. This process can take up to an hour. +  +12. Switch to the **Virtual machines pool** page by selecting Virtual machines on the left menu or by selecting Virtual machines tile. Confirm that you see virtual machines that are in **Unassigned** state. These VMs are not assigned to students yet. They should be in **Stopped** state. You can start a student VM, connect to the VM, stop the VM, and delete the VM on this page. You can start them in this page or let your students start the VMs. -  -12. Switch to the **Virtual machines pool** page by selecting Virtual machines on the left menu or by selecting Virtual machines tile. Confirm that you see virtual machines that are in **Unassigned** state. These VMs are not assigned to students yet. They should be in **Stopped** state. You can start a student VM, connect to the VM, stop the VM, and delete the VM on this page. You can start them in this page or let your students start the VMs. +  -  + You do the following tasks on this page (don't do these steps for the tutorial. These steps are for your information only.): - You do the following tasks on this page (don't do these steps for the tutorial. These steps are for your information only.): - 1. To change the lab capacity (number of VMs in the lab), select **Lab capacity** on the toolbar.- 2. To start all the VMs at once, select **Start all** on the toolbar. - 3. To start a specific VM, select the down arrow in the **Status**, and then select **Start**. You can also start a VM by selecting a VM in the first column, and then by selecting **Start** on the toolbar. + 2. To start all the VMs at once, select **Start all** on the toolbar. + 3. To start a specific VM, select the down arrow in the **Status**, and then select **Start**. You can also start a VM by selecting a VM in the first column, and then by selecting **Start** on the toolbar. ### VM sizes -| Size | Cores | RAM | Description | -| - | -- | | -- | -| Small | 2 | 3.5 GB | This size is best suited for command line, opening web browser, low traffic web servers, small to medium databases. | -| Medium | 4 | 7 GB | This size is best suited for relational databases, in-memory caching, and analytics | -| Medium (Nested virtualization) | 4 | 16 GB | This size is best suited for relational databases, in-memory caching, and analytics. This size also supports nested virtualization. <p>This size can be used in scenarios where each student needs multiple VMs. Educators can use nested virtualization to set up a few small-size nested virtual machines inside the virtual machine. </p> | -| Small GPU (Compute) | 6 | 56 GB | <p>This size is best suited for compute-intensive and network-intensive applications like artificial intelligence and deep learning applications.</p><p>Azure Lab Services automatically installs and configures the necessary GPU drivers for you when you create a lab with GPU images. </p> | -| Small GPU (Visualization) | 6 | 56 GB | This size is best suited for remote visualization, streaming, gaming, encoding using frameworks such as OpenGL and DirectX. | -| Large | 8 | 16 GB | This size is best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. | -| Large (Nested virtualization) | 8 | 32 GB | This size is best suited for applications that need faster CPUs, better local disk performance, large databases, large memory caches. This size also supports nested virtualization. | -| Medium GPU (Visualization) | 12 | 112 GB | This size is best suited for remote visualization, streaming, gaming, encoding using frameworks such as OpenGL and DirectX. | +For information on VM sizes and their cost, see the [Azure Pricing Calculator](https://azure.microsoft.com/pricing/calculator/). > [!NOTE]-> You may not see some of these VM sizes in the list when creating a classroom lab. The list is populated based on the current capacity of the lab's location. If the lab account creator [allows lab creators to pick a location for the lab](allow-lab-creator-pick-lab-location.md), you may try choosing a different location for the lab and see if the VM size is available. +> You may not see some of the expected VM sizes in the list when creating a lab. The list is populated based on the current capacity of the lab's location. If the lab account creator [allows lab creators to pick a location for the lab](allow-lab-creator-pick-lab-location.md), you may try choosing a different location for the lab and see if the VM size is available. ## View all labs -1. Navigate to [Azure Lab Services portal](https://labs.azure.com). -1. Select **Sign in**. Select or enter a **user ID** that is a member of the **Lab Creator** role in the lab account, and enter password. Azure Lab Services supports organizational accounts and Microsoft accounts. +1. Navigate to Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). +1. Select **Sign in**. Select or enter a **user ID** that is a member of the **Lab Creator** role in the lab account, and enter password. Azure Lab Services supports organizational accounts and Microsoft accounts. [!INCLUDE [Select a tenant](./includes/multi-tenant-support.md)] 1. Confirm that you see all the labs in the selected lab account. On the lab's tile, you see the number of virtual machines in the lab and the quota for each user (outside the scheduled time). -1. Use the drop-down list at the top to select a different lab account. You see labs in the selected lab account. +1. Use the drop-down list at the top to select a different lab account. You see labs in the selected lab account. -## Delete a classroom lab +## Delete a lab -1. On the tile for the lab, select three dots (...) in the corner, and then select **Delete**. +1. On the tile for the lab, select three dots (...) in the corner, and then select **Delete**. -1. On the **Delete lab** dialog box, select **Delete** to continue with the deletion. +1. On the **Delete lab** dialog box, select **Delete** to continue with the deletion. -## Switch to another classroom lab +## Switch to another lab -To switch to another classroom lab from the current, select the drop-down list of labs in the lab account at the top. +To switch to another lab from the current, select the drop-down list of labs in the lab account at the top.  -You can also create a new lab using the **New lab** in this drop-down list. +You can also create a new lab using the **New lab** in this drop-down list. > [!NOTE]-> You can also use the Az.LabServices PowerShell module (preview) to manage labs. For more information, see the [Az.LabServices home page on GitHub](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Modules/Library). +> You can also use the Az.LabServices PowerShell module (preview) to manage labs. For more information, see the [Az.LabServices home page on GitHub](https://aka.ms/azlabs/samples/PowerShellModule). -To switch to a different lab account, select the drop-down next to the lab account and select the other lab account. +To switch to a different lab account, select the drop-down next to the lab account and select the other lab account. ## Next steps+ See the following articles: - [As a lab owner, set up and publish templates](how-to-create-manage-template.md) - [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)-- [As a lab user, access labs](how-to-use-classroom-lab.md)-+- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | How To Manage Lab Accounts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-lab-accounts.md | Title: Manage lab accounts in Azure Lab Services | Microsoft Docs + Title: Manage lab accounts in Azure Lab Services (deprecated) | Microsoft Docs description: Learn how to create a lab account, view all lab accounts, or delete a lab account in an Azure subscription. Previously updated : 06/26/2020 Last updated : 02/02/2022 -# Create and manage lab accounts -In Azure Lab Services, a lab account is a container for managed lab types such as labs. An administrator sets up a lab account with Azure Lab Services and provides access to lab owners who can create labs in the account. This article describes how to create a lab account, view all lab accounts, or delete a lab account. +# Create and manage lab accounts (deprecated) ++In Azure Lab Services, a lab account is a container for labs. An administrator creates a lab account with Azure Lab Services and provides access to lab owners who can create labs in the account. This article describes how to create a lab account, view all lab accounts, and delete a lab account. ## Create a lab account-The following steps illustrate how to use the Azure portal to create a lab account with Azure Lab Services. -1. Sign in to the [Azure portal](https://portal.azure.com). -2. Select **All Services** on the left menu. Select **Lab Accounts** in the **DevOps** section. If you select star (`*`) next to **Lab Accounts**, it's added to the **FAVORITES** section on the left menu. From the next time onwards, you select **Lab Accounts** under **FAVORITES**. +The following steps illustrate how to use the Azure portal to create a lab account with Azure Lab Services. -  -3. On the **Lab Accounts** page, select **Add** on the toolbar or **Create lab account** on the page. +1. Sign in to the [Azure portal](https://portal.azure.com). +1. Select **All services** on the left menu. Select the **DevOps** category. Select the **Lab accounts** tile. -  -4. On the **Basics** tab of the **Create a lab account** page, do the following actions: - 1. For **Lab account name**, enter a name. - 2. Select the **Azure subscription** in which you want to create the lab account. - 3. For **Resource group**, select **Create new**, and enter a name for the resource group. - 4. For **Location**, select a location/region in which you want the lab account to be created. - 5. For the **Allow lab creator to pick lab location** field, specify whether you want lab creators to be able to select a location for the lab. By default, the option is disabled. When it's disabled, lab creators can't specify a location for the lab they are creating. The labs are created in the closest geographical location to lab account. When it's enabled, a lab creator can select a location at the time of creating a lab. For more information, see [Allow lab creator to pick location for the lab](allow-lab-creator-pick-lab-location.md). + :::image type="content" source="./media/how-to-manage-lab-accounts/select-lab-accounts.png" alt-text="Screenshot of All services page in the Azure portal. The Dev Ops category and DevTest Labs items are highlighted."::: -  -5. Select **Next: Advanced** at the bottom of the page to navigate to the **Advanced** tab, and then do the following steps: - 1. Select an existing **shared image gallery** or create one. You can save the template VM in the shared image gallery for it to be reused by others. For detailed information on shared image galleries, see [Use a shared image gallery in Azure Lab Services](how-to-use-shared-image-gallery.md). - 2. Specify whether you want to **automatically shut down Windows virtual machines** when users disconnect from them. Specify how long the virtual machines should wait for the user to reconnect before automatically shutting down. - 3. For **Peer virtual network**, select a peer virtual network (VNet) for the lab network. Labs created in this account are connected to the selected VNet and have access to the resources in the selected VNet. For more information, see [Connect your lab's virtual network with a peer virtual network](how-to-connect-peer-virtual-network.md). - 8. Specify an **address range** for VMs in the lab. The address range should be in the classless inter-domain routing (CIDR) notation (example: 10.20.0.0/23). Virtual machines in the lab will be created in this address range. For more information, see [Specify an address range for VMs in the lab](how-to-connect-peer-virtual-network.md#specify-an-address-range-for-vms-in-the-lab-account) +1. On the **Lab Accounts** page, select **Create** on the toolbar or **Create lab account** on the page. - > [!NOTE] - > The **address range** property applies only if a **peer virtual network** is enabled for the lab. + :::image type="content" source="./media/how-to-manage-lab-accounts/create-lab-account-button.png" alt-text="Screenshot of lab account resources in the Azure portal. The Create button and Create lab account buttons are highlighted."::: -  -6. Select **Next: Tags** at the bottom of the page to switch to the **Tags** tab. Add any tags you want to associate with the lab account. Tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups. For more information, see [Use tags to organize your Azure resources](../azure-resource-manager/management/tag-resources.md). +1. On the **Basics** tab of the **Create a lab account** page, do the following actions: + 1. Select the **Azure subscription** in which you want to create the lab account. + 1. For **Resource group**, select **Create new**, and enter a name for the resource group. + 1. For **Lab account name**, enter a name. + 1. For **Location**, select a location/region in which you want the lab account to be created. -  -7. Select **Review + create** at the bottom of this page to switch to the **Review + create** tab. -4. Review the summary information on this page, and select **Create**. + :::image type="content" source="./media/how-to-manage-lab-accounts/create-lab-account-basics.png" alt-text="Screenshot of the Basics tab in Create lab account wizard."::: +1. Select **Next: Tags**. +1. On the Tags tab, add any tags you want to associate with the lab account. Tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups. For more information, see [Use tags to organize your Azure resources](../azure-resource-manager/management/tag-resources.md). -  -5. Wait until the deployment is complete, expand **Next steps**, and select **Go to resource** as shown in the following image: + :::image type="content" source="./media/how-to-manage-lab-accounts/create-lab-account-tags.png" alt-text="Screenshot that shows the Tags tab of the Create lab account wizard."::: +1. Select **Next: Review + create**. +1. Wait for validation to pass. Review the summary information on the **Review + create** page, and select **Create**. - You can also select the **bell icon** on the toolbar (**Notifications**), confirm that the deployment succeeded, and then select **Go to resource**. + :::image type="content" source="./media/how-to-manage-lab-accounts/create-lab-account-review-create.png" alt-text="Screenshot that shows the Review and create tab of the Create lab account wizard"::: +1. Wait until the deployment is complete, expand **Next steps**, and select **Go to resource**. - Alternatively, select **Refresh** on the **Lab Accounts** page, and select the lab account you created. + You can also select the **bell icon** on the toolbar (**Notifications**), confirm that the deployment succeeded, and then select **Go to resource**. -  -6. You see the following **lab account** page: + :::image type="content" source="./media/how-to-manage-lab-accounts/go-to-lab-account.png" alt-text="Screenshot that shows the deploy resource page for the lab account. The Go to resource button is highlighted."::: +1. You'll see the **Overview** page for the lab account. -  + :::image type="content" source="./media/how-to-manage-lab-accounts/lab-account-overview.png" alt-text="Screenshot that shows overview page of a lab account."::: ## View lab accounts-1. Sign in to the [Azure portal](https://portal.azure.com). -2. Select **All resources** from the menu. -3. Select **Lab Accounts** for the **type**. - You can also filter by subscription, resource group, locations, and tags. -  +1. Sign in to the [Azure portal](https://portal.azure.com). +2. Select **All resources** from the menu. +3. Select **Lab Accounts** for the **type**. + You can also filter by subscription, resource group, locations, and tags. + :::image type="content" source="./media/how-to-manage-lab-accounts/all-resources-lab-accounts.png" alt-text="Screenshot that shows All resources page in the Azure portal. The resource type filter is highlighted and set to show resources of type lab accounts."::: ## Delete a lab account-Follow instructions from the previous section that displays lab accounts in a list. Use the following instructions to delete a lab account: -1. Select the **lab account** that you want to delete. -2. Select **Delete** from the toolbar. +Follow instructions from the previous section that displays lab accounts in a list. Use the following instructions to delete a lab account: ++1. Select the **lab account** that you want to delete. +1. Select **Delete** from the toolbar. ++ :::image type="content" source="./media/how-to-manage-lab-accounts/delete-button.png" alt-text="Screenshot that shows All resources page in the Azure portal with resources filtered to list lab accounts. The delete button on the toolbar is highlighted."::: +1. Type **yes** for confirmation. +1. Select **Delete**. ++ :::image type="content" source="./media/how-to-manage-lab-accounts/delete-lab-account-confirmation.png" alt-text="Screenshot that shows delete confirmation page."::: -  -1. Type **Yes** for confirmation. -1. Select **Delete**. +## Automatic shutdown settings -  +Automatic shutdown features enable you to prevent wasted VM usage hours in the labs. The following settings catch most of the cases where users accidentally leave their virtual machines running: +++You can configure these settings at both the lab account level and the lab level. If you enable them at the lab account level, they're applied to all labs within the lab account. For all new lab accounts, these settings are turned on by default. ++### Automatically disconnect users from virtual machines that the OS deems idle > [!NOTE]-> You can also use the Az.LabServices PowerShell module (preview) to manage lab accounts. For more information, see the [Az.LabServices home page on GitHub](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Modules/Library). +> This setting is available only for Windows virtual machines. ++When the **Disconnect users when virtual machines are idle** setting is turned on, the user is disconnected from any machines in the lab when the Windows OS deems the session to be idle (including the template virtual machines). The [Windows OS definition of idle](/windows/win32/taskschd/task-idle-conditions#detecting-the-idle-state) uses two criteria: ++- User absence: no keyboard or mouse input. +- Lack of resource consumption: All the processors and all the disks were idle for a certain percentage of time. ++Users will see a message like this in the VM before they're disconnected: +++The virtual machine is still running when the user is disconnected. If the user reconnects to the virtual machine by signing in, windows or files that were open or work that was unsaved before the disconnect will still be there. In this state, because the virtual machine is running, it still counts as active and accrues cost. ++To automatically shut down idle Windows virtual machines that are disconnected, use the combination of **Disconnect users when virtual machines are idle** and **Shut down virtual machines when users disconnect** settings. ++For example, if you configure the settings as follows: ++- **Disconnect users when virtual machines are idle**: 15 minutes after the idle state is detected. +- **Shut down virtual machines when users disconnect**: 5 minutes after the user disconnects. ++The Windows virtual machines will automatically shut down 20 minutes after the user stops using them. +++### Automatically shut down virtual machines when users disconnect ++The **Shut down virtual machines when users disconnect** setting supports both Windows and Linux virtual machines. When this setting is on, automatic shutdown will occur when: ++- The Remote Desktop (RDP) connection is disconnected for Windows or Linux VMs. +- The Secure Shell (SSH) connection is disconnected for a Linux VM. ++> [!IMPORTANT] +> Only [specific distributions and versions of Linux](../virtual-machines/extensions/diagnostics-linux.md#supported-linux-distributions) are supported. Shutdown settings are not supported by the [Data Science Virtual Machine - Ubuntu 18.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) image. ++You can specify how long the virtual machines should wait for the user to reconnect before automatically shutting down. ++### Automatically shut down virtual machines that are started but users don't connect ++In a lab, a user might start a virtual machine but never connect to it. For example: ++- A schedule in the lab starts all virtual machines for a class session, but some students don't show up and don't connect to their machines. +- A user starts a virtual machine but forgets to connect. ++The **Shut down virtual machines when users do not connect** setting will catch these cases and automatically shut down the virtual machines. ## Next steps-See other articles in the **How-to guides** -> **Create and configure lab accounts (lab account owner)** section of the table-of-content (TOC). ++- As an admin, [configure automatic shutdown settings for a lab account](how-to-configure-lab-accounts.md). +- As an admin, use the [Az.LabServices PowerShell module (preview)](https://aka.ms/azlabs/samples/PowerShellModule) to manage lab accounts. +- As an educator, [configure automatic shutdown settings for a lab](how-to-enable-shutdown-disconnect.md). |
| lab-services | How To Manage Lab Plans | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-lab-plans.md | + + Title: Manage lab plans in Azure Lab Services | Microsoft Docs +description: Learn how to create a lab plan, view all lab plans, or delete a lab plan in an Azure subscription. + Last updated : 10/26/2021+++# Create and manage lab plans +++In Azure Lab Services, a lab plan is a container for managed lab types such as labs. An administrator sets up a lab plan with Azure Lab Services and provides access to lab owners who can create labs in the plan. This article describes how to create a lab plan, view all lab plans, or delete a lab plan. ++## Create a lab plan ++To create a lab plan, see [Tutorial: Set up a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). ++## View lab plans ++1. Sign in to the [Azure portal](https://portal.azure.com). +2. Select **All resources** from the menu. +3. Select **Lab Plans** for the type. You can also filter by subscription, resource group, locations, and tags. ++ :::image type="content" source="./media/how-to-manage-lab-plans/all-resources-lab-plans.png" alt-text="All resources -> Lab Plans"::: ++## Delete a lab plan ++Follow instructions from the previous section that displays lab plans in a list. Use the following instructions to delete a lab plan: ++1. Select the **lab plan** that you want to delete. +1. Select **Delete** from the toolbar. ++ :::image type="content" source="./media/how-to-manage-lab-plans/delete-button.png" alt-text="Lab Plans -> Delete button"::: +1. Type **Yes** for confirmation. +1. Select **Delete**. ++ :::image type="content" source="./media/how-to-manage-lab-plans/delete-lab-plan-confirmation.png" alt-text="Delete lab plan - confirmation"::: ++> [!NOTE] +> Deleting a lab plan will not delete any labs created from that lab plan. ++## Next steps ++See other articles in the **How-to guides** -> **Create and configure lab plans** section of the table-of-content (TOC). |
| lab-services | How To Manage Labs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-labs.md | + + Title: Manage labs in Azure Lab Services | Microsoft Docs +description: Learn how to create a lab, configure a lab, view all the labs, or delete a lab. + Last updated : 01/21/2022+++# Manage labs in Azure Lab Services ++This article describes how to create and delete labs. It also shows you how to view all the labs in a lab plan. ++## Prerequisites ++- One or more labs. To create a lab, see [Tutorial: Create a lab](tutorial-setup-lab.md). +- Permission to edit the lab. To give educators permission to add and creation labs, see [Add a user to the Lab Creator role](tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role). For more role options, see [Lab Services built-in roles](administrator-guide.md#rbac-roles). ++## View all labs ++1. Navigate to Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). +1. Select **Sign in**. Select or enter a **user ID** that is a member of the **Lab Creator** role in the lab plan, and enter password. Azure Lab Services supports organizational accounts and Microsoft accounts. ++ [!INCLUDE [Select a tenant](./includes/multi-tenant-support.md)] +1. Confirm that you see all the labs in the selected resource group. On the lab's tile, you see the number of virtual machines in the lab and the quota for each user. ++  +1. Use the drop-down list at the top to select a different lab plan. You see labs in the selected lab plan. ++## Delete a lab ++1. On the tile for the lab, select three dots (...) in the corner, and then select **Delete**. ++  +1. On the **Delete lab** dialog box, select **Delete** to continue with the deletion. ++## Switch to another lab ++To switch to another lab from the current, select the drop-down list of labs at the top. ++ ++To switch to a different group, select the left drop-down and choose the lab plan's resource group. To switch to a different lab account, select the left drop-down and choose the lab account name. The Azure Lab Services portal organizes labs by lab plan's resource group/lab account, then by lab name. ++## Next steps ++See the following articles: ++- [As a lab owner, set up and publish templates](how-to-create-manage-template.md) +- [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md) +- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | How To Manage User Lists Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-user-lists-within-canvas.md | + + Title: Manage Azure Lab Services user lists from Canvas +description: Learn how to manage Azure Lab Services user lists from Canvas. + Last updated : 01/22/2022+++# Manage Lab Services user lists from Canvas +++When a [lab is created within Canvas](how-to-get-started-create-lab-within-canvas.md), the lab user list is automatically populated and synced with the course membership. An automatic sync is triggered every 24 hours. Educators can also manually sync the user list when needed. ++## Sync users ++Educators can use the **Sync** button to trigger a manual sync once the course membership is updated. +++Once the automatic or manual sync is complete, adjustments are made to the lab depending on whether the lab has been [published](tutorial-setup-lab.md#publish-a-lab) or not. ++If the lab has *not* been published at least once: ++- Users will be added or deleted from the lab user list as per changes to the course membership. ++If the lab has been published at least once: ++- Users will be added or deleted from the lab user list as per changes to the course membership. +- New VMs will be created if there are any new students added to the course. +- VM will be deleted if any student has been deleted from the course. +- Lab capacity will be automatically updated as needed. ++## Next steps ++Users will be automatically registered to the lab and VMs will be assigned to them on their first login to Azure Lab Services. That is, when they first access the tab having **Azure Lab Services** app. ++To manage VM pools, see [Manage a VM pool in Lab Services from Canvas](how-to-manage-vm-pool-within-canvas.md). ++### Also review ++See the following articles: ++- [Use Azure Lab Services within Canvas overview](lab-services-within-canvas-overview.md) +- [Get started and create a Lab Services lab from Canvas](how-to-get-started-create-lab-within-canvas.md) +- [Create Lab Services schedules from Canvas](how-to-create-schedules-within-canvas.md) +- [Access a VM (student view) in Lab Services from Canvas](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | How To Manage User Lists Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-user-lists-within-teams.md | Title: Manage Azure Lab Services user lists from Teams description: Learn how to manage Azure Lab Services user lists from Teams. Previously updated : 10/07/2020 Last updated : 01/04/2022 # Manage Lab Services user lists from Teams -When a lab is created within Teams (see [Get started and create a Lab Services lab from Teams](how-to-get-started-create-lab-within-teams.md)), the lab user list is automatically populated and synced with the team membership. Everyone on the team, including Owners, Members, and Guests will be automatically added to the lab user list. Azure lab Services maintains a sync with the team membership and an automatic sync is triggered every 24 hours. +When a lab is [created within Teams](how-to-get-started-create-lab-within-teams.md), the user list is automatically synced with the team membership. Everyone on the team, including owners, members, and guests will be automatically added to the lab user list. Azure lab Services maintains a sync with the team membership and an automatic sync is triggered every 24 hours. ## Sync users -Educators can use the **Sync** button to trigger a manual sync once the team membership is updated. +Educators can use the **Sync** button to trigger a manual sync once the team membership is updated. -> [!div class="mx-imgBorder"] -> :::image type="content" source="./media/how-to-manage-users-with-teams/sync-users.png" alt-text="Sync users"::: -Once the automatic or manual sync is complete the following is true depending on whether the lab has been published. +Users are added or deleted from the lab user list as per changes to the team membership when the sync operation has completed. -* If the lab has not been published at least once: - * Users will be added or deleted from the lab user list as per changes to the team membership. -* If the lab has been published at least once, in addition to adding or deleting users, the lab capacity will be automatically updated. - * If there are any new additions to the team, new VMs will be created. - * If any user has been deleted from the team, the associated VM will be deleted as well. +If the lab has been published, the lab capacity will be automatically updated. -## Next steps --Once the template VM is configured and when the educator selects to publish the template, number of VMs equivalent to the number of users in the labΓÇÖs user list will be created. Once the lab is published and VMs are created, Users will be automatically registered to the lab and VMs will be assigned to them on their first login to Azure Lab Services that is, when they first access the tab having **Azure Lab Services** App. --To publish the template VM, go to the Teams Lab Services window, select **Template** tab -> **...** -> **Publish**. +- If there are any new additions to the team, new VMs will be created. +- If any user has been deleted from the team, the associated VM will be deleted as well. -To manage VM pools, see [Manage a VM pool in Lab Services from Teams](how-to-manage-vm-pool-within-teams.md). --### Also review --See the following articles: +## Next steps -- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Get started and create a Lab Services lab from Teams](how-to-get-started-create-lab-within-teams.md)-- [Create Lab Services schedules from Teams](how-to-create-schedules-within-teams.md)-- [Access a VM (student view) in Lab Services from Teams](how-to-access-vm-for-students-within-teams.md)+To [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm), go to the Teams Lab Services window, select **Template** tab -> **...** -> **Publish**. +- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md). +- As an educator, [manage VM pool within Teams](how-to-manage-vm-pool-within-teams.md). +- As an educator, [create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md). +- As an admin and educator, [delete labs within Teams](how-to-delete-lab-within-teams.md) +- As student, [access a VM within Teams](how-to-access-vm-for-students-within-teams.md) |
| lab-services | How To Manage Vm Pool Within Canvas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-vm-pool-within-canvas.md | + + Title: Manage a VM pool in Azure Lab Services from Canvas +description: Learn how to manage a VM pool in Azure Lab Services from Canvas. + Last updated : 01/21/2022+++# Manage a VM pool in Lab Services from Canvas +++Virtual machine (VM) creation starts as soon as the lab is published. VMs equaling the number of students in the course list will be created. ++## Update VM pool ++Azure Lab Services periodically syncs the users from the Canvas course. After the sync operation completes, VMs will be created or removed to match the Canvas course roster. Educators can manually [sync users](how-to-manage-user-lists-within-canvas.md#sync-users) to cause the VM pool to be updated. ++## Access VMs ++Educators can access student VMs directly from the **Virtual machine pool** tab. For more information, see [Manage a VM pool in Azure Lab Services](how-to-manage-vm-pool.md) +++As part of the publish process, Canvas educators are assigned their own lab VMs. The VM can be accessed by clicking on the **My Virtual Machines** button (top/right corner of the screen). +++## Next steps ++See the following articles: ++- [Use Azure Lab Services within Canvas overview](lab-services-within-canvas-overview.md) +- [Get started and create a Lab Services lab from Canvas](how-to-get-started-create-lab-within-canvas.md) +- [Manage Lab Services user lists from Canvas](how-to-manage-user-lists-within-canvas.md) +- [Create Lab Services schedules from Canvas](how-to-create-schedules-within-canvas.md) +- [Access a VM (student view) in Lab Services from Canvas](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | How To Manage Vm Pool Within Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-vm-pool-within-teams.md | Title: Manage a VM pool in Azure Lab Services from Teams description: Learn how to manage a VM pool in Azure Lab Services from Teams. Previously updated : 10/07/2020 Last updated : 04/25/2022+ # Manage a VM pool in Lab Services from Teams -Virtual Machine (VM) creation starts as soon as the template VM is first published. VMs equaling the number of users in the lab user list will be created. VMs are automatically assigned to students upon their first login to Azure Lab Services. +Virtual Machine (VM) creation starts as soon as the template VM is first published. VMs equaling the number of users in the lab user list will be created. VMs are automatically assigned to students when they first access the Azure Lab Services lab. ## Publish a template and manage a VM pool -To publish the template, go to the Teams Lab Services window, select **Template** tab -> **...** -> **Publish**. +To publish the template, go to the Teams Lab Services window, select **Template** tab > **...** > **Publish**. -Once the template VM is configured and when the educator selects to publish the template, number of VMs equivalent to the number of users in the labΓÇÖs user list will be created. Once the lab is published and VMs are created, Users will be automatically registered to the lab and VMs will be assigned to them on their first login to Azure Lab Services that is, when they first access the tab having **Azure Lab Services** App. +Once the lab is published and VMs are created, users will be automatically registered to the lab. Lab VMs will be assigned to users the first time they first access the tab having **Azure Lab Services** App. -When a user list sync is triggered, Lab Capacity (number of VMs in the lab) will be automatically updated based on the changes to the team membership. New VMs will be created as new users are added and VMs assigned to the users removed from the team will be deleted as well. For more information see [How to manage users within Teams](how-to-manage-user-lists-within-teams.md). +Team membership and lab user list are kept in sync. The lab capacity (number of VMs in the lab) will be automatically updated based on the changes to the team membership. New VMs will be created as new users are added to the team. VMs assigned to the users removed from the team will be deleted. For more information, see [How to manage users within Teams](how-to-manage-user-lists-within-teams.md). -Educators can continue to access student VMs directly from the VM Pool tab. And educators can access VMs assigned to themselves either from the **Virtual machine pool** tab or by clicking on the **My Virtual Machines** button (top/right corner of the screen). +Educators can continue to access student VMs directly from the VM Pool tab. And educators can access VMs assigned to themselves either from the **Virtual machine pool** tab or by clicking on the **My Virtual Machines** button (top-right corner of the screen). > [!div class="mx-imgBorder"]-> :::image type="content" source="./media/how-to-manage-vm-pool-with-teams/vm-pool.png" alt-text="VM pool"::: +> :::image type="content" source="./media/how-to-manage-vm-pool-with-teams/vm-pool.png" alt-text="Screenshot of the VM pool."::: ## Next steps See the following articles: -- [Use Azure Lab Services within Teams overview](lab-services-within-teams-overview.md)-- [Get started and create a Lab Services lab from Teams](how-to-get-started-create-lab-within-teams.md)-- [Manage Lab Services user lists from Teams](how-to-manage-user-lists-within-teams.md)-- [Create Lab Services schedules from Teams](how-to-create-schedules-within-teams.md)-- [Access a VM (student view) in Lab Services from Teams](how-to-access-vm-for-students-within-teams.md)--+- As an educator, [Get started and create a Lab Services lab within Teams](how-to-get-started-create-lab-within-teams.md). +- As an educator, [create and manage schedules within Teams](how-to-create-schedules-within-teams.md). +- As an educator, [manage lab user lists from Teams](how-to-manage-user-lists-within-teams.md). +- As an admin or educator, [delete labs within Teams](how-to-delete-lab-within-teams.md) +- As student, [access a VM within Teams](how-to-access-vm-for-students-within-teams.md) |
| lab-services | How To Manage Vm Pool | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-manage-vm-pool.md | + + Title: Manage a VM pool in Azure Lab Services +description: Learn how to manage a VM pool in Azure Lab Services + Last updated : 01/21/2022+++# Manage a VM pool in Lab Services ++The **Virtual machine pool** page of a lab allows educators to set how many VMs are available for use and manage the state of those VMs. ++- Start and stop all the VMs at once. +- Start and stop specific VMs. +- Reset a VM. +- Connect to a student's VM. +- Change the lab capacity. ++VMs can be in one of a few states. ++- **Unassigned**. These VMs aren't assigned to students yet. These VMs won't be started when a schedule runs. +- **Stopped**. VM is turned off and not available for use. +- **Starting**. VM is starting. It's not yet available for use. +- **Running**. VM is running and available for use. +- **Stopping**. VM is stopping and not available for use. ++> [!WARNING] +> Turning on a student VM will not affect the quota for the student. Make sure to stop all VMs manually or using a [schedule](how-to-create-schedules.md) to avoid unexpected costs. ++## Manually starting VMs ++You can start all VMs in a lab by selecting the **Start all** button at the top of the page. +++Individual VMs can be started by clicking the state toggle. The toggle will read **Starting** as the VM starts up, and then **Running** once the VM has started. You can also select multiple VMs using the checks to the left of the **Name** column. Once the VMs are checked, select the **Start** button at the top of the screen. ++## Manually stopping VMs ++You can select the **Stop all** button to stop all of the VMs. +++Individual VMs can be stopped by clicking the state toggle. The toggle will read **Stopping** as the VM shuts down, and then **Stopped** once the VM has shutdown. You can also select multiple VMs using the checks to the left of the **Name** column. Once the VMs are checked, select the **Stop** button at the top of the screen. ++## Reset VMs ++To reset one or more VMs, select them in the list, and then select **Reset** on the toolbar. +++On the **Reset virtual machine(s)** dialog box, select **Reset**. +++### Redeploy VMs ++In the [April 2022 Update (preview)](lab-services-whats-new.md), redeploying VMs replaces the previous reset VM behavior. In the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com), the command is named **Troubleshoot** and is available in the student's view of their VMs. ++If students are facing difficulties accessing their VM, redeploying the VM may provide a resolution for the issue. Redeploying, unlike resetting, doesn't cause the data on the OS to be lost. When you [redeploy a VM](/troubleshoot/azure/virtual-machines/redeploy-to-new-node-windows), Azure Lab Services will shut down the VM, move it to a new host, and restart it. You can think of it as a refresh of the underlying VM for the studentΓÇÖs machine. The student doesnΓÇÖt need to re-register to the lab or do any other action. Any data you saved in the OS disk (usually C: drive) of the VM will still be available after the redeploy operation. Anything saved on the temporary disk (usually D: drive) will be lost. +++## Connect to VMs ++Educators can connect to a student VM as long as it's turned on. Verify the student *isn't* connected to the VM first. By connecting to the VM, you can access local files on the VM and help students troubleshoot issues. ++To connect to the student VM, hover the mouse on the VM in the list and select the **Connect** button. For further instructions based on the operating system you're using, see [Connect to a lab VM](connect-virtual-machine.md). ++## Set lab capacity ++To change the lab capacity (number of VMs in the lab), select **Lab capacity** on the toolbar and update number of VMs on the **Lab capacity** window on the right. +++If using [Teams](how-to-manage-vm-pool-within-teams.md) or [Canvas](how-to-manage-vm-pool-within-canvas.md) integration, lab capacity will automatically be updated when Azure Lab Services syncs the user list. ++## Export list of VMs ++1. Switch to the **Virtual machine pool** tab. +2. Select **...** (ellipsis) on the toolbar and then select **Export CSV**. ++ :::image type="content" source="./media/how-to-manage-vm-pool/virtual-machines-export-csv.png" alt-text="Screenshot of virtual machine pool page in Azure Lab Services. The Export CSV menu item is highlighted."::: ++## Next steps ++See the following articles: ++- [As a lab owner, set up and publish templates](how-to-create-manage-template.md) +- [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md) +- [As a lab user, access labs](how-to-use-lab.md) |
| lab-services | How To Set Virtual Machine Passwords Student | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-set-virtual-machine-passwords-student.md | Title: Reset passwords for classroom lab VMs in Azure Lab Services | Microsoft Docs + Title: Reset passwords for lab VMs in Azure Lab Services | Microsoft Docs description: Learn how to reset passwords for virtual machines (VMs) in labs of Azure Lab Services. Last updated 06/26/2020 # Set or reset password for virtual machines in labs (students)-This article shows you how students can set/reset password for their VMs. ++This article shows you how students can set/reset password for their VMs. ## Enable resetting of passwords-At the time of creating the lab, the lab owner can enable or disable the **Use same password for all virtual machines**. If this option was enabled, students can't reset password. All the VMs in the labs will have the same password that's set by the instructor. -If this option is disabled, users will have to set a password when trying to connect to the VM for the first time. Students can also reset the password later at any time as shown in the last section of this article. +At the time of creating the lab, the lab owner can enable or disable the **Use same password for all virtual machines**. If this option was enabled, students can't reset password. All the VMs in the labs will have the same password that's set by the educator. ++If this option is disabled, users will have to set a password when trying to connect to the VM for the first time. Students can also reset the password later at any time as shown in the last section of this article. ## Reset password for the first time-If the **Use same password for all virtual machines** option was disabled, when users (students) select the **Connect** button on the lab tile on the **My virtual machines** page, the user sees the following dialog box to set the password for the VM: ++If the **Use same password for all virtual machines** option was disabled, when users (students) select the **Connect** button on the lab tile on the **My virtual machines** page, the user sees the following dialog box to set the password for the VM:  ## Reset password later-Student also can set the password by clicking the overflow menu (**vertical three dots**) on the lab tile, and selecting **Reset password**. - +Student also can set the password by clicking the overflow menu (**vertical three dots**) on the lab tile, and selecting **Reset password**. + ## Next steps+ To learn about other student usage options that a lab owner can configure, see the following article: [Configure student usage](how-to-configure-student-usage.md). |
| lab-services | How To Set Virtual Machine Passwords | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-set-virtual-machine-passwords.md | -# Set up and manage virtual machine pool -This article shows you how to do the following tasks: +# Set or reset virtual machine passwords -- Increase the number of virtual machines (VMs) in the lab-- Start all VMs or selected VMs -- Reset VMs+A lab owner (educator) sets the password for VMs at the time of creating the lab or after creating the lab on the **Template** page. -## Update the lab capacity -To increase or decrease the lab capacity (number of virtual machines in a lab), do the following steps: +## Set password at the time of lab creation -1. On the **Virtual machine pool** page, select **Lab capacity: <number> machines**. -2. Enter the new **number of VMs** you want in the lab. This number must be greater than or equal to the number of users registered in the lab. -3. Then, select **Save**. --  -4. If you increased the capacity, you can see the VM or VMs being created. If you don't see the new VM in the list, refresh the page. --  --## Start VMs --### Start ot stop all VMs -1. Switch to the **Virtual machine pool** page. -2. Select **Start all** from the toolbar. --  -3. After all the VMs are started, you can stop all VMs by selecting the **Stop all** button on the toolbar. --  --### Start selected VMs -There are two ways to start selected VMs (one or more). First way is to select the VM or VMs in the list, and then select **Start** on the toolbar. --The second way is to select one or more VMs in the list, and toggle the button in the **State** column. -- --Similarly, you can stop one or more VMs by toggling the button in the **State** column or selecting **Stop** on the toolbar. --> [!NOTE] -> When an educator turns on a student VM, quota for the student isn't affected. Quota for a user specifies the number of lab hours available to the user outside of the scheduled class time. For more information on quotas, see [Set quotas for users](how-to-configure-student-usage.md?#set-quotas-for-users). --## Reset VMs --To reset one or more VMs, select them in the list, and then select **Reset** on the toolbar. -- --On the **Reset virtual machine(s)** dialog box, select **Reset**. -- --## Set password for VMs -A lab owner (educator) can set/reset the password for VMs at the time of creating the lab (lab creation wizard) or after creating the lab on the **Template** page. --### Set password at the time of lab creation A lab owner (educator) can set a password for VMs in the lab on the **Virtual machine credentials** page of the lab creation wizard. - -By enabling/disabling the **Use same password for all virtual machines** option on this page, an educator can choose to use same password for all VMs in the lab or allow students to set passwords for their VMs. By default, this setting is enabled for all Windows and Linux operating system images except Ubuntu. When this setting is disabled, students will be prompted to set a password when they try to connect to the VM for the first time. +By enabling the **Use same password for all virtual machines** option on this page, an educator chooses to use the same password for all VMs in the lab. Disabling the **Use same password for all virtual machines** option makes the students set a password for their VMs before logging in for the first time. By default, labs use the same password for all VMs. (Ubuntu doesn't support use of the same password for all VMs.) -### Reset password later +## Reset password later -1. On the **Template** page of the lab, select **Reset password** on the toolbar. +1. On the **Template** page of the lab, select **Start template** on the toolbar. +1. Once the template machine has fully started, select **Reset password** on the toolbar. 1. On the **Reset password** dialog box, enter a password, and select **Reset password**.- -  --## Connect to student VMs -The lab creator (educator) can connect to a student VM if the following conditions are met: -- The **Use same password for all virtual machines** option was selected when creating the lab-- The VM is running -- To connect to the student VM, hover the mouse on the VM in the list and select the computer button. -- +  > [!NOTE]-> When the educator starts the VM and connects to it, the student quota is unaffected. --## Export list of virtual machines to a CSV file --1. Switch to the **Virtual machine pool** tab. -2. Select **...** (ellipsis) on the toolbar and then select **Export CSV**. --  +> Reset password option is not available for labs created without a template using the [April 2022 Updates (preview)](lab-services-whats-new.md). ## Next steps+ To learn about other student usage options you (as a lab owner) can configure, see the following article: [Configure student usage](how-to-configure-student-usage.md). -To learn about how students can reset passwords for their VMs, see [Set or reset password for virtual machines in labs (students)](how-to-set-virtual-machine-passwords-student.md). +To learn about how students can reset passwords for their VMs, see [Set or reset password for virtual machines in labs (students)](how-to-set-virtual-machine-passwords-student.md). |
| lab-services | How To Setup Lab Gpu | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-setup-lab-gpu.md | This article shows you how to do the following tasks: - Ensure that the appropriate GPU drivers are installed. ## Choose between visualization and compute GPU sizes+ On the first page of the lab creation wizard, in the **Which virtual machine size do you need?** drop-down list, you select the size of the VMs that are needed for your class.  In this process, you have the option of selecting either **Visualization** or ** As described in the following table, the *compute* GPU size is intended for compute-intensive applications. For example, the [Deep Learning in Natural Language Processing class type](./class-type-deep-learning-natural-language-processing.md) uses the **Small GPU (Compute)** size. The compute GPU is suitable for this type of class, because students use deep learning frameworks and tools that are provided by the [Data Science Virtual Machine image](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-1804) to train deep learning models with large sets of data. -| Size | Cores | RAM | Description | -| - | -- | | -- | -| Small GPU (Compute) | - 6 cores<br>- 56 GB RAM | [Standard_NC6](../virtual-machines/nc-series.md) |This size is best suited for compute-intensive applications such as artificial intelligence (AI) and deep learning. | +| Size | vCPUs | RAM | Description | +| - | -- | | -- | +| Small GPU (Compute) | 6 vCPUs | 56 GB RAM | [Standard_NC6](../virtual-machines/nc-series.md). This size is best suited for compute-intensive applications such as artificial intelligence (AI) and deep learning. | The *visualization* GPU sizes are intended for graphics-intensive applications. For example, the [SOLIDWORKS engineering class type](./class-type-solidworks.md) shows using the **Small GPU (Visualization)** size. The visualization GPU is suitable for this type of class, because students interact with the SOLIDWORKS 3D computer-aided design (CAD) environment for modeling and visualizing solid objects. -| Size | Cores | RAM | Description | -| - | -- | | -- | -| Small GPU (Visualization) | - 6 cores<br>- 56 GB RAM | [Standard_NV6](../virtual-machines/nv-series.md) | This size is best suited for remote visualization, streaming, gaming, and encoding that use frameworks such as OpenGL and DirectX. | -| Medium GPU (Visualization) | - 12 cores<br>- 112 GB RAM | [Standard_NV12](../virtual-machines/nv-series.md?bc=%2fazure%2fvirtual-machines%2flinux%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json) | This size is best suited for remote visualization, streaming, gaming, and encoding that use frameworks such as OpenGL and DirectX. | +| Size | vCPUs | RAM | Description | +| - | -- | | -- | +| Small GPU (Visualization) | 6 vCPUs | 56 GB RAM | [Standard_NV6](../virtual-machines/nv-series.md). This size is best suited for remote visualization, streaming, gaming, and encoding that use frameworks such as OpenGL and DirectX. | +| Medium GPU (Visualization) | 12 vCPUs | 112 GB RAM | [Standard_NV12](../virtual-machines/nv-series.md?bc=%2fazure%2fvirtual-machines%2flinux%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json). This size is best suited for remote visualization, streaming, gaming, and encoding that use frameworks such as OpenGL and DirectX. | > [!NOTE]-> You may not see some of these VM sizes in the list when creating a classroom lab. The list is populated based on the current capacity of the lab's location. If the lab account creator [allows lab creators to pick a location for the lab](allow-lab-creator-pick-lab-location.md), you may try choosing a different location for the lab and see if the VM size is available. For availability of VMs, see [Products available by region](https://azure.microsoft.com/regions/services/?products=virtual-machines). +> You may not see some of these VM sizes in the list when creating a lab. The list is populated based on the current capacity of the lab's location. For availability of VMs, see [Products available by region](https://azure.microsoft.com/regions/services/?products=virtual-machines). ## Ensure that the appropriate GPU drivers are installed+ To take advantage of the GPU capabilities of your lab VMs, ensure that the appropriate GPU drivers are installed. In the lab creation wizard, when you select a GPU VM size, you can select the **Install GPU drivers** option.  As shown in the preceding image, this option is enabled by default, which ensures that recently released drivers are installed for the type of GPU and image that you selected:+ - When you select a *compute* GPU size, your lab VMs are powered by the [NVIDIA Tesla K80](https://www.nvidia.com/content/dam/en-zz/Solutions/Data-Center/tesla-product-literature/Tesla-K80-BoardSpec-07317-001-v05.pdf) GPU. In this case, recent [Compute Unified Device Architecture (CUDA)](http://developer.download.nvidia.com/compute/cuda/2_0/docs/CudaReferenceManual_2.0.pdf) drivers are installed, which enables high-performance computing. - When you select a *visualization* GPU size, your lab VMs are powered by the [NVIDIA Tesla M60](https://images.nvidia.com/content/tesla/pdf/188417-Tesla-M60-DS-A4-fnl-Web.pdf) GPU and [GRID technology](https://www.nvidia.com/content/dam/en-zz/Solutions/design-visualization/solutions/resources/documents1/NVIDIA_GRID_vPC_Solution_Overview.pdf). In this case, recent GRID drivers are installed, which enables the use of graphics-intensive applications. As shown in the preceding image, this option is enabled by default, which ensure > The **Install GPU drivers** option only installs the drivers when they aren't present on your lab's image. For example, the GPU drivers are already installed on the Azure marketplace's [Data Science image](../machine-learning/data-science-virtual-machine/overview.md#whats-included-on-the-dsvm). If you create a lab using the Data Science image and choose to **Install GPU drivers**, the drivers won't be updated to a more recent version. To update the drivers, you will need to manually install them as explained in the next section. ### Install the drivers manually+ You might need to install a different version of the drivers than the version that Azure Lab Services installs for you. This section shows how to manually install the appropriate drivers, depending on whether you're using a *compute* GPU or a *visualization* GPU. #### Install the compute GPU drivers To manually install drivers for the *compute* GPU size, do the following: -1. In the lab creation wizard, when you're [creating your lab](./how-to-manage-classroom-labs.md), disable the **Install GPU drivers** setting. +1. In the lab creation wizard, when you're [creating your lab](./how-to-manage-labs.md), disable the **Install GPU drivers** setting. 1. After your lab is created, connect to the template VM to install the appropriate drivers. -  +  a. In a browser, go to the [NVIDIA Driver Downloads page](https://www.nvidia.com/Download/index.aspx). b. Set the **Product Type** to **Tesla**. To manually install drivers for the *compute* GPU size, do the following: f. Select **Search** to look for your drivers. g. Select **Download** to download the installer. h. Run the installer so that the drivers are installed on the template VM. -1. Validate that the drivers are installed correctly by following the instructions in the [Validate the installed drivers](how-to-setup-lab-gpu.md#validate-the-installed-drivers) section. +1. Validate that the drivers are installed correctly by following the instructions in the [Validate the installed drivers](how-to-setup-lab-gpu.md#validate-the-installed-drivers) section. 1. After you've installed the drivers and other software that are required for your class, select **Publish** to create your students' VMs. > [!NOTE] To manually install drivers for the *compute* GPU size, do the following: To manually install drivers for the *visualization* GPU sizes, do the following: -1. In the lab creation wizard, when you're [creating your lab](./how-to-manage-classroom-labs.md), disable the **Install GPU drivers** setting. +1. In the lab creation wizard, when you're [creating your lab](./how-to-manage-labs.md), disable the **Install GPU drivers** setting. 1. After your lab is created, connect to the template VM to install the appropriate drivers. 1. Install the GRID drivers that are provided by Microsoft on the template VM by following the instructions for your operating system:- - [Windows NVIDIA GRID drivers](../virtual-machines/windows/n-series-driver-setup.md#nvidia-grid-drivers) - - [Linux NVIDIA GRID drivers](../virtual-machines/linux/n-series-driver-setup.md?toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json#nvidia-grid-drivers) + - [Windows NVIDIA GRID drivers](../virtual-machines/windows/n-series-driver-setup.md#nvidia-grid-drivers) + - [Linux NVIDIA GRID drivers](../virtual-machines/linux/n-series-driver-setup.md?toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json#nvidia-grid-drivers) 1. Restart the template VM. 1. Validate that the drivers are installed correctly by following the instructions in the [Validate the installed drivers](how-to-setup-lab-gpu.md#validate-the-installed-drivers) section. 1. After you've installed the drivers and other software that are required for your class, select **Publish** to create your students' VMs. ### Validate the installed drivers+ This section describes how to validate that your GPU drivers are properly installed. #### Windows images-1. Follow the instructions in the "Verify driver installation" section of [Install NVIDIA GPU drivers on N-series VMs running Windows](../virtual-machines/windows/n-series-driver-setup.md#verify-driver-installation). -1. If you're using a *visualization* GPU, you can also: ++1. Follow the instructions in the "Verify driver installation" section of [Install NVIDIA GPU drivers on N-series VMs running Windows](../virtual-machines/windows/n-series-driver-setup.md#verify-driver-installation). +1. If you're using a *visualization* GPU, you can also: - View and adjust your GPU settings in the NVIDIA Control Panel. To do so, in **Windows Control Panel**, select **Hardware**, and then select **NVIDIA Control Panel**. -  +  - - View your GPU performance by using **Task Manager**. To do so, select the **Performance** tab, and then select the **GPU** option. + - View your GPU performance by using **Task Manager**. To do so, select the **Performance** tab, and then select the **GPU** option. -  +  > [!IMPORTANT] > The NVIDIA Control Panel settings can be accessed only for *visualization* GPUs. If you attempt to open the NVIDIA Control Panel for a compute GPU, you'll get the following error: "NVIDIA Display settings are not available. You are not currently using a display attached to an NVIDIA GPU." Similarly, the GPU performance information in Task Manager is provided only for visualization GPUs. - Depending on your scenario, you may also need to do additional validation to ensure the GPU is properly configured. Read the class type about [Python and Jupyter Notebooks](./class-type-jupyter-notebook.md#template-virtual-machine) that explains an example where specific versions of drivers are needed. + Depending on your scenario, you may also need to do additional validation to ensure the GPU is properly configured. Read the class type about [Python and Jupyter Notebooks](class-type-jupyter-notebook.md#template-machine-configuration) that explains an example where specific versions of drivers are needed. #### Linux images+ Follow the instructions in the "Verify driver installation" section of [Install NVIDIA GPU drivers on N-series VMs running Linux](../virtual-machines/linux/n-series-driver-setup.md#verify-driver-installation). ## Next steps+ See the following articles: -- [Create and manage labs](how-to-manage-classroom-labs.md)+- [Create and manage labs](how-to-manage-labs.md) - [SOLIDWORKS computer-aided design (CAD) class type](class-type-solidworks.md)-- [MATLAB (matrix laboratory) class type](class-type-matlab.md)+- [MATLAB (matrix laboratory) class type](class-type-matlab.md) |
| lab-services | How To Use Classroom Lab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-use-classroom-lab.md | - Title: How to access a classroom lab in Azure Lab Services | Microsoft Docs -description: Learn how to register to a classroom lab, view all the labs that you can access, start/stop a VM in the lab, and connect to the VM. - Previously updated : 06/26/2020---# How to access a classroom lab in Azure Lab Services -This article describes how to register to a classroom lab, view all the labs that you can access, start/stop a VM in the lab, and connect to the VM. --## Register to the lab --1. Navigate to the **registration URL** that you received from the educator. You don't need to use the registration URL after you complete the registration. Instead, use the URL: [https://labs.azure.com](https://labs.azure.com). Internet Explorer 11 isn't supported yet. --  -1. Sign in to the service using your school account to complete the registration. -- > [!NOTE] - > A Microsoft account is required for using Azure Lab Services. If you are trying to use your non-Microsoft account such as Yahoo or Google accounts to sign in to the portal, follow instructions to create a Microsoft account that will be linked to your non-Microsoft account. Then, follow the steps to complete the registration process. -1. Once registered, confirm that you see the virtual machine for the lab you have access to. --  -1. Wait until the virtual machine is ready. On the VM tile, notice the following fields: - 1. At the top of the tile, you see the **name of the lab**. - 1. To its right, you see the icon representing the **operating system (OS)** of the VM. In this example, it's Windows OS. - 1. You see icons/buttons at the bottom of the tile to start/stop the VM, and connect to the VM. - 1. To the right of the buttons, you see the status of the VM. Confirm that you see the status of the VM is **Stopped**. --  --## Start or stop the VM -1. **Start** the VM by selecting the first button as shown in the following image. This process takes some time. --  -4. Confirm that the status of the VM is set to **Running**. --  -- Notice that the icon of the first button changed to represent a **stop** operation. You can select this button to stop the VM. --## Connect to the VM --1. Select the second button as shown in the following image to **connect** to the lab's VM. --  -2. Do one of the following steps: - 1. For **Windows** virtual machines, save the **RDP** file to the hard disk. Open the RDP file to connect to the virtual machine. Use the **user name** and **password** you get from your educator to sign in to the machine. - 3. For **Linux** virtual machines, you can use **SSH** or **RDP** (if it's enabled) to connect to them. For more information, see [Enable remote desktop connection for Linux machines](how-to-enable-remote-desktop-linux.md). - 1. If you are using a **Mac** to connect to the lab VM, follow instructions in the next section. --## Progress bar -The progress bar on the tile shows the number of hours used against the number of [quota hours](how-to-configure-student-usage.md#set-quotas-for-users) assigned to you. This time is the additional time allotted to you in addition to the scheduled time for the lab. The color of the progress bar and the text under the progress bar varies as per the following scenarios: --- If a class is in progress (within the schedule of the class), progress bar is grayed out to represent quota hours aren't being used. --  -- If a quota isn't assigned (zero hours), the text **Available during classes only** is shown in place of the progress bar. - -  -- If you ran **out of quota**, the color of the progress bar is **red**. --  -- The color of the progress bar is **blue** when it's outside the scheduled time for the lab and some of the quota time has been used. --  ---## View all the labs -After you register to the labs, you can view all the labs by taking the following steps: --1. Navigate to [https://labs.azure.com](https://labs.azure.com). Internet Explorer 11 isn't supported yet. -2. Sign in to the service by using the user account that you used to register to the lab. -3. Confirm that you see all the labs you have access to. --  ---## Next steps -See the following articles: --- [As an admin, create and manage lab accounts](how-to-manage-lab-accounts.md)-- [As a lab owner, create and manage labs](how-to-manage-classroom-labs.md)-- [As a lab owner, set up and publish templates](how-to-create-manage-template.md)-- [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)- |
| lab-services | How To Use Lab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-use-lab.md | + + Title: How to access a lab in Azure Lab Services | Microsoft Docs +description: Learn how to register to a lab. Also learn how to view, start, stop, and connect to all the lab VMs assigned to you. + Last updated : 02/01/2022+++# How to access a lab in Azure Lab Services ++Learn how to register for a lab. Also learn how to view, start, stop, and connect to all the lab VMs assigned to you. ++## Register to the lab ++1. Navigate to the **registration URL** that you received from the educator. You don't need to use the registration URL after you complete the registration. Instead, use the URL: [https://labs.azure.com](https://labs.azure.com). ++ :::image type="content" source="./media/how-to-use-lab/register-lab.png" alt-text="Screenshot of registration link for lab."::: ++1. Sign in to the service using your school account to complete the registration. ++ > [!NOTE] + > A Microsoft account is required for using Azure Lab Services unless using Canvas. If you are trying to use your non-Microsoft account such as Yahoo or Google accounts to sign in to the portal, follow instructions to create a Microsoft account that will be linked to your non-Microsoft account. Then, follow the steps to complete the registration process. +1. Once registered, confirm that you see the virtual machine for the lab you have access to. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/accessible-vms.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services."::: +1. Wait until the virtual machine is ready. On the VM tile, notice the following fields: + 1. At the top of the tile, you see the **name of the lab**. + 1. To its right, you see the icon representing the **operating system (OS)** of the VM. In this example, it's Windows OS. + 1. You see icons/buttons at the bottom of the tile to start/stop the VM, and connect to the VM. + 1. To the right of the buttons, you see the status of the VM. Confirm that you see the status of the VM is **Stopped**. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/vm-in-stopped-state.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The status toggle and Stopped label are highlighted."::: ++## Start or stop the VM ++1. **Start** the VM by selecting the first button as shown in the following image. This process takes some time. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/start-vm.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The status toggle and Starting label on the VM tile are highlighted."::: +1. Confirm that the status of the VM is set to **Running**. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/vm-running.png" alt-text="Screenshot of My virtual machines page for Azure Lab Services. The Running label on the VM tile is highlighted."::: ++ Notice that the status toggle is in the on position. Select the status toggle again to **stop** the VM. ++Using the [Azure Lab Services portal](https://labs.azure.com/virtualmachines) is the preferred method for a student to stop their lab VM. However, with the [April 2022 Updates (preview)](lab-services-whats-new.md), Azure Lab Services will detect when a student shuts down their VM using the OS shutdown command. After a long delay to ensure the VM wasn't being restarted, the lab VM will be marked as stopped and billing will discontinue. ++## Connect to the VM ++For OS-specific instructions to connect to your lab VM, see [Connect to a lab VM](connect-virtual-machine.md). ++## Progress bar ++The progress bar on the tile shows the number of hours used against the number of [quota hours](how-to-configure-student-usage.md#set-quotas-for-users) assigned to you. This time is the extra time allotted to you in outside of the scheduled time for the lab. The color of the progress bar and the text under the progress bar varies. Let's cover the scenarios you might see. ++- If a class is in progress (within the schedule of the class), progress bar is grayed out to represent quota hours aren't being used. + <br/>:::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/progress-bar-class-in-progress.png" alt-text="Screenshot of lab VM tile in Azure Lab Services when VM has been started by a schedule."::: +- If a quota isn't assigned (zero hours), the text **Available during classes only** is shown in place of the progress bar. + <br/>:::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/available-during-class.png" alt-text="Screenshot of lab VM tile in Azure Lab Services when no quota has been assigned."::: +- If you ran **out of quota**, the color of the progress bar is **red**. + <br/>:::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/progress-bar-red-color.png" alt-text="Screenshot of lab VM tile in Azure Lab Services when quota has been used."::: +- The color of the progress bar is **blue** when it's outside the scheduled time for the lab and some of the quota time has been used. + <br/>:::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/progress-bar-blue-color.png" alt-text="Screenshot of lab VM tile in Azure Lab Services when quota has been partially used."::: ++## Next steps ++See the following articles: ++- [As an admin, create and manage lab plans](how-to-manage-lab-plans.md) +- [As a lab owner, create and manage labs](how-to-manage-labs.md) +- [As a lab owner, set up and publish templates](how-to-create-manage-template.md) +- [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md) |
| lab-services | How To Use Remote Desktop Linux Student | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-use-remote-desktop-linux-student.md | - Title: Connect to a Linux VM in Azure Lab Services | Microsoft Docs -description: Learn how to use remote desktop for Linux virtual machines in a lab in Azure Lab Services. - Previously updated : 06/26/2020---# Connect to Linux virtual machines in a classroom lab of Azure Lab Services -This article shows how students can connect to a Linux virtual machine (VM) in a lab using: -- SSH (secure shell protocol) terminal-- GUI (graphical user interface) remote desktop--> [!IMPORTANT] -> SSH is configured automatically so that both students and the instructor can SSH into Linux VMs without any additional setup. However, if students need to connect to using a GUI remote desktop, the instructor may need to do additional setup. For details, see [Enable remote desktop for Linux virtual machines](how-to-enable-remote-desktop-linux.md). --## Connect to the student VM using SSH --1. When a student signs in to the Labs portal directly (`https://labs.azure.com`) or by using a registration link (`https://labs.azure.com/register/<registrationCode>`), a tile for each lab the student has access to is displayed. - -1. On the tile, toggle the button to start the VM if it's in stopped state. --2. Select **Connect**. You see two options to connect to the VM: **SSH** and **RDP**. --  --3. Select the **SSH** option and you will see the **Connect to your virtual machine** dialog box: --  --4. Click the **Copy** button next to the text box to copy the SSH connection information to the clipboard. --5. Save the SSH connection information, such as in Text pad, so that you can use this connection information in the next step. --6. From an SSH terminal (like [Putty](https://www.putty.org/)), connect to your VM. --## Connect to the student VM using GUI remote desktop -The instructor may choose to configure VMs so that students can also connect using a GUI remote desktop. In this case, students need to find out from their instructor whether to connect to their VMs using the **Microsoft Remote Desktop (RDP)** or **X2Go** client application. Both of these applications allow a student to connect remotely to their VM and display the Linux graphical desktop on their local computer. --> [!WARNING] -> If you need to use [GNOME](https://www.gnome.org/) or [MATE](https://mate-desktop.org/) you should coordinate with your instructor to ensure your lab VM can be properly configured. There is a known networking conflict that can occur with the Azure Linux Agent which is needed for the VMs to work properly in Azure Lab Services. Instead, we recommend using a different graphical desktop environment, such as [XFCE](https://www.xfce.org/). --### Connect to the student VM using Microsoft Remote Desktop (RDP) -Students can use Microsoft Remote Desktop (RDP) to connect to their Linux VMs after their instructor sets up their lab with RDP and GUI packages for a Linux graphical desktop environment, such as XFCE. Here are the steps to connect: --1. On the tile for your VM, ensure the VM is running and click **Connect**. You see two options to connect to the VM: **SSH** and **RDP**. --  -2. Select the **RDP** option. When the RDP file is downloaded onto your machine, save it to your VM. --3. If you are connecting from a Windows computer, typically, the RDP client is already installed and configured. As a result, all you need to do is click on the RDP file to open it and start the remote session. -- Instead, if you are connecting from either a Mac or Chromebook, refer to the following steps: - - [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md). - - [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md). --The RDP client includes various settings that can be adjusted to optimize the user's connection experience. Typically, these settings don't need to be changed. By default, the settings are already configured to choose the right experience based on your network connection. For more information on these settings, [read the article about the RDP client's **Experience** settings](/windows-server/administration/performance-tuning/role/remote-desktop/session-hosts#client-experience-settings). --If your instructor has configured the GNOME graphical desktop with the RDP client, we recommend the following settings to optimize performance: -- Under the **Display** tab, set the color depth to **High Color (15 bit)**.-  --- Under the **Experience** tab, set the connection speed to **Modem (56 kbps)**.-  --### Connect to the student VM using X2Go -Students can use X2Go to connect to their Linux VMs after their instructor sets up their lab with X2Go and the GUI packages for a Linux graphical desktop environment, such as XFCE. --Students need to find out from their instructor which Linux graphical desktop environment their instructor has installed. This information is needed in the next steps to connect using the X2Go client. --1. Install the [X2Go client](https://wiki.x2go.org/doku.php/doc:installation:x2goclient) on your local computer. --1. Follow the instructions in the [first section](how-to-use-remote-desktop-linux-student.md#connect-to-the-student-vm-using-ssh) to copy the SSH connection information for your VM. You need this information to connect using the X2Go client. --1. Once you have the SSH connection information, open the X2Go client and select **Session** > **New Session**. -  --1. Enter the values in the **Session Preferences** pane based on your SSH connection information. For example, your connection information will look similar to this: -- ```bash - ssh -p 12345 student@ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com - ``` -- Using this example, the following values are entered: -- - **Session name** - Specify a name, such as the name of your VM. - - **Host** - The ID of your VM; for example, **`ml-lab-00000000-0000-0000-0000-000000000000.eastus2.cloudapp.azure.com`**. - - **Login** - The username for your VM; for example, **student**. - - **SSH port** - The unique port assigned to your VM; for example, **12345**. - - **Session type** - Select the Linux graphical desktop environment that your instructor configured your VM. You need to get this information from your instructor. For example, select `XFCE` if you are using either XFCE or Xubuntu graphical desktop environments. - -- Finally, click **OK** to create the session. --  --1. Click on your session in the right-hand pane. --  -- > [!NOTE] - > If you are prompted with a similar message to this, select **yes** to continue to entering your password: **The authenticity of host '[`00000000-0000-0000-0000-000000000000.eastus2.cloudapp.eastus.cloudapp.azure.com`]:12345' can't be established. ECDSA key fingerprint is SHA256:00000000000000000000000000000000000000000000.Are you sure you want to continue connecting (yes/no)?** --2. When prompted, enter your password and click **OK**. You will now be remotely connected to your VM's GUI desktop environment. --## Next steps -To learn how to enable the remote desktop connection feature for Linux VMs in a classroom lab, see [Enable remote desktop for Linux virtual machines](how-to-enable-remote-desktop-linux.md). - |
| lab-services | How To Use Shared Image Gallery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-use-shared-image-gallery.md | Title: Use a shared image gallery in Azure Lab Services | Microsoft Docs -description: Learn how to configure a lab account to use a shared image gallery so that a user can share an image with other and another user can use the image to create a template VM in the lab. + Title: Use an Azure Compute Gallery in Azure Lab Services | Microsoft Docs +description: Learn how to configure a lab plan to use a compute gallery so that a user can share an image with other and another user can use the image to create a template VM in the lab. Previously updated : 09/11/2020 Last updated : 11/13/2021 -# Use a shared image gallery in Azure Lab Services +# Use an Azure Compute Gallery in Azure Lab Services An image contains the operating system, software applications, files, and settings that are installed on a VM. There are two types of images that you can use when you set up a new lab:-- Marketplace images that are prebuilt by Microsoft for use within Azure. These images have either Windows or Linux installed and may also include software applications. For example, the [Data Science Virtual Machine image](../machine-learning/data-science-virtual-machine/overview.md#whats-included-on-the-dsvm) includes installed deep learning frameworks and tools.-- Custom images that are created by your institutionΓÇÖs IT department and\or other educators. You can create both Windows and Linux custom images and have the flexibility to install Microsoft and 3rd party applications based on your unique needs. You also can add files, change application settings, and more. -This article shows how educators/lab admins can create and save a custom image from a template virtual machine to a [shared image gallery](../virtual-machines/shared-image-galleries.md) so that it can be used by others to create new labs. +- Azure Marketplace images that are prebuilt by Microsoft for use within Azure. These images have either Windows or Linux installed and may also include software applications. For example, the [Data Science Virtual Machine image](../machine-learning/data-science-virtual-machine/overview.md#whats-included-on-the-dsvm) includes installed deep learning frameworks and tools. +- Custom images that are created by your institutionΓÇÖs IT department and\or other educators. You can create both Windows and Linux custom images and have the flexibility to install Microsoft and 3rd party applications based on your unique needs. You also can add files, change application settings, and more. ++This article shows how educators/lab admins can create and save a custom image from a template virtual machine to a [compute gallery](../virtual-machines/shared-image-galleries.md) so that it can be used by others to create new labs. > [!IMPORTANT]-> While using a Shared Image Gallery, Azure Lab Services supports only images with less than 128 GB of OS Disk Space. Images with more than 128 GB of disk space or multiple disks will not be shown in the list of virtual machine images during lab creation. +> While using a Azure compute galleries, Azure Lab Services supports only images with less than 128 GB of OS Disk Space. Images with more than 128 GB of disk space or multiple disks will not be shown in the list of virtual machine images during lab creation. ## Scenarios-Here are the couple of scenarios supported by this feature: -- A lab account admin attaches a shared image gallery to the lab account, and uploads an image to the shared image gallery outside the context of a lab. Then, lab creators can use that image from the shared image gallery to create labs. -- A lab account admin attaches a shared image gallery to the lab account. A lab creator (instructor) saves the customized image of his/her lab to the shared image gallery. Then, other lab creators can select this image from the shared image gallery to create a template for their labs. +Here are the couple of scenarios supported by this feature: ++- A lab plan admin attaches a compute gallery to the lab plan, and uploads an image to the compute gallery outside the context of a lab. Then, lab creators can use that image from the compute gallery to create labs. +- A lab plan admin attaches a compute gallery to the lab plan. A lab creator (educator) saves the customized image of their lab to the compute gallery. Then, other lab creators can select this image from the compute gallery to create a template for their labs. - When an image is saved to a shared image gallery, Azure Lab Services replicates the saved image to other regions available in the same [geography](https://azure.microsoft.com/global-infrastructure/geographies/). It ensures that the image is available for labs created in other regions in the same geography. Saving images to a shared image gallery incurs an additional cost, which includes cost for all replicated images. This cost is separate from the Azure Lab Services usage cost. For more information about Shared Image Gallery pricing, see [Shared Image Gallery ΓÇô Billing](../virtual-machines/shared-image-galleries.md#billing). - ## Prerequisites-- Create a [shared image gallery](../virtual-machines/create-gallery.md).-- You have attached the shared image gallery to the lab account. For step-by-step instructions, see [How to attach or detach shared image gallery](how-to-attach-detach-shared-image-gallery.md). -## Save an image to the shared image gallery -After a shared image gallery is attached, a lab account admin or an educator can save an image to the shared image gallery so that it can be reused by other educators. +- Create a [compute gallery](../virtual-machines/create-gallery.md). +- You've attached the compute gallery to the lab plan. For step-by-step instructions, see [How to attach or detach compute gallery](how-to-attach-detach-shared-image-gallery.md). +- Image must be replicated to the same region as the lab plan. -1. On the **Template** page for the lab, select **Export to Shared Image Gallery** on the toolbar. +## Save an image to a compute gallery -  -2. On the **Export to Shared Image Gallery** dialog, enter a **name for the image**, and then select **Export**. +After a compute gallery is attached, an educator can save an image to the compute gallery so that it can be reused by other educators. -  +1. On the **Template** page for the lab, select **Export to Azure Compute Gallery** on the toolbar. -3. You can see the progress of this operation on the **Template** page. This operation can take sometime. +  +2. On the **Export to Azure Compute Gallery** dialog, enter a **name for the image**, and then select **Export**. -  -4. When the export operation is successful, you see the following message: + :::image type="content" source="./media/how-to-use-shared-image-gallery/export-to-shared-image-gallery-dialog.png" alt-text="Export to Azure Compute Gallery dialog"::: -  +3. You'll see a note telling you to go to the Azure port to see the progress of this operation. This operation can take sometime. - After you save the image to the shared image gallery, you can use that image from the gallery when creating another lab. You can also upload an image to the shared image gallery outside the context of a lab. For more information, see: +  +After you save the image to the compute gallery, you can use that image from the gallery when creating another lab. You can also upload an image to the compute gallery outside the context of a lab. For more information, see: - - [Shared image gallery overview](../virtual-machines/shared-image-galleries.md) - - [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) +- [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md) +- [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) +> [!IMPORTANT] +> When you save a template image of a lab in Azure Lab Services to a compute gallery, the image is uploaded to the gallery as a **specialized image**. [Specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) keep machine-specific information and user profiles. You can still directly upload a generalized image to the gallery outside of Azure Lab Services. - > [!IMPORTANT] - > When you [save a template image of a lab](how-to-use-shared-image-gallery.md#save-an-image-to-the-shared-image-gallery) in Azure Lab Services to a shared image gallery, the image is uploaded to the gallery as a **specialized image**. [Specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images) keep machine-specific information and user profiles. You can still directly upload a generalized image to the gallery outside of Azure Lab Services. +## Use a custom image from the compute gallery -## Use a custom image from the shared image gallery -An educator can pick a custom image available in the shared image gallery for the template VM that is created when you setup a new lab. +An educator can pick a custom image available in the compute gallery for the template VM when creating a new lab. Educators can create a template VM based on both **generalized** and **specialized** images in Azure Lab Services.  -> [!NOTE] -> You can create a template VM based on both **generalized** and **specialized** images in Azure Lab Services. +>[!IMPORTANT] +>Azure Compute Gallery images will not show if they have been disabled or if the region of the lab plan is different than the gallery images. -### Resave a custom image to shared image gallery +For more information about replicating images, see [replication in Azure Compute Gallery](/azure/virtual-machines/shared-image-galleries.md). For more information about disabling gallery images for a lab plan, see [enable and disable images](how-to-attach-detach-shared-image-gallery.md#enable-and-disable-images). -After you've created a lab from a custom image in a shared image gallery, you can make changes to the image using the template VM and reexport the image to shared image gallery. When you reexport, you have the option to either create a new image or to update the original image. +### Re-save a custom image to compute gallery -  +After you've created a lab from a custom image in a compute gallery, you can make changes to the image using the template VM and reexport the image to compute gallery. When you reexport, you can either create a new image or to update the original image. -If you choose **Create new image**, a new [image definition](../virtual-machines/shared-image-galleries.md#image-definitions) is created. This allows you to save an entirely new custom image without changing the original custom image that already exists in shared image gallery. +If you choose **Create new image**, a new [image definition](../virtual-machines/shared-image-galleries.md#image-definitions) is created. Creating a new image allows you to save an entirely new custom image without changing the original custom image that already exists in compute gallery. If instead you choose **Update existing image**, the original custom image's definition is updated with a new [version](../virtual-machines/shared-image-galleries.md#image-versions). Lab Services automatically will use the most recent version the next time a lab is created using the custom image. ## Next steps-To learn about how to set up shared image gallery by attaching and detaching it to a lab account, see [How to attach and detach shared image gallery](how-to-attach-detach-shared-image-gallery.md). -To explore other options for bringing custom images to shared image gallery outside of the context of a lab, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). +To learn about how to set up a compute gallery by attaching and detaching it to a lab plan, see [How to attach and detach a compute gallery](how-to-attach-detach-shared-image-gallery.md). ++To explore other options for bringing custom images to compute gallery outside of the context of a lab, see [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md). -For more information about shared image galleries in general, see [shared image gallery](../virtual-machines/shared-image-galleries.md). +For more information about compute galleries in general, see [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md). |
| lab-services | How To Windows Shutdown | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/how-to-windows-shutdown.md | Title: Guide to controlling Windows shutdown behavior in Azure Lab Services | Microsoft Docs description: Steps to automatically shutdown an idle Windows virtual machine and remove the Windows shutdown command. Previously updated : 09/29/2020 Last updated : 02/04/2022 # Guide to controlling Windows shutdown behavior -Azure Lab Services provides several cost controls to ensure that Windows virtual machines (VMs) are not running unexpectedly: +Azure Lab Services provides cost controls to ensure that Windows virtual machines (VMs) aren't running unexpectedly: -Even with these cost controls, there are situations where a Windows VM may unexpectedly continue to run; and as a result, deduct from the student's quota: +- [Set a schedule](how-to-create-schedules.md) +- [Set quotas for students](./how-to-configure-student-usage.md#set-quotas-for-users) +- [Automatic shutdown policies](./how-to-enable-shutdown-disconnect.md) + - Disconnect users when virtual machines are idle + - Shut down virtual machines when users disconnect + - Shut down virtual machines when users don't connect -- **RDP window is left open**- - When a student connects to their VM using RDP, they may inadvertently leave the RDP window open. As long as the RDP window remains open, the **automatic shutdown on disconnect** setting will never take effect since it is only triggered after the RDP session is disconnected. --- **Windows shutdown command is used to turn off the VM**- - A student may use Windows shutdown command, or other shutdown mechanisms provided within Windows, to turn off the VM instead of using [Azure Lab Services' stop button](./how-to-use-classroom-lab.md#start-or-stop-the-vm). When this happens, from the perspective of Azure Lab Services, the VM is still being used. - -To help you prevent these situations from happening, this guide provides steps to automatically shutdown an idle Windows VM and remove the Windows shutdown command from the **Start** menu. --> [!NOTE] -> A VM may also unexpectedly deduct from the quota when the student starts their VM, but never actually connects to it using RDP. This guide does *not* currently address this scenario. Instead, students should be reminded to immediately connect to their VM using RDP after they start it; or, they should stop the VM. +However, a student may use Windows shutdown command to turn off the VM. If Azure Lab Services' [stop button](./how-to-use-lab.md#start-or-stop-the-vm) or [automatic shutdown policies](./how-to-enable-shutdown-disconnect.md) aren't used, of Azure Lab Services still thinks the VM is being used. + +To help you prevent this situation from happening, this guide provides steps to remove the Windows shutdown command from the **Start** menu. The disconnect command is still available for students. The Windows disconnect command will trigger the lab policy (if enabled) that shuts down the VM when users disconnect. ## Remove Windows shutdown command from Start menu Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies Or, you can choose to follow these manual steps using the template VM: 1. Press the Windows key, type **gpedit**, then select **Edit group policy (Control panel)**.- 1. Go to **Computer Configuration > Administrative Templates > Start Menu and Taskbar**. -  + :::image type="content" source="./media/how-to-windows-shutdown/group-policy-shutdown.png" alt-text="Screenshot of Group Policy Editor in Windows." lightbox="./media/how-to-windows-shutdown/group-policy-shutdown.png"::: -1. Right-click **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands**, and click **Edit**. --1. Select the **Enabled** setting and then click **OK**: +1. Right-click **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands**, and select **Edit**. +1. Select the **Enabled** setting. Select **OK**: + + :::image type="content" source="./media/how-to-windows-shutdown/edit-shutdown.png" alt-text="Screenshot of Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands dialog in Windows."::: -  +1. Notice that the shutdown command no longer appears under Windows **Start** menu. Only the **Disconnect** command appears. -1. Notice that the shutdown command no longer appears under Windows **Start** menu; only the **Disconnect** command appears. + :::image type="content" source="./media/how-to-windows-shutdown/start-menu.png" alt-text="Screenshot of the Start menu in Windows. The power button and disconnect item are highlighted."::: -  ## Next steps-See the article on how to prepare a Windows template VM: [Guide to setting up a Windows template machine in Azure Lab Services](how-to-prepare-windows-template.md) +- As an educator, enable [automatic shutdown policies](./how-to-enable-shutdown-disconnect.md). +- As an educator, [prepare Windows template VM](how-to-prepare-windows-template.md) for the lab. +- As an educator, [publish the template VM](how-to-create-manage-template.md#publish-the-template-vm). |
| lab-services | Instructor Access Virtual Machines | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/instructor-access-virtual-machines.md | Title: Educator accessing VMs in Azure Lab Services description: This article shows how educators can access their student VMs from the educator view. For example, a teaching assistant can be an educator for one class but a student for other classes. Previously updated : 06/26/2020 Last updated : 03/01/2022+ # Access virtual machines as a student from the educator view -This article shows how educators can access their VMs for classes that they attend as students. -Here is a scenario where this feature will help. A teaching assistant is an educator for one class but a student in other classes. And, the teaching assistant wants to view and access the student VMs from the educator view that shows the labs they own. +This article shows how educators can access their VMs for classes that they attend as students. ++The feature will be of great use when a teaching assistant is an educator for one class and a student in another class. And now, the teaching assistant wants to view and access the student VMs from the educator's view that shows the labs they own. ## Access VMs from educator view -1. Sign in to the [Azure Lab Services website](https://labs.azure.com). You see the labs that you own. These labs may be labs you created yourself or the labs that admin assigned to you as owner. For more information, see [How to add additional owners to an existing lab](how-to-add-user-lab-owner.md) -2. To access VMs for classes that you attend as a student, select the computer icon in the top-right corner. Confirm that you see VMs you can access as a student. In the following example, the user is a teaching assistant for the Python lab, but a student of the Java lab. So, the user sees the VM from the Java lab in the drop-down list. The user can start the VM and connect to it. - -  +1. Sign in to the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). You see the labs that you own. These labs can be labs you created yourself or the labs that admin assigned to you as owner. +2. To access VMs for classes that you attend as a student, select the computer icon in the top-right corner. Confirm that you see VMs you can access as a student. In the following example, the user is a teaching assistant for the Python lab, but a student of the Java lab. So, the user sees the VM from the Java lab in the drop-down list. The user can start the VM and connect to it. ++ :::image type="content" source="./media/instructors-access-virtual-machines/access-student-virtual-machines.png" alt-text="Screenshot that shows how to access student VMs."::: ## Next steps+ See the following articles: -- [Connect to a VM](how-to-use-classroom-lab.md#connect-to-the-vm)-- [Connect to a VM using RDP on a Mac](connect-virtual-machine-mac-remote-desktop.md)-- [Connect to a VM using RDP on a Chromebook](connect-virtual-machine-chromebook-remote-desktop.md)-- [Use remote desktop for Linux virtual machines](how-to-use-remote-desktop-linux-student.md)+- As an educator, [manage a template VM](how-to-create-manage-template.md). +- As a student, [connect to a lab VM](connect-virtual-machine.md). |
| lab-services | Lab Account Owner Support Information | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-account-owner-support-information.md | Title: Set up support information (lab account owner) description: Describes how a lab account owner can set support contact information. Lab creators and lab users can view and use it to get help. Previously updated : 06/26/2020 Last updated : 04/25/2022 + # Set up support information (lab account owner in Azure Lab Services) -This article explains how you (as a lab account owner) can specify support information that lab creators (educators) and lab users (students) can use to get help if they run into any technical issues with using the lab account or lab. ++This article explains how you (as a lab account owner) can specify the support information. The support information can be used by the lab creators (educators) and lab users (students) to get help if they run into any technical issues while using the lab. The support information includes: - URL - Email - Phone-- Additional instructions +- Additional instructions ## Specify support information-1. Sign in to [Azure portal](https://portal.azure.com). -2. In the search bar, enter **Lab Services**, and select **Lab Services** in the search results. -3. Select your lab account from the list of lab accounts. -4. Switch to the **Internal support** page, do the following steps: - 1. Enter the **support URL**. - 2. Enter the **support email**. - 3. Enter the **support phone**. - 4. Enter detailed **support instructions** (optional). Lab owners and users will see this text along with the support contact information. URLs will be automatically turned into links. - 5. Select **Save** on the toolbar. -  +1. Sign in to [Azure portal](https://portal.azure.com). +1. In the search bar, enter **Lab Services**, and select **Lab Services** in the search results. +1. Select your lab account from the list of lab accounts. +1. Switch to the **Internal support** page, and do the following steps: + 1. Enter the **support URL**. + 1. Enter the **support email**. + 1. Enter the **support phone**. + 1. Enter detailed **support instructions** (optional). Lab owners and users will see this text along with the support contact information. URLs will be automatically turned into links. + 1. Select **Save** on the toolbar. + :::image type="content" source="./media/lab-account-owner-support-information/internal-support-page.png" alt-text="Screenshot of Internal support page."::: ## Next steps+ See the following articles: - [View contact information (lab creator)](lab-creator-support-information.md) |
| lab-services | Lab Creator Support Information | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-creator-support-information.md | Title: View support information (lab creator) description: This article explains how lab creators can view support information that they can use to get help. Previously updated : 06/26/2020 Last updated : 11/24/2021 + # View support information (lab creator in Azure Lab Services)+ This article explains how you (as a lab creator) can view the following support information: - URL This article explains how you (as a lab creator) can view the following support - Phone - Additional instructions -You can use this information to get help when you run into any technical issues while creating a lab in a lab account. +You can use this information to get help when you run into any technical issues while creating a lab in a lab plan. - ## View support information-1. Sign in to [Azure Lab Services portal](https://labs.azure.com). -2. Select question mark (**?**) at the top-right corner of the page. -3. Confirm that you see links to the **view support website**, **email support**, and **support phone number**. -  +1. Sign in to Azure Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). +2. Select question mark (**?**) at the top-right corner of the page. +3. Confirm that you see the links to the **view support website**, **email support**, and **support phone number**. ++ :::image type="content" source="./media/lab-creator-support-information/support-information.png" alt-text="Screenshot that shows the links to the support information."::: ## Next steps+ See the following article to learn about how a lab user views the support contact information: - [View contact information (lab user)](lab-user-support-information.md)-- [Specify contact information (lab account owner)](lab-account-owner-support-information.md) |
| lab-services | Lab Plan Setup Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-plan-setup-guide.md | + + Title: Accelerated lab plan setup guide +description: This guide helps administrators quickly set up a lab plan for use within their school. + Last updated : 11/23/2021+++# Lab plan setup guide +++If you're an administrator, before you set up your Azure Lab Services environment, you first need to create a *lab plan* within your Azure subscription. A lab plan is associated one or more labs, and it takes only a few minutes to set up. ++This guide includes three sections: ++- Prerequisites +- Plan your lab plan settings +- Set up your lab plan ++## Prerequisites ++The following sections outline what you need to do before you can set up a lab plan. ++### Access your Azure subscription ++To create a lab plan, you need access to an Azure subscription that's already set up for your school. Your school might have one or more subscriptions. You use a subscription to manage billing and security for all your Azure resources and services, including lab plans. Azure subscriptions are usually managed by your IT department. For more information, see the "Subscription" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#subscription). ++### Estimate how many VMs and VM sizes you need ++It's important to know how many [virtual machines (VMs) and VM sizes](./administrator-guide.md#vm-sizing) your school lab requires. ++For guidance on structuring your labs and images, see the blog post [Moving from a physical lab to Azure Lab Services](https://techcommunity.microsoft.com/t5/azure-lab-services/moving-from-a-physical-lab-to-azure-lab-services/ba-p/1654931). ++For additional guidance on how to structure labs, see the "Lab" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#lab). ++### Understand subscription VM limits and regional VM capacity ++After you've estimated the number of VMs and the VM sizes for your labs, you need to: ++- Ensure that your Azure subscription's capacity limit allows for the number of VMs and the VM size that you plan to use in your labs. +- Create your lab plan within a region that has sufficient available VM capacity. ++For more information, see [VM subscription limits and regional capacity](https://techcommunity.microsoft.com/t5/azure-lab-services/vm-subscription-limits-and-regional-capacity/ba-p/1845553). ++### Decide how many lab plans to create ++To get started quickly, create a single lab plan within its own resource group. Later, you can create additional lab plans and resource groups, as needed. For example, you might eventually have one lab plan and resource group per department as a way to clearly separate costs. ++For more information about lab plans, resource groups, and separating costs, see: ++- The "Resource group" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#resource-group) +- The "Lab plan" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#lab-plan) +- [Cost management for Azure Lab Services](./cost-management-guide.md) ++## Plan your lab plan settings ++To plan your lab plan settings, consider the following questions. ++### Who should be the Owners and Contributors of the lab plan? ++Your school's IT administrators ordinarily take on the Owner and Contributor roles for a lab plan. These roles are responsible for managing the policies that apply to all the labs in the lab plan. The person who creates the lab plan is automatically an Owner. You can add additional Owners and Contributors from the Azure Active Directory (Azure AD) tenant that's associated with your subscription. ++For more information about the lab plan Owner and Contributor roles, see [RBAC roles](./administrator-guide.md#rbac-roles). +++Lab users see only a single list of the VMs that they have access to across Azure AD tenants in Azure Lab Services. ++### Who will be allowed to create labs? ++You may choose to have your IT team or faculty members create labs. To create labs, you then assign these people to the Lab Creator role within the lab plan. You ordinarily assign this role from the Azure AD tenant that's associated with your school subscription. Whoever creates a lab is automatically assigned as the Owner of the lab. ++For more information about the Lab Creator role, see [RBAC roles](./administrator-guide.md#rbac-roles). ++### Who will be allowed to own and manage labs? ++You can also choose to have IT and faculty members own\manage labs *without* giving them the ability to create labs. In this case, users from your subscription's Azure AD tenant are assigned either the Owner or Contributor for existing labs. ++For more information about the lab Owner and Contributor roles, see [RBAC roles](./administrator-guide.md#rbac-roles). ++### Do you want to save images and share them across labs? ++Azure Compute Gallery is a service that you can use for saving and sharing images. For classes that need to use the same image, Lab Creators can create the image and then export it to a compute gallery. After an image is exported to the compute gallery, it can be used to create new labs. ++You might want to create your images in your physical environment and then import them to a compute gallery. For more information, see the blog post [Import a custom image to a compute gallery](https://techcommunity.microsoft.com/t5/azure-lab-services/import-custom-image-to-shared-image-gallery/ba-p/1777353). ++If you decide to use the compute gallery service, you'll need to create or attach a compute gallery to your lab plan. You can postpone this decision for now, because a compute gallery can be attached to a lab plan at any time. ++For more information, see: ++- The "Azure computegallery" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#azure-compute-gallery) +- The "Pricing" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#pricing) ++### Which images in Azure Marketplace will your labs use? ++Azure Marketplace provides hundreds of images that you can enable so that Lab Creators can use them for creating their labs. Some images might include everything that a lab already needs. In other cases, you might use an image as a starting point, and then the Lab Creator can customize it by installing additional applications or tools. ++If you don't know which images you need, you can come back later to enable them. The best way to see which images are available is to first create a lab plan. This gives you access so that you can review the list of available images and their contents. ++For more information, see [Specify the Azure Marketplace images that are available to Lab Creators](./specify-marketplace-images.md). + +### Do the lab VMs need access to other Azure or on-premises resources? ++When you set up a lab plan, you also can bring your own virtual network to your lab plan. Keep in mind that both your virtual network and the lab plan must be located in the same region. To decide whether you need to use a virtual network, consider the following scenarios: ++- **Access to a license server** + + When you use Azure Marketplace images, the cost of the operating system license is bundled into the pricing for lab services. However, you don't need to provide licenses for the operating system itself. For additional software and applications that are installed, you do need to provide a license, as appropriate. To access a license server: ++ - You may choose to connect to an on-premises license server. Connecting to an on-premises license server requires additional setup. + - Another option, which is faster to set up, is to create a license server that you host on an Azure VM. The Azure VM is located within a virtual network that you associated with your lab plan. ++- **Access to other on-premises resources such as a file share or database** ++ You ordinarily create a virtual network to provide access to on-premises resources by using a site-to-site virtual network gateway. Setting up this type of environment will take additional time. ++- **Access to other Azure resources that are located outside a virtual network** ++ If you need access to Azure resources that are *not* secured within a virtual network, you can access them through the public internet, without adding your own virtual network. ++ For more information about virtual networks, see: ++ - The "Virtual network" section of [Architecture fundamentals in Azure Lab Services](./classroom-labs-fundamentals.md#virtual-network) + - [Connect to your virtual network in Azure Lab Services](./how-to-connect-vnet-injection.md) + - [Create a lab with a shared resource in Azure Lab Services](./how-to-create-a-lab-with-shared-resource.md) ++## Set up your lab plan ++After you've finished planning, you're ready to set up your lab plan. ++1. **Create your lab plan**. For instructions, see [Create a lab plan](./tutorial-setup-lab-plan.md#create-a-lab-plan). ++ For information about naming conventions, see the "Naming" section of [Azure Lab Services - Administrator guide](./administrator-guide.md#naming). ++1. **Add users to the Lab Creator role**. For instructions, see [Add users to the Lab Creator role](./tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role). ++1. **Connect to your virtual network**. For instructions, see [Connect to your virtual network in Azure Lab Services](./how-to-connect-vnet-injection.md). ++1. **Enable and review images**. For instructions, see [Specify which Azure Marketplace images are available to Lab Creators](./specify-marketplace-images.md). ++ To review the contents of each Azure Marketplace image, select the image name. For example, the following screenshot shows the details of the Ubuntu Data Science VM image: ++  ++ If a compute gallery is attached to your lab plan, and you want to enable custom images to be shared by Lab Creators, complete similar steps as shown in the following screenshot: ++  ++## Next steps ++For more information about setting up and managing labs, see: ++- [Manage lab plans](how-to-manage-lab-plans.md) +- [Lab setup guide](setup-guide.md) |
| lab-services | Lab Services Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-services-overview.md | Title: About Azure Lab Services | Microsoft Docs -description: Learn how Lab Services can make it easy to create, manage, and secure labs with virtual machines that can be used by developers, testers, educators, students, and others. +description: Learn how Lab Services can make it easy to create, manage, and secure labs with VMs for educators and students. Previously updated : 12/16/2021 Last updated : 01/04/2022 -# What is Azure Lab Services? +# An introduction to Azure Lab Services -Azure Lab Services enables you to quickly set up a classroom lab environment in the cloud. An educator creates a classroom lab, provisions Windows, or Linux virtual machines, installs the necessary software and tools labs in the class, and makes them available to students. The students in the class connect to virtual machines (VMs) in the lab, and use them for their projects, assignments, classroom exercises. -Currently, classroom lab is the only type of managed lab that's supported by Azure Lab Services. The service itself handles all the infrastructure management for a managed lab type, from spinning up VMs to handling errors and scaling the infrastructure. You specify what kind of infrastructure you need and install any tools or software that's required for the class. Learn more about [service architecture](classroom-labs-fundamentals.md). +**Azure Lab Services** lets you create labs whose infrastructure is managed by Azure. The service itself handles all the infrastructure management, from spinning up VMs to handling errors and scaling the infrastructure. Azure Lab Services was designed with three major personas in mind: [administrators, educators, and students](classroom-labs-concepts.md#user-profiles). After an IT administrator creates a lab plan, an educator can quickly set up a lab for the class. Educators specify the number and type of VMs needed, configures the template VM, and adds users to the class. Once a user registers to the class, the user can access the VM to do exercises for the class. -After an IT admin creates a lab account in Azure Lab Services, an instructor can quickly [set up a lab for the class](tutorial-setup-classroom-lab.md), specify the number and type of VMs that are needed for exercises in the class, and add users to the class. Once a user registers to the class, the user can [access the VM to do exercises for the class](tutorial-connect-virtual-machine-classroom-lab.md). - +To [create a lab](tutorial-setup-lab.md), you need to [create a lab plan](tutorial-setup-lab-plan.md) for your organization first. The lab plan serves as a collection of configurations and settings that apply to the labs created from it. -## Key capabilities -Azure Lab Services supports the following key capabilities/features: --- **Fast and flexible setup of a lab**. Using Azure Lab Services, lab owners can quickly [set up a lab](tutorial-setup-classroom-lab.md) for their needs. The service offers the option to take care of all Azure infrastructure work for managed lab types. The service provides built-in scaling and resiliency of infrastructure for labs that the service manages for you.--- **Simplified experience for lab users**. Users who are invited to your lab get immediate access to the resources you give them inside your labs. They just need to sign in to see the full list of virtual machines they have access to across multiple labs. They can click on a single button to connect to the virtual machines and start working. Users don’t need Azure subscriptions to use the service. [Lab users can register](how-to-use-classroom-lab.md) to a lab with a registration code and can access the lab anytime to use the lab’s resources. +The service creates and manages resources in a subscription managed by Microsoft. Resources aren't created in your own Azure subscription. The [advanced networking](how-to-connect-vnet-injection.md) option is an exception as there are a few resources saved in your subscription. Virtual machines are always hosted in the Microsoft managed subscription. The service keeps track of usage of these resources in internal Microsoft subscriptions. This usage is [billed back to your Azure subscription](cost-management-guide.md) that contains the lab plan. -- **Cost optimization and analysis**. [Keep your budget in check](cost-management-guide.md) by controlling exactly how many hours your lab users can use the virtual machines. Set up schedules in the lab to allow users to use the virtual machines only during designated time slots or set up reoccurring auto-shutdown and start times. Keep track of individual users’ usage and set limits.+## Key capabilities -- **Automatic management of Azure infrastructure and scale** Azure Lab Services is a managed service, which means that provisioning and management of a lab’s underlying infrastructure is handled automatically by the service. You can just focus on preparing the right lab experience for your users. Let the service handle the rest and roll out your lab’s virtual machines to your audience. Scale your lab to hundreds of virtual machines with a single click.+Azure Lab Services supports the following key capabilities and features: +- **Fast and flexible setup of a lab**. Using Azure Lab Services, lab owners can quickly [set up a lab](tutorial-setup-lab.md) for their needs. The service takes care of all Azure infrastructure including built-in scaling and resiliency of infrastructure for labs. -If you want to just input what you need in a lab and let the service set up and manage infrastructure required for the lab, choose from one of the **managed lab types**. Currently, **classroom lab** is the only managed lab type that you can create with Azure Lab Services. +- **Simplified experience for lab users**. Students who are invited to a lab get immediate access to the resources you give them inside your labs. They just need to sign in to see the full list of virtual machines for all labs that they can access. They can select a single button to connect to the virtual machines and start working. Users don’t need Azure subscriptions to use the service. [Lab users can register](how-to-use-lab.md) to a lab with a registration code and can access the lab anytime to use the lab’s resources. -The following sections provide more details about these labs. +- **Cost optimization and analysis**. [Keep your budget in check](cost-management-guide.md) by controlling exactly how many hours your lab users can use the virtual machines. Set up [schedules](how-to-create-schedules.md) in the lab to allow users to use the virtual machines only during designated time slots. Set up [auto-shutdown policies](how-to-configure-auto-shutdown-lab-plans.md) to avoid unneeded VM usage. Keep track of [individual users’ usage](how-to-manage-classroom-labs.md) and [set limits](how-to-configure-student-usage.md#set-quotas-for-users). -## Managed lab types +- **Automatic management of Azure infrastructure and scale** Azure Lab Services is a managed service, which means that provisioning and management of a lab’s underlying infrastructure is handled automatically by the service. You can just focus on preparing the right lab experience for your users. Let the service handle the rest and roll out your lab’s virtual machines to your audience. Scale your lab to hundreds of virtual machines with a single action. -Azure Lab Services allows you to create labs whose infrastructure is managed by Azure. This article refers to them as managed lab types. Managed lab types offer different types of labs that fit for your specific need. Currently, the only managed lab type that's supported is **classroom lab**. +Here are some of the **use cases for managed labs**: -Managed lab types enable you to get started right away, with minimal setup. The service itself handles all the management of the infrastructure for the lab, from spinning up the VMs to handling errors and scaling the infrastructure. To create a managed lab type such as a classroom lab, you need to create a lab account for your organization first. The lab account serves as the central account in which all labs in the organization are managed.  +- Provide students with a lab of virtual machines configured with exactly what’s needed for a class. Give each student a limited number of hours for using the VMs for homework or personal projects. +- Set up a pool of high-performance compute VMs to perform compute-intensive or graphics-intensive research. Run the VMs as needed, and clean up the machines once you're done. +- Move your school’s physical computer lab into the cloud. Automatically scale the number of VMs only to the maximum usage and cost threshold that you set on the lab. +- Quickly create a lab of virtual machines for hosting a hackathon. Delete the lab with a single action once you’re done. -When you create and use Azure resources in these managed lab types, the service creates and manages resources in internal Microsoft subscriptions. They are not created in your own Azure subscription. The service keeps track of usage of these resources in internal Microsoft subscriptions. This usage is billed back to your Azure subscription that contains the lab account.    +## Example class types -Here are some of the **use cases for managed lab types**: +You can set up labs for several types of classes with Azure Lab Services. See the [Example class types on Azure Lab Services](class-types.md) article for a few example types of classes for which you can set up labs with Azure Lab Services. -- Provide students with a lab of virtual machines that are configured with exactly what’s needed for a class. Give each student a limited number of hours for using the VMs for homework or personal projects.-- Set up a pool of high performance compute VMs to perform compute-intensive or graphics-intensive research. Run the VMs as needed, and clean up the machines once you are done. -- Move your school’s physical computer lab into the cloud. Automatically scale the number of VMs only to the maximum usage and cost threshold that you set on the lab. -- Quickly provision a lab of virtual machines for hosting a hackathon. Delete the lab with a single click once you’re done. +## Region availability +Visit the [Azure Global Infrastructure products by region](https://azure.microsoft.com/global-infrastructure/services/?products=lab-services) page to learn where Azure Lab Services is available. -## Example class types +[Azure Lab Services April 2022 Update (preview](lab-services-whats-new.md)) doesn’t move or store customer data outside the region it’s deployed in. However, accessing Azure Lab Services resources through the Azure Lab Services portal may cause customer data to cross regions. -You can set up labs for several types of classes with Azure Lab Services. See the [Example class types on Azure Lab Services](class-types.md) article for a few example types of classes for which you can set up labs with Azure Lab Services. +There are no guarantees customer data will stay in the region it’s deployed to when using Azure Lab Services previous to the April 2022 Update (preview). ## Next steps-See the following tutorials for step-by-step instructions to create a lab account, and create a classroom lab. -- [Quickstart: get started with Azure Lab Services](get-started-manage-labs.md)-- [Tutorial: setup a lab account](tutorial-setup-lab-account.md)-- [Tutorial: create a classroom lab](tutorial-setup-classroom-lab.md)+See the following tutorials for step-by-step instructions to create a lab plan, and create a lab. ++- [Azure Lab Service concepts](classroom-labs-concepts.md) +- [Tutorial: setup a lab plan](tutorial-setup-lab-plan.md) +- [Tutorial: create a lab](tutorial-setup-lab.md) |
| lab-services | Lab Services Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-services-whats-new.md | + + Title: What's New in Azure Lab Services | Microsoft Docs +description: Learn what's new in the Azure Lab Services April 2022 Updates. + Last updated : 04/14/2022+++# What's new in Azure Lab Services April 2022 Update (preview) ++We've made fundamental improvements for the service to boost performance, reliability, and scalability. In this article, we'll describe all the great changes and new features that are available in this preview! ++## Overview ++**[Lab plans replace lab accounts](#lab-plans-replace-lab-accounts).** The lab account concept is being replaced with a new concept called a lab plan. Although similar in functionality, there are some fundamental differences between the two concepts. The lab plan serves as a collection of configurations and settings that apply to the labs created from it. Also, labs are now an Azure resource in their own right and a sibling resource to lab plans. ++**[Canvas Integration](how-to-get-started-create-lab-within-canvas.md)**. Now, educators donΓÇÖt have to leave Canvas to create their labs. Students can connect to a virtual machine from inside their course. ++**[Per customer assigned capacity](capacity-limits.md#per-customer-assigned-capacity)**. No more sharing capacity with others. If your organization has requested more quota, Azure Lab Services will save it just for you. ++**[Virtual network injection](how-to-connect-vnet-injection.md)**. Virtual network peering is replaced by virtual network injection. In your own subscription, create a virtual network in the same region as the lab plan and delegate a subnet to Azure Lab Services. Lab plans with advanced networking will cause labs to create VMs attached to your virtual network. ++**[Improved auto-shutdown](how-to-configure-auto-shutdown-lab-plans.md)**. Auto-shutdown settings are now available for *all* operating systems! ++**[More built-in roles](administrator-guide.md#rbac-roles)**. Previously, there was only the Lab Creator built-in role. WeΓÇÖve added a few more roles including Lab Operator and Lab Assistant. Lab operators can manage existing labs, but not create new ones. Lab assistants can only help students by starting, stopping, or redeploying virtual machines. Lab assistants can't adjust quota or set schedules. ++**[Improved cost tracking in Azure Cost Management](cost-management-guide.md#separate-the-costs)**. Lab virtual machines are now the cost unit tracked in Azure Cost Management. Tags for lab plan ID and lab name are automatically added to each cost entry. If you want to track the cost of a single lab, group the lab VM cost entries together by the lab name tag. Custom tags on labs will also propagate to Azure Cost Management entries to allow further cost analysis. ++**[Updates to lab owner experience](how-to-manage-labs.md)**. Choose to skip the template creation process when creating a new lab if you already have an image ready to use. WeΓÇÖve also added the ability to add a non-admin user to lab VMs. ++**[Updates to student experience](how-to-manage-vm-pool.md#redeploy-vms)**. Students can now redeploy their VM without losing data. We also updated the registration experience for some scenarios. A lab VM is assigned to students *automatically* if the lab is set up to use Azure AD group sync, Teams, or Canvas. ++**SDKs**. The Azure Lab Services PowerShell is now integrated with the [Az PowerShell module](/powershell/azure/release-notes-azureps). Also, check out the C# SDK. ++In this release, there are a few known issues: ++- When using virtual network injection, use caution in making changes to the virtual network and subnet. Changes may cause the lab VMs to stop working. For example, deleting your virtual network will cause all the lab VMs to stop working. We plan to improve this experience in the future, but for now make sure to delete labs before deleting networks. +- Moving lab plan and lab resources from one Azure region to another isn't supported. +- Azure Compute [resource provider must be registered](/azure/azure-resource-manager/management/resource-providers-and-types) before Azure Lab Services can [create and attach an Azure Compute Gallery resource](how-to-attach-detach-shared-image-gallery.md#create-and-attach-a-compute-gallery). ++### Lab plans replace lab accounts ++For the new version of Lab Services, the lab account concept is being replaced with a new concept called a lab plan. Although similar in functionality, there are some fundamental differences between the old lab account and the new lab plan. ++|Lab account (classic)|Lab plan| +|-|-| +|Lab account was the only resource that administrators could interact with inside the Azure portal.|Administrators can now manage two types of resources, lab plan and lab, in the Azure portal.| +|Lab account served as the **parent** for the labs.|Lab plan is a **sibling** resource to the lab resource. Grouping of labs is now done by the resource group.| +|Lab account served as a container for the labs. A change to the lab account often affected the labs under it.|The lab plan serves as a collection of configurations and settings that are applied when a lab is **created**. If you change a lab planΓÇÖs settings, these changes wonΓÇÖt affect any existing labs that were previously created from the lab plan. (The exception is the internal help information, which will affect all labs.)| ++Lab accounts and labs have a parental relationship. Moving to a sibling relationship between the lab plan and lab provides an upgraded experience. The following table compares the previous experience with a lab account and the new improved experience with a lab plan. ++|Feature/area|Lab account (classic)|Lab plan| +|-|-|-| +|Resource Management|Lab account was the only resource tracked in the Azure portal. All other resources were child resources of the lab account and tracked in Lab Services directly.|Lab plans and labs are now sibling resources in Azure. Administrators can use existing tools in the Azure portal to manage labs. Virtual machines will continue to be a child resource of labs.| +|Cost tracking|In Azure Cost Management, admins could only track and analyze cost at the service level and at the lab account level.| Cost entries in Azure Cost Management are now for lab virtual machines. Automatic tags on each entry specify the lab plan ID and the lab name. You can analyze cost by lab plan, lab, or virtual machine from within the Azure portal. Custom tags on the lab will also show in the cost data.| +|Selecting regions|By default, labs were created in the same geography as the lab account. A geography typically aligns with a country and contains one or more Azure regions. Lab owners weren't able to manage exactly which Azure region the labs resided in.|In the lab plan, administrators now can manage the exact Azure regions allowed for lab creation. By default, labs will be created in the same Azure region as the lab plan. </br> Note, when a lab plan has advanced networking enabled, labs are created in the same Azure region as virtual network.| +|Deletion experience|When a lab account is deleted, all labs within it are also deleted.|When deleting a lab plan, labs *aren't* deleted. After a lab plan is deleted, labs will keep references to their virtual network even if advanced networking is enabled. However, if a lab plan was connected to an Azure Compute Gallery, the labs can no longer export an image to that Azure Compute Gallery.| +|Connecting to a virtual network|The lab account provided an option to peer to a virtual network. If you already had labs in the lab account before you peered to a virtual network, the virtual network connection didn't apply to existing labs. Admins couldn't tell which labs in the lab account were peered to the virtual network.|In a lab plan, admins set up the advanced networking only at the time of lab plan creation. Once a lab plan is created, you'll see a read-only connection to the virtual network. If you need to use another virtual network, create a new lab plan configured with the new virtual network.| +|Labs portal experience|Labs are listed under lab accounts in [https://labs.azure.com](https://labs.azure.com).|Labs are listed under resource group name in [https://labs.azure.com](https://labs.azure.com). If there are multiple lab plans in the same resource group, educators can choose which lab plan to use when creating the lab.| +|Permissions needed to manage labs|To create a lab, someone must be assigned:</br>- **Lab Contributor** role on the lab account.</br>To modify an existing lab, someone must be assigned:</br>- **Reader** role on the lab account.</br>- **Owner** or **Contributor** role on the lab. (Lab creators are assigned the **Owner** role to any labs they create.)|To create a lab, someone must be assigned:</br>- **Owner** or **Contributor** role on the resource group that contains the lab plan.</br>- **Lab Creator** role on the lab plan.</br>To modify an existing lab, someone must be assigned:</br>- **Owner** or **Contributor** role on the lab. (Lab creators are assigned the **Owner** role to any labs they create.)| ++### Configure a lab plan ++Once the lab plan is [created](how-to-manage-lab-plans.md), administrators can set up configurations as needed. ++Most lab plan configurations apply at the time of lab creation. ++- Which region(s) the labs can be created in. +- Default auto-shutdown settings for labs. +- What marketplace images are allowed. +- What custom images from a connected Azure Compute Gallery are allowed. +- Linked Azure Compute Gallery to export custom VM images to. +- Give access to educators to create and manage labs. ++Configuration that applies to all labs: ++- Internal support information for your organization when using Azure Lab Services. ++Remember, changes made to the lab settings from the lab plan will apply only to new labs created after the settings change is saved. ++Don't forget to assign user permissions on the lab plan and the lab planΓÇÖs resource group. Permission assignments for new labs may also be required if labs are created for educators instead of by them. ++### Getting started ++Use the following checklist to get started with Azure Lab Services April 2022 Update (preview): ++> [!div class="checklist"] +> * Configure shared resources. +> * Create lab plans. +> * Request capacity. +> * Validate images. +> * Configure LMS integrations. +> * Create labs. +> * Update cost management reports. ++As you migrate, there likely will be a time when you're using both the April 2022 Update (preview) and the current version of Azure Lab Services. You might have both lab accounts and lab plans that coexist in your subscription and that access the same external resources. ++With all the new enhancements, it's a good time to revisit your overall lab structure. More than one lab plan might be needed depending on your scenario. For example, the math department may only require one lab plan in one resource group. The computer science department might require multiple lab plans. One lab plan can enable advanced networking and a few custom images. Another lab plan can use basic networking and not enable custom images. Both lab plans can be kept in the same resource group. ++Let's cover each step to get started with the April 2022 Update (preview) in more detail. ++1. **Configure shared resources**. Optionally, [configure licensing servers](how-to-create-a-lab-with-shared-resource.md). For VMs that require access to a licensing server, create a lab using a lab plan with [advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation). You can reuse the same Azure Compute Gallery and the licensing servers that you use with your lab accounts. +1. **Create Lab plans.** ++ 1. [Create](tutorial-setup-lab-plan.md) and [configure lab plans](#configure-a-lab-plan). If you plan to use a license server, don't forget to enable [advanced networking](how-to-connect-vnet-injection.md#connect-the-virtual-network-during-lab-plan-creation) when creating your lab plans. + 1. [Assign permissions](tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role) to educators that will create labs. + 1. Enable [Azure Marketplace images](specify-marketplace-images.md). + 1. Optionally, [attach an Azure Compute Gallery](how-to-attach-detach-shared-image-gallery.md). ++1. **Request capacity**. Forecast and [request dedicated VM capacity](capacity-limits.md#request-a-limit-increase). Even if enrollment isn't finalized, you can use preliminary estimates for your initial capacity request. You can request more capacity later, if needed. +1. **Validate images**. Each of the VM sizes has been remapped to use a newer Azure VM Compute SKU. If using an [attached compute gallery](how-to-attach-detach-shared-image-gallery.md), validate images with new [Azure VM Compute SKUs](administrator-guide.md#vm-sizing). Validate that each image in the compute gallery is replicated to regions the lab plans and labs are in. +1. **Configure integrations**. Optionally, configure [integration with Canvas](lab-services-within-canvas-overview.md) including [adding the app and linking lab plans](how-to-get-started-create-lab-within-canvas.md). Alternately, configure [integration with Teams](lab-services-within-teams-overview.md) by [adding the app to Teams groups](how-to-get-started-create-lab-within-teams.md). +1. **Create labs**. Create labs to test educator and student experience in preparation for general availability of the updates. Lab administrators and educators should validate performance based on common student workloads. +1. **Update cost management reports.** Update reports to include the new cost entry type, `Microsoft.LabServices/labs`, for labs created using the April 2022 Update (preview). [Built-in and custom tags](cost-management-guide.md#understand-the-entries) allow for [grouping](/azure/cost-management-billing/costs/quick-acm-cost-analysis) in cost analysis. For more information about tracking costs, see [Cost management for Azure Lab Services](cost-management-guide.md). ++## Next steps ++- As an admin, [create a lab plan](tutorial-setup-lab-plan.md). +- As an admin, [manage your lab plan](how-to-manage-lab-plans.md). +- As an educator, [create a lab](tutorial-setup-lab.md). +- As a student, [access a lab](how-to-use-lab.md). |
| lab-services | Lab Services Within Canvas Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-services-within-canvas-overview.md | + + Title: Overview of Labs within Canvas | Microsoft Docs +description: Learn how to use Lab Services within Canvas. + Last updated : 01/22/2022+++# Overview of Lab Services within Canvas + ++Azure Lab Services now provides an integrated experience for using labs with the Canvas. [Canvas LMS](https://www.instructure.com/canvas) is a cloud-based learning management system that provides one place for course content, quizzes, and grades for both educators and students. Educators can create labs from within Canvas and students will see their lab VMs alongside their other material for a course. ++## Benefits ++Integration with Canvas LMS includes the following key capabilities: ++- Labs are created and managed inside a course in Canvas. +- Each lab automatically pulls and updates the list of students based on the latest course roster. +- Virtual machines are added and deleted automatically based on changes to the course roster. +- Students access their labs directly inside a course in Canvas. ++## Next steps ++See the following articles: ++- [Get started and create a Lab Services lab within Canvas](how-to-get-started-create-lab-within-canvas.md) +- [Manage lab user lists within Canvas](how-to-manage-user-lists-within-canvas.md) +- [Manage lab's VM pool within Canvas](how-to-manage-vm-pool-within-canvas.md) +- [Create and manage lab schedules within Canvas](how-to-create-schedules-within-canvas.md) +- [Access a VM within Canvas ΓÇô Student view](how-to-access-vm-for-students-within-canvas.md) |
| lab-services | Lab Services Within Teams Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-services-within-teams-overview.md | Last updated 10/07/2020 # Azure Lab Services within Microsoft Teams -Azure Lab Services can be leveraged within Microsoft Teams using **Azure Lab Services** Teams App. Any team owner with owner/contributor/creator access to the lab accounts will be able to create labs and provision virtual machines to everyone on the team. +Azure Lab Services can be leveraged within Microsoft Teams using **Azure Lab Services** Teams App. Any team owner with owner/contributor/creator access to the lab plan will be able to create labs and provision virtual machines to everyone on the team. -This article outlines the benefits of using Azure Lab Services within Teams and provides links to other articles for instructions on how to create and manage labs within Teams. +This article outlines the benefits of using Azure Lab Services within Teams and provides links to other articles for instructions on how to create and manage labs within Teams. > [!NOTE]->**Azure Lab Services** Teams App can be added only to a team, it cannot be added to individual chats or group chats. +> **Azure Lab Services** Teams App can be added only to a team, it cannot be added to individual chats or group chats. ## Benefits -Azure Lab Services integration with Microsoft Teams will help educators set up a classroom environment and provide virtual lab environments within the team(class): +Azure Lab Services integration with Microsoft Teams will help educators set up a classroom environment and provide virtual lab environments within the team(class): -* Educators can set up labs so the students can access their VMs from within Teams, without leaving Teams and having to navigate to the [Azure Lab Services website](https://labs.azure.com). +* Educators can set up labs so the students can access their VMs from within Teams, without leaving Teams and having to navigate to the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). * Single Sign-on (SSO) from Teams to Azure Lab Services.-* Team and Lab owners need not maintain class rosters in two different systems - Lab user list is autopopulated from the Team membership and a sync is performed every 24 hours automatically. -* After the initial publish of the Template VM, Lab Capacity (that is, number of VMs in the lab) would be automatically adjusted based on the addition/deletion of users from the Team membership. -* Team and Lab Owners will view only the labs related to the team and students will view only the VMs, which are provisioned for the specific team. +* Team and Lab owners need not maintain class rosters in two different systems - Lab user list is autopopulated from the Team membership and a sync is performed every 24 hours automatically. +* After the initial publish of the Template VM, Lab Capacity (that is, number of VMs in the lab) would be automatically adjusted based on the addition/deletion of users from the Team membership. +* Team and Lab Owners will view only the labs related to the team and students will view only the VMs, which are provisioned for the specific team. * Users will be auto registered to the lab and VMs will be automatically assigned upon the first login after the lab is published. Educators don't need to send invitations and students don't need to register for the lab separately. ## Next steps See the following articles: -- [Get started and create a lab within Teams](how-to-get-started-create-lab-within-teams.md)-- [Manage lab user lists within Teams](how-to-manage-user-lists-within-teams.md)-- [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md)-- [Create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md)-- [Access a VM within Teams ΓÇô Student view](how-to-access-vm-for-students-within-teams.md)+* [Get started and create a lab within Teams](how-to-get-started-create-lab-within-teams.md) +* [Manage lab user lists within Teams](how-to-manage-user-lists-within-teams.md) +* [Manage lab's VM pool within Teams](how-to-manage-vm-pool-within-teams.md) +* [Create and manage lab schedules within Teams](how-to-create-schedules-within-teams.md) +* [Access a VM within Teams ΓÇô Student view](how-to-access-vm-for-students-within-teams.md) |
| lab-services | Lab User Support Information | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/lab-user-support-information.md | You can use this information to get help when you run into any technical issues ## View support information-1. Sign in to [Azure Lab Services portal](https://labs.azure.com). +1. Sign in to Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). 2. Select the **lab or virtual machine** for which you need help, and select **?** at the top-right corner of the page. 3. Confirm that you see links to the **view support website**, **email support**, and **support phone number**. |
| lab-services | Manage Labs 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/manage-labs-1.md | + + Title: View and delete labs in a lab account in Azure Lab Services (deprecated) +description: Learn how to view all labs in a lab account and delete a lab from the lab account. + Last updated : 06/26/2020+++# Manage labs in a lab account (deprecated) ++This article shows you how a lab account owner or administrator can view all the labs in a lab account, and delete a lab in the lab account. ++## View labs in a lab account ++1. On the **Lab Account** page, select **All labs** on the left menu. ++  +1. You see a **list of labs** in the account with the following information: + 1. Name of the lab. + 2. The date on which the lab was created. + 3. Email address of the user who created the lab. + 4. Maximum number of users allowed into the lab. + 5. Status of the lab. + 6. Role assignments. ++## Delete a lab in a lab account ++Follow instructions in the previous section to see a list of the labs in the lab account. ++1. Select **... (ellipsis)**, and select **Delete**. ++  +2. Select **Yes** on the warning message. ++  ++## Next steps ++See other articles in the **How-to guides** -> **Create and configure lab accounts (lab account owner)** section of the table-of-content (TOC). |
| lab-services | Manage Labs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/manage-labs.md | Title: View and delete labs in a lab account in Azure Lab Services -description: Learn how to view all labs in a lab account and delete a lab from the lab account. + Title: View and delete labs in Azure Lab Services +description: Learn how to view and delete all the labs associated with a lab plan. Previously updated : 06/26/2020 Last updated : 04/06/2021+ -# Manage labs in a lab account -This article shows you how a lab account owner or administrator can view all the labs in a lab account, and delete a lab in the lab account. +# Manage labs -## View labs in a lab account +This article describes how a lab plan owner or administrator can view and delete all the labs associated with a lab plan. -1. On the **Lab Account** page, select **All labs** on the left menu. +Lab plans and labs are sibling resources contained in a resource group. Administrators can use existing tools in the Azure portal to manage labs. -  -1. You see a **list of labs** in the account with the following information: +## View labs ++1. Open the **Resource Group** page. ++ :::image type="content" source="./media/how-to-manage-lab-plans/labs-in-resource-group.png" alt-text="Screenshot of the labs in the plan."::: ++ To view only lab resources, set a filter for `Type == Lab`. ++1. You see a **list of labs** with the following information: 1. Name of the lab.- 2. The date on which the lab was created. - 3. Email address of the user who created the lab. - 4. Maximum number of users allowed into the lab. - 5. Status of the lab. - 6. Role assignments. + 1. Type of the resource (Lab). + 1. Location of the lab. ++1. Open a lab to view additional information such as the associated lab plan, OS type, and virtual machine size. -## Delete a lab in a lab account -Follow instructions in the previous section to see a list of the labs in the lab account. +## Delete a lab -1. Select **... (ellipsis)**, and select **Delete**. +1. Open the **Resource Group** page. -  -2. Select **Yes** on the warning message. + To view only lab resources, set a filter for `Type == Lab`. -  +1. Select **... (ellipsis)**, and then select **Delete**. ++ :::image type="content" source="./media/how-to-manage-lab-plans/delete-lab-button.png" alt-text="Screenshot of lab deletion."::: ++1. Type **Yes** on the warning message. ++ :::image type="content" source="./media/how-to-manage-lab-plans/confirm-lab-delete.png" alt-text="Screenshot of lab deletion confirmation message."::: ## Next steps-See other articles in the **How-to guides** -> **Create and configure lab accounts (lab account owner)** section of the table-of-content (TOC). ++See other articles in the **How-to guides** -> **Create and configure lab plans (lab plan owner)** section of the table-of-content (TOC). |
| lab-services | Quick Create Lab Plan Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/quick-create-lab-plan-portal.md | + + Title: Azure Lab Services Quickstart - Create a lab plan using the Azure portal +description: In this quickstart, you learn how to create an Azure Lab Services lab plan using the Azure portal. + Last updated : 1/18/2022++++# Quickstart: Create a lab plan using the Azure portal ++A lab plan for Azure Lab Services can be created through the Azure portal. This quickstart shows you, as the admin, how to use the Azure portal to create a lab plan. Lab plans are used when creating labs for Azure Lab Services. You'll also add a role assignment so an educator can create labs based on the lab plan. For an overview of Azure Lab Services, see [An introduction to Azure Lab Services](lab-services-overview.md). ++## Prerequisites ++To complete this quick start, make sure that you have: ++- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/). ++## Create a lab plan ++The following steps show how to use the Azure portal to create a lab plan. ++1. In the [Azure portal](https://portal.azure.com), select **Create a resource** at the top left of the screen. +1. Select **All services** in the left menu. Search for **Lab plans**. +1. Select the **Lab plans (preview)** tile, select **Create**. ++ :::image type="content" source="./media/quick-create-lab-plan-portal/select-lab-plans-service.png" alt-text="Screenshot that shows the Lab plan tile for Azure Marketplace."::: ++1. On the **Basics** tab of the **Create a lab plan** page: + 1. For the **Subscription**, select the Azure subscription in which you want to create the lab plan. + 1. For **Resource Group**, select **Create New** and enter *MyResourceGroup*. + 1. For **Name**, enter a *MyLabPlan*. + 1. For **Region**, select the Azure region you want to create the lab plan. (Region for the lab plan is also the default region where your labs will be created.) + 1. Select **Review + create**. ++ :::image type="content" source="./media/quick-create-lab-plan-portal/Create-lab-plan-basics-tab.png" alt-text="Screenshot that shows the Basics tab of the Create a new lab plan experience."::: ++1. Review the summary and select **Create**. ++ :::image type="content" source="./media/quick-create-lab-plan-portal/Create-lab-plan-review-create-tab.png" alt-text="Screenshot that shows the Review and Create tab of the Create a new lab plan experience."::: ++1. When the deployment is complete, expand **Next steps**, and select **Go to resource**. ++ :::image type="content" source="./media/quick-create-lab-plan-portal/Create-lab-plan-deployment-complete.png" alt-text="Screenshot that the deployment of the lab plan resource is complete."::: ++1. Confirm that you see the **Overview** page for *MyLabPlan*. ++## Add a user to the Lab Creator role +++## Clean up resources ++When no longer needed, you can delete the resource group, lab plan, and all related resources. ++1. On the **Overview** page for the lab plan, select the **Resource group** link. +1. At the top of the page for the resource group, select **Delete resource group**. +1. A page will open warning you that you're about to delete resources. Type the name of the resource group and select **Delete** to finish deleting the resources and the resource group. ++## Next steps ++In this quickstart, you created a resource group and a lab plan. To learn more about advanced options for lab plans, see [Tutorial: Create a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). ++Advance to the next article to learn how to create a lab. +> [!div class="nextstepaction"] +> [Create a lab](quick-create-lab-portal.md) |
| lab-services | Quick Create Lab Plan Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/quick-create-lab-plan-powershell.md | + + Title: Azure Lab Services Quickstart - Create a lab plan using PowerShell +description: In this quickstart, you learn how to create an Azure Lab Services lab plan using PowerShell and the Az module. ++ Last updated : 02/15/2022++++# Quickstart: Create a lab plan using PowerShell and the Azure modules ++In this article you, as the admin, use PowerShell and the Azure module to create a lab plan. Lab plans are used when creating labs for Azure Lab Services. You'll also add a role assignment so an educator can create labs based on the lab plan. For an overview of Azure Lab Services, see [An introduction to Azure Lab Services](lab-services-overview.md). ++## Prerequisites ++- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free). +- [Windows PowerShell](/powershell/scripting/windows-powershell/starting-windows-powershell?view=powershell-7.2&preserve-view=true). +- [Azure Az PowerShell module](/powershell/azure/new-azureps-module-az). Must be version 7.2 or higher. ++ ```powershell + Install-Module 'Az' + ``` ++- [Az.LabServices PowerShell module](/powershell/module/az.labservices/). ++ ```powershell + Install-Module 'Az.LabServices' + ``` ++Run [Connect-AzAccount](/powershell/module/az.accounts/connect-azaccount) to sign in to Azure and verify an active subscription. ++## Create a lab plan ++The following steps will show you how to create a lab plan. Any properties set in the lab plan will be used in labs created with this plan. ++```powershell +New-AzResourceGroup -Name "MyResourceGroup" -Location "eastus" ++$plan = New-AzLabServicesLabPlan -Name "ContosoLabPlan" ` + -ResourceGroupName "MyResourceGroup" ` + -Location "eastus" ` + -AllowedRegion @("westus","eastus") +``` ++## Add a user to the Lab Creator role ++To create or edit up a lab in the Lab Services web portal ([https://labs.azure.com](https://labs.azure.com)), the educator must be assigned the **Lab Creator** role. Assigning the **Lab Creator** role on the lab plan's resource group will allow an educator to use all lab plans in that resource group. ++```powershell +New-AzRoleAssignment -SignInName <emailOrUserprincipalname> ` + -RoleDefinitionName "Lab Creator" ` + -ResourceGroupName "MyResourceGroup" +``` ++For more information about role assignments, see [Assign Azure roles using Azure PowerShell](/azure/role-based-access-control/role-assignments-powershell). ++## Clean up resources ++If you're not going to continue to use this application, delete the lab with the following steps: ++```powershell +Remove-AzRoleAssignment -SignInName <emailOrUserprincipalname> ` + -RoleDefinitionName "Lab Creator" ` + -ResourceGroupName "MyResourceGroup" +$plan | Remove-AzLabServicesLabPlan +``` ++## Next steps ++In this QuickStart, you created a resource group and a lab plan. As an admin, you can learn more about [Azure PowerShell module](/powershell/azure) and [Az.LabServices cmdlets](/powershell/module/az.labservices/). ++> [!div class="nextstepaction"] +> [Quickstart: Create a lab using PowerShell and the Azure module](quick-create-lab-powershell.md) |
| lab-services | Quick Create Lab Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/quick-create-lab-portal.md | + + Title: Azure Lab Services Quickstart - Create a lab using the Azure Lab Services labs.azure.com portal. +description: In this quickstart, you learn how to create an Azure Lab Services lab using the labs.azure.com portal. + Last updated : 1/18/2022++++# Quickstart: Create a lab using the Azure Lab Services portal ++Educators can create labs containing VMs for students using the Azure Lab Services portal. This quickstart shows you how to create a lab with Windows 11 Pro image. Once a lab is created, an educator [configures the template](how-to-create-manage-template.md), [adds lab users](how-to-configure-student-usage.md#add-and-manage-lab-users), and [publishes the lab](tutorial-setup-lab.md#publish-a-lab). ++## Prerequisites ++To complete this quick start, make sure that you have: ++- Azure subscription. If you donΓÇÖt have one, [create a free account](https://azure.microsoft.com/free/) before you begin. +- Lab plan. If you haven't create a lab plan, see [Quickstart: Create a lab plan using the Azure portal](quick-create-lab-plan-portal.md). ++## Create a lab ++The following steps show how to create a lab with Azure Lab Services. ++1. Sign into the [Azure Lab Service portal](https://labs.azure.com). +1. Select **New lab**. ++ :::image type="content" source="./media/quick-create-lab-portal/new-lab-button.png" alt-text="Screenshot of Azure Lab Services portal. New lab button is highlighted."::: ++1. In the **New Lab** window, choose the basic settings for the lab. + 1. Set the **Name** to *Lab 101*. + 1. Set the **Virtual machine image** to **Windows 11 Pro**. + 1. Set the **Virtual machine size** to **Medium**. ++ :::image type="content" source="./media/quick-create-lab-portal/new-lab-window.png" alt-text="Screenshot of the New lab window for Azure Lab Services."::: ++ 1. On the **Virtual machine credentials** page, specify default administrator credentials for all VMs in the lab. Specify the **name** and the **password** for the administrator. By default all the student VMs will have the same password as the one specified here. ++ :::image type="content" source="./media/quick-create-lab-portal/new-lab-credentials.png" alt-text="Screenshot of the Virtual Machine credentials window for Azure Lab Services."::: ++ > [!IMPORTANT] + > Make a note of user name and password. They won't be shown again. ++ 1. On the **Lab policies** page, leave the default selections and select **Next**. ++ :::image type="content" source="./media/quick-create-lab-portal/quota-for-each-user.png" alt-text="Screenshot of the Lab policy window when creating a new Azure Lab Services lab."::: ++ 1. On the **Template virtual machine settings** window, leave the selection on **Create a template virtual machine**. ++ :::image type="content" source="./media/quick-create-lab-portal/template-virtual-machine-settings.png" alt-text="Screenshot of the Template virtual machine settings windows when creating a new Azure Lab Services lab."::: ++1. You should see the following screen that shows the status of the template VM creation. ++ :::image type="content" source="./media/quick-create-lab-portal/create-template-vm-progress.png" alt-text="Screenshot of status of the template VM creation."::: ++1. When the lab is completed, you'll see the **Template** page of the lab. ++ :::image type="content" source="./media/quick-create-lab-portal/lab-template-page.png" alt-text="Screenshot of Template page of a lab."::: ++## Clean up resources ++When no longer needed, you can delete the lab. ++On the tile for the lab, select three dots (...) in the corner, and then select **Delete**. +++On the **Delete lab** dialog box, select **Delete** to continue with the deletion. ++## Next steps ++In this quickstart, you created a lab with Azure Lab Services. To learn more about advanced options for labs, see [Tutorial: Create and publish a lab](tutorial-setup-lab.md). ++Advance to the next article to learn how to configure the template VM. ++> [!div class="nextstepaction"] +> [Configure a template VM](how-to-create-manage-template.md) |
| lab-services | Quick Create Lab Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/quick-create-lab-powershell.md | + + Title: Azure Lab Services Quickstart - Create a lab using PowerShell +description: In this quickstart, you learn how to create an Azure Lab Services lab using PowerShell and the Az module. ++ Last updated : 02/15/2022++++# Quickstart: Create a lab using PowerShell and the Azure module ++In this quickstart, you, as the educator, create a lab using PowerShell and the Azure modules. The lab will use the settings from a previously created lab plan. For detailed overview of Azure Lab Services, see [An introduction to Azure Lab Services](lab-services-overview.md). ++## Prerequisites ++- Azure subscription. If you donΓÇÖt have one, [create a free account](https://azure.microsoft.com/free/) before you begin. +- [Windows PowerShell](/powershell/scripting/windows-powershell/starting-windows-powershell?view=powershell-7.2&preserve-view=true). +- [Azure Az PowerShell module](/powershell/azure/new-azureps-module-az). Must be version 7.2 or higher. ++ ```powershell + Install-Module 'Az' + ``` ++- [Az.LabServices PowerShell module](/powershell/module/az.labservices/). ++ ```powershell + Install-Module 'Az.LabServices' + ``` ++- Lab plan. To create a lab plan, see [Quickstart: Create a lab plan using PowerShell and the Azure modules](quick-create-lab-plan-powershell.md). ++Run [Connect-AzAccount](/powershell/module/az.accounts/connect-azaccount) to sign in to Azure and verify an active subscription. ++## Create a lab ++Before we can create a lab, we need the lab plan object. In the [previous quickstart](quick-create-lab-plan-powershell.md), we created a lab plan named `ContosoLabPlan` in a resource group named `MyResourceGroup`. ++```powershell +$plan = Get-AzLabServicesLabPlan ` + -Name "ContosoLabPlan" ` + -ResourceGroupName "MyResourceGroupName" +``` ++We also need to choose a base image for the lab VMs from the available images for the lab plan. Let's see what is available. ++```powershell +$plan | Get-AzLabServicesPlanImage | Where-Object { $_.EnabledState.ToString() -eq "enabled" } +``` ++We'll choose the Windows 11 image. ++```powershell +$image = $plan | Get-AzLabServicesPlanImage | Where-Object { $_.EnabledState.ToString() -eq "enabled" -and $_.DisplayName -eq "Windows 11 Pro (Gen2)" } +``` ++We're now ready to create a lab based of our lab plan with the Window 11 Pro image. The following command will create a lab using the lab plan created above. ++``` powershell +# $plan and $image are from the Create LabPlan QuickStart. +$password = "<custom password>" ++$lab = New-AzLabServicesLab -Name "ContosoLab" ` + -ResourceGroupName "MyResourceGroup" ` + -Location "westus" ` + -LabPlanId $plan.Id ` + -AdminUserPassword (ConvertTo-SecureString $password -AsPlainText -Force) ` + -AdminUserUsername "adminUser" ` + ` + -AutoShutdownProfileShutdownOnDisconnect Enabled ` + -AutoShutdownProfileDisconnectDelay $(New-Timespan) ` + -AutoShutdownProfileShutdownOnIdle "LowUsage" ` + -AutoShutdownProfileIdleDelay $(New-TimeSpan -Minutes 15) ` + -AutoShutdownProfileShutdownWhenNotConnected Disabled ` + -AutoShutdownProfileNoConnectDelay $(New-TimeSpan -Minutes 15) ` + ` + -ConnectionProfileClientRdpAccess Public ` + -ConnectionProfileClientSshAccess None ` + -ConnectionProfileWebRdpAccess None ` + -ConnectionProfileWebSshAccess None ` + -SecurityProfileOpenAccess Disabled ` + ` + -ImageReferenceOffer $image.Offer ` + -ImageReferencePublisher $image.Publisher ` + -ImageReferenceSku $image.Sku ` + -ImageReferenceVersion $image.Version ` + -SkuCapacity 1 ` + -SkuName "Classic_Fsv2_4_8GB_128_S_SSD" ` + ` + -Title "Contoso Lab" ` + -Description "The Contoso lab" ` + -AdditionalCapabilityInstallGpuDriver Disabled ` + -VirtualMachineProfileCreateOption "TemplateVM" ` + -VirtualMachineProfileUseSharedPassword Enabled +``` ++## Clean up resources ++If you're not going to continue to use this application, delete +the plan and lab with the following steps: ++```powershell +$lab | Remove-AzLabServicesLab +``` ++## More information ++As an admin, you can learn more about [Azure PowerShell module](/powershell/azure) and [Az.LabServices cmdlets](/powershell/module/az.labservices/). |
| lab-services | Reference Powershell Module | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/reference-powershell-module.md | Title: PowerShell module for Azure Lab Services description: Learn how to install and launch Az.LabServices PowerShell module Previously updated : 12/12/2021 Last updated : 04/06/2022+ -# Az.LabServices PowerShell module (preview) for Azure Lab Services resources +# Az.LabServices PowerShell module for Azure Lab Services resources (deprecated) +++> [!NOTE] +> To learn more about the integrated Az module experience available with the April 2022 Update (preview), see [Quickstart: Create a lab plan using PowerShell and the Azure modules](quick-create-lab-plan-powershell.md). The [Az.LabServices (preview)](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Modules/Library) PowerShell module simplifies the management of Azure Lab Services. This module provides composable functions to create, query, update and delete resources, such as labs, lab accounts, VMs, and images. ## Install and launch -1. Install [Azure PowerShell](/powershell/azure/). +1. Install [Azure PowerShell](/powershell/azure/). 1. Download [Az.LabServices.psm1](https://github.com/Azure/azure-devtestlab/blob/master/samples/ClassroomLabs/Modules/Library/Az.LabServices.psm1) module to your machine. 1. Import the module:+ ```powershell Import-Module .\Az.LabServices.psm1 ```- Some example commands: - ```powershell - # To list all the labs in your subscription: - Get-AzLabAccount | Get-AzLab - #To stop all running VMs in all labs - Get-AzLabAccount | Get-AzLab | Get-AzLabVm -Status Running | Stop-AzLabVm - ``` - +Some example commands: ++```powershell +# To list all the labs in your subscription: +Get-AzLabAccount | Get-AzLab ++# To stop all running VMs in all labs +Get-AzLabAccount | Get-AzLab | Get-AzLabVm -Status Running | Stop-AzLabVm +``` + ## Next steps Learn more about module at the [Az.LabServices home page on GitHub](https://github.com/Azure/azure-devtestlab/tree/master/samples/ClassroomLabs/Modules/Library). |
| lab-services | Setup Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/setup-guide.md | Title: Accelerated lab setup guide for Azure Lab Services -description: If you're a lab creator, this guide can help you quickly set up a lab account at your school. +description: If you're a lab creator, this guide can help you quickly set up a lab plan at your school. Last updated 06/26/2020 Refer to your class's learning objectives as you decide which operating system, - **Create a new custom image**: You can create your own custom image by using an Azure Marketplace image as a starting point. You can then customize it by installing additional software and making configuration changes. -- **Use an existing custom image**: You can reuse custom images that you previously created, or images that were created by other administrators or faculty at your school. To use custom images, your administrators need to set up a Shared Image Gallery. A Shared Image Gallery is a repository that is used for saving custom images.+- **Use an existing custom image**: You can reuse custom images that you previously created, or images that were created by other administrators or faculty at your school. To use custom images, your administrators need to set up an Azure Compute Gallery. A compute gallery is a repository that is used for saving custom images. > [!NOTE] > Your administrators are responsible for enabling Azure Marketplace images and custom images so that you can use them. Coordinate with your IT department to ensure that the images that you need are enabled. Custom images that you create are automatically enabled for use within labs that you own. You can choose from a variety of compute sizes: - **GPU sizes**: Lets your students use computer-intensive types of applications. For example, this choice is often used with artificial intelligence and machine learning. For guidance on selecting the appropriate VM size, see:+ - [VM sizing](./administrator-guide.md#vm-sizing) - [Move from a physical lab to Azure Lab Services](https://techcommunity.microsoft.com/t5/azure-lab-services/moving-from-a-physical-lab-to-azure-lab-services/ba-p/1654931) For guidance on selecting the appropriate VM size, see: > Because compute size availability varies by region, fewer sizes might be available to your lab. Generally, you should select the smallest compute size that suits your needs. With Azure Lab Services, you can set up a new lab with a greater compute capacity later, if you need to. ### What dependencies does the class have on external Azure or network resources?+ Your lab VMs might need access to external resources, such as a database, a file share, or a licensing server. To allow your lab VMs to use external resources, coordinate with your IT administrators. > [!NOTE] > You should consider whether you can reduce your lab's dependency on external resources by providing network resources directly on the VM. For example, to eliminate the need to read data from an external database, you can install the database directly on the VM. ### How will you control costs?+ Lab Services uses a pay-as-you-go pricing model, which means that you pay only for the time that a lab VM is running. To control costs, use any or all of the following options: - **Schedule**: Use schedules to automatically control when your lab VMs are started and shut down. Lab Services uses a pay-as-you-go pricing model, which means that you pay only f - **Automatic shutdown**: When you enable the auto-shutdown setting, Windows VMs automatically shut down after a student has disconnected from a Remote Desktop Protocol (RDP) session. By default, this setting is disabled. For more information about controlling costs, see:+ - [Estimate costs](./cost-management-guide.md#estimate-the-lab-costs) - [Manage costs](./cost-management-guide.md#manage-costs) ### How will students save their work?+ Each individual student is assigned a VM for the lifetime of the lab. Students can save their work: - To the VM. Each individual student is assigned a VM for the lifetime of the lab. Students c > To ensure that your students have continued access to their saved work outside of the lab and after the class ends, we recommend that they save their work to an external repository. ### How will students connect to their VMs?+ For RDP connections to Windows VMs, we recommend that students use the [Microsoft Remote Desktop client](/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). The Remote Desktop client supports Mac, Chromebook, and Windows devices. For Linux VMs, students can use either the Secure Shell (SSH) or RDP protocol. To have students connect by using RDP, you must install and configure the necessary RDP and graphical user interface (GUI) packages. ### Will students also use Microsoft Teams?+ Azure Lab Services integrates with Microsoft Teams so that faculty members can create and manage their labs in Teams. Similarly, students can access their labs in Teams. For more information, see [Azure Lab Services in Microsoft Teams](./lab-services-within-teams-overview.md). For more information, see [Azure Lab Services in Microsoft Teams](./lab-services After you understand the requirements for your class's lab, you're ready to set it up. To learn how, follow the links in this section. Instructions are also provided for setting up labs in Teams. 1. **Create a lab**. See the following tutorials:- - [Create a classroom lab](./tutorial-setup-classroom-lab.md#create-a-classroom-lab) + - [Create a lab](./tutorial-setup-lab.md#create-a-lab) - [Create a lab in Teams](./how-to-get-started-create-lab-within-teams.md)+ - [Create a lab in Canvas](how-to-get-started-create-lab-within-canvas.md) ++1. **Customize images and publish lab VMs**. To connect to a special VM called the template VM, see: + - [Create and manage a template VM](./tutorial-setup-lab.md#publish-a-lab) + - [Use a compute gallery](./how-to-use-shared-image-gallery.md) > [!NOTE] > If your class requires nested virtualization, see [Enable nested virtualization](./how-to-enable-nested-virtualization-template-vm.md). -1. **Customize images and publish lab VMs**. To connect to a special VM called the template VM, see: - - [Create and manage a template VM](./tutorial-setup-classroom-lab.md#publish-the-template-vm) - - [Use a shared image gallery](./how-to-use-shared-image-gallery.md) - > [!NOTE] > If you're using Windows, also see [Set up a Windows template VM](./how-to-prepare-windows-template.md). These instructions include steps for setting up OneDrive and Microsoft Office for your students. After you understand the requirements for your class's lab, you're ready to set - [Manage a VM pool in Lab Services in Teams](./how-to-manage-vm-pool-within-teams.md) 1. **Add and manage lab users**. To add users to your lab, see:- - [Add users to the lab](./tutorial-setup-classroom-lab.md#add-users-to-the-lab) - - [Send invitations to users](./tutorial-setup-classroom-lab.md#send-invitation-emails-to-users) + - [Add users to the lab](./tutorial-setup-lab.md#add-users-to-the-lab) + - [Send invitations to users](./tutorial-setup-lab.md#send-invitation-emails-to-users) - [Manage Lab Services user lists in Teams](./how-to-manage-user-lists-within-teams.md) For information about the types of accounts that students can use, see [Student accounts](./how-to-configure-student-usage.md#student-accounts). 1. **Set cost controls**. To set a schedule, establish quotas, and enable automatic shutdown, see the following tutorials: - - [Set a schedule](./tutorial-setup-classroom-lab.md#set-a-schedule-for-the-lab) + - [Set a schedule](./tutorial-setup-lab.md#set-a-schedule-for-the-lab) > [!NOTE] > Depending on the operating system you've installed, a VM might take several minutes to start. To ensure that a lab VM is ready for use during your scheduled hours, we recommend that you start it 30 minutes in advance. After you understand the requirements for your class's lab, you're ready to set - [Enable automatic shutdown on disconnect](./how-to-enable-shutdown-disconnect.md) > [!NOTE]- > Schedules and quotas don't apply to the template VM, but the automatic shutdown settings do apply. - > - > When you create a lab, the template VM is created but not started. You can start the template VM, connect to it, install any prerequisite software for the lab, and then publish it. When you publish the template VM, it is automatically shut down for you if you havenΓÇÖt done so manually. - > + > Schedules and quotas don't apply to the template VM, but the automatic shutdown settings do apply. + > + > When you create a lab, the template VM is created but not started. You can start the template VM, connect to it, install any prerequisite software for the lab, and then publish it. When you publish the template VM, it is automatically shut down for you if you havenΓÇÖt done so manually. + > > Template VMs incur *cost* when they're running, so ensure that the template VM is shut down when you donΓÇÖt need it to be running. - - [Create and manage Lab Services schedules in Teams](./how-to-create-schedules-within-teams.md) + - [Create and manage Lab Services schedules in Teams](./how-to-create-schedules-within-teams.md) -1. **Use the dashboard**. For instructions, see [Use the classroom lab dashboard](./use-dashboard.md). +1. **Use the dashboard**. For instructions, see [Use the lab dashboard](./use-dashboard.md). > [!NOTE]- > The estimated cost shown on the dashboard is the maximum cost that you can expect to incur for student lab usage. For example, you will *not* be charged for unused quota hours by your students. The estimated costs do *not* reflect any charges for using the template VM, the shared image gallery, or when the lab creator starts a user machine. + > The estimated cost shown on the dashboard is the maximum cost that you can expect to incur for student lab usage. For example, you will *not* be charged for unused quota hours by your students. The estimated costs do *not* reflect any charges for using the template VM, the compute gallery, or when the lab creator starts a user machine. ## Next steps As part of managing your labs, see the following articles:-- [Track classroom lab usage](tutorial-track-usage.md) -- [Access a classroom lab](tutorial-connect-virtual-machine-classroom-lab.md)++- [Track lab usage](tutorial-track-usage.md) +- [Access a lab](tutorial-connect-lab-virtual-machine.md) |
| lab-services | Specify Marketplace Images 1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/specify-marketplace-images-1.md | + + Title: Specify marketplace images in a lab account (deprecated) +description: This article shows you how to specify the Marketplace images that a lab creator can use to create labs. + Last updated : 02/15/2022+++# Specify Marketplace images available to lab creators (deprecated) ++As a lab account owner, you can specify the Marketplace images that lab creators can use to create labs in the lab account. ++## Select images available for labs ++Select **Marketplace images** on the menu to the left. By default, you see the full list of images (both enabled and disabled). You can filter for **Status** to be equal to **Enabled** or **Disabled**. +++The Marketplace images that are displayed in the list are only the ones that satisfy the following conditions: ++- Creates a single VM. +- Uses Azure Resource Manager to provision VMs +- Doesn't require purchasing an extra licensing plan ++## Enable and disable images ++To enable one or more images: ++1. Check images you want to enable. +2. Select **Enable image** button. +3. Select **Apply**. +++To disable one or images: ++1. Check images you want to disable. +2. Select **Disable image** button. +3. Select **Apply**. ++## Next steps ++- As an educator, [create and manage labs](how-to-manage-classroom-labs.md). +- As an educator, [configure and publish templates](how-to-create-manage-template.md). +- As an educator, [configure and control usage of a lab](how-to-configure-student-usage.md). +- As a student, [access labs](how-to-use-lab.md). |
| lab-services | Specify Marketplace Images | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/specify-marketplace-images.md | Title: Specify marketplace images for a lab in Azure Lab Services -description: This article shows you how to specify the Marketplace images that lab creator can use to create labs in a lab account in Azure Lab Services. +description: This article shows you how to specify which Marketplace images can be used during lab creation. Previously updated : 06/26/2020 Last updated : 03/04/2022+ # Specify Marketplace images available to lab creators-As a lab account owner, you can specify the Marketplace images that lab creators can use to create labs in the lab account. -## Select images available for labs -Select **Marketplace images** on the menu to the left. By default, you see the full list of images (both enabled and disabled). You can filter the list to see only enabled/disabled images by selecting the **Enabled only**/**Disabled only** option from the drop-down list at the top. - - --The Marketplace images that are displayed in the list are only the ones that satisfy the following conditions: - -- Creates a single VM.-- Uses Azure Resource Manager to provision VMs-- Doesn't require purchasing an extra licensing plan -## Disable images for a lab -To disable a single image for a lab, select **... (ellipsis)** in the last column, and select **Disable image**. +> [!NOTE] +> If you're using a version of Azure Lab Services prior to the [April 2022 Update (preview)](lab-services-whats-new.md), see [Specify Marketplace images available to lab creators (deprecated)](specify-marketplace-images-1.md). - +As an admin, you can specify the Marketplace images that educators can use when creating labs. -Alternatively, you select the checkbox before the image name, and select **Disable selected images** on the toolbar. +## Select images available for labs -To disable multiple images at the same time, select checkboxes before the image names, and select **Disable selected images** on the toolbar. +Select **Marketplace images** on the menu to the left. By default, you can see the full list of images (both enabled and disabled). You can filter for **Status** to be equal to **Enabled** or **Disabled**. - +The Marketplace images that are displayed in the list are only the ones that satisfy the following conditions: -## Enable images for a lab -To enable a disabled image, select **... (ellipsis)** in the last column, and select **Enable image**. Alternatively, you select the checkbox before the image name, and select **Enable selected images** on the toolbar. +- Creates a single VM. +- Uses Azure Resource Manager to provision VMs. +- Doesn't require purchasing an extra licensing plan. -To disable multiple images at the same time, select checkboxes before the image names, and select **Enable selected images** on the toolbar. +## Enable and disable images -## Enable images at the time of lab creation -You can enable more images at the time lab creation: +To enable one or more images: -1. Sign in to the [Azure Lab Services website](https://labs.azure.com) using **lab account owner** credentials -2. Select the default virtual machine image or the down arrow. -3. Select **Enable more image options**. +1. Check images you want to enable. +1. Select **Enable image** button. +1. Select **Apply**. -  -4. Follow instructions from the previous section to enable the images you select. -5. You may need to close the **New lab** window and reopen it to see the images you selected in the previous step. +To disable one or images: +1. Check images you want to disable. +1. Select **Disable image** button. +1. Select **Apply**. ## Next steps-See the following articles: -- [As a lab owner, create and manage labs](how-to-manage-classroom-labs.md)-- [As a lab owner, set up and publish templates](how-to-create-manage-template.md)-- [As a lab owner, configure and control usage of a lab](how-to-configure-student-usage.md)-- [As a lab user, access labs](how-to-use-classroom-lab.md)+- As an educator, [create and manage labs](how-to-manage-classroom-labs.md). +- As an educator, [configure and publish templates](how-to-create-manage-template.md). +- As an educator, [configure and control usage of a lab](how-to-configure-student-usage.md). +- As a student, [access labs](how-to-use-lab.md). |
| lab-services | Tutorial Connect Lab Virtual Machine | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-connect-lab-virtual-machine.md | + + Title: Access a lab in Azure Lab Services | Microsoft Docs +description: In this tutorial, students access virtual machines in a lab that's set up by an educator. + Last updated : 01/04/2022+++# Tutorial: Access a lab in Azure Lab Services ++In this tutorial, you, as a student, connect to a virtual machine (VM) in a lab by completing the following actions in the Lab Services web portal: [https://labs.azure.com](https://labs.azure.com): ++> [!div class="checklist"] +> * Register to the lab +> * Start the VM +> * Connect to the VM ++The tutorial applies to the Lab Services web portal ([https://labs.azure.com](https://labs.azure.com)) only. If using Teams, see [Access a VM (student view) in Azure Lab from Teams](how-to-access-vm-for-students-within-teams.md). If using Canvas, see [Access a VM (student view) in Azure Lab Services from Canvas](how-to-access-vm-for-students-within-canvas.md). ++## Register to the lab ++1. Navigate to the **registration URL** that you received from the educator. You only have to use the registration URL once to complete the registration. Registration must be completed for each lab. + > [!IMPORTANT] + > Registration must be completed for each lab. ++ :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/register-lab.png" alt-text="Screenshot of browser with example registration link for Azure Lab Services. Registration link is highlighted."::: +1. Sign in using your school account to complete the registration. ++ > [!NOTE] + > A Microsoft account is required for using Azure Lab Services. If you are trying to use your non-Microsoft account such as Yahoo or Google accounts to sign in to the portal, follow instructions to create a Microsoft account that will be linked to your non-Microsoft account email. Then, follow the steps to complete the registration process. +1. Once registered, confirm that you see the virtual machine for the lab you have access to. Now that you have registered, you can go directly to the Azure Lab Services portal at [https://labs.azure.com](https://labs.azure.com) in the future. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/accessible-vms.png" alt-text="Screenshot of My virtual machines page in Azure Lab Services portal."::: +1. Wait until the virtual machine is ready. On the VM tile, notice the following fields: + 1. At the top of the tile, you see the **name of the lab**. + 1. To its right, you see the icon representing the **operating system (OS)** of the VM. In this example, it's Windows. + 1. The progress bar on the tile shows the number of hours used against the number of [quota hours](how-to-configure-student-usage.md#set-quotas-for-users) assigned to you. Quota time is time you have in addition to the scheduled time for the lab. + 1. You see icons and buttons at the bottom of the tile to start, stop, and connect to the VM. + 1. To the right of the buttons, you see the status of the VM. Confirm that you see the status of the VM is **Stopped**. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/vm-in-stopped-state.png" alt-text="Screenshot of My virtual machines page in Azure Lab Services portal. VM state toggle with stopped label is highlighted."::: ++## Start the VM ++1. **Start** the VM by selecting the toggle button as shown in the following image. This process takes some time. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/start-vm.png" alt-text="Screenshot of My virtual machines page in Azure Lab Services portal. VM state toggle with starting label is highlighted."::: +1. Confirm that the status of the VM is set to **Running**. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/vm-running.png" alt-text="Screenshot of My virtual machines page in Azure Lab Services portal. VM state toggle with running label is highlighted."::: ++## Connect to the VM ++1. Select the button in the lower right of the tile as shown in the following image to connect to the lab's VM. + :::image type="content" source="./media/tutorial-connect-vm-in-classroom-lab/connect-vm.png" alt-text="Screenshot of My virtual machines page in Azure Lab Services portal. Connect VM button is highlighted."::: +1. Do one of the following steps: + 1. For **Windows** virtual machines, open the **RDP** file once it has finished downloading. Use the **username** and **password** you get from your educator to sign in to the machine. For more information, see [Connect to a Windows lab VM](connect-virtual-machine.md#connect-to-a-windows-lab-vm). + 2. For **Linux** virtual machines, you can use **SSH** or **RDP** (if it's enabled) to connect to them. For more information, see [Connect to a Linux lab VM](connect-virtual-machine.md#connect-to-a-linux-lab-vm). ++## Next steps ++In this tutorial, you accessed a lab using the registration link you got from your educator. When done with the VM, stop the VM from the Azure Lab Services portal. ++>[!div class="nextstepaction"] +>[Stop the VM](how-to-use-lab.md#start-or-stop-the-vm) |
| lab-services | Tutorial Connect Virtual Machine Classroom Lab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-connect-virtual-machine-classroom-lab.md | - Title: Access a classroom lab in Azure Lab Services | Microsoft Docs -description: In this tutorial, you access virtual machines in a classroom lab that's set up by an educator. - Previously updated : 06/26/2020---# Tutorial: Access a classroom lab in Azure Lab Services -In this tutorial, you, as a student, connect to a virtual machine (VM) in a classroom lab. --In this tutorial, you do the following actions: --> [!div class="checklist"] -> * Register to the lab -> * Start the VM -> * Connect to the VM --## Register to the lab --1. Navigate to the **registration URL** that you received from the educator. You don't need to use the registration URL after you complete the registration. Instead, use the URL: [https://labs.azure.com](https://labs.azure.com). Internet Explorer 11 isn't supported yet. --  -1. Sign in to the service using your school account to complete the registration. -- > [!NOTE] - > A Microsoft account is required for using Azure Lab Services. If you are trying to use your non-Microsoft account such as Yahoo or Google accounts to sign in to the portal, follow instructions to create a Microsoft account that will be linked to your non-Microsoft account. Then, follow the steps to complete the registration process. -1. Once registered, confirm that you see the virtual machine for the lab you have access to. --  -1. Wait until the virtual machine is ready. On the VM tile, notice the following fields: - 1. At the top of the tile, you see the **name of the lab**. - 1. To its right, you see the icon representing the **operating system (OS)** of the VM. In this example, it's Windows OS. - 1. The progress bar on the tile shows the number of hours used against the number of [quota hours](how-to-configure-student-usage.md#set-quotas-for-users) assigned to you. This time is the additional time allotted to you in addition to the scheduled time for the lab. - 1. You see icons/buttons at the bottom of the tile to start/stop the VM, and connect to the VM. - 1. To the right of the buttons, you see the status of the VM. Confirm that you see the status of the VM is **Stopped**. --  --## Start the VM -1. **Start** the VM by selecting the first button as shown in the following image. This process takes some time. --  -4. Confirm that the status of the VM is set to **Running**. --  -- Notice that the icon of the first button changed to represent a **stop** operation. You can select this button to stop the VM. --## Connect to the VM --1. Select the second button as shown in the following image to **connect** to the lab's VM. --  -2. Do one of the following steps: - 1. For **Windows** virtual machines, save the **RDP** file to the hard disk. Open the RDP file to connect to the virtual machine. Use the **user name** and **password** you get from your educator to sign in to the machine. - 3. For **Linux** virtual machines, you can use **SSH** or **RDP** (if it's enabled) to connect to them. For more information, see [Enable remote desktop connection for Linux machines](how-to-enable-remote-desktop-linux.md). --## Next steps -In this tutorial, you accessed a classroom lab using the registration link you get from your educator. --As a lab owner, you want to view who has registered with your lab and track the usage of VMs. Advance to the next tutorial to learn how to track the usage of the lab: --> [!div class="nextstepaction"] -> [Track usage of a lab](tutorial-track-usage.md) |
| lab-services | Tutorial Setup Classroom Lab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-setup-classroom-lab.md | - Title: Set up a classroom lab using Azure Lab Services | Microsoft Docs -description: In this tutorial, you use Azure Lab Services to set up a classroom lab with virtual machines that are used by students in your class. - Previously updated : 12/03/2020---# Tutorial: Set up a classroom lab -In this tutorial, you set up a classroom lab with virtual machines that are used by students in the classroom. --In this tutorial, you do the following actions: --> [!div class="checklist"] -> * Create a classroom lab -> * Add users to the lab -> * Set schedule for the lab -> * Send invitation email to students --## Prerequisites -In this tutorial, you set up a lab with virtual machines for your class. To set up a classroom lab in a lab account, you must be a member of one of these roles in the lab account: Owner, Lab Creator, or Contributor. The account you used to create a lab account is automatically added to the owner role. So, you can use the user account that you used to create a lab account to create a classroom lab. --Here is the typical workflow when using Azure Lab --1. A lab account creator adds other users to the **Lab Creator** role. For example, the lab account creator/admin adds educators to the **Lab Creator** role so that they can create labs for their classes. -2. Then, the educators create labs with VMs for their classes and send registration links to students in the class. -3. Students use the registration link that they receive from educators to register to the lab. Once they are registered, they can use VMs in the labs to do the class work and home work. --## Create a classroom lab -In this step, you create a lab for your class in Azure. --1. Navigate to [Azure Lab Services website](https://labs.azure.com). Note that Internet Explorer 11 is not supported yet. -2. Select **Sign in** and enter your credentials. Azure Lab Services supports organizational accounts and Microsoft accounts. -3. Select **New lab**. - -  -4. In the **New Lab** window, do the following actions: - 1. Specify a **name** for your lab, and select **Next**. --  - 2. On the **Virtual machine credentials** page, specify default credentials for all VMs in the lab. Specify the **name** and the **password** for the user, and then select **Next**. --  -- > [!IMPORTANT] - > Make a note of user name and password. They won't be shown again. - 3. On the **Lab policies** page, select **Finish**. --  -5. You should see the following screen that shows the status of the template VM creation. This operation takes up to 20 minutes. --  -8. On the **Template** page, do the following steps: These steps are **optional** for the tutorial. -- 1. Connect to the template VM by selecting **Connect**. If it's a Linux template VM, you choose whether you want to connect using SSH or RDP (if RDP is enabled). - 3. Install and configure software required for your class on the template VM. - 4. **Stop** the template VM. -- > [!NOTE] - > Template VMs incur **cost** when running, so ensure that the template VM is shutdown when you donΓÇÖt need it to be running. --## Publish the template VM -In this step, you publish the template VM. When you publish the template VM, Azure Lab Services creates VMs in the lab by using the template. All virtual machines have the same configuration as the template. --1. On the **Template** page, select **Publish** on the toolbar. --  -- > [!WARNING] - > Once you publish, you can't unpublish. -2. On the **Publish template** page, enter the number of virtual machines you want to create in the lab, and then select **Publish**. --  -3. You see the **status of publishing** the template on page. This process can take up to an hour. --  -4. Wait until the publishing is complete and then switch to the **Virtual machines pool** page by selecting **Virtual machines** on the left menu or by selecting **Virtual machines** tile. Confirm that you see virtual machines that are in **Unassigned** state. These VMs are not assigned to students yet. They should be in **Stopped** state. You can start a student VM, connect to the VM, stop the VM, and delete the VM on this page. You can start them in this page or let your students start the VMs. --  -- > [!NOTE] - > When an educator turns on a student VM, quota for the student isn't affected. Quota for a user specifies the number of lab hours available to the user outside of the scheduled class time. For more information on quotas, see [Set quotas for users](how-to-configure-student-usage.md?#set-quotas-for-users). --## Set a schedule for the lab -Create a scheduled event for the lab so that VMs in the lab are automatically started/stopped at specific times. The user quota (default: 10 hours) you specified earlier is the additional time assigned to each user outside this scheduled time. --1. Switch to the **Schedules** page, and select **Add scheduled event** on the toolbar. --  -2. On the **Add scheduled event** page, do the following steps: - 1. Confirm that **Standard** is selected the **Event type**. - 2. Select the **start date** for the class. - 4. Select the **start time** at which you want the VMs to be started. - 5. Select the **stop time** at which the VMs are to be shut down. - 6. Select the **time zone** for the start and stop times you specified. -3. On the same **Add scheduled event** page, select the current schedule in the **Repeat** section. --  -5. On the **Repeat** dialog box, do the following steps: - 1. Confirm that **every week** is set for the **Repeat** field. - 2. Select the days on which you want the schedule to take effect. In the following example, Monday-Friday is selected. - 3. Select an **end date** for the schedule. - 8. Select **Save**. --  --3. Now, on the **Add scheduled event** page, for **Notes (optional)**, enter any description or notes for the schedule. -4. On the **Add scheduled event** page, select **Save**. --  -5. Navigate to the start date in the calendar to verify that the schedule is set. - -  -- For more information about creating and managing schedules for a class, see [Create and manage schedule for labs](how-to-create-schedules.md). ---## Add users to the lab --When you add users, by default, the **Restrict access** option is turned on and, unless they're in the list of users, students can't register with the lab even if they have a registration link. Only listed users can register with the lab by using the registration link you send. You can turn off **Restrict access**, which allows students to register with the lab as long as they have the registration link. --### Add users from an Azure AD group --You can sync a lab user list to an existing Azure Active Directory (Azure AD) group so that you don't have to manually add or delete users. --An Azure AD group can be created within your organization's Azure Active Directory to manage access to organizational resources and cloud-based apps. To learn more, see [Azure AD groups](../active-directory/fundamentals/active-directory-manage-groups.md). If your organization uses Microsoft Office 365 or Azure services, your organization will already have admins who manage your Azure Active Directory. --> [!IMPORTANT] -> Make sure the user list is empty. If there are existing users inside a lab that you added manually or through importing a CSV file, the option to sync the lab to an existing group will not appear. --1. In the left pane, select **Users**. -1. Click **Sync from group**. -- :::image type="content" source="./media/how-to-configure-student-usage/add-users-sync-group.png" alt-text="Add users by syncing from an Azure AD group"::: - -1. You will be prompted to pick an existing Azure AD group to sync your lab to. - - If you don't see an Azure AD group in the list, could be because of the following reasons: -- - If you are a guest user for an Azure Active Directory (usually if you're outside the organization that owns the Azure AD), and you are not able to to search for groups inside the Azure AD. In this case, you wonΓÇÖt be able to add an Azure AD group to the lab in this case. - - Azure AD groups created through Teams don't show up in this list. You can add the Azure Lab Services app inside Teams to create and manage labs directly from within it. See more information about [managing a labΓÇÖs user list from within Teams](how-to-manage-user-lists-within-teams.md). -1. Once you picked the Azure AD group to sync your lab to, click **Add**. -1. Once a lab is synced, it will pull everyone inside the Azure AD group into the lab as users, and you will see the user list updated. Only the people in this Azure AD group will have access to your lab. The user list will refresh every 24 hours to match the latest membership of the Azure AD group. You can also click on the Sync button in the Users tab to manually sync to the latest changes in the Azure AD group. -1. Invite the users to your lab by clicking on the **Invite All** button, which will send an email to all users with the registration link to the lab. --### Add users manually from email(s) or CSV file --In this section, you add students manually (by email address or by uploading a CSV file). --#### Add users by email address --1. In the left pane, select **Users**. -1. Click **Add users manually**. -- :::image type="content" source="./media/how-to-configure-student-usage/add-users-manually.png" alt-text="Add users manually"::: -1. Select **Add by email address** (default), enter the students' email addresses on separate lines or on a single line separated by semicolons. -- :::image type="content" source="./media/how-to-configure-student-usage/add-users-email-addresses.png" alt-text="Add users' email addresses"::: -1. Select **Save**. -- The list displays the email addresses and statuses of the current users, whether they're registered with the lab or not. -- :::image type="content" source="./media/how-to-configure-student-usage/list-of-added-users.png" alt-text="Users list"::: -- > [!NOTE] - > After the students are registered with the lab, the list displays their names. The name that's shown in the list is constructed by using the first and last names of the students in Azure Active Directory. --#### Add users by uploading a CSV file --You can also add users by uploading a CSV file that contains their email addresses. --A CSV text file is used to store comma-separated (CSV) tabular data (numbers and text). Instead of storing information in columns fields (such as in spreadsheets), a CSV file stores information separated by commas. Each line in a CSV file will have the same number of comma-separated "fields." You can use Excel to easily create and edit CSV files. --1. In Microsoft Excel, create a CSV file that lists students' email addresses in one column. -- :::image type="content" source="./media/how-to-configure-student-usage/csv-file-with-users.png" alt-text="List of users in a CSV file"::: -1. At the top of the **Users** pane, select **Add users**, and then select **Upload CSV**. -1. Select the CSV file that contains the students' email addresses, and then select **Open**. -- The **Add users** window displays the email address list from the CSV file. -1. Select **Save**. -1. In the **Users** pane, view the list of added students. -- :::image type="content" source="./media/how-to-configure-student-usage/list-of-added-users.png" alt-text="List of added users in the Users pane"::: --## Send invitation emails to users --1. Switch to the **Users** view if you are not on the page already, and select **Invite all** on the toolbar. --  -1. On the **Send invitation by email** page, enter an optional message, and then select **Send**. The email automatically includes the registration link. You can get this registration link by selecting **... (ellipsis)** on the toolbar, and **Registration link**. --  -4. You see the status of **invitation** in the **Users** list. The status should change to **Sending** and then to **Sent on <date>**. --For more information about adding students to a class and managing their usage of the lab, see [How to configure student usage](how-to-configure-student-usage.md). --## Next steps -In this tutorial, you created a lab for your class in Azure. To learn how a student can access a VM in the lab using the registration link, advance to the next tutorial: --> [!div class="nextstepaction"] -> [Connect to a VM in the classroom lab](tutorial-connect-virtual-machine-classroom-lab.md) |
| lab-services | Tutorial Setup Lab Account | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-setup-lab-account.md | Title: Set up a lab account with Azure Lab Services | Microsoft Docs -description: Learn how to set up a lab account with Azure Lab Services, add a lab creator, and specify Marketplace images to be used by labs in the lab account. + Title: Set up a lab account with Azure Lab Services (deprecated) | Microsoft Docs +description: Learn how to set up a lab account and add users that can create labs in the lab account. Previously updated : 07/26/2021 Last updated : 01/06/2022 -# Tutorial: Set up a lab account with Azure Lab Services -In Azure Lab Services, a lab account serves as the central account in which your organization's labs are managed. In your lab account, give permission to others to create labs, and set policies that apply to all labs under the lab account. In this tutorial, learn how to create a lab account. +# Tutorial: Set up a lab account with Azure Lab Services (deprecated) +++In Azure Lab Services, a lab account serves as the central account in which your organization's labs are managed. In your lab account, give permission to others to create labs, and set policies that apply to all labs under the lab account. In this tutorial, learn how to create a lab account. In this tutorial, you do the following actions: > [!div class="checklist"]-> * Create a lab account -> * Add a user to the Lab Creator role +> - Create a lab account +> - Add a user to the Lab Creator role If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ## Create a lab account-The following steps illustrate how to use the Azure portal to create a lab account with Azure Lab Services. ++The following steps illustrate how to use the Azure portal to create a lab account with Azure Lab Services. 1. Sign in to the [Azure portal](https://portal.azure.com). 2. Select **All Services** on the left menu. Select **DevOps** from **Categories**. Then, select **Lab Services**. If you select star (`*`) next to **Lab Services**, it's added to the **FAVORITES** section on the left menu. From the next time onwards, you select **Lab Services** under **FAVORITES**. -3. On the **Lab Services** page, select **Add** on the toolbar or select **Create lab account** button on the page. +3. On the **Lab Services** page, select **Add** on the toolbar or select **Create lab account** button on the page. -4. On the **Basics** tab of the **Create a lab account** page, do the following actions: - 1. For **Lab account name**, enter a name. +4. On the **Basics** tab of the **Create a lab account** page, do the following actions: + 1. For **Lab account name**, enter a name. 2. Select the **Azure subscription** in which you want to create the lab account. 3. For **Resource group**, select an existing resource group or select **Create new**, and enter a name for the resource group.- 4. For **Location**, select a location/region in which you want to create the lab account. + 4. For **Location**, select a location/region in which you want to create the lab account.  5. Select **Review + create**.- 6. Review the summary, and select **Create**. + 6. Review the summary, and select **Create**. -  -5. When the deployment is complete, expand **Next steps**, and select **Go to resource**. +  +5. When the deployment is complete, expand **Next steps**, and select **Go to resource**. -6. Confirm that you see the **Lab Account** page. +6. Confirm that you see the **Lab Account** page.  ## Add a user to the Lab Creator role-To set up a classroom lab in a lab account, the user must be a member of the **Lab Creator** role in the lab account. To provide educators the permission to create labs for their classes, add them to the **Lab Creator** role: For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md). -> [!NOTE] -> The account you used to create the lab account is automatically added to this role. If you are planning to use the same user account to create a classroom lab in this tutorial, skip this step. +To set up a lab in a lab account, the user must be a member of the **Lab Creator** role in the lab account. To provide educators the permission to create labs for their classes, add them to the **Lab Creator** role: For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md). +> [!NOTE] +> The account you used to create the lab account is automatically added to this role. If you are planning to use the same user account to create a lab in this tutorial, skip this step. 1. On the **Lab Account** page, select **Access control (IAM)** To set up a classroom lab in a lab account, the user must be a member of the **L 1. On the **Review + assign** tab, select **Review + assign** to assign the role. - ## Next steps-In this tutorial, you created a lab account. To learn about how to create a classroom lab as an educator, advance to the next tutorial: -> [!div class="nextstepaction"] -> [Set up a classroom lab](tutorial-setup-classroom-lab.md) +In this tutorial, you created a lab account. To learn about how to create a lab as an educator, advance to the next tutorial: +> [!div class="nextstepaction"] +> [Set up a lab](tutorial-setup-lab.md) |
| lab-services | Tutorial Setup Lab Plan | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-setup-lab-plan.md | + + Title: Create a lab plan with Azure Lab Services | Microsoft Docs +description: Learn how to set up a lab plan with Azure Lab Services, add a lab creator, and specify Marketplace images to be used by labs in the lab plan. + Last updated : 01/06/2022++++# Tutorial: Create a lab plan with Azure Lab Services ++In Azure Lab Services, the lab plan serves as a collection of configurations and settings that apply to the labs created from it. In your lab plan, give permission to others to create labs, and set policies that apply to newly created labs. In this tutorial, learn how to create a lab plan. ++In this tutorial, you do the following actions: ++> [!div class="checklist"] +> * Create a lab plan +> * Assign a user to the Lab Creator role ++If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. ++## Create a lab plan ++The following steps illustrate how to use the Azure portal to create a lab plan with Azure Lab Services. ++1. Sign in to the [Azure portal](https://portal.azure.com). +1. Select **Create a resource** in the upper left-hand corner of the Azure portal. +1. Search for **lab plan**. (**Lab plan (preview)** can also be found under the **DevOps** category.) +1. On the **Lab plan (preview)** tile, select the **Create** dropdown and choose **Lab plan**. ++ :::image type="content" source="./media/tutorial-setup-lab-plan/select-lab-plans-service.png" alt-text="All Services -> Lab Services"::: +1. On the **Basics** tab of the **Create a lab plan** page, do the following actions: + 1. Select the **Azure subscription** in which you want to create the lab plan. + 2. For **Resource group**, select an existing resource group or select **Create new**, and enter a name for the new resource group. + 3. For **Name**, enter a lab plan name. For more information about naming restrictions, see [Microsoft.LabServices resource name rules](../azure-resource-manager/management/resource-name-rules.md#microsoftlabservices). + 4. For **Region**, select a location/region in which you want to create the lab plan. ++ :::image type="content" source="./media/tutorial-setup-lab-plan/lab-plan-basics-page.png" alt-text="Lab plan - basics page"::: + 5. If you would like to enable advanced networking, see [Connect to your virtual network in Azure Lab Services](how-to-connect-vnet-injection.md). + 6. Select **Review + Create**. When the validation succeeds, select **Create**. + 7. Review the summary, and select **Create**. ++ :::image type="content" source="./media/tutorial-setup-lab-plan/create-button.png" alt-text="Review + create -> Create"::: +1. When the deployment is complete, select **Go to resource** under **Next steps**. ++ :::image type="content" source="./media/tutorial-setup-lab-plan/go-to-lab-plan.png" alt-text="Go to lab plan page"::: +1. Confirm that you see the **Lab Plan** page. ++ :::image type="content" source="./media/tutorial-setup-lab-plan/lab-plan-page.png" alt-text="Lab plan page"::: ++## Add a user to the Lab Creator role ++## Next steps ++In this tutorial, you created a lab plan and gave lab creation permissions to an educator. To learn about how to create a lab as an educator, advance to the next tutorial: ++> [!div class="nextstepaction"] +> [Create a lab](tutorial-setup-lab.md) |
| lab-services | Tutorial Setup Lab | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-setup-lab.md | + + Title: Create a lab using Azure Lab Services | Microsoft Docs +description: In this tutorial, you use Azure Lab Services to set up a lab with virtual machines that are used by students in your class. + Last updated : 1/21/2022+++# Tutorial: Create and publish a lab +++In this tutorial, you set up a lab with virtual machines that are used by students in the classroom by doing the following actions: ++> [!div class="checklist"] +> * Create a lab +> * Publish a lab +> * Add users to the lab +> * Set schedule for the lab +> * Send invitation email to students ++## Prerequisites ++* A lab plan. To create a lab plan, see [Tutorial: Create a lab plan with Azure Lab Services](tutorial-setup-lab-plan.md). +* Permission to create a lab. You must be a member of one of these roles in the lab plan: Owner, Lab Creator, or Contributor. For more information, see [Azure Lab Services built-in roles](administrator-guide.md#rbac-roles). The user account used to create a lab plan will already have the required permissions to create a lab. ++Here's the typical workflow when using Azure Lab ++1. The person that created the lab plan adds other users to the **Lab Creator** role. For example, the administrator (who created the lab plan) assigns educators to the **Lab Creator** role on the lab plan or resource group so that they can create labs for their classes. The administrator can also assign educators the **Lab Creator** role on the resource group that contains one or more lab plans. To assign the **Lab Creator** role to someone, see [Add a user to the Lab Creator role](tutorial-setup-lab-plan.md#add-a-user-to-the-lab-creator-role). +2. Then, the educators create labs with VMs for their classes and send registration links to students in the class. If the administrator assigned the **Lab Creator** role at the resource group, the educator can choose from all lab plans in that resource group when creating new labs. +3. Students use the registration link that they receive from educators to register to the lab. Once they're registered, they can use VMs in the labs to do the class work and homework. If [Canvas](lab-services-within-canvas-overview.md) or [Teams](lab-services-within-teams-overview.md) integration with Azure Lab Services is used, this step is skipped by the students. ++## Create a lab ++In this step, you create a lab for your class in Azure Lab Services portal. ++1. Navigate to Lab Services web portal: [https://labs.azure.com](https://labs.azure.com). +2. Select **Sign in** and enter your credentials. Azure Lab Services supports organizational accounts and Microsoft accounts. +3. Select **New lab**. + <br>:::image type="content" source="./media/tutorial-setup-lab/new-lab-button.png" alt-text="Screenshot of Azure Lab Services portal. New lab button is highlighted."::: +4. In the **New Lab** window, do the following actions: + 1. Specify a **name**, **virtual machine image**, **size**, and **region** for your lab, and select **Next**. For more information about naming restrictions, see [Microsoft.LabServices resource name rules](../azure-resource-manager/management/resource-name-rules.md#microsoftlabservices). + + Possibly, you'll need to choose a **lab plan**. If more than one lab plan is in the resource group, you'll see a dropdown to choose a lab plan. If there's only one lab plan in the resource group, this option will be hidden. ++ > [!IMPORTANT] + > Talk to your admin, if you don't see the virtual machine image you need. They may have to [specify Marketplace images](specify-marketplace-images.md) or [specify custom images](how-to-attach-detach-shared-image-gallery.md#enable-and-disable-images) available to lab creators. If using custom images, the admin must also verify the custom image is replicated to the same region as the lab plan. ++ > [!NOTE] + > Prices shown are for example only. For current pricing information, see [Azure Lab Services pricing](https://azure.microsoft.com/pricing/details/lab-services/). + + :::image type="content" source="./media/tutorial-setup-lab/new-lab-window.png" alt-text="Screenshot of the New lab window for Azure Lab Services."::: ++ 1. On the **Virtual machine credentials** page, specify default administrator credentials for all VMs in the lab. Specify the **name** and the **password** for the administrator. By default all the student VMs will have the same password as the one specified here. ++ > [!IMPORTANT] + > Make a note of user name and password. They won't be shown again. + 1. This step is **optional** for the tutorial. Select **Give lab user a non-admin account on their virtual machines** to give the student non-administrator account rather the default administrator account. + > [!IMPORTANT] + > Make a note of non-admin user name and password. They won't be shown again. + 1. If you would like students to set their own password the first time they sign into their VM, uncheck **Use same password for all virtual machines**. Note, students will have to wait for the password set function to complete before the connect button is available for their VM if **Use same password for all virtual machines** is unchecked. Select **Next**. ++ :::image type="content" source="./media/tutorial-setup-lab/virtual-machine-credentials.png" alt-text="Screenshot that shows the Virtual machine credentials window when creating a new Azure Lab Services lab."::: ++ 1. On the **Lab policies** page, leave the default selections and select **Next**. ++ :::image type="content" source="./media/tutorial-setup-lab/quota-for-each-user.png" alt-text="Screenshot of the Lab policy window when creating a new Azure Lab Services lab."::: ++ 1. On the **Template virtual machine settings** window, leave the selection on **Create a template virtual machine** if you need to make modifications to the template used to create all the student VMs. If you don't need to make any modifications to the image chosen earlier, choose **Use a virtual machine image without customization**. Select **Finish**. ++ :::image type="content" source="./media/tutorial-setup-lab/template-virtual-machine-settings.png" alt-text="Screenshot of the Template virtual machine settings windows when creating a new Azure Lab Services lab."::: ++5. You should see the following screen that shows the status of the template VM creation. ++ :::image type="content" source="./media/tutorial-setup-lab/create-template-vm-progress.png" alt-text="Screenshot of status of the template VM creation."::: +6. If **Use a virtual machine image without customization** was selected on the **Template virtual machine settings** window when creating the lab, skip this step. On the **Template** page, optionally do the following steps: ++ 1. Connect to the template VM by selecting **Start**. If it's a Linux template VM, you choose whether you want to connect using SSH or RDP (if RDP is enabled). + :::image type="content" source="./media/tutorial-setup-lab/start-template-vm.png" alt-text="Screenshot of the template page of an Azure Lab Services lab. Start template button is highlighted."::: + 2. Install and configure software required for your class on the template VM. + 3. **Stop** the template VM. ++ > [!NOTE] + > Template VMs incur **cost** when running, so ensure that the template VM is shutdown when you donΓÇÖt need it to be running. ++If you chose to create a Linux template VM, more setup is required to use a GUI remote desktop. For more information, see [Enable graphical remote desktop for Linux virtual machines in Azure Lab Services](how-to-enable-remote-desktop-linux.md). ++## Publish a lab ++In this step, you publish the lab. When you publish the template VM, Azure Lab Services creates VMs in the lab by using the template. All virtual machines have the same configuration as the template. ++1. On the **Template** page, select **Publish** on the toolbar. ++ :::image type="content" source="./media/tutorial-setup-lab/template-page-publish-button.png" alt-text="Screenshot of Azure Lab Services template page. The Publish template menu button is highlighted."::: ++ > [!WARNING] + > Publishing is an irreversible action! It can't be undone. +2. On the **Publish template** page, select **Publish**. Select **OK** when warned that publishing is a permanent action. ++ :::image type="content" source="./media/tutorial-setup-lab/publish-template-number-vms.png" alt-text="Screenshot of confirmation window for publish action of Azure."::: ++3. You see the **status of publishing** the template on page. ++ :::image type="content" source="./media/tutorial-setup-lab/publish-template-progress.png" alt-text="Screenshot of Azure Lab Services template page. The publishing in progress message is highlighted."::: ++4. Wait until the publishing is complete. +5. Select **Virtual machine pool** on the left menu or select **Virtual machines** tile on the dashboard page to see the list of available machines. Confirm that you see virtual machines that are in **Unassigned** state. These VMs aren't assigned to students yet. They should be in **Stopped** state. For more information about managing the virtual machine pool, see [Manage a VM pool in Lab Services](how-to-manage-vm-pool.md). ++ :::image type="content" source="./media/tutorial-setup-lab/virtual-machines-stopped.png" alt-text="Screenshot of virtual machines stopped. The virtual machine pool menu is highlighted."::: ++ > [!NOTE] + > When an educator turns on a student VM, quota for the student isn't affected. Quota for a user specifies the number of lab hours available to a student outside of the scheduled class time. For more information on quotas, see [Set quotas for users](how-to-configure-student-usage.md?#set-quotas-for-users). ++## Set a schedule for the lab ++Create a scheduled event for the lab so that VMs in the lab are automatically started and stopped at specific times. The user quota (default: 10 hours) you specified earlier is the extra time assigned to each student outside this scheduled time. ++1. Switch to the **Schedules** page, and select **Add scheduled event** on the toolbar. **Add scheduled event** will be disabled if the lab is actively being published. ++ :::image type="content" source="./media/how-to-create-schedules/add-schedule-button.png" alt-text="Screenshot of the Add scheduled event button on the Schedules page. The Schedules menu and Add scheduled event button are highlighted."::: ++1. On the **Add scheduled event** page, do the following steps: + 1. Confirm that **Standard** is selected the **Event type**. + 2. Select the **start date** for the class. + 3. Select the **start time** at which you want the VMs to be started. + 4. Select the **stop time** at which the VMs are to be shut down. + 5. Select the **time zone** for the start and stop times you specified. +1. On the same **Add scheduled event** page, select the current schedule in the **Repeat** section. + :::image type="content" source="./media/how-to-create-schedules/select-current-schedule.png" alt-text="Screenshot of the Add scheduled event window. The Repeat description of the scheduled event is highlighted."::: +1. On the **Repeat** dialog box, do the following steps: + 1. Confirm that **every week** is set for the **Repeat** field. + 2. Select the days on which you want the schedule to take effect. In the following example, Monday-Friday is selected. + 3. Select an **end date** for the schedule. + 4. Select **Save**. + :::image type="content" source="./media/how-to-create-schedules/set-repeat-schedule.png" alt-text="Screenshot of the Repeat windows for scheduled events. Event repeats every week, Monday through Friday."::: +1. On the **Add scheduled event** page, for **Notes (optional)**, enter any description or notes for the schedule. +1. On the **Add scheduled event** page, select **Save**. + :::image type="content" source="./media/how-to-create-schedules/add-schedule-page-weekly.png" alt-text="Screenshot of the Add scheduled event window."::: +1. Navigate to the start date in the calendar to verify that the schedule is set. + :::image type="content" source="./media/how-to-create-schedules/schedule-calendar.png" alt-text="Screenshot of the Schedule page for Azure Lab Services. Repeating schedule, Monday through Friday shown in the calendar."::: ++For more information about creating and managing schedules for a class, see [Create and manage schedule for labs](how-to-create-schedules.md). ++## Add users to the lab ++In this section, you add students to the lab. Students can be added to a lab several ways including [manually by entering an email address](how-to-configure-student-usage.md#add-users-by-email-address), [uploading a CSV file with student information](how-to-configure-student-usage.md#add-users-by-uploading-a-csv-file), or [syncing to an Azure AD group](how-to-configure-student-usage.md#sync-users-with-azure-ad-group). ++By default, the **Restrict access** option, found on the **Users** page, is turned on for a lab. *Only* listed users can register with the lab by using the registration link you send. You can turn off restricted access, which allows students to register with the lab as long as they have the registration link. ++1. Select the **Users** page. +1. Select **Add users manually**. ++ :::image type="content" source="./media/tutorial-setup-lab/add-users-manually.png" alt-text="Add users manually."::: +1. Select **Add by email address** (default), enter the students' email addresses on separate lines or on a single line separated by semicolons. ++ :::image type="content" source="./media/tutorial-setup-lab/add-users-email-addresses.png" alt-text="Add users' email addresses"::: +1. Select **Save**. ++ The list displays the email addresses and statuses of the current users, whether they're registered with the lab or not. ++ :::image type="content" source="./media/tutorial-setup-lab/list-of-added-users.png" alt-text="Users list."::: ++ > [!NOTE] + > After the students are registered with the lab, the list displays their names. The name that's shown in the list is constructed by using the first and last names of the student's information from Azure AD or their Microsoft Account. For more information on supported account types, see [Student accounts](how-to-configure-student-usage.md#student-accounts). ++## Send invitation emails to users ++1. Switch to the **Users** view if you aren't on the page already, and select **Invite all** on the toolbar. + :::image type="content" source="./media/tutorial-setup-lab/invite-all-button.png" alt-text="Screenshot of User page in Azure Lab Services. Invite all button highlighted."::: +1. On the **Send invitation by email** page, enter an optional message, and then select **Send**. The email automatically includes the registration link. You can get this registration link by selecting **... (ellipsis)** on the toolbar, and **Registration link**. + :::image type="content" source="./media/tutorial-setup-lab/send-email.png" alt-text="Screenshot of Send invitation by email windows for Azure Lab Services."::: +1. You see the status of **invitation** in the **Users** list. The status should change to **Sending** and then to **Sent on <date>**. ++For more information about managing usage of student VMs, see [How to configure student usage](how-to-configure-student-usage.md). ++## Next steps ++In this tutorial, you created a lab for your class in Azure. To learn how a student can access a VM in the lab using the registration link, advance to the next tutorial. ++> [!div class="nextstepaction"] +> [Connect to a VM in the lab](tutorial-connect-lab-virtual-machine.md) |
| lab-services | Tutorial Track Usage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/tutorial-track-usage.md | Title: Track usage of a lab in Azure Lab Services | Microsoft Docs description: In this tutorial, you, as a lab creator/owner, track the usage of your lab. Previously updated : 06/26/2020 Last updated : 01/06/2022 # Tutorial: Track usage of a lab in Azure Lab Service+ This tutorial shows you how a lab creator/owner can track usage of a lab. In this tutorial, you do the following actions: In this tutorial, you do the following actions: > [!div class="checklist"] > * View users registered with your lab > * View the usage of VMs in the lab-> * Manage student VMs -+> * Manage student VMs ## View registered users -1. Navigate to [Azure Lab Services website](https://labs.azure.com). +1. Navigate to Lab Services web portal ([https://labs.azure.com](https://labs.azure.com)). 2. Select **Sign in** and enter your credentials. Azure Lab Services supports organizational accounts and Microsoft accounts.-3. On the **My labs** page, select the lab for which you want to track the usage. +3. On the **My labs** page, select the lab for which you want to track the usage. 4. Select **Users** on the left menu or **Users** tile. You see students who have registered with your lab.  In this tutorial, you do the following actions: ## View the usage of VMs -1. Select **Virtual machines** on menu to the left. -2. Confirm that you see the status of VMs and the number of hours the VMs have been running. The time that a lab owner spends on a student VM doesn't count against the usage time shown in the last column. +1. Select **Virtual machines** on menu to the left. +2. Confirm that you see the status of VMs and the number of hours the VMs have been running. The time that a lab owner spends on a student VM doesn't count against the usage time shown in the last column.  -## Manage student VMs +## Manage student VMs + On this page, you can start, stop, or reset student VMs by using controls in the **State** column or on the toolbar.  For more information about managing virtual machine pool for the lab, see [Set u > When an educator turns on a student VM, quota for the student isn't affected. Quota for a user specifies the number of lab hours available to the user outside of the scheduled class time. For more information on quotas, see [Set quotas for users](how-to-configure-student-usage.md?#set-quotas-for-users). ## Next steps-To learn more about labs, see articles under [How-to guides](how-to-manage-lab-accounts.md). ++To learn more about labs, see [Administrator Guide](administrator-guide.md). |
| lab-services | Upload Custom Image Shared Image Gallery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/upload-custom-image-shared-image-gallery.md | -The steps in this article show how to import a custom image that starts from your physical lab environment. With this approach, you create a VHD from your physical environment and import the VHD into a shared image gallery so that it can be used within Lab Services. Before you use this approach for creating a custom image, read the article [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. +The steps in this article show how to import a custom image that starts from your physical lab environment. With this approach, you create a VHD from your physical environment and import the VHD into a compute gallery so that it can be used within Lab Services. Before you use this approach for creating a custom image, read the article [Recommended approaches for creating custom images](approaches-for-custom-image-creation.md) to decide the best approach for your scenario. ## Prerequisites The following steps show how to create a Windows image from a Windows Hyper-V vi 1. [Install Windows Updates](../virtual-machines/windows/prepare-for-upload-vhd-image.md). 1. [Install Azure VM Agent and additional configuration as shown here](../virtual-machines/windows/prepare-for-upload-vhd-image.md#complete-the-recommended-configurations) - You can upload either specialized or generalized images to a shared image gallery and use them to create labs. The steps above will create a specialized image. If you need to instead create a generalized image, you also will need to [run SysPrep](../virtual-machines/windows/prepare-for-upload-vhd-image.md#determine-when-to-use-sysprep). + You can upload either specialized or generalized images to a compute gallery and use them to create labs. The steps above will create a specialized image. If you need to instead create a generalized image, you also will need to [run SysPrep](../virtual-machines/windows/prepare-for-upload-vhd-image.md#determine-when-to-use-sysprep). You should create a specialized image if you want to maintain machine-specific information and user profiles. For more information about the differences between generalized and specialized images, see [Generalized and specialized images](../virtual-machines/shared-image-galleries.md#generalized-and-specialized-images). To help with resizing the VHD and converting to a VHDX, you can also use the fol - [Resize-VHD](/powershell/module/hyper-v/resize-vhd) - [Convert-VHD](/powershell/module/hyper-v/convert-vhd) -## Upload the custom image to a shared image gallery +## Upload the custom image to a compute gallery 1. Upload the VHD to Azure to create a managed disk. 1. You can use either Storage Explorer or AzCopy from the command line, as shown in [Upload a VHD to Azure or copy a managed disk to another region](../virtual-machines/windows/disks-upload-vhd-to-managed-disk-powershell.md). To help with resizing the VHD and converting to a VHDX, you can also use the fol The Azure portal's **Size+Performance** tab for the managed disk allows you to change your disk size. As mentioned before, the size must *not* be greater than 128 GB. -1. In a shared image gallery, create an image definition and version: +1. In a compute gallery, create an image definition and version: 1. [Create an image definition](../virtual-machines/image-version.md). - Choose **Gen 1** for the **VM generation**. - Choose whether you are creating a **specialized** or **generalized** image for the **Operating system state**. To help with resizing the VHD and converting to a VHDX, you can also use the fol ## Create a lab -1. [Create the lab](tutorial-setup-classroom-lab.md) in Lab Services and select the custom image from the shared image gallery. +1. [Create the lab](tutorial-setup-lab.md) in Lab Services and select the custom image from the compute gallery. If you expanded the disk *after* the OS was installed on the original Hyper-V VM, you may also need to extend the C drive in Windows to use the unallocated disk space: - Log into the lab's template VM and follow steps similar to what is shown in [Extend a basic volume](/windows-server/storage/disk-management/extend-a-basic-volume). ## Next steps -- [Shared image gallery overview](../virtual-machines/shared-image-galleries.md)-- [Attach or detach a shared image gallery](how-to-attach-detach-shared-image-gallery.md)-- [How to use a shared image gallery](how-to-use-shared-image-gallery.md)+- [Azure Compute Gallery overview](../virtual-machines/shared-image-galleries.md) +- [Attach or detach a compute gallery](how-to-attach-detach-shared-image-gallery.md) +- [Use a compute gallery](how-to-use-shared-image-gallery.md) |
| lab-services | Use Dashboard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/use-dashboard.md | Title: Use dashboard for a classroom lab in Azure Lab Services | Microsoft Docs -description: Learn how to use dashboard for a classroom lab in Azure Lab Services. + Title: Use dashboard for a lab in Azure Lab Services | Microsoft Docs +description: Learn how to use dashboard for a lab in Azure Lab Services. Last updated 06/26/2020 # Dashboard for labs-This article describes the dashboard view of a classroom lab in Azure Lab Services. - +This article describes the dashboard view of a lab in Azure Lab Services. ++ ## Costs and billing tile+ This tile provides the following cost estimate details: -| Setting | Value | -| - | -- | +| Setting | Value | +| - | -- | | Quota hours | The maximum number of hours a user can use the VM outside the scheduled hours. | | Scheduled hours | Hours that will be incurred based on the schedule set in the lab. This value is only available if there is a from/to date set on all the schedule events. | | Hours/user | The sum of quota hours and scheduled hours. | This tile provides the following cost estimate details: | Total estimated cost | This is the maximum price for this lab based on current settings. | ## Template tile+ You see the following information on this tile: -- The date on which the template was created -- The date on which the template was last published +- The date on which the template was created +- The date on which the template was last published -It also has a link to navigate to the **Template** page where you can [manage the template VM](how-to-create-manage-template.md) for the class. +It also has a link to navigate to the **Template** page where you can [manage the template VM](how-to-create-manage-template.md) for the class. ## Virtual machine pool tile You see the following information on this tile: - Number of virtual machines that are assigned to students (users) - Number of virtual machines that haven't been assigned to students yet -It also has a link to navigate to the **Virtual machine pool** page where you can [manage the pool of virtual machines](how-to-set-virtual-machine-passwords.md) in the lab. +It also has a link to navigate to the **Virtual machine pool** page where you can [manage the pool of virtual machines](how-to-set-virtual-machine-passwords.md) in the lab. ## Users tile You see the following information on this tile: - Number of users registered to the class-- Number of users who are added to the lab but not registered to the class +- Number of users who are added to the lab but not registered to the class -It also has a link to navigate to the **Users** page where you can [manage users](how-to-configure-student-usage.md) for the lab. +It also has a link to navigate to the **Users** page where you can [manage users](how-to-configure-student-usage.md) for the lab. ## Schedules tile-You see the current scheduled events for the lab on the tile. It also has a link to navigate to the **Schedule** page where you can [create and manage schedules](how-to-create-schedules.md). The tile shows you details for only two scheduled events and the number of remaining scheduled events for the lab. - +You see the current scheduled events for the lab on the tile. It also has a link to navigate to the **Schedule** page where you can [create and manage schedules](how-to-create-schedules.md). The tile shows you details for only two scheduled events and the number of remaining scheduled events for the lab. + |
| load-balancer | Load Balancer Multivip Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/load-balancer-multivip-overview.md | The destination of the inbound flow is the frontend IP address on the loopback i Notice that this example does not change the destination port. Even though this is a Floating IP scenario, Azure Load Balancer also supports defining a rule to rewrite the backend destination port and to make it different from the frontend destination port. -The Floating IP rule type is the foundation of several load balancer configuration patterns. One example that is currently available is the [SQL AlwaysOn with Multiple Listeners](../azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure.md) configuration. Over time, we will document more of these scenarios. +The Floating IP rule type is the foundation of several load balancer configuration patterns. One example that is currently available is the [SQL AlwaysOn with Multiple Listeners](/azure/azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure) configuration. Over time, we will document more of these scenarios. ## Limitations |
| load-testing | Tutorial Identify Bottlenecks Azure Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-testing/tutorial-identify-bottlenecks-azure-portal.md | Before you can load test the sample app, you have to get it deployed and running 1. Open Windows PowerShell, sign in to Azure, and set the subscription: - ```powershell + ```azurecli az login az account set --subscription <your-Azure-Subscription-ID> ``` |
| logic-apps | Handle Long Running Stored Procedures Sql Connector | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/logic-apps/handle-long-running-stored-procedures-sql-connector.md | For example, when getting or inserting multiple rows, your logic app can iterate ## Timeout limit on stored procedure execution -The SQL connector has a stored procedure timeout limit that's [less than 2-minutes](/connectors/sql/#known-issues-and-limitations). Some stored procedures might take longer than this limit to complete, causing a `504 Timeout` error. Sometimes these long-running processes are coded as stored procedures explicitly for this purpose. Due to the timeout limit, calling these procedures from Azure Logic Apps might create problems. Although the SQL connector doesn't natively support an asynchronous mode, you can work around this problem and simulate this mode by using a SQL completion trigger, native SQL pass-through query, a state table, and server-side jobs. For this task, you can use the [Azure Elastic Job Agent](../azure-sql/database/elastic-jobs-overview.md) for [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md). For [SQL Server on premises](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md), you can use the [SQL Server Agent](/sql/ssms/agent/sql-server-agent). +The SQL connector has a stored procedure timeout limit that's [less than 2-minutes](/connectors/sql/#known-issues-and-limitations). Some stored procedures might take longer than this limit to complete, causing a `504 Timeout` error. Sometimes these long-running processes are coded as stored procedures explicitly for this purpose. Due to the timeout limit, calling these procedures from Azure Logic Apps might create problems. Although the SQL connector doesn't natively support an asynchronous mode, you can work around this problem and simulate this mode by using a SQL completion trigger, native SQL pass-through query, a state table, and server-side jobs. For this task, you can use the [Azure Elastic Job Agent](/azure/azure-sql/database/elastic-jobs-overview) for [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview). For [SQL Server on premises](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview), you can use the [SQL Server Agent](/sql/ssms/agent/sql-server-agent). For example, suppose that you have the following long-running stored procedure, which takes longer than the timeout limit to finish running. If you run this stored procedure from a logic app by using the SQL connector, you get an `HTTP 504 Gateway Timeout` error as the result. Rather than directly call the stored procedure, you can asynchronously run the p > which means that they can run multiple times without affecting the results. > If the asynchronous processing fails or times out, the job agent might retry the step, > and thus your stored procedure, multiple times. To avoid duplicating output, -> before you create any objects, review these [best practices and approaches](../azure-sql/database/elastic-jobs-overview.md#idempotent-scripts). +> before you create any objects, review these [best practices and approaches](/azure/azure-sql/database/elastic-jobs-overview#idempotent-scripts). The next section describes how you can use the Azure Elastic Job Agent for Azure SQL Database. For SQL Server and Azure SQL Managed Instance, you can use the SQL Server Agent. Some management details will differ, but the fundamental steps remain the same as setting up a job agent for Azure SQL Database. The next section describes how you can use the Azure Elastic Job Agent for Azure ## Job agent for Azure SQL Database -To create a job that can run the stored procedure for [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md), use the [Azure Elastic Job Agent](../azure-sql/database/elastic-jobs-overview.md). Create your job agent in the Azure portal. This approach will add several stored procedures to the database that's used by the agent, also known as the *agent database*. You can then create a job that runs your stored procedure in the target database and captures the output when finished. +To create a job that can run the stored procedure for [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview), use the [Azure Elastic Job Agent](/azure/azure-sql/database/elastic-jobs-overview). Create your job agent in the Azure portal. This approach will add several stored procedures to the database that's used by the agent, also known as the *agent database*. You can then create a job that runs your stored procedure in the target database and captures the output when finished. -Before you can create the job, you need to set up permissions, groups, and targets as described by the [full documentation for the Azure Elastic Job Agent](../azure-sql/database/elastic-jobs-overview.md). You also need to create a supporting table in the target database as described in the following sections. +Before you can create the job, you need to set up permissions, groups, and targets as described by the [full documentation for the Azure Elastic Job Agent](/azure/azure-sql/database/elastic-jobs-overview). You also need to create a supporting table in the target database as described in the following sections. <a name="create-state-table"></a> When the job completes, the job updates the `LongRunningState` table so that you ## Job agent for SQL Server or Azure SQL Managed Instance -For the same scenario, you can use the [SQL Server Agent](/sql/ssms/agent/sql-server-agent) for [SQL Server on premises](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md). Although some management details differ, the fundamental steps remain the same as the setting up a job agent for Azure SQL Database. +For the same scenario, you can use the [SQL Server Agent](/sql/ssms/agent/sql-server-agent) for [SQL Server on premises](/sql/sql-server/sql-server-technical-documentation) and [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview). Although some management details differ, the fundamental steps remain the same as the setting up a job agent for Azure SQL Database. ## Next steps |
| logic-apps | Logic Apps Azure Resource Manager Templates Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/logic-apps/logic-apps-azure-resource-manager-templates-overview.md | Your logic app's [workflow resource definition in a template](/azure/templates/m "tags": { "displayName": "LogicApp" },- "apiVersion": "2016-06-01", + "apiVersion": "2019-05-01", "dependsOn": [ ] } Here is an example that provides the account name and access key for an Azure Bl "tags": { "displayName": "LogicApp" },- "apiVersion": "2016-06-01", + "apiVersion": "2019-05-01", // Template parameter reference for value to use at deployment "dependsOn": [ "[resourceId('Microsoft.Web/connections', parameters('azureblob_1_Connection_Name'))]" Here is the parameterized sample template that's used by this topic's examples: "tags": { "displayName": "LogicApp" },- "apiVersion": "2016-06-01", + "apiVersion": "2019-05-01", "dependsOn": [ "[resourceId('Microsoft.Web/connections', parameters('azureblob_1_Connection_Name'))]", "[resourceId('Microsoft.Web/connections', parameters('office365_1_Connection_Name'))]" |
| logic-apps | Set Up Sql Db Storage Single Tenant Standard Workflows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/logic-apps/set-up-sql-db-storage-single-tenant-standard-workflows.md | The following table describes some reasons why you might want to use SQL: - If you're using Azure SQL database, complete the following requirements: - - For local development and testing, explicitly allow connections from your local computer's IP address. You can [set your IP firewall rules in Azure SQL Server](../azure-sql/database/network-access-controls-overview.md#ip-firewall-rules). + - For local development and testing, explicitly allow connections from your local computer's IP address. You can [set your IP firewall rules in Azure SQL Server](/azure/azure-sql/database/network-access-controls-overview#ip-firewall-rules). - - In the [Azure portal](https://portal.azure.com), permit your logic app resource to access the SQL database with a provided connection string by [allowing Azure services](../azure-sql/database/network-access-controls-overview.md#allow-azure-services). + - In the [Azure portal](https://portal.azure.com), permit your logic app resource to access the SQL database with a provided connection string by [allowing Azure services](/azure/azure-sql/database/network-access-controls-overview#allow-azure-services). - - Set up any other [SQL database network access controls](../azure-sql/database/network-access-controls-overview.md) as necessary for your scenario. + - Set up any other [SQL database network access controls](/azure/azure-sql/database/network-access-controls-overview) as necessary for your scenario. - - If you're using Azure SQL Managed Instance, allow Azure services (`logicapp`) to [connect to your SQL database through secured public endpoints](../azure-sql/managed-instance/public-endpoint-overview.md). + - If you're using Azure SQL Managed Instance, allow Azure services (`logicapp`) to [connect to your SQL database through secured public endpoints](/azure/azure-sql/managed-instance/public-endpoint-overview). <a name="set-up-sql-logic-app-creation-azure-portal"></a> |
| machine-learning | Azure Machine Learning Release Notes Cli V2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/azure-machine-learning-release-notes-cli-v2.md | |
| machine-learning | Concept Network Data Access | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/concept-network-data-access.md | When using Azure Data Lake Storage Gen2 as a datastore, you can use both Azure R ## Azure SQL Database -To access data stored in an Azure SQL Database with a managed identity, you must create a SQL contained user that maps to the managed identity. For more information on creating a user from an external provider, see [Create contained users mapped to Azure AD identities](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities). +To access data stored in an Azure SQL Database with a managed identity, you must create a SQL contained user that maps to the managed identity. For more information on creating a user from an external provider, see [Create contained users mapped to Azure AD identities](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities). After you create a SQL contained user, grant permissions to it by using the [GRANT T-SQL command](/sql/t-sql/statements/grant-object-permissions-transact-sql). To secure communication between Azure Machine Learning and Azure SQL Database, t * __Allow Azure services and resources to access the Azure SQL Database server__. Enabling this setting _allows all connections from Azure_, including __connections from the subscriptions of other customers__, to your database server. - For information on enabling this setting, see [IP firewall rules - Azure SQL Database and Synapse Analytics](../azure-sql/database/firewall-configure.md). + For information on enabling this setting, see [IP firewall rules - Azure SQL Database and Synapse Analytics](/azure/azure-sql/database/firewall-configure). * __Allow the IP address range of the Azure Machine Learning service in Firewalls and virtual networks__ for the Azure SQL Database. Allowing the IP addresses through the firewall limits __connections to the Azure Machine Learning service for a region__. To secure communication between Azure Machine Learning and Azure SQL Database, t To get a list of the IP addresses for Azure Machine Learning, download the [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) and search the file for `AzureMachineLearning.<region>`, where `<region>` is the Azure region that contains your Azure Machine Learning workspace. - To add the IP addresses to your Azure SQL Database, see [IP firewall rules - Azure SQL Database and Synapse Analytics](../azure-sql/database/firewall-configure.md). + To add the IP addresses to your Azure SQL Database, see [IP firewall rules - Azure SQL Database and Synapse Analytics](/azure/azure-sql/database/firewall-configure). ## Next steps |
| machine-learning | Concept Onnx | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/concept-onnx.md | Microsoft and a community of partners created ONNX as an open standard for repre ONNX Runtime is used in high-scale Microsoft services such as Bing, Office, and Azure Cognitive Services. Performance gains are dependent on a number of factors, but these Microsoft services have seen an __average 2x performance gain on CPU__. In addition to Azure Machine Learning services, ONNX Runtime also runs in other products that support Machine Learning workloads, including: + Windows: The runtime is built into Windows as part of [Windows Machine Learning](/windows/ai/windows-ml/) and runs on hundreds of millions of devices. -+ Azure SQL product family: Run native scoring on data in [Azure SQL Edge](../azure-sql-edge/onnx-overview.md) and [Azure SQL Managed Instance](../azure-sql/managed-instance/machine-learning-services-overview.md). ++ Azure SQL product family: Run native scoring on data in [Azure SQL Edge](../azure-sql-edge/onnx-overview.md) and [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/machine-learning-services-overview). + ML.NET: [Run ONNX models in ML.NET](/dotnet/machine-learning/tutorials/object-detection-onnx). |
| machine-learning | How To Access Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-access-data.md | Datastores currently support storing connection information to the storage servi [Azure File Share](../storage/files/storage-files-introduction.md)| Account key <br> SAS token | Γ£ô | Γ£ô | Γ£ô |Γ£ô|Γ£ô [Azure Data Lake Storage Gen 1](../data-lake-store/index.yml)| Service principal| Γ£ô | Γ£ô | Γ£ô |Γ£ô| [Azure Data Lake Storage Gen 2](../storage/blobs/data-lake-storage-introduction.md)| Service principal| Γ£ô | Γ£ô | Γ£ô |Γ£ô|-[Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md)| SQL authentication <br>Service principal| Γ£ô | Γ£ô | Γ£ô |Γ£ô| +[Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview)| SQL authentication <br>Service principal| Γ£ô | Γ£ô | Γ£ô |Γ£ô| [Azure PostgreSQL](../postgresql/overview.md) | SQL authentication| Γ£ô | Γ£ô | Γ£ô |Γ£ô| [Azure Database for MySQL](../mysql/overview.md) | SQL authentication| | Γ£ô* | Γ£ô* |Γ£ô*| [Databricks File System](/azure/databricks/data/databricks-file-system)| No authentication | | Γ£ô** | Γ£ô ** |Γ£ô** | |
| machine-learning | How To Deploy Batch With Rest | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-deploy-batch-with-rest.md | |
| machine-learning | How To Enable Studio Virtual Network | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-enable-studio-virtual-network.md | When using Azure Data Lake Storage Gen2 as a datastore, you can use both Azure R ## Datastore: Azure SQL Database -To access data stored in an Azure SQL Database with a managed identity, you must create a SQL contained user that maps to the managed identity. For more information on creating a user from an external provider, see [Create contained users mapped to Azure AD identities](../azure-sql/database/authentication-aad-configure.md#create-contained-users-mapped-to-azure-ad-identities). +To access data stored in an Azure SQL Database with a managed identity, you must create a SQL contained user that maps to the managed identity. For more information on creating a user from an external provider, see [Create contained users mapped to Azure AD identities](/azure/azure-sql/database/authentication-aad-configure#create-contained-users-mapped-to-azure-ad-identities). After you create a SQL contained user, grant permissions to it by using the [GRANT T-SQL command](/sql/t-sql/statements/grant-object-permissions-transact-sql). |
| machine-learning | How To High Availability Machine Learning | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-high-availability-machine-learning.md | __Data services__ * **Azure Blob container / Azure Files / Data Lake Storage Gen2**: See [Azure Storage redundancy](../storage/common/storage-redundancy.md). * **Data Lake Storage Gen1**: See [High availability and disaster recovery guidance for Data Lake Storage Gen1](../data-lake-store/data-lake-store-disaster-recovery-guidance.md).-* **SQL Database**: See [High availability for Azure SQL Database and SQL Managed Instance](../azure-sql/database/high-availability-sla.md). +* **SQL Database**: See [High availability for Azure SQL Database and SQL Managed Instance](/azure/azure-sql/database/high-availability-sla). * **Azure Database for PostgreSQL**: See [High availability concepts in Azure Database for PostgreSQL - Single Server](../postgresql/concepts-high-availability.md). * **Azure Database for MySQL**: See [Understand business continuity in Azure Database for MySQL](../mysql/concepts-business-continuity.md). * **Azure Databricks File System**: See [Regional disaster recovery for Azure Databricks clusters](/azure/databricks/scenarios/howto-regional-disaster-recovery). |
| machine-learning | How To Identity Based Data Access | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-identity-based-data-access.md | Certain machine learning scenarios involve training models with private data. In - [Azure Blob Storage](../storage/blobs/storage-blobs-overview.md) - [Azure Data Lake Storage Gen1](../data-lake-store/index.yml) - [Azure Data Lake Storage Gen2](../storage/blobs/data-lake-storage-introduction.md)- - [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md) + - [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) - The [Azure Machine Learning SDK for Python](/python/api/overview/azure/ml/install). |
| machine-learning | How To Manage Environments V2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-manage-environments-v2.md | |
| machine-learning | How To Migrate From Estimators To Scriptrunconfig | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-migrate-from-estimators-to-scriptrunconfig.md | Title: Migrate from Estimators to ScriptRunConfig description: Migration guide for migrating from Estimators to ScriptRunConfig for configuring training jobs. --++ |
| machine-learning | How To Monitor Tensorboard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-monitor-tensorboard.md | description: Launch TensorBoard to visualize experiment run histories and identi --++ Last updated 10/21/2021 |
| machine-learning | How To Train Keras | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-train-keras.md | description: Learn how to train and register a Keras deep neural network classif --++ Last updated 09/28/2020 |
| machine-learning | How To Train Pytorch | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-train-pytorch.md | description: Learn how to run your PyTorch training scripts at enterprise scale --++ Last updated 02/28/2022 |
| machine-learning | How To Train Tensorflow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-train-tensorflow.md | description: Learn how Azure Machine Learning enables you to scale out a TensorF --++ Last updated 02/23/2022 |
| machine-learning | How To Train With Rest | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-train-with-rest.md | In the following REST API calls, we use `$SUBSCRIPTION_ID`, `$RESOURCE_GROUP`, ` Administrative REST requests a [service principal authentication token](how-to-manage-rest.md#retrieve-a-service-principal-authentication-token). Replace `$TOKEN` with your own value. You can retrieve this token with the following command: -```bash +```azurecli TOKEN=$(az account get-access-token --query accessToken -o tsv) ``` Now that you have the datastore, you can create a dataset. For this example, use Now that you have the dataset and datastore, you can upload the training script that will run on the job. Use the Azure Storage CLI to upload a blob into your default container. You can also use other methods to upload, such as the Azure portal or Azure Storage Explorer. -```bash +```azurecli az storage blob upload-batch -d $AZUREML_DEFAULT_CONTAINER/src \ -s jobs/train/lightgbm/iris/src --account-name $AZURE_STORAGE_ACCOUNT --account-key $AZURE_STORAGE_KEY ``` |
| machine-learning | How To Troubleshoot Batch Endpoints | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-troubleshoot-batch-endpoints.md | Option 1: Stream logs to local console You can run the following command to stream system-generated logs to your console. Only logs in the `azureml-logs` folder will be streamed. -```bash +```azurecli az ml job stream -name <job_name> ``` |
| machine-learning | How To Use Batch Endpoint | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/how-to-use-batch-endpoint.md | |
| machine-learning | Reference Yaml Core Syntax | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/reference-yaml-core-syntax.md | |
| machine-learning | Reference Yaml Deployment Batch | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/reference-yaml-deployment-batch.md | |
| machine-learning | Reference Yaml Endpoint Batch | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/reference-yaml-endpoint-batch.md | |
| machine-learning | Reference Yaml Job Command | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/reference-yaml-job-command.md | |
| machine-learning | Reference Yaml Job Sweep | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/reference-yaml-job-sweep.md | |
| marketplace | Azure Container Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/azure-container-offer-listing.md | In the **Support contact** section, provide the **Support website** where Azure Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Azure Vm Image Test | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/azure-vm-image-test.md | There are two ways to run validations on the deployed image. ### Use Certification Test Tool for Azure Certified > [!IMPORTANT]-> To run the certification test tool, the Windows Remote Management service must be running and configured on Windows. This enables access to port 5986. +> To run the certification test tool, the Windows Remote Management service must be running and configured on Windows. This enables access to port 5986. For information, see [Installation and configuration for Windows Remote Management](/windows/win32/winrm/installation-and-configuration-for-windows-remote-management). #### Download and run the certification test tool |
| marketplace | Azure Vm Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/azure-vm-offer-listing.md | If applicable, provide the **Name**, **Email**, and **Phone** of the contact for Provide logos, screenshots, and videos to use with your offer. These will appear on the search results and detail pages in the Azure Marketplace. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Create Consulting Service Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/create-consulting-service-offer-listing.md | Add at least one and up to three PDF documents to support your offer listing. Af ## Marketplace media +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + > [!NOTE] > If you have an issue uploading files, make sure your local network does not block the `https://upload.xboxlive.com` service used by Partner Center. |
| marketplace | Create Managed Service Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/create-managed-service-offer-listing.md | If you have support websites for Azure Global Customers and/or Azure Government ## Marketplace media +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + > [!NOTE] > If you have an issue uploading files, make sure your local network does not block the `https://upload.xboxlive.com` service used by Partner Center. |
| marketplace | Create New Saas Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/create-new-saas-offer-listing.md | You must add at least one and a maximum of three marketing documents for your of ## Add marketplace media +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + ### Add logos Under **Logos**, upload a **Large** logo in PNG format between 216 x 216 and 350 x 350 pixels. Partner Center will automatically create **Small** (48 x 48) and **Medium** (90 x 90) logos, which you can replace later if you want. |
| marketplace | Dynamics 365 Business Central Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/dynamics-365-business-central-offer-listing.md | Provide at least one (and up to three) related PDF marketing documents here, suc Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Dynamics 365 Customer Engage Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/dynamics-365-customer-engage-offer-listing.md | Provide at least one (and up to three) related PDF marketing documents here, suc Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Dynamics 365 Operations Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/dynamics-365-operations-offer-listing.md | Provide at least one (and up to three) related PDF marketing documents here, suc Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Gtm Offer Listing Best Practices | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/gtm-offer-listing-best-practices.md | For an analysis of how your offers are performing, go to the [Marketplace Insigh > [!IMPORTANT] > Make sure your offer name and offer description adhere to **[Microsoft Trademark and Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general.aspx)** and other relevant, product-specific guidelines when referring to Microsoft trademarks and the names of Microsoft software, products, and services. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + ## Link to your offer page from your website To easily direct users to your offer in the commercial marketplace, leverage our **Get It Now** badges on your website or in your digital marketing collateral. Find these badges in our [Marketplace Marketing Toolkit](https://partner.microsoft.com/asset/collection/azure-marketplace-and-appsource-publisher-toolkit#/). |
| marketplace | Iot Edge Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/iot-edge-offer-listing.md | In the **Support contact** section, provide the **CSP Program Marketing Material Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Commercial Marketplace Get Customer Leads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-get-customer-leads.md | description: Learn about generating and receiving customer leads from your Micro --++ Last updated 05/20/2021 |
| marketplace | Commercial Marketplace Lead Management Instructions Azure Table | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-lead-management-instructions-azure-table.md | description: Learn how to use Azure Table storage to configure leads for Microso --++ Last updated 12/02/2021 |
| marketplace | Commercial Marketplace Lead Management Instructions Dynamics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-lead-management-instructions-dynamics.md | description: Learn how to set up Dynamics 365 Customer Engagement to manage lead --++ Last updated 03/30/2020 |
| marketplace | Commercial Marketplace Lead Management Instructions Https | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-lead-management-instructions-https.md | description: Learn how to use Power Automate and an HTTPS endpoint to manage lea --++ Last updated 05/21/2021 |
| marketplace | Commercial Marketplace Lead Management Instructions Marketo | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-lead-management-instructions-marketo.md | description: Learn how to use a Marketo CRM system to manage leads from Microsof --++ Last updated 03/30/2020 |
| marketplace | Commercial Marketplace Lead Management Instructions Salesforce | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/partner-center-portal/commercial-marketplace-lead-management-instructions-salesforce.md | description: Learn how to use Salesforce to configure leads for Microsoft AppSou --++ Last updated 12/03/2021 |
| marketplace | Power Bi App Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/power-bi-app-offer-listing.md | Provide up to three related PDF marketing documents here, such as white papers, Provide logos and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure that your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. |
| marketplace | Power Bi Visual Offer Listing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/power-bi-visual-offer-listing.md | Provide listing details in any one or multiple supported languages. Select **Man Provide an icon and images to use with your offer. All images must be in PNG format. Blurry images will cause your submission to be rejected. +> [!IMPORTANT] +> When creating media for your offer, make sure that the assets you create are welcoming and inclusive for all. To learn more about how to create accessible media, see [Create accessible media](https://www.microsoft.com/accessibility/supplier-toolkit-resources). + >[!NOTE] >If you have an issue uploading files, ensure your local network doesn't block the https://upload.xboxlive.com service that's used by Partner Center. Provide at least one and up to five screenshots. The format should be PNG and th ### Additional information (optional) -To increase the interest of users for your custom visual, provide a **YouTube** or **Vimeo** link to a video about your visual. The format of your URL should include https:// or https://. --For tips on making your offer listing as effective as possible, see [Tips for creating effective listings](). +To increase the interest of users for your custom visual, provide a **YouTube** or **Vimeo** link to a video about your visual. The format of your URL should include `https://` or `https://`. For additional marketplace listing resources, see [Best practices for marketplace offer listings](gtm-offer-listing-best-practices.md). If you selected additional languages, select each from the dropdown list at the ## Next steps -- [**Availability**](power-bi-visual-availability.md)+- [**Availability**](power-bi-visual-availability.md) |
| migrate | Common Questions Discovery Assessment | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/migrate/common-questions-discovery-assessment.md | This can happen when the target deployment type chosen in the assessment propert The user is recommended to create an assessment in Azure Migrate with assessment type as **Azure VM** to determine if the server on which the instance is running is ready to migrate to an Azure VM instead: - Azure VM assessments in Azure Migrate are currently lift-an-shift focused and will not consider the specific performance metrics for running SQL instances and databases on the Azure virtual machine.-- When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) for SQL Server on Azure virtual machines.+- When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) for SQL Server on Azure virtual machines. ## I can't see some databases in my assessment even though the instance is part of the assessment The Azure SQL assessment only includes databases that are in online status. In c ## I want to compare costs for running my SQL instances on Azure VM Vs Azure SQL Database/Azure SQL Managed Instance -You can create an assessment with type **Azure VM** on the same group that was used in your **Azure SQL** assessment. You can then compare the two reports side by side. Though, Azure VM assessments in Azure Migrate are currently lift-and-shift focused and will not consider the specific performance metrics for running SQL instances and databases on the Azure virtual machine. When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) for SQL Server on Azure virtual machines. +You can create an assessment with type **Azure VM** on the same group that was used in your **Azure SQL** assessment. You can then compare the two reports side by side. Though, Azure VM assessments in Azure Migrate are currently lift-and-shift focused and will not consider the specific performance metrics for running SQL instances and databases on the Azure virtual machine. When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) for SQL Server on Azure virtual machines. ## The storage cost in my Azure SQL assessment is zero |
| migrate | Concepts Azure Sql Assessment Calculation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/migrate/concepts-azure-sql-assessment-calculation.md | Here's what's included in Azure SQL assessment properties: **Percentile utilization** | Percentile utilization specifies the percentile value of the performance sample used for rightsizing. **Comfort factor** | The buffer used during assessment. It accounts for issues like seasonal usage, short performance history, and likely increases in future usage.<br/><br/> For example, a 10-core instance with 20% utilization normally results in a two-core instance. With a comfort factor of 2.0, the result is a four-core instance instead. **Offer/Licensing program** | The [Azure offer](https://azure.microsoft.com/support/legal/offer-details/) in which you're enrolled. Currently you can only choose from Pay-as-you-go and Pay-as-you-go Dev/Test. Note that you can avail additional discount by applying reserved capacity and Azure Hybrid Benefit on top of Pay-as-you-go offer.-**Service tier** | The most appropriate service tier option to accommodate your business needs for migration to Azure SQL Database and/or Azure SQL Managed Instance:<br/><br/>**Recommended** if you want Azure Migrate to recommend the best suited service tier for your servers. This can be General purpose or Business critical. <br/><br/> **General Purpose** If you want an Azure SQL configuration designed for budget-oriented workloads. [Learn More](../azure-sql/database/service-tier-general-purpose.md) <br/><br/> **Business Critical** If you want an Azure SQL configuration designed for low-latency workloads with high resiliency to failures and fast failovers. [Learn More](../azure-sql/database/service-tier-business-critical.md) +**Service tier** | The most appropriate service tier option to accommodate your business needs for migration to Azure SQL Database and/or Azure SQL Managed Instance:<br/><br/>**Recommended** if you want Azure Migrate to recommend the best suited service tier for your servers. This can be General purpose or Business critical. <br/><br/> **General Purpose** If you want an Azure SQL configuration designed for budget-oriented workloads. [Learn More](/azure/azure-sql/database/service-tier-general-purpose) <br/><br/> **Business Critical** If you want an Azure SQL configuration designed for low-latency workloads with high resiliency to failures and fast failovers. [Learn More](/azure/azure-sql/database/service-tier-business-critical) **Currency** | The billing currency for your account. **Discount (%)** | Any subscription-specific discounts you receive on top of the Azure offer. The default setting is 0%. **Azure Hybrid Benefit** | Specifies whether you already have a SQL Server license. <br/><br/> If you do and they're covered with active Software Assurance of SQL Server Subscriptions, you can apply for the Azure Hybrid Benefit when you bring licenses to Azure. If you select the target deployment type as **Recommended** in the Azure SQL ass If the SQL instance is not ready for Azure SQL Database and Azure SQL Managed Instance, the Recommended deployment type is marked as *Potentially ready for Azure VM*. - The user is recommended to create an assessment in Azure Migrate with assessment type as "Azure VM" to determine if the server on which the instance is running is ready to migrate to an Azure VM instead. Note that: - Azure VM assessments in Azure Migrate are currently lift and shift focused and will not consider the specific performance metrics for running SQL instances and databases on the Azure virtual machine. - - When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) for SQL Server on Azure virtual machines. + - When you run an Azure VM assessment on a server, the recommended size and cost estimates will be for all instances running on the server and can be migrated to an Azure VM using the Server Migration tool. Before you migrate, [review the performance guidelines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) for SQL Server on Azure virtual machines. ## Calculate sizing |
| migrate | How To Modify Assessment | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/migrate/how-to-modify-assessment.md | Here's what's included in Azure SQL assessment properties: **Percentile utilization** | Percentile utilization specifies the percentile value of the performance sample used for rightsizing. **Comfort factor** | The buffer used during assessment. It accounts for issues like seasonal usage, short performance history, and likely increases in future usage.<br/><br/> For example, a 10-core instance with 20% utilization normally results in a two-core instance. With a comfort factor of 2.0, the result is a four-core instance instead. **Offer/Licensing program** | The [Azure offer](https://azure.microsoft.com/support/legal/offer-details/) in which you're enrolled. Currently you can only choose from Pay-as-you-go and Pay-as-you-go Dev/Test. Note that you can avail additional discount by applying reserved capacity and Azure Hybrid Benefit on top of Pay-as-you-go offer.-**Service tier** | The most appropriate service tier option to accommodate your business needs for migration to Azure SQL Database and/or Azure SQL Managed Instance:<br/><br/>**Recommended** if you want Azure Migrate to recommend the best suited service tier for your servers. This can be General purpose or Business critical. <br/><br/> **General Purpose** If you want an Azure SQL configuration designed for budget-oriented workloads. [Learn More](../azure-sql/database/service-tier-general-purpose.md) <br/><br/> **Business Critical** If you want an Azure SQL configuration designed for low-latency workloads with high resiliency to failures and fast failovers. [Learn More](../azure-sql/database/service-tier-business-critical.md) +**Service tier** | The most appropriate service tier option to accommodate your business needs for migration to Azure SQL Database and/or Azure SQL Managed Instance:<br/><br/>**Recommended** if you want Azure Migrate to recommend the best suited service tier for your servers. This can be General purpose or Business critical. <br/><br/> **General Purpose** If you want an Azure SQL configuration designed for budget-oriented workloads. [Learn More](/azure/azure-sql/database/service-tier-general-purpose) <br/><br/> **Business Critical** If you want an Azure SQL configuration designed for low-latency workloads with high resiliency to failures and fast failovers. [Learn More](/azure/azure-sql/database/service-tier-business-critical) **Currency** | The billing currency for your account. **Discount (%)** | Any subscription-specific discounts you receive on top of the Azure offer. The default setting is 0%. **Azure Hybrid Benefit** | Specifies whether you already have a SQL Server license. <br/><br/> If you do and they're covered with active Software Assurance of SQL Server Subscriptions, you can apply for the Azure Hybrid Benefit when you bring licenses to Azure. |
| migrate | Policy Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/migrate/policy-reference.md | description: Lists Azure Policy built-in policy definitions for Azure Migrate. T Last updated 03/08/2022 --++ # Azure Policy built-in definitions for Azure Migrate |
| migrate | Troubleshoot Network Connectivity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/migrate/troubleshoot-network-connectivity.md | Title: Troubleshoot network connectivity issues | Microsoft Docs description: Provides troubleshooting tips for common errors in using Azure Migrate with private endpoints.--++ ms. |
| mysql | Concepts High Availability | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/mysql/flexible-server/concepts-high-availability.md | Unplanned service downtime can be caused by software bugs or infrastructure faul The overall failover time is expected to be between 60 and 120 seconds. But, depending on the activity in the primary database server at the time of the failover (like large transactions and recovery time), the failover might take longer. +#### How automatic failover detection works in HA enabled servers ++The primary server and the secondary server has two network endpoints, +- Customer Endpoint: Customer connects and runs query on the instance using this endpoint. +- Management Endpoint: Used internally for service communications to management components and to connect to backend storage. ++The health monitor component continuously does the following checks +* The monitor pings to the nodes Management network Endpoint. If this check fails two times continuously, it triggers automatic failover operation. The scenario like node is unavailable/not responding because of OS issue, networking issue between management components and nodes etc. will be addressed by this health check. +* The monitor also runs a simple query on the Instance. If the queries fail to run, automatic failover will be triggered. The scenarios like MySQL demon crashed/ stopped/hung, Backend storage issue etc., will be addressed by this health check. ++>[!Note] +>If there are any networking issue between the application and the customer networking endpoint (Private/Public access), either in networking path , on the endpoint or DNS issues in client side, the health check does not monitor this scenario. If you are using private access, make sure that the NSG rules for the VNet does not block the communication to the instance customer networking endpoint on port 3306. For public access make sure that the firewall rules are set and network traffic is allowed on port 3306 (if network path has any other firewalls). The DNS resolution from the client application side also needs to be taken care of. + ## Monitoring for high availability The health of your HA is continuously monitored and reported on the overview page. Here are the replication statuses: |
| mysql | Tutorial Php Database App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/mysql/flexible-server/tutorial-php-database-app.md | To configure the deployment user, run the [az webapp deployment user set](/cli/a The username must be unique within Azure, and for local Git pushes, must not contain the '@' symbol. The password must be at least eight characters long, with two of the following three elements: letters, numbers, and symbols. -```bash +```azurecli az appservice plan create --name myAppServicePlan --resource-group myResourceGroup --sku F1 --is-linux ``` Create a [web app](../../app-service/overview.md#app-service-on-linux) in the my In the Cloud Shell, you can use the [az webapp create](/cli/azure/webapp#az-webapp-create) command. In the following example, replace _<app-name>_ with a globally unique app name (valid characters are `a-z`, `0-9`, and `-`). The runtime is set to `PHP|7.0`. To see all supported runtimes, run [az webapp list-runtimes --os linux](/cli/azure/webapp#az-webapp-list-runtimes). -```bash +```azurecli az webapp create --resource-group myResourceGroup --plan myAppServicePlan --name <app-name> --runtime "PHP|7.3" --deployment-local-git ``` If you added any tasks, they are retained in the database. Updates to the data s In the preceding steps, you created Azure resources in a resource group. If you don't expect to need these resources in the future, delete the resource group by running the following command in the Cloud Shell: -```bash +```azurecli az group delete --name myResourceGroup ``` |
| mysql | Howto Data Encryption Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/mysql/howto-data-encryption-portal.md | Learn how to use the Azure portal to set up and manage data encryption for your * recoverylevel attribute set to **Recoverable** (this requires soft-delete enabled with retention period set to 90 days) * Purge protection enabled -You can verify the above attributes of the key by using the following command: + You can verify the above attributes of the key by using the following command: ++ ```azurecli-interactive + az keyvault key show --vault-name <key_vault_name> -n <key_name> + ``` -```azurecli-interactive -az keyvault key show --vault-name <key_vault_name> -n <key_name> -``` * The Azure Database for MySQL - Single Server should be on General Purpose or Memory Optimized pricing tier and on general purpose storage v2. Before you proceed further, refer limitations for [data encryption with customer managed keys](concepts-data-encryption-mysql.md#limitations). ## Set the right permissions for key operations After Azure Database for MySQL is encrypted with a customer's managed key stored :::image type="content" source="media/concepts-data-access-and-security-data-encryption/show-revalidate-data-encryption.png" alt-text="Screenshot of Azure Database for MySQL, with revalidation step highlighted"::: - You will have to give the key vault access to the new server. + You will have to give the key vault access to the new server. For more information, see [Assign a Key Vault access policy](../key-vault/general/assign-access-policy.md?tabs=azure-portal). 4. After registering the service principal, revalidate the key again, and the server resumes its normal functionality. |
| notification-hubs | Uwp React | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/notification-hubs/uwp-react.md | To build the sample, follow these steps. ### Create resource: SQL database -[Create a SQL Server database instance](../azure-sql/database/single-database-create-quickstart.md?tabs=azure-portal) in the Azure portal. For example: +[Create a SQL Server database instance](/azure/azure-sql/database/single-database-create-quickstart?tabs=azure-portal) in the Azure portal. For example: :::image type="content" source="media/uwp-react/resources-sql.png" alt-text="SQL instance resources"::: |
| openshift | Configure Azure Ad Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/configure-azure-ad-cli.md | app_id=$(az ad app create \ Retrieve the tenant ID of the subscription that owns the application. -```azure +```azurecli-interactive tenant_id=$(az account show --query tenantId -o tsv) ``` |
| openshift | Howto Create A Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/howto-create-a-backup.md | To [install](https://velero.io/docs/main/basic-install/) Velero on your system, This step will create a resource group outside of the ARO cluster's resource group. This resource group will allow the backups to persist and can restore applications to new clusters. -```bash +```azurecli AZURE_BACKUP_RESOURCE_GROUP=Velero_Backups az group create -n $AZURE_BACKUP_RESOURCE_GROUP --location eastus export AZURE_RESOURCE_GROUP=$(az aro show --name <name of cluster> --resource-gr ``` -```bash +```azurecli AZURE_SUBSCRIPTION_ID=$(az account list --query '[?isDefault].id' -o tsv) AZURE_TENANT_ID=$(az account list --query '[?isDefault].tenantId' -o tsv) ``` -```bash +```azurecli AZURE_CLIENT_SECRET=$(az ad sp create-for-rbac --name "velero" --role "Contributor" --query 'password' -o tsv \ --scopes /subscriptions/$AZURE_SUBSCRIPTION_ID) AZURE_CLIENT_ID=$(az ad sp list --display-name "velero" --query '[0].appId' -o tsv) |
| openshift | Howto Create A Storageclass | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/howto-create-a-storageclass.md | Deploy an Azure Red Hat OpenShift 4 cluster into your subscription, see [Create This step will create a resource group outside of the Azure Red Hat OpenShift (ARO) clusterΓÇÖs resource group. This resource group will contain the Azure Files shares that are created by Azure Red Hat OpenShiftΓÇÖs dynamic provisioner. -```bash +```azurecli AZURE_FILES_RESOURCE_GROUP=aro_azure_files LOCATION=eastus az storage account create \ The ARO service principal requires 'listKeys' permission on the new Azure storage account resource group. Assign the ΓÇÿContributorΓÇÖ role to achieve this. -```bash +```azurecli ARO_RESOURCE_GROUP=aro-rg CLUSTER=cluster ARO_SERVICE_PRINCIPAL_ID=$(az aro show -g $ARO_RESOURCE_GROUP -n $CLUSTER --query servicePrincipalProfile.clientId -o tsv) az role assignment create --role Contributor --scope /subscriptions/mySubscripti ### Set ARO cluster permissions The OpenShift persistent volume binder service account will require the ability to read secrets. Create and assign an OpenShift cluster role to achieve this.-```bash +```azurecli ARO_API_SERVER=$(az aro list --query "[?contains(name,'$CLUSTER')].[apiserverProfile.url]" -o tsv) oc login -u kubeadmin -p $(az aro list-credentials -g $ARO_RESOURCE_GROUP -n $CLUSTER --query=kubeadminPassword -o tsv) $ARO_API_SERVER |
| openshift | Howto Restrict Egress | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/howto-restrict-egress.md | LOCATION=eastus # The location where ARO cluster is deployed ``` ### Create a resource group-```bash +```azurecli az group create -g "$RESOURCEGROUP" -l $LOCATION ``` ### Create the virtual network-```bash +```azurecli az network vnet create \ -g $RESOURCEGROUP \ -n $AROVNET \ az network vnet create \ ``` ### Add two empty subnets to your virtual network-```bash +```azurecli az network vnet subnet create \ -g "$RESOURCEGROUP" \ --vnet-name $AROVNET \ az network vnet create \ ``` ### Disable network policies for Private Link Service on your virtual network and subnets. This is a requirement for the ARO service to access and manage the cluster.-```bash +```azurecli az network vnet subnet update \ -g "$RESOURCEGROUP" \ --vnet-name $AROVNET \ az network vnet subnet update \ --disable-private-link-service-network-policies true ``` ### Create a Firewall Subnet-```bash +```azurecli az network vnet subnet create \ -g "$RESOURCEGROUP" \ --vnet-name $AROVNET \ az network vnet subnet create \ ## Create a jump-host VM ### Create a jump-subnet-```bash +```azurecli az network vnet subnet create \ -g "$RESOURCEGROUP" \ --vnet-name $AROVNET \ az network vnet subnet create \ --service-endpoints Microsoft.ContainerRegistry ``` ### Create a jump-host VM-```bash +```azurecli VMUSERNAME=aroadmin az vm create --name ubuntu-jump \ When running the `az aro create` command, you can reference your pull secret usi If you are copying your pull secret or referencing it in other scripts, your pull secret should be formatted as a valid JSON string. -```bash +```azurecli az aro create \ -g "$RESOURCEGROUP" \ -n "$CLUSTER" \ az aro create \ ## Create an Azure Firewall ### Create a public IP Address-```bash +```azurecli az network public-ip create -g $RESOURCEGROUP -n fw-ip --sku "Standard" --location $LOCATION ``` ### Update install Azure Firewall extension-```bash +```azurecli az extension add -n azure-firewall az extension update -n azure-firewall ``` ### Create Azure Firewall and configure IP Config-```bash +```azurecli az network firewall create -g $RESOURCEGROUP -n aro-private -l $LOCATION az network firewall ip-config create -g $RESOURCEGROUP -f aro-private -n fw-config --public-ip-address fw-ip --vnet-name $AROVNET ``` ### Capture Azure Firewall IPs for a later use-```bash +```azurecli FWPUBLIC_IP=$(az network public-ip show -g $RESOURCEGROUP -n fw-ip --query "ipAddress" -o tsv) FWPRIVATE_IP=$(az network firewall show -g $RESOURCEGROUP -n aro-private --query "ipConfigurations[0].privateIpAddress" -o tsv) echo $FWPRIVATE_IP ``` ### Create a UDR and Routing Table for Azure Firewall-```bash +```azurecli az network route-table create -g $RESOURCEGROUP --name aro-udr az network route-table route create -g $RESOURCEGROUP --name aro-udr --route-table-name aro-udr --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $FWPRIVATE_IP az network route-table route create -g $RESOURCEGROUP --name aro-udr --route-tab ### Add Application Rules for Azure Firewall Rule for OpenShift to work based on this [list](https://docs.openshift.com/container-platform/4.3/installing/install_config/configuring-firewall.html#configuring-firewall_configuring-firewall):-```bash +```azurecli az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \ --collection-name 'ARO' \ --action allow \ az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \ --target-fqdns 'registry.redhat.io' '*.quay.io' 'sso.redhat.com' 'management.azure.com' 'mirror.openshift.com' 'api.openshift.com' 'quay.io' '*.blob.core.windows.net' 'gcs.prod.monitoring.core.windows.net' 'registry.access.redhat.com' 'login.microsoftonline.com' '*.servicebus.windows.net' '*.table.core.windows.net' 'grafana.com' ``` Optional rules for Docker images:-```bash +```azurecli az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \ --collection-name 'Docker' \ --action allow \ az network firewall application-rule create -g $RESOURCEGROUP -f aro-private \ ``` ### Associate ARO Subnets to FW-```bash +```azurecli az network vnet subnet update -g $RESOURCEGROUP --vnet-name $AROVNET --name "$CLUSTER-master" --route-table aro-udr az network vnet subnet update -g $RESOURCEGROUP --vnet-name $AROVNET --name "$CLUSTER-worker" --route-table aro-udr ``` ARO_PASSWORD=$(az aro list-credentials -n $CLUSTER -g $RESOURCEGROUP -o json | j ARO_USERNAME=$(az aro list-credentials -n $CLUSTER -g $RESOURCEGROUP -o json | jq -r '.kubeadminUsername') ``` Get an API server endpoint:-```bash +```azurecli ARO_URL=$(az aro show -n $CLUSTER -g $RESOURCEGROUP -o json | jq -r '.apiserverProfile.url') ``` sudo ssh -i /Users/jimzim/.ssh/id_rsa -L 443:console-openshift-console.apps.d5xm ## Clean up resources -```bash +```azurecli # Clean up the ARO cluster, vnet, firewall and jumpbox |
| openshift | Howto Service Principal Credential Rotation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/howto-service-principal-credential-rotation.md | If the service principal credentials are expired please update using one of the ### Cluster AAD application contains a client secret with an empty description When using [automated service principal credential rotation](#Automated-Service-Principal-Credential-Rotation) the following error occurs:-```bash +```azurecli $ az aro update --refresh-credentials --name MyManagedCluster --resource-group MyResourceGroup Cluster AAD application contains a client secret with an empty description. |
| openshift | Tutorial Delete Cluster | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/tutorial-delete-cluster.md | If you choose to install and use the CLI locally, this tutorial requires that yo If you're running the Azure CLI locally, run `az login` to sign in to Azure. -```bash +```azurecli az login ``` RESOURCEGROUP=yourresourcegroup Using these values, delete your cluster: -```bash +```azurecli az aro delete --resource-group $RESOURCEGROUP --name $CLUSTER ``` |
| postgresql | Concepts Pricing Tiers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/concepts-pricing-tiers.md | The storage you provision is the amount of storage capacity available to your Az | IOPS | Variable |3 IOPS/GB<br/>Min 100 IOPS<br/>Max 20,000 IOPS | 3 IOPS/GB<br/>Min 100 IOPS<br/>Max 20,000 IOPS | > [!NOTE]-> Storage up to 16TB and 20,000 IOPS is supported in the following regions: Australia East, Australia South East, Brazil South, Canada Central, Canada East, Central US, China East 2, China North 2, East Asia, East US, East US 1, East US 2, France Central, Japan East, Japan West, Korea Central, Korea South, North Central US, North Europe, South Central US, Southeast Asia, Switzerland North, Switzerland West, US Gov East, US Gov SouthCentral, US Gov SouthWest, UK South, UK West, West Europe, West Central US, West US, and West US 2. +> Storage up to 16TB and 20,000 IOPS is supported in the following regions: Australia East, Australia South East, Brazil South, Canada Central, Canada East, Central US, China East 2, China North 2, East Asia, East US, East US 1, East US 2, France Central, India Central, India South, Japan East, Japan West, Korea Central, Korea South, North Central US, North Europe, South Central US, Southeast Asia, Switzerland North, Switzerland West, US Gov East, US Gov SouthCentral, US Gov SouthWest, UK South, UK West, West Europe, West Central US, West US, and West US 2. > > All other regions support up to 4TB of storage and 6000 IOPS. > |
| postgresql | Concepts Server Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/concepts-server-logs.md | Last updated 06/25/2020 Azure Database for PostgreSQL allows you to configure and access Postgres's standard logs. The logs can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance. Logging information you can configure and access includes errors, query information, autovacuum records, connections, and checkpoints. (Access to transaction logs is not available). -Audit logging is made available through a Postgres extension, pgaudit. To learn more, visit the [auditing concepts](concepts-audit.md) article. +Audit logging is made available through a PostgreSQL extension, pgaudit. To learn more, visit the [auditing concepts](concepts-audit.md) article. ## Configure logging |
| postgresql | Concepts Logical | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/flexible-server/concepts-logical.md | Logical decoding: 1. Go to server parameters page on the portal. 2. Set the server parameter `wal_level` to `logical`.-3. If you want to use pglogical extension, search for the `shared_preload_libraries` parameter, and select `pglogical` from the drop-down box. +3. If you want to use pglogical extension, search for the `shared_preload_libraries` and `azure.extensions` parameters, and select `pglogical` from the drop-down box. 4. Update `max_worker_processes` parameter value to at least 16. Otherwise, you may run into issues like `WARNING: out of background worker slots`. 5. Save the changes and restart the server to apply the `wal_level` change. 6. Confirm that your PostgreSQL instance allows network traffic from your connecting resource. |
| postgresql | Concepts Networking | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/flexible-server/concepts-networking.md | Here are some concepts to be familiar with when you're using virtual networks wi * **Delegated subnet**. A virtual network contains subnets (sub-networks). Subnets enable you to segment your virtual network into smaller address spaces. Azure resources are deployed into specific subnets within a virtual network. Your flexible server must be in a subnet that's *delegated*. That is, only Azure Database for PostgreSQL - Flexible Server instances can use that subnet. No other Azure resource types can be in the delegated subnet. You delegate a subnet by assigning its delegation property as `Microsoft.DBforPostgreSQL/flexibleServers`.- The smallest CIDR range you can specify for a subnet is /28, which provides fourteen IP addresses, of which five will be utilized by Azure internally, whereas a single Flexible Server with HA features utilizes 4 addresses. + The smallest CIDR range you can specify for a subnet is /28, which provides fourteen IP addresses, however the first and last address in any network or subnet can't be assigned to any individual host. Azure reserves five IPs to be utilized internally by Azure networking, which include two IPs that cannot be assigned to host, mentioned above. This leaves you eleven available IP addresses for /28 CIDR range, whereas a single Flexible Server with High Availability features utilizes 4 addresses. > [!IMPORTANT] > The names `AzureFirewallSubnet`, `AzureFirewallManagementSubnet`, `AzureBastionSubnet`, and `GatewaySubnet` are reserved within Azure. Don't use any of these as your subnet name. If you use an Azure API, an Azure Resource Manager template (ARM template), or T When using private network access with Azure virtual network, providing the private DNS zone information is mandatory across various interfaces, including API, ARM, and Terraform. Therefore, for new Azure Database for PostgreSQL Flexible Server creation using private network access with API, ARM, or Terraform, create private DNS zones and use them while configuring flexible servers with private access. See more information on [REST API specifications for Microsoft Azure](https://github.com/Azure/azure-rest-api-specs/blob/master/specification/postgresql/resource-manager/Microsoft.DBforPostgreSQL/stable/2021-06-01/postgresql.json). If you use the [Azure portal](./how-to-manage-virtual-network-portal.md) or [Azure CLI](./how-to-manage-virtual-network-cli.md) for creating flexible servers, you can either provide a private DNS zone name that you had previously created in the same or a different subscription or a default private DNS zone is automatically created in your subscription. +Using Azure Portal, CLI or ARM, you can also change private DNS Zone from the one you provided when creating your Azure Database for PostgreSQL - Flexible Server to another private DNS zone that exists the same or different subscription. + ### Integration with a custom DNS server If you're using a custom DNS server, you must use a DNS forwarder to resolve the FQDN of Azure Database for PostgreSQL - Flexible Server. The forwarder IP address should be [168.63.129.16](../../virtual-network/what-is-ip-address-168-63-129-16.md). |
| private-link | Availability | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-link/availability.md | The following tables list the Private Link services and the regions where they'r |Supported services |Available regions | Other considerations | Status | |:-|:--|:-|:--|-|Azure Synapse Analytics| All public regions <br/> All Government regions | Supported for Proxy [connection policy](../azure-sql/database/connectivity-architecture.md#connection-policy) |GA <br/> [Learn how to create a private endpoint for Azure Synapse Analytics.](../azure-sql/database/private-endpoint-overview.md)| +|Azure Synapse Analytics| All public regions <br/> All Government regions | Supported for Proxy [connection policy](/azure/azure-sql/database/connectivity-architecture#connection-policy) |GA <br/> [Learn how to create a private endpoint for Azure Synapse Analytics.](/azure/azure-sql/database/private-endpoint-overview)| |Azure Event Hub | All public regions<br/>All Government regions | | GA <br/> [Learn how to create a private endpoint for Azure Event Hub.](../event-hubs/private-link-service.md) | | Azure Monitor <br/>(Log Analytics & Application Insights) | All public regions | | GA <br/> [Learn how to create a private endpoint for Azure Monitor.](../azure-monitor/logs/private-link-security.md) | |Azure Data Factory | All public regions<br/> All Government regions<br/>All China regions | Credentials need to be stored in an Azure key vault| GA <br/> [Learn how to create a private endpoint for Azure Data Factory.](../data-factory/data-factory-private-link.md) | The following tables list the Private Link services and the regions where they'r |Supported services |Available regions | Other considerations | Status | |:-|:--|:-|:--|-| Azure SQL Database | All public regions <br/> All Government regions<br/>All China regions | Supported for Proxy [connection policy](../azure-sql/database/connectivity-architecture.md#connection-policy) | GA <br/> [Learn how to create a private endpoint for Azure SQL](./tutorial-private-endpoint-sql-portal.md) | +| Azure SQL Database | All public regions <br/> All Government regions<br/>All China regions | Supported for Proxy [connection policy](/azure/azure-sql/database/connectivity-architecture#connection-policy) | GA <br/> [Learn how to create a private endpoint for Azure SQL](./tutorial-private-endpoint-sql-portal.md) | |Azure Cosmos DB| All public regions<br/> All Government regions</br> All China regions | |GA <br/> [Learn how to create a private endpoint for Cosmos DB.](./tutorial-private-endpoint-cosmosdb-portal.md)| | Azure Database for PostgreSQL - Single server | All public regions <br/> All Government regions<br/>All China regions | Supported for General Purpose and Memory Optimized pricing tiers | GA <br/> [Learn how to create a private endpoint for Azure Database for PostgreSQL.](../postgresql/concepts-data-access-and-security-private-link.md) | | Azure Database for MySQL | All public regions<br/> All Government regions<br/>All China regions | | GA <br/> [Learn how to create a private endpoint for Azure Database for MySQL.](../mysql/concepts-data-access-security-private-link.md) | |
| private-link | Inspect Traffic With Azure Firewall | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-link/inspect-traffic-with-azure-firewall.md | Azure Firewall filters traffic using either: > The use of application rules over network rules is recommended when inspecting traffic destined to private endpoints in order to maintain flow symmetry. If network rules are used, or an NVA is used instead of Azure Firewall, SNAT must be configured for traffic destined to private endpoints. > [!NOTE]-> SQL FQDN filtering is supported in [proxy-mode](../azure-sql/database/connectivity-architecture.md#connection-policy) only (port 1433). **Proxy** mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using FQDN in firewall network rules. +> SQL FQDN filtering is supported in [proxy-mode](/azure/azure-sql/database/connectivity-architecture#connection-policy) only (port 1433). **Proxy** mode can result in more latency compared to *redirect*. If you want to continue using redirect mode, which is the default for clients connecting within Azure, you can filter access using FQDN in firewall network rules. ## Scenario 1: Hub and spoke architecture - Dedicated virtual network for private endpoints |
| private-link | Tutorial Private Endpoint Sql Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-link/tutorial-private-endpoint-sql-portal.md | In this tutorial, you created a: You used the virtual machine to test connectivity securely to the SQL server across the private endpoint. -As a next step, you may also be interested in the **Web app with private connectivity to Azure SQL database** architecture scenario, which connects a web application outside of the virtual network to the private endpoint of a database. +As a next step, you may also be interested in the **Web app with private connectivity to Azure SQL Database** architecture scenario, which connects a web application outside of the virtual network to the private endpoint of a database. > [!div class="nextstepaction"]-> [Web app with private connectivity to Azure SQL database](/azure/architecture/example-scenario/private-web-app/private-web-app) +> [Web app with private connectivity to Azure SQL Database](/azure/architecture/example-scenario/private-web-app/private-web-app) |
| purview | Concept Best Practices Lineage Azure Data Factory | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/concept-best-practices-lineage-azure-data-factory.md | Data lineage is the process of describing what data exists, where it is :::image type="content" source="./media/how-to-link-azure-data-factory/warning-for-disconnect-factory.png" alt-text="Screenshot showing warning to disconnect Azure Data Factory."::: -* Data factory's managed identity is used to authenticate lineage in Microsoft Purview account, the data factory's managed identity Data Curator role on Microsoft Purview root collection is required. -* Support no more than 10 data factories at once. If you want to add more than 10 data factories at once, please file a support ticket. +* Data factory's managed identity is used to authenticate lineage push operations in Microsoft Purview account. The data factory's managed identity needs Data Curator role on Microsoft Purview root collection. ++* Currently, only 10 data factories can be connected at a time. If you want to add more than 10 data factories, please file a support ticket. + ### Azure Data Factory activities Data lineage is the process of describing what data exists, where it is * Supported data sources in data flow activity is listed **Data Flow support** of [Connect to Azure Data Factory](how-to-link-azure-data-factory.md) * Supported data sources in SSIS is listed **SSIS execute package activity support** of [Lineage from SQL Server Integration Services](how-to-lineage-sql-server-integration-services.md) -* Microsoft Purview cannot capture lineage if Azure Data Factory copy activity use copy activity features listed in **Limitations on copy activity lineage** of [Connect to Azure Data Factory](how-to-link-azure-data-factory.md) +* Microsoft Purview cannot capture lineage if Azure Data Factory copy activity uses copy activity features listed in **Limitations on copy activity lineage** of [Connect to Azure Data Factory](how-to-link-azure-data-factory.md) * For the lineage of Dataflow activity, Microsoft Purview only support source and sink. The lineage for Dataflow transformation is not supported yet. * Data flow lineage doesn't integrate with Microsoft Purview resource set. -- **Resource set example 1** -- Qualified name: https://myblob.blob.core.windows.net/sample-data/data{N}.csv -- Display name: "data" + **Resource set example:** + Qualified name: https://myblob.blob.core.windows.net/sample-data/data{N}.csv + Display name: "data" * For the lineage of Execute SSIS Package activity, we only support source and destination. The lineage for transformation is not supported yet. |
| purview | Concept Best Practices Sensitivity Labels | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/concept-best-practices-sensitivity-labels.md | Title: Best practices for applying sensitivity labels in the Microsoft Purview Data Map -description: This article provides best practices for applying sensitivity labels in Microsoft Purview. +description: This article provides best practices for applying sensitivity labels in Microsoft Purview Data Map. Last updated 04/21/2022 -# Labeling best practices +# Labeling best practices for the data map The Microsoft Purview Data Map supports labeling structured and unstructured data stored across various data sources. Labeling data within the data map allows users to easily find data that matches predefined autolabeling rules that were configured in the Microsoft Purview compliance portal. The data map extends the use of sensitivity labels from Microsoft Purview Information Protection to assets stored in infrastructure cloud locations and structured data sources. The following sections walk you through the process of implementing labeling for :::image type="content" source="media/concept-best-practices/label-detection-criteria.png" alt-text="Screenshot that shows detection criteria for a label."::: > [!NOTE]- > Microsoft Purview Information Protection trainable classifiers aren't used by the Microsoft Purview Data Map. + > Trainable classifiers from Microsoft Purview Information Protection aren't supported by Microsoft Purview Data Map. - Maintain consistency in labeling across your data estate. If you use autolabeling rules for files, use the same sensitive information types for autolabeling database columns. - [Define your sensitivity labels via Microsoft Purview Information Protection to identify your personal data at a central place](/microsoft-365/compliance/information-protection). The following sections walk you through the process of implementing labeling for - Run test scans from the Microsoft Purview Data Map on different data sources like hybrid cloud and on-premises to identify sensitivity labels. - Gather and consider insights, for example, by using Microsoft Purview Insights. Use alerting mechanisms to mitigate potential breaches of regulations. -By using sensitivity labels with the Microsoft Purview Data Map, you can extend Microsoft Purview Information Protection beyond the border of your Microsoft data estate to your on-premises, hybrid cloud, multicloud, and software as a service (SaaS) scenarios. +By using sensitivity labels with Microsoft Purview Data Map, you can extend information protection beyond the border of your Microsoft data estate to your on-premises, hybrid cloud, multicloud, and software as a service (SaaS) scenarios. ## Next steps - [Get started with sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels).-- [Automatically apply sensitivity labels to your data in Microsoft Purview](how-to-automatically-label-your-content.md).+- [How to automatically apply sensitivity labels to your data in the Microsoft Purview Data Map](how-to-automatically-label-your-content.md). |
| purview | How To Integrate With Azure Security Products | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/how-to-integrate-with-azure-security-products.md | The integration supports data sources in Azure and AWS; sensitive data discovere - [Azure Files](./register-scan-azure-files-storage-source.md) - [Azure Database for MySQL](./register-scan-azure-mysql-database.md) - [Azure Database for PostgreSQL](./register-scan-azure-postgresql.md)-- [Azure SQL Database Managed Instance](./register-scan-azure-sql-database-managed-instance.md)+- [Azure SQL Managed Instance](./register-scan-azure-sql-database-managed-instance.md) - [Azure Dedicated SQL pool (formerly SQL DW)](./register-scan-azure-synapse-analytics.md) - [Azure SQL Database](./register-scan-azure-sql-database.md) - [Azure Synapse Analytics (Workspace)](./register-scan-synapse-workspace.md) The integration supports data sources in Azure and AWS; sensitive data discovere 3. Data sensitivity information is currently not shared for Azure PaaS data sources registered using a connection string. 5. Unregistering the data source in Microsoft Purview doesn't remove the data sensitivity enrichment in Microsoft Defender for Cloud. 6. Deleting the Microsoft Purview account will persist the data sensitivity enrichment for 30 days in Microsoft Defender for Cloud.-7. Custom classifications defined in the Microsoft 365 Compliance Center or in Microsoft Purview are not shared with Microsoft Defender for Cloud. +7. Custom classifications defined in the Microsoft Purview compliance portal or Microsoft Purview governance portal aren't shared with Microsoft Defender for Cloud. ### FAQ #### **Why don't I see the AWS data source I have scanned with Microsoft Purview in Microsoft Defender for Cloud?** Data sources must be onboarded to Microsoft Defender for Cloud as well. Learn mo #### **Why don't I see sensitivity labels in Microsoft Defender for Cloud?** -Assets must first be labeled in Microsoft Purview, before the labels are shown in Microsoft Defender for Cloud. Check if you have the [prerequisites of sensitivity labels](./how-to-automatically-label-your-content.md) in place. Once your scan the data, the labels will show up in Microsoft Purview and then automatically in Microsoft Defender for Cloud. +Assets must first be labeled in Microsoft Purview Data Map, before the labels are shown in Microsoft Defender for Cloud. Check if you have the necessary [prerequisites for sensitivity labels](./how-to-automatically-label-your-content.md) in place. After you've scanned the data, the labels will show up in Microsoft Purview Data Map and then automatically in Microsoft Defender for Cloud. ## Microsoft Sentinel |
| purview | Register Scan Azure Sql Database Managed Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/register-scan-azure-sql-database-managed-instance.md | This article outlines how to register and Azure SQL Database Managed Instance, a * You will need to be a Data Source Administrator and Data Reader to register a source and manage it in the Microsoft Purview governance portal. See our [Microsoft Purview Permissions page](catalog-permissions.md) for details. -* [Configure public endpoint in Azure SQL Managed Instance](../azure-sql/managed-instance/public-endpoint-configure.md) +* [Configure public endpoint in Azure SQL Managed Instance](/azure/azure-sql/managed-instance/public-endpoint-configure) > [!Note] > We now support scanning Azure SQL Database Managed Instances over the private connection using Microsoft Purview ingestion private endpoints and a self-hosted integration runtime VM. This section describes how to register an Azure SQL Database Managed Instance in ### Authentication for registration -If you need to create new authentication, you need to [authorize database access to SQL Database Managed Instance](../azure-sql/database/logins-create-manage.md). There are three authentication methods that Microsoft Purview supports today: +If you need to create new authentication, you need to [authorize database access to SQL Database Managed Instance](/azure/azure-sql/database/logins-create-manage). There are three authentication methods that Microsoft Purview supports today: - [System or user assigned managed identity](#system-or-user-assigned-managed-identity-to-register) - [Service Principal](#service-principal-to-register) For user-assigned managed identity (preview): 1. The object (principal) ID is displayed in the overview essential section. Either managed identity will need permission to get metadata for the database, schemas and tables, and to query the tables for classification.-- Create an Azure AD user in Azure SQL Database Managed Instance by following the prerequisites and tutorial on [Create contained users mapped to Azure AD identities](../azure-sql/database/authentication-aad-configure.md?tabs=azure-powershell#create-contained-users-mapped-to-azure-ad-identities)+- Create an Azure AD user in Azure SQL Database Managed Instance by following the prerequisites and tutorial on [Create contained users mapped to Azure AD identities](/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#create-contained-users-mapped-to-azure-ad-identities) - Assign `db_datareader` permission to the identity. #### Service Principal to register If you have to create a new Service Principal, follow these steps: #### Configure Azure AD authentication in the database account The service principal must have permission to get metadata for the database, schemas, and tables. It must also be able to query the tables to sample for classification.-- [Configure and manage Azure AD authentication with Azure SQL](../azure-sql/database/authentication-aad-configure.md)-- Create an Azure AD user in Azure SQL Database Managed Instance by following the prerequisites and tutorial on [Create contained users mapped to Azure AD identities](../azure-sql/database/authentication-aad-configure.md?tabs=azure-powershell#create-contained-users-mapped-to-azure-ad-identities)+- [Configure and manage Azure AD authentication with Azure SQL](/azure/azure-sql/database/authentication-aad-configure) +- Create an Azure AD user in Azure SQL Database Managed Instance by following the prerequisites and tutorial on [Create contained users mapped to Azure AD identities](/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#create-contained-users-mapped-to-azure-ad-identities) - Assign `db_datareader` permission to the identity. #### Add service principal to key vault and Microsoft Purview's credential |
| purview | Register Scan Azure Sql Database | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/register-scan-azure-sql-database.md | For more information about the Azure SQL Firewall, see the [SQL Database firewal #### Allow Azure Connections -Enabling Azure connections will allow Microsoft Purview to reach and connect the server without updating the firewall itself. You can follow the How-to guide for [Connections from inside Azure](../azure-sql/database/firewall-configure.md#connections-from-inside-azure). +Enabling Azure connections will allow Microsoft Purview to reach and connect the server without updating the firewall itself. You can follow the How-to guide for [Connections from inside Azure](/azure/azure-sql/database/firewall-configure#connections-from-inside-azure). 1. Navigate to your database account 1. Select the server name in the **Overview** page Select your chosen method of authentication from the tabs below for steps to aut The managed identity needs permission to get metadata for the database, schemas, and tables. It must also be authorized to query the tables to sample for classification. -- If you haven't already, [configure Azure AD authentication with Azure SQL](../azure-sql/database/authentication-aad-configure.md)-- Create Azure AD user in Azure SQL Database with the exact Microsoft Purview's managed identity by following tutorial on [create the user in Azure SQL Database](../azure-sql/database/authentication-aad-service-principal-tutorial.md#create-the-service-principal-user-in-azure-sql-database). Assign proper permission (for example: `db_datareader`) to the identity. Example SQL syntax to create user and grant permission:+- If you haven't already, [configure Azure AD authentication with Azure SQL](/azure/azure-sql/database/authentication-aad-configure) +- Create Azure AD user in Azure SQL Database with the exact Microsoft Purview's managed identity by following tutorial on [create the user in Azure SQL Database](/azure/azure-sql/database/authentication-aad-service-principal-tutorial#create-the-service-principal-user-in-azure-sql-database). Assign proper permission (for example: `db_datareader`) to the identity. Example SQL syntax to create user and grant permission: ```sql CREATE USER [Username] FROM EXTERNAL PROVIDER If you don't have a service principal, you can [follow the service principal gui The service principal needs permission to get metadata for the database, schemas, and tables. It must also be authorized to query the tables to sample for classification. -- If you haven't already, [configure Azure AD authentication with Azure SQL](../azure-sql/database/authentication-aad-configure.md)-- Create Azure AD user in Azure SQL Database with your service principal by following tutorial on [Create the service principal user in Azure SQL Database](../azure-sql/database/authentication-aad-service-principal-tutorial.md#create-the-service-principal-user-in-azure-sql-database). Assign proper permission (for example: `db_datareader`) to the identity. Example SQL syntax to create user and grant permission:+- If you haven't already, [configure Azure AD authentication with Azure SQL](/azure/azure-sql/database/authentication-aad-configure) +- Create Azure AD user in Azure SQL Database with your service principal by following tutorial on [Create the service principal user in Azure SQL Database](/azure/azure-sql/database/authentication-aad-service-principal-tutorial#create-the-service-principal-user-in-azure-sql-database). Assign proper permission (for example: `db_datareader`) to the identity. Example SQL syntax to create user and grant permission: ```sql CREATE USER [Username] FROM EXTERNAL PROVIDER |
| purview | Register Scan Azure Synapse Analytics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/purview/register-scan-azure-synapse-analytics.md | There are three ways to set up authentication: #### System or user assigned managed identity to register -You can use either your Microsoft Purview system-assigned managed identity (SAMI), or a [User-assigned managed identity](manage-credentials.md#create-a-user-assigned-managed-identity) (UAMI) to authenticate. Both options allow you to assign authentication directly to Microsoft Purview, like you would for any other user, group, or service principal. The Microsoft Purview SAMI is created automatically when the account is created. A UAMI is a resource that can be created independently, and to create one you can follow our [user-assigned managed identity guide](manage-credentials.md#create-a-user-assigned-managed-identity). Create an Azure AD user in the dedicated SQL pool using your managed identity object name by following the prerequisites and tutorial on [Create Azure AD users using Azure AD applications](../azure-sql/database/authentication-aad-service-principal-tutorial.md). +You can use either your Microsoft Purview system-assigned managed identity (SAMI), or a [User-assigned managed identity](manage-credentials.md#create-a-user-assigned-managed-identity) (UAMI) to authenticate. Both options allow you to assign authentication directly to Microsoft Purview, like you would for any other user, group, or service principal. The Microsoft Purview SAMI is created automatically when the account is created. A UAMI is a resource that can be created independently, and to create one you can follow our [user-assigned managed identity guide](manage-credentials.md#create-a-user-assigned-managed-identity). Create an Azure AD user in the dedicated SQL pool using your managed identity object name by following the prerequisites and tutorial on [Create Azure AD users using Azure AD applications](/azure/azure-sql/database/authentication-aad-service-principal-tutorial). Example SQL syntax to create user and grant permission: It is required to get the Service Principal's application ID and secret: ##### Granting the Service Principal access -In addition, you must also create an Azure AD user in the dedicated pool by following the prerequisites and tutorial on [Create Azure AD users using Azure AD applications](../azure-sql/database/authentication-aad-service-principal-tutorial.md). Example SQL syntax to create user and grant permission: +In addition, you must also create an Azure AD user in the dedicated pool by following the prerequisites and tutorial on [Create Azure AD users using Azure AD applications](/azure/azure-sql/database/authentication-aad-service-principal-tutorial). Example SQL syntax to create user and grant permission: ```sql CREATE USER [ServicePrincipalName] FROM EXTERNAL PROVIDER |
| remote-rendering | System Requirements | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/remote-rendering/overview/system-requirements.md | The following software must be installed: ## Unity For development with Unity, install a supported version of Unity [(download)](https://unity3d.com/get-unity/download). We recommend using Unity Hub for managing installations.++> [!IMPORTANT] +> In addition to the supported versions mentioned below, make sure to check out the [Unity known issues page](/mixed-reality/develop/unity/known-issues). + Make sure to include the following modules in your Unity installation: * **UWP** - Universal Windows Platform Build Support * **IL2CPP** - Windows Build Support (IL2CPP) |
| resource-mover | Support Matrix Move Region Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/resource-mover/support-matrix-move-region-sql.md | Requirements are summarized in the following table. **Azure SQL Database Hyperscale** | Not supported | Can't move databases in the Azure SQL Hyperscale service tier with Resource Mover. **Zone redundancy** | Supported | Supported move options:<br/><br/> - Between regions that support zone redundancy.<br/><br/> - Between regions that don't support zone redundancy.<br/><br/> - Between a region that supports zone redundancy to a region that doesn't support zone redundancy.<br/><br/> - Between a region that doesn't support zone redundancy to a region that does support zone redundancy. **Data sync** | Hub/sync database: Not supported<br/><br/> Sync member: Supported. | If a sync member is moved, you need to set up data sync to the new target database.-**Existing geo-replication** | Supported | Existing geo replicas are remapped to the new primary in the target region.<br/><br/> Seeding must be initialized after the move. [Learn more](../azure-sql/database/active-geo-replication-configure-portal.md) +**Existing geo-replication** | Supported | Existing geo replicas are remapped to the new primary in the target region.<br/><br/> Seeding must be initialized after the move. [Learn more](/azure/azure-sql/database/active-geo-replication-configure-portal) **Transparent Data Encryption (TDE) with Bring Your Own Key (BYOK)** | Supported | [Learn more](../key-vault/general/move-region.md) about moving key vaults across regions. **TDE with service-managed key** | Supported. | [Learn more](../key-vault/general/move-region.md) about moving key vaults across regions.-**Dynamic data masking rules** | Supported. | Rules are automatically copied over to the target region as part of the move. [Learn more](../azure-sql/database/dynamic-data-masking-configure-portal.md). -**Advanced data security** | Not supported. | Workaround: Set up at the SQL Server level in the target region. [Learn more](../azure-sql/database/azure-defender-for-sql.md). -**Firewall rules** | Not supported. | Workaround: Set up firewall rules for SQL Server in the target region. Database-level firewall rules are copied from the source server to the target server. [Learn more](../azure-sql/database/firewall-create-server-level-portal-quickstart.md). -**Auditing policies** | Not supported. | Policies will reset to default after the move. [Learn](../azure-sql/database/auditing-overview.md) how to reset. -**Backup retention** | Supported. | Backup retention policies for the source database are carried over to the target database. [Learn](../azure-sql/database/long-term-backup-retention-configure.md) how to modify settings after the move. -**Auto tuning** | Not supported. | Workaround: Set auto tuning settings after the move. [Learn more](../azure-sql/database/automatic-tuning-enable.md). -**Database alerts** | Not supported. | Workaround: Set alerts after the move. [Learn more](../azure-sql/database/alerts-insights-configure-portal.md). +**Dynamic data masking rules** | Supported. | Rules are automatically copied over to the target region as part of the move. [Learn more](/azure/azure-sql/database/dynamic-data-masking-configure-portal). +**Advanced data security** | Not supported. | Workaround: Set up at the SQL Server level in the target region. [Learn more](/azure/azure-sql/database/azure-defender-for-sql). +**Firewall rules** | Not supported. | Workaround: Set up firewall rules for SQL Server in the target region. Database-level firewall rules are copied from the source server to the target server. [Learn more](/azure/azure-sql/database/firewall-create-server-level-portal-quickstart). +**Auditing policies** | Not supported. | Policies will reset to default after the move. [Learn](/azure/azure-sql/database/auditing-overview) how to reset. +**Backup retention** | Supported. | Backup retention policies for the source database are carried over to the target database. [Learn](/azure/azure-sql/database/long-term-backup-retention-configure) how to modify settings after the move. +**Auto tuning** | Not supported. | Workaround: Set auto tuning settings after the move. [Learn more](/azure/azure-sql/database/automatic-tuning-enable). +**Database alerts** | Not supported. | Workaround: Set alerts after the move. [Learn more](/azure/azure-sql/database/alerts-insights-configure-portal). **Azure SQL Server stretch database** | Not Supported | Can't move SQL server stretch databases with Resource Mover. **Azure Synapse Analytics** | Not Supported | CanΓÇÖt move Azure Synapse Analytics with Resource Mover. ## Next steps |
| resource-mover | Tutorial Move Region Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/resource-mover/tutorial-move-region-sql.md | If you don't have an Azure subscription, create a [free account](https://azure.m ## Check SQL requirements 1. [Check](support-matrix-move-region-sql.md) which database/elastic pool features are supported for moving to another region.-2. In the target region, create a target server for each source server. [Learn more](../azure-sql/database/active-geo-replication-security-configure.md#how-to-configure-logins-and-users). +2. In the target region, create a target server for each source server. [Learn more](/azure/azure-sql/database/active-geo-replication-security-configure#how-to-configure-logins-and-users). 4. If databases are encrypted with transparent data encryption (TDE) and you use your own encryption key in Azure Key Vault, [learn how to](../key-vault/general/move-region.md) move key vaults to another region. 5. If SQL data sync is enabled, moving member databases is supported. After the move, you need to set up SQL data sync to the new target database.-6. Remove advanced data security settings before the move. After the move, [configure the settings](../azure-sql/database/azure-defender-for-sql.md) at the SQL Server level in the target region. -7. If auditing is enabled, policies reset to default after the move. [Set up auditing](../azure-sql/database/auditing-overview.md) again, after the move. -7. Backup retention policies for the source database are carried over to the target database. [Learn more](../azure-sql/database/long-term-backup-retention-configure.md) about modifying settings after the move. -8. Remove server-level firewall rules before the move. Database-level firewall rules are copied from the source server to the target server, during the move. After the move, [set up firewall rules](../azure-sql/database/firewall-create-server-level-portal-quickstart.md) for SQL Server in the target region. -9. Remove autotuning settings before the move. [Set up autotuning ](../azure-sql/database/automatic-tuning-enable.md) again after moving. -10. Remove database alert settings before the move. [Reset](../azure-sql/database/alerts-insights-configure-portal.md) after moving. +6. Remove advanced data security settings before the move. After the move, [configure the settings](/azure/azure-sql/database/azure-defender-for-sql) at the SQL Server level in the target region. +7. If auditing is enabled, policies reset to default after the move. [Set up auditing](/azure/azure-sql/database/auditing-overview) again, after the move. +7. Backup retention policies for the source database are carried over to the target database. [Learn more](/azure/azure-sql/database/long-term-backup-retention-configure) about modifying settings after the move. +8. Remove server-level firewall rules before the move. Database-level firewall rules are copied from the source server to the target server, during the move. After the move, [set up firewall rules](/azure/azure-sql/database/firewall-create-server-level-portal-quickstart) for SQL Server in the target region. +9. Remove autotuning settings before the move. [Set up autotuning ](/azure/azure-sql/database/automatic-tuning-enable) again after moving. +10. Remove database alert settings before the move. [Reset](/azure/azure-sql/database/alerts-insights-configure-portal) after moving. ## Select resources |
| role-based-access-control | Built In Roles | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/built-in-roles.md | Lets you manage SQL Managed Instances and required network configuration, but ca ### SQL Security Manager -Lets you manage the security-related policies of SQL servers and databases, but not access to them. [Learn more](../azure-sql/database/azure-defender-for-sql.md) +Lets you manage the security-related policies of SQL servers and databases, but not access to them. [Learn more](/azure/azure-sql/database/azure-defender-for-sql) > [!div class="mx-tableFixed"] > | Actions | Description | Lets you manage the security-related policies of SQL servers and databases, but ### SQL Server Contributor -Lets you manage SQL servers and databases, but not access to them, and not their security-related policies. [Learn more](../azure-sql/database/authentication-aad-configure.md) +Lets you manage SQL servers and databases, but not access to them, and not their security-related policies. [Learn more](/azure/azure-sql/database/authentication-aad-configure) > [!div class="mx-tableFixed"] > | Actions | Description | Lets you purchase reservations [Learn more](../cost-management-billing/reservati > [!div class="mx-tableFixed"] > | Actions | Description | > | | |-> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. | -> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. | +> | [Microsoft.Authorization](resource-provider-operations.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. | +> | [Microsoft.Capacity](resource-provider-operations.md#microsoftcapacity)/catalogs/read | Read catalog of Reservation | > | [Microsoft.Capacity](resource-provider-operations.md#microsoftcapacity)/register/action | Registers the Capacity resource provider and enables the creation of Capacity resources. | > | [Microsoft.Compute](resource-provider-operations.md#microsoftcompute)/register/action | Registers Subscription with Microsoft.Compute resource provider |-> | [Microsoft.SQL](resource-provider-operations.md#microsoftsql)/register/action | Registers the subscription for the Microsoft SQL Database resource provider and enables the creation of Microsoft SQL Databases. | > | [Microsoft.Consumption](resource-provider-operations.md#microsoftconsumption)/register/action | Register to Consumption RP |-> | [Microsoft.Capacity](resource-provider-operations.md#microsoftcapacity)/catalogs/read | Read catalog of Reservation | -> | [Microsoft.Authorization](resource-provider-operations.md#microsoftauthorization)/roleAssignments/read | Get information about a role assignment. | +> | [Microsoft.Consumption](resource-provider-operations.md#microsoftconsumption)/reservationRecommendationDetails/read | List Reservation Recommendation Details | > | [Microsoft.Consumption](resource-provider-operations.md#microsoftconsumption)/reservationRecommendations/read | List single or shared recommendations for Reserved instances for a subscription. |+> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. | +> | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. | +> | [Microsoft.SQL](resource-provider-operations.md#microsoftsql)/register/action | Registers the subscription for the Microsoft SQL Database resource provider and enables the creation of Microsoft SQL Databases. | > | [Microsoft.Support](resource-provider-operations.md#microsoftsupport)/supporttickets/write | Allows creating and updating a support ticket | > | **NotActions** | | > | *none* | | Lets you purchase reservations [Learn more](../cost-management-billing/reservati "permissions": [ { "actions": [- "Microsoft.Resources/subscriptions/read", - "Microsoft.Resources/subscriptions/resourceGroups/read", + "Microsoft.Authorization/roleAssignments/read", + "Microsoft.Capacity/catalogs/read", "Microsoft.Capacity/register/action", "Microsoft.Compute/register/action",- "Microsoft.SQL/register/action", "Microsoft.Consumption/register/action",- "Microsoft.Capacity/catalogs/read", - "Microsoft.Authorization/roleAssignments/read", + "Microsoft.Consumption/reservationRecommendationDetails/read", "Microsoft.Consumption/reservationRecommendations/read",+ "Microsoft.Resources/subscriptions/read", + "Microsoft.Resources/subscriptions/resourceGroups/read", + "Microsoft.SQL/register/action", "Microsoft.Support/supporttickets/write" ], "notActions": [], Lets you manage Scheduler job collections, but not access to them. > | [Microsoft.ResourceHealth](resource-provider-operations.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope | > | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/deployments/* | Create and manage a deployment | > | [Microsoft.Resources](resource-provider-operations.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |-> | [Microsoft.Scheduler](resource-provider-operations.md#microsoftscheduler)/jobcollections/* | Create and manage job collections | +> | Microsoft.Scheduler/jobcollections/* | Create and manage job collections | > | [Microsoft.Support](resource-provider-operations.md#microsoftsupport)/* | Create and update a support ticket | > | **NotActions** | | > | *none* | | |
| role-based-access-control | Resource Provider Operations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/resource-provider-operations.md | Click the resource provider name in the following table to see the list of opera | [Microsoft.Portal](#microsoftportal) | | [Microsoft.RecoveryServices](#microsoftrecoveryservices) | | [Microsoft.Resources](#microsoftresources) |-| [Microsoft.Scheduler](#microsoftscheduler) | | [Microsoft.Solutions](#microsoftsolutions) | | [Microsoft.Subscription](#microsoftsubscription) | | **Intune** | Azure service: [Virtual Machines](../virtual-machines/index.yml), [Virtual Machi > | Microsoft.Compute/snapshots/upload/action | Perform write data operations on Snapshot SAS Uri | > | Microsoft.Compute/virtualMachines/login/action | Log in to a virtual machine as a regular user | > | Microsoft.Compute/virtualMachines/loginAsAdmin/action | Log in to a virtual machine with Windows administrator or Linux root user privileges |+> | Microsoft.Compute/virtualMachines/WACloginAsAdmin/action | Lets you manage the OS of your resource via Windows Admin Center as an administrator | ### Microsoft.ServiceFabric Azure service: [Content Delivery Network](../cdn/index.yml) > | Microsoft.Cdn/CheckNameAvailability/action | | > | Microsoft.Cdn/ValidateProbe/action | | > | Microsoft.Cdn/CheckResourceUsage/action | |+> | Microsoft.Cdn/ValidateSecret/action | | > | Microsoft.Cdn/cdnwebapplicationfirewallmanagedrulesets/read | | > | Microsoft.Cdn/cdnwebapplicationfirewallmanagedrulesets/write | | > | Microsoft.Cdn/cdnwebapplicationfirewallmanagedrulesets/delete | | Azure service: [Content Delivery Network](../cdn/index.yml) > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/Purge/action | | > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/Usages/action | | > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/ValidateCustomDomain/action | |+> | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/CheckEndpointNameAvailability/action | | > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/routeresults/read | | > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/routeresults/write | | > | Microsoft.Cdn/operationresults/profileresults/afdendpointresults/routeresults/delete | | Azure service: [Content Delivery Network](../cdn/index.yml) > | Microsoft.Cdn/operationresults/profileresults/secretresults/read | | > | Microsoft.Cdn/operationresults/profileresults/secretresults/write | | > | Microsoft.Cdn/operationresults/profileresults/secretresults/delete | |-> | Microsoft.Cdn/operationresults/profileresults/secretresults/ValidateSecret/action | | > | Microsoft.Cdn/operationresults/profileresults/securitypolicyresults/read | | > | Microsoft.Cdn/operationresults/profileresults/securitypolicyresults/write | | > | Microsoft.Cdn/operationresults/profileresults/securitypolicyresults/delete | | Azure service: [Content Delivery Network](../cdn/index.yml) > | Microsoft.Cdn/profiles/afdendpoints/Purge/action | | > | Microsoft.Cdn/profiles/afdendpoints/Usages/action | | > | Microsoft.Cdn/profiles/afdendpoints/ValidateCustomDomain/action | |+> | Microsoft.Cdn/profiles/afdendpoints/CheckEndpointNameAvailability/action | | > | Microsoft.Cdn/profiles/afdendpoints/routes/read | | > | Microsoft.Cdn/profiles/afdendpoints/routes/write | | > | Microsoft.Cdn/profiles/afdendpoints/routes/delete | | Azure service: [Content Delivery Network](../cdn/index.yml) > | Microsoft.Cdn/profiles/secrets/read | | > | Microsoft.Cdn/profiles/secrets/write | | > | Microsoft.Cdn/profiles/secrets/delete | |-> | Microsoft.Cdn/profiles/secrets/ValidateSecret/action | | > | Microsoft.Cdn/profiles/securitypolicies/read | | > | Microsoft.Cdn/profiles/securitypolicies/write | | > | Microsoft.Cdn/profiles/securitypolicies/delete | | Azure service: [Application Gateway](../application-gateway/index.yml), [Azure B > | Microsoft.Network/dnsResolvers/outboundEndpoints/write | Creates Or Updates a DNS Resolver Outbound Endpoint, in JSON format | > | Microsoft.Network/dnsResolvers/outboundEndpoints/join/action | Join DNS Resolver | > | Microsoft.Network/dnsResolvers/outboundEndpoints/delete | Deletes a DNS Resolver Outbound Endpoint description. |+> | Microsoft.Network/dnsResolvers/outboundEndpoints/listDnsForwardingRulesets/action | Gets the DNS Forwarding Rulesets Properties for DNS Resolver Outbound Endpoint, in JSON format | > | Microsoft.Network/dnszones/read | Get the DNS zone, in JSON format. The zone properties include tags, etag, numberOfRecordSets, and maxNumberOfRecordSets. Note that this command does not retrieve the record sets contained within the zone. | > | Microsoft.Network/dnszones/write | Create or update a DNS zone within a resource group. Used to update the tags on a DNS zone resource. Note that this command can not be used to create or update record sets within the zone. | > | Microsoft.Network/dnszones/delete | Delete the DNS zone, in JSON format. The zone properties include tags, etag, numberOfRecordSets, and maxNumberOfRecordSets. | Azure service: [Application Gateway](../application-gateway/index.yml), [Azure B > | Microsoft.Network/frontDoorWebApplicationFirewallPolicies/write | Creates or updates a Web Application Firewall Policy | > | Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete | Deletes a Web Application Firewall Policy | > | Microsoft.Network/frontDoorWebApplicationFirewallPolicies/join/action | Joins a Web Application Firewall Policy. Not Alertable. |+> | Microsoft.Network/internalPublicIpAddresses/read | Returns internal public ip addresses in subscription | > | Microsoft.Network/ipAllocations/read | Get The IpAllocation | > | Microsoft.Network/ipAllocations/write | Creates A IpAllocation Or Updates An Existing IpAllocation | > | Microsoft.Network/ipAllocations/delete | Deletes A IpAllocation | Azure service: [Application Gateway](../application-gateway/index.yml), [Azure B > | Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read | Check if Ip Address is available at the specified virtual network | > | Microsoft.Network/virtualNetworks/customViews/read | Get definition of a custom view of Virtual Network | > | Microsoft.Network/virtualNetworks/customViews/get/action | Get a Virtual Network custom view content |-> | Microsoft.Network/virtualNetworks/dnsForwardingRulesets/read | Gets the DNS Forwarding Ruleset for Virtual Network, in JSON format | -> | Microsoft.Network/virtualNetworks/dnsResolvers/read | Gets the DNS Resolver for Virtual Network, in JSON format | +> | Microsoft.Network/virtualNetworks/listDnsForwardingRulesets/read | Gets the DNS Forwarding Ruleset for Virtual Network, in JSON format | +> | Microsoft.Network/virtualNetworks/listDnsResolvers/read | Gets the DNS Resolver for Virtual Network, in JSON format | > | Microsoft.Network/virtualNetworks/privateDnsZoneLinks/read | Get the Private DNS zone link to a virtual network properties, in JSON format. | > | Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read | Get the diagnostic settings of Virtual Network | > | Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/write | Create or update the diagnostic settings of the Virtual Network | Azure service: [Storage](../storage/index.yml) > | Microsoft.Storage/storageAccounts/objectReplicationPolicies/write | Create or update object replication policy | > | Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write | | > | Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/read | Get Private Endpoint Connection Proxy |+> | Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action | Update storage account private endpoint properties | > | Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/delete | Delete Private Endpoint Connection Proxies | > | Microsoft.Storage/storageAccounts/privateEndpointConnectionProxies/write | Put Private Endpoint Connection Proxies | > | Microsoft.Storage/storageAccounts/privateEndpointConnections/read | List Private Endpoint Connections | Azure service: [Storage](../storage/index.yml) > | microsoft.storagesync/storageSyncServices/privateEndpointConnectionProxies/validate/action | Validate any Private Endpoint ConnectionProxies | > | microsoft.storagesync/storageSyncServices/privateEndpointConnectionProxies/read | Read any Private Endpoint ConnectionProxies | > | microsoft.storagesync/storageSyncServices/privateEndpointConnectionProxies/write | Create or Update any Private Endpoint ConnectionProxies |+> | microsoft.storagesync/storageSyncServices/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action | Update any Private Endpoint ConnectionProxies | > | microsoft.storagesync/storageSyncServices/privateEndpointConnectionProxies/delete | Delete any Private Endpoint ConnectionProxies | > | microsoft.storagesync/storageSyncServices/privateEndpointConnections/read | Read any Private Endpoint Connections | > | microsoft.storagesync/storageSyncServices/privateEndpointConnections/write | Create or Update any Private Endpoint Connections | Azure service: [App Service Certificates](../app-service/configure-ssl-certifica > | Microsoft.CertificateRegistration/certificateOrders/retrieveEmailHistory/Action | Retrieve certificate email history | > | Microsoft.CertificateRegistration/certificateOrders/resendEmail/Action | Resend certificate email | > | Microsoft.CertificateRegistration/certificateOrders/verifyDomainOwnership/Action | Verify domain ownership |-> | Microsoft.CertificateRegistration/certificateOrders/resendRequestEmails/Action | Resend request emails to another email address | -> | Microsoft.CertificateRegistration/certificateOrders/resendRequestEmails/Action | Retrieve site seal for an issued App Service Certificate | +> | Microsoft.CertificateRegistration/certificateOrders/resendRequestEmails/Action | Resend domain verification ownership email containing steps on how to verify a domain for a given certificate order | +> | Microsoft.CertificateRegistration/certificateOrders/resendRequestEmails/Action | This method is used to obtain the site seal information for an issued certificate.<br>A site seal is a graphic that the certificate purchaser can embed on their web site to show their visitors information about their TLS/SSL certificate.<br>If a web site visitor clicks on the site seal image, a pop-up page is displayed that contains detailed information about the TLS/SSL certificate.<br>The site seal token is used to link the site seal graphic image to the appropriate certificate details pop-up page display when a user clicks on the site seal.<br>The site seal images are expected to be static images and hosted by the reseller, to minimize delays for customer page load times. | > | Microsoft.CertificateRegistration/certificateOrders/certificates/Write | Add a new certificate or update an existing one | > | Microsoft.CertificateRegistration/certificateOrders/certificates/Delete | Delete an existing certificate | > | Microsoft.CertificateRegistration/certificateOrders/certificates/Read | Get the list of certificates | Azure service: [Media Services](/media-services/) > | Microsoft.Media/mediaservices/assets/assetfilters/read | Read any Asset Filter | > | Microsoft.Media/mediaservices/assets/assetfilters/write | Create or Update any Asset Filter | > | Microsoft.Media/mediaservices/assets/assetfilters/delete | Delete any Asset Filter |+> | Microsoft.Media/mediaservices/assets/assetTracks/read | Read any Asset Track | +> | Microsoft.Media/mediaservices/assets/assetTracks/write | Create or Update any Asset Track | +> | Microsoft.Media/mediaservices/assets/assetTracks/delete | Delete any Asset Track | +> | Microsoft.Media/mediaservices/assets/assetTracks/updateTrackData/action | Update the track data for Asset Track | +> | Microsoft.Media/mediaservices/assets/assetTracks/assetTracksOperationResults/read | Read any Asset Track Operation Result | +> | Microsoft.Media/mediaservices/assets/assetTracks/assetTracksOperationStatuses/read | Read any Asset Track Operation Result | > | Microsoft.Media/mediaservices/contentKeyPolicies/read | Read any Content Key Policy | > | Microsoft.Media/mediaservices/contentKeyPolicies/write | Create or Update any Content Key Policy | > | Microsoft.Media/mediaservices/contentKeyPolicies/delete | Delete any Content Key Policy | Azure service: [Azure SignalR Service](../azure-signalr/index.yml) > | Microsoft.SignalRService/SignalR/eventGridFilters/delete | Delete an event grid filter from a SignalR resource. | > | Microsoft.SignalRService/SignalR/operationResults/read | | > | Microsoft.SignalRService/SignalR/operationStatuses/read | |+> | Microsoft.SignalRService/SignalR/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action | | > | Microsoft.SignalRService/SignalR/privateEndpointConnectionProxies/validate/action | Validate Private Endpoint Connection Proxy | > | Microsoft.SignalRService/SignalR/privateEndpointConnectionProxies/write | Write Private Endpoint Connection Proxy | > | Microsoft.SignalRService/SignalR/privateEndpointConnectionProxies/read | Read Private Endpoint Connection Proxy | Azure service: [Azure SignalR Service](../azure-signalr/index.yml) > | Microsoft.SignalRService/WebPubSub/hubs/delete | Delete hub settings | > | Microsoft.SignalRService/WebPubSub/operationResults/read | | > | Microsoft.SignalRService/WebPubSub/operationStatuses/read | |+> | Microsoft.SignalRService/WebPubSub/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action | | > | Microsoft.SignalRService/WebPubSub/privateEndpointConnectionProxies/validate/action | Validate Private Endpoint Connection Proxy | > | Microsoft.SignalRService/WebPubSub/privateEndpointConnectionProxies/write | Write Private Endpoint Connection Proxy | > | Microsoft.SignalRService/WebPubSub/privateEndpointConnectionProxies/read | Read Private Endpoint Connection Proxy | Azure service: [Azure SignalR Service](../azure-signalr/index.yml) > | Microsoft.SignalRService/SignalR/group/read | Check group existence or user existence in group. | > | Microsoft.SignalRService/SignalR/group/write | Join / Leave group. | > | Microsoft.SignalRService/SignalR/hub/send/action | Broadcast messages to all client connections in hub. |+> | Microsoft.SignalRService/SignalR/livetrace/read | Read live trace tool results | +> | Microsoft.SignalRService/SignalR/livetrace/write | Create live trace connections | > | Microsoft.SignalRService/SignalR/serverConnection/write | Start a server connection. | > | Microsoft.SignalRService/SignalR/user/send/action | Send messages to user, who may consist of multiple client connections. | > | Microsoft.SignalRService/SignalR/user/read | Check user existence. | Azure service: [Azure SignalR Service](../azure-signalr/index.yml) > | Microsoft.SignalRService/WebPubSub/group/read | Check group existence or user existence in group. | > | Microsoft.SignalRService/WebPubSub/group/write | Join / Leave group. | > | Microsoft.SignalRService/WebPubSub/hub/send/action | Broadcast messages to all client connections in hub. |+> | Microsoft.SignalRService/WebPubSub/livetrace/read | Read live trace tool results | +> | Microsoft.SignalRService/WebPubSub/livetrace/write | Create live trace connections | > | Microsoft.SignalRService/WebPubSub/user/send/action | Send messages to user, who may consist of multiple client connections. | > | Microsoft.SignalRService/WebPubSub/user/read | Check user existence. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/certificates/Read | Get the list of certificates. | > | Microsoft.Web/certificates/Write | Add a new certificate or update an existing one. | > | Microsoft.Web/certificates/Delete | Delete an existing certificate. |+> | microsoft.web/certificates/operationresults/read | Get Certificates Operation Results. | > | microsoft.web/checknameavailability/read | Check if resource name is available. | > | microsoft.web/classicmobileservices/read | Get Classic Mobile Services. | > | Microsoft.Web/connectionGateways/Read | Get the list of Connection Gateways. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/customhostnameSites/Read | Get info about custom hostnames under subscription. | > | Microsoft.Web/deletedSites/Read | Get the properties of a Deleted Web App | > | microsoft.web/deploymentlocations/read | Get Deployment Locations. |+> | microsoft.web/functionappstacks/read | Get Function App Stacks. | > | Microsoft.Web/geoRegions/Read | Get the list of Geo regions. | > | Microsoft.Web/hostingEnvironments/Read | Get the properties of an App Service Environment | > | Microsoft.Web/hostingEnvironments/Write | Create a new App Service Environment or update existing one | > | Microsoft.Web/hostingEnvironments/Delete | Delete an App Service Environment | > | Microsoft.Web/hostingEnvironments/Join/Action | Joins an App Service Environment | > | Microsoft.Web/hostingEnvironments/reboot/Action | Reboot all machines in an App Service Environment |+> | Microsoft.Web/hostingEnvironments/upgrade/Action | Upgrades an App Service Environment | > | Microsoft.Web/hostingEnvironments/PrivateEndpointConnectionsApproval/action | Approve Private Endpoint Connections | > | microsoft.web/hostingenvironments/resume/action | Resume Hosting Environments. | > | microsoft.web/hostingenvironments/suspend/action | Suspend Hosting Environments. | > | microsoft.web/hostingenvironments/capacities/read | Get Hosting Environments Capacities. |+> | microsoft.web/hostingenvironments/configurations/read | Get Hosting Environment Configurations. | +> | microsoft.web/hostingenvironments/configurations/write | Update Hosting Environment Configurations. | > | Microsoft.Web/hostingEnvironments/configurations/networking/Read | Get networking configuration of an App Service Environment | > | Microsoft.Web/hostingEnvironments/configurations/networking/Write | Update networking configuration of an App Service Environment. | > | microsoft.web/hostingenvironments/detectors/read | Get Hosting Environments Detectors. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/locations/extractapidefinitionfromwsdl/action | Extract Api Definition from WSDL for Locations. | > | microsoft.web/locations/listwsdlinterfaces/action | List WSDL Interfaces for Locations. | > | microsoft.web/locations/deleteVirtualNetworkOrSubnets/action | Vnet or subnet deletion notification for Locations. |+> | microsoft.web/locations/validateDeleteVirtualNetworkOrSubnets/action | Validates deleting Vnet or subnet for Locations | > | Microsoft.Web/locations/previewstaticsiteworkflowfile/action | Preview Static Site Workflow File | > | microsoft.web/locations/apioperations/read | Get Locations API Operations. | > | microsoft.web/locations/connectiongatewayinstallations/read | Get Locations Connection Gateway Installations. |+> | Microsoft.Web/locations/deletedSites/Read | Get the properties of a Deleted Web App at location | +> | microsoft.web/locations/functionappstacks/read | Get Function App Stacks for location. | > | microsoft.web/locations/managedapis/read | Get Locations Managed APIs. | > | Microsoft.Web/locations/managedapis/Join/Action | Joins a Managed API. | > | microsoft.web/locations/managedapis/apioperations/read | Get Locations Managed API Operations. | > | microsoft.web/locations/operationResults/read | Get Operations. | > | microsoft.web/locations/operations/read | Get Operations. |+> | microsoft.web/locations/webappstacks/read | Get Web App Stacks for location. | > | microsoft.web/operations/read | Get Operations. | > | microsoft.web/publishingusers/read | Get Publishing Users. | > | microsoft.web/publishingusers/write | Update Publishing Users. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/serverfarms/eventGridFilters/delete | Delete Event Grid Filter on server farm. | > | Microsoft.Web/serverfarms/eventGridFilters/read | Get Event Grid Filter on server farm. | > | Microsoft.Web/serverfarms/eventGridFilters/write | Put Event Grid Filter on server farm. |+> | microsoft.web/serverfarms/firstpartyapps/keyvaultsettings/read | Get first party Azure Key vault referenced settings for App Service Plan. | +> | microsoft.web/serverfarms/firstpartyapps/keyvaultsettings/write | Create or Update first party Azure Key vault referenced settings for App Service Plan. | > | microsoft.web/serverfarms/firstpartyapps/settings/delete | Delete App Service Plans First Party Apps Settings. | > | microsoft.web/serverfarms/firstpartyapps/settings/read | Get App Service Plans First Party Apps Settings. | > | microsoft.web/serverfarms/firstpartyapps/settings/write | Update App Service Plans First Party Apps Settings. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/serverfarms/providers/Microsoft.Insights/diagnosticSettings/read | Gets the diagnostic setting for the resource | > | microsoft.web/serverfarms/providers/Microsoft.Insights/diagnosticSettings/write | Creates or updates the diagnostic setting for the resource | > | Microsoft.Web/serverfarms/providers/Microsoft.Insights/metricDefinitions/Read | Gets the available metrics for App Service Plan |+> | Microsoft.Web/serverfarms/recommendations/Read | Get the list of recommendations for App Service Plan. | > | microsoft.web/serverfarms/sites/read | Get App Service Plans Web Apps. | > | microsoft.web/serverfarms/skus/read | Get App Service Plans SKUs. | > | microsoft.web/serverfarms/usages/read | Get App Service Plans Usages. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/backups/action | Discovers an existing app backup that can be restored from a blob in Azure storage. | > | microsoft.web/sites/containerlogs/action | Get Zipped Container Logs for Web App. | > | microsoft.web/sites/restorefrombackupblob/action | Restore Web App From Backup Blob. |+> | microsoft.web/sites/listbackups/action | List Web App backups. | +> | microsoft.web/sites/slotcopy/action | Copy content from deployment slot. | > | microsoft.web/sites/analyzecustomhostname/read | Analyze Custom Hostname. | > | microsoft.web/sites/backup/read | Get Web Apps Backup. | > | microsoft.web/sites/backup/write | Update Web Apps Backup. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/sites/config/list/Action | List Web App's security sensitive settings, such as publishing credentials, app settings and connection strings | > | Microsoft.Web/sites/config/Write | Update Web App's configuration settings | > | microsoft.web/sites/config/delete | Delete Web Apps Config. |+> | microsoft.web/sites/config/appsettings/read | Get Web App settings. | > | microsoft.web/sites/config/snapshots/read | Get Web Apps Config Snapshots. | > | microsoft.web/sites/config/snapshots/listsecrets/action | Web Apps List Secrets From Snapshot. |+> | microsoft.web/sites/config/web/appsettings/read | Get Web App Single App setting. | +> | microsoft.web/sites/config/web/appsettings/write | Create or Update Web App Single App setting | +> | microsoft.web/sites/config/web/appsettings/delete | Delete Web Apps App Setting | +> | microsoft.web/sites/config/web/connectionstrings/read | Get Web App single connectionstring | +> | microsoft.web/sites/config/web/connectionstrings/write | Get Web App single App setting. | +> | microsoft.web/sites/config/web/connectionstrings/delete | Delete Web App single connection string | > | microsoft.web/sites/containerlogs/download/action | Download Web Apps Container Logs. | > | microsoft.web/sites/continuouswebjobs/delete | Delete Web Apps Continuous Web Jobs. | > | microsoft.web/sites/continuouswebjobs/read | Get Web Apps Continuous Web Jobs. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/diagnostics/workerprocessrecycle/read | Get Web Apps Diagnostics Worker Process Recycle. | > | microsoft.web/sites/domainownershipidentifiers/read | Get Web Apps Domain Ownership Identifiers. | > | microsoft.web/sites/domainownershipidentifiers/write | Update Web Apps Domain Ownership Identifiers. |+> | microsoft.web/sites/domainownershipidentifiers/delete | Delete Web Apps Domain Ownership Identifiers. | > | Microsoft.Web/sites/eventGridFilters/delete | Delete Event Grid Filter on web app. | > | Microsoft.Web/sites/eventGridFilters/read | Get Event Grid Filter on web app. | > | Microsoft.Web/sites/eventGridFilters/write | Put Event Grid Filter on web app. | > | microsoft.web/sites/extensions/delete | Delete Web Apps Site Extensions. | > | microsoft.web/sites/extensions/read | Get Web Apps Site Extensions. | > | microsoft.web/sites/extensions/write | Update Web Apps Site Extensions. |+> | microsoft.web/sites/extensions/api/action | Invoke App Service Extensions APIs. | > | microsoft.web/sites/functions/delete | Delete Web Apps Functions. | > | microsoft.web/sites/functions/listsecrets/action | List Function secrets. | > | microsoft.web/sites/functions/listkeys/action | List Function keys. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/networkConfig/read | Get App Service Network Configuration. | > | microsoft.web/sites/networkConfig/write | Update App Service Network Configuration. | > | microsoft.web/sites/networkConfig/delete | Delete App Service Network Configuration. |+> | microsoft.web/sites/networkfeatures/read | Get Web App Features. | > | microsoft.web/sites/networktraces/operationresults/read | Get Web Apps Network Trace Operation Results. | > | microsoft.web/sites/operationresults/read | Get Web Apps Operation Results. | > | microsoft.web/sites/operations/read | Get Web Apps Operations. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/sites/slots/applySlotConfig/Action | Apply web app slot configuration from target slot to the current slot. | > | Microsoft.Web/sites/slots/resetSlotConfig/Action | Reset web app slot configuration | > | Microsoft.Web/sites/slots/Read | Get the properties of a Web App deployment slot |+> | microsoft.web/sites/slots/listsyncfunctiontriggerstatus/action | List Sync Function Trigger Status for deployment slot. | > | microsoft.web/sites/slots/newpassword/action | Newpassword Web Apps Slots. | > | microsoft.web/sites/slots/sync/action | Sync Web Apps Slots. |+> | microsoft.web/sites/slots/syncfunctiontriggers/action | Sync Function Triggers for deployment slot. | > | microsoft.web/sites/slots/networktrace/action | Network Trace Web Apps Slots. | > | microsoft.web/sites/slots/recover/action | Recover Web Apps Slots. | > | microsoft.web/sites/slots/restoresnapshot/action | Restore Web Apps Slots Snapshots. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/slots/backups/action | Discover Web Apps Slots Backups. | > | microsoft.web/sites/slots/containerlogs/action | Get Zipped Container Logs for Web App Slot. | > | microsoft.web/sites/slots/restorefrombackupblob/action | Restore Web Apps Slot From Backup Blob. |+> | microsoft.web/sites/slots/listbackups/action | List Web App Slot backups. | +> | microsoft.web/sites/slots/slotcopy/action | Copy content from one deployment slot to another. | > | microsoft.web/sites/slots/analyzecustomhostname/read | Get Web Apps Slots Analyze Custom Hostname. | > | microsoft.web/sites/slots/backup/write | Update Web Apps Slots Backup. | > | microsoft.web/sites/slots/backup/read | Get Web Apps Slots Backup. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/sites/slots/config/list/Action | List Web App Slot's security sensitive settings, such as publishing credentials, app settings and connection strings | > | Microsoft.Web/sites/slots/config/Write | Update Web App Slot's configuration settings | > | microsoft.web/sites/slots/config/delete | Delete Web Apps Slots Config. |+> | microsoft.web/sites/slots/config/validateupgradepath/action | Validate upgrade path for Web App. | +> | microsoft.web/sites/slots/config/validateupgradepath/action | Validate upgrade path for Web App Slot. | +> | microsoft.web/sites/slots/config/appsettings/read | Get Web App Slot settings. | +> | microsoft.web/sites/slots/config/appsettings/read | Get Web App Slot's single App setting. | +> | microsoft.web/sites/slots/config/appsettings/write | Create or Update Web App Slot's Single App setting | +> | microsoft.web/sites/slots/config/snapshots/read | Get Web App Slots Config Snapshots. | > | microsoft.web/sites/slots/config/snapshots/listsecrets/action | Web Apps List Slot Secrets From Snapshot. |+> | microsoft.web/sites/slots/config/web/appsettings/delete | Delete Web App Slot's App Setting | +> | microsoft.web/sites/slots/config/web/connectionstrings/read | Get Web App Slot's single connection string | +> | microsoft.web/sites/slots/config/web/connectionstrings/write | Create or Update Web App Slot's single sonnection string | +> | microsoft.web/sites/slots/config/web/connectionstrings/delete | Delete Web App slot's single connection string | > | microsoft.web/sites/slots/containerlogs/download/action | Download Web Apps Slots Container Logs. | > | microsoft.web/sites/slots/continuouswebjobs/delete | Delete Web Apps Slots Continuous Web Jobs. | > | microsoft.web/sites/slots/continuouswebjobs/read | Get Web Apps Slots Continuous Web Jobs. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/slots/diagnostics/workeravailability/read | Get Web Apps Slots Diagnostics Workeravailability. | > | microsoft.web/sites/slots/diagnostics/workerprocessrecycle/read | Get Web Apps Slots Diagnostics Worker Process Recycle. | > | microsoft.web/sites/slots/domainownershipidentifiers/read | Get Web Apps Slots Domain Ownership Identifiers. |+> | microsoft.web/sites/slots/domainownershipidentifiers/write | Update Web App Slots Domain Ownership Identifiers. | +> | microsoft.web/sites/slots/domainownershipidentifiers/delete | Delete Web App Slots Domain Ownership Identifiers. | > | microsoft.web/sites/slots/extensions/read | Get Web Apps Slots Extensions. | > | microsoft.web/sites/slots/extensions/write | Update Web Apps Slots Extensions. |+> | microsoft.web/sites/slots/extensions/api/action | Invoke App Service Slots Extensions APIs. | > | microsoft.web/sites/slots/functions/listkeys/action | List Function keys. | > | microsoft.web/sites/slots/functions/read | Get Web Apps Slots Functions. | > | microsoft.web/sites/slots/functions/listsecrets/action | List Secrets Web Apps Slots Functions. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/slots/networkConfig/read | Get App Service Slots Network Configuration. | > | microsoft.web/sites/slots/networkConfig/write | Update App Service Slots Network Configuration. | > | microsoft.web/sites/slots/networkConfig/delete | Delete App Service Slots Network Configuration. |+> | microsoft.web/sites/slots/networkfeatures/read | Get Web App Slot Features. | > | microsoft.web/sites/slots/networktraces/operationresults/read | Get Web Apps Slots Network Trace Operation Results. | > | microsoft.web/sites/slots/operationresults/read | Get Web Apps Slots Operation Results. | > | microsoft.web/sites/slots/operations/read | Get Web Apps Slots Operations. | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | microsoft.web/sites/slots/premieraddons/delete | Delete Web Apps Slots Premier Addons. | > | microsoft.web/sites/slots/premieraddons/read | Get Web Apps Slots Premier Addons. | > | microsoft.web/sites/slots/premieraddons/write | Update Web Apps Slots Premier Addons. |+> | microsoft.web/sites/slots/privateaccess/read | Get data around private site access enablement and authorized Virtual Networks that can access the site. | > | microsoft.web/sites/slots/processes/read | Get Web Apps Slots Processes. | > | microsoft.web/sites/slots/providers/Microsoft.Insights/diagnosticSettings/read | Gets the diagnostic setting for the resource | > | microsoft.web/sites/slots/providers/Microsoft.Insights/diagnosticSettings/write | Creates or updates the diagnostic setting for the resource | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/staticSites/builds/zipdeploy/action | Deploy a Static Site Build from zipped content | > | Microsoft.Web/staticSites/builds/config/Write | Create or update app settings for a Static Site Build | > | Microsoft.Web/staticSites/builds/functions/Read | List the functions for a Static Site Build |+> | Microsoft.Web/staticSites/builds/linkedBackends/validate/action | Validate a Linked Backend for a Static Site Build | +> | Microsoft.Web/staticSites/builds/linkedBackends/Delete | Unlink a Backend from a Static Site Build | +> | Microsoft.Web/staticSites/builds/linkedBackends/Read | Get Static Site Build Linked Backends | +> | Microsoft.Web/staticSites/builds/linkedBackends/Write | Register a Linked Backend with a Static Site Build | > | Microsoft.Web/staticSites/builds/userProvidedFunctionApps/Delete | Detach a User Provided Function App from a Static Site Build | > | Microsoft.Web/staticSites/builds/userProvidedFunctionApps/Read | Get Static Site Build User Provided Function Apps | > | Microsoft.Web/staticSites/builds/userProvidedFunctionApps/Write | Register a User Provided Function App with a Static Site Build | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/staticSites/customdomains/Read | List the custom domains for a Static Site | > | Microsoft.Web/staticSites/customdomains/validate/Action | Validate a custom domain can be added to a Static Site | > | Microsoft.Web/staticSites/functions/Read | List the functions for a Static Site |+> | Microsoft.Web/staticSites/linkedBackends/validate/action | Validate a Linked Backend for a Static Site | +> | Microsoft.Web/staticSites/linkedBackends/Delete | Unlink a Backend from a Static Site | +> | Microsoft.Web/staticSites/linkedBackends/Read | Get Static Site Linked Backends | +> | Microsoft.Web/staticSites/linkedBackends/Write | Register a Linked Backend with a Static Site | > | Microsoft.Web/staticSites/privateEndpointConnectionProxies/validate/action | Validate Private Endpoint Connection Proxies for a Static Site | > | Microsoft.Web/staticSites/privateEndpointConnectionProxies/Write | Create or Update Private Endpoint Connection Proxies for a Static Site | > | Microsoft.Web/staticSites/privateEndpointConnectionProxies/Delete | Delete Private Endpoint Connection Proxies for a Static Site | Azure service: [App Service](../app-service/index.yml), [Azure Functions](../azu > | Microsoft.Web/staticSites/userProvidedFunctionApps/Delete | Detach a User Provided Function App from a Static Site | > | Microsoft.Web/staticSites/userProvidedFunctionApps/Read | Get Static Site User Provided Function Apps | > | Microsoft.Web/staticSites/userProvidedFunctionApps/Write | Register a User Provided Function App with a Static Site |+> | microsoft.web/webappstacks/read | Get Web App Stacks. | > | Microsoft.Web/workerApps/read | Get the properties for a Worker App | > | Microsoft.Web/workerApps/write | Create a Worker App or update an existing one | > | Microsoft.Web/workerApps/delete | Delete a Worker App | Azure service: [Azure Kubernetes Service (AKS)](../aks/index.yml) > | Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read | Gets a maintenance configuration | > | Microsoft.ContainerService/managedClusters/maintenanceConfigurations/write | Creates a new MaintenanceConfiguration or updates an existing one | > | Microsoft.ContainerService/managedClusters/maintenanceConfigurations/delete | Deletes a maintenance configuration |+> | Microsoft.ContainerService/managedClusters/networkSecurityPerimeterAssociationProxies/read | Get ManagedCluster NetworkSecurityPerimeter Association | +> | Microsoft.ContainerService/managedClusters/networkSecurityPerimeterAssociationProxies/write | Create or update ManagedCluster NetworkSecurityPerimeter Association | +> | Microsoft.ContainerService/managedClusters/networkSecurityPerimeterAssociationProxies/delete | Delete ManagedCluster NetworkSecurityPerimeter Association | > | Microsoft.ContainerService/managedClusters/privateEndpointConnections/read | Get private endpoint connection | > | Microsoft.ContainerService/managedClusters/privateEndpointConnections/write | Approve or Reject a private endpoint connection | > | Microsoft.ContainerService/managedClusters/privateEndpointConnections/delete | Delete private endpoint connection | Azure service: [Data Factory](../data-factory/index.yml) > | Microsoft.DataFactory/factories/debugpipelineruns/cancel/action | Cancels a debug run for the Pipeline. | > | Microsoft.DataFactory/factories/getDataPlaneAccess/read | Reads access to ADF DataPlane service. | > | Microsoft.DataFactory/factories/getFeatureValue/read | Reads exposure control feature value for the specific location. |+> | Microsoft.DataFactory/factories/globalParameters/read | Reads GlobalParameter. | +> | Microsoft.DataFactory/factories/globalParameters/delete | Deletes GlobalParameter. | +> | Microsoft.DataFactory/factories/globalParameters/write | Create or Update GlobalParameter. | > | Microsoft.DataFactory/factories/integrationruntimes/read | Reads any Integration Runtime. | > | Microsoft.DataFactory/factories/integrationruntimes/write | Creates or Updates any Integration Runtime. | > | Microsoft.DataFactory/factories/integrationruntimes/delete | Deletes any Integration Runtime. | Azure service: [Azure Database for PostgreSQL](../postgresql/index.yml) > | Microsoft.DBforPostgreSQL/flexibleServers/stop/action | Stops an existing server | > | Microsoft.DBforPostgreSQL/flexibleServers/advisors/read | | > | Microsoft.DBforPostgreSQL/flexibleServers/advisors/recommendedActions/read | |+> | Microsoft.DBforPostgreSQL/flexibleServers/backups/read | | > | Microsoft.DBforPostgreSQL/flexibleServers/configurations/read | Returns the list of PostgreSQL server configurations or gets the configurations for the specified server. | > | Microsoft.DBforPostgreSQL/flexibleServers/configurations/write | Updates the configuration of a PostgreSQL server. | > | Microsoft.DBforPostgreSQL/flexibleServers/databases/read | Returns the list of PostgreSQL server databases or gets the database for the specified server. | Azure service: [Azure Cosmos DB](../cosmos-db/index.yml) ### Microsoft.Sql -Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL Managed Instance](../azure-sql/managed-instance/index.yml), [Azure Synapse Analytics](../synapse-analytics/index.yml) +Azure service: [Azure SQL Database](/azure/azure-sql/database/index), [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/index), [Azure Synapse Analytics](../synapse-analytics/index.yml) > [!div class="mx-tableFixed"] > | Action | Description | Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL > | Microsoft.Sql/locations/connectionPoliciesAzureAsyncOperation/read | Gets the in progress operation of server connection policy update. | > | Microsoft.Sql/locations/connectionPoliciesOperationResults/read | Gets the in progress operation of server connection policy update. | > | Microsoft.Sql/locations/databaseAzureAsyncOperation/read | Gets the status of a database operation. |+> | Microsoft.Sql/locations/databaseEncryptionProtectorRevalidateAzureAsyncOperation/read | Revalidate key for azure sql database azure async operation | +> | Microsoft.Sql/locations/databaseEncryptionProtectorRevalidateOperationResults/read | Revalidate key for azure sql database operation results | > | Microsoft.Sql/locations/databaseOperationResults/read | Gets the status of a database operation. | > | Microsoft.Sql/locations/deletedServerAsyncOperation/read | Gets in-progress operations on deleted server | > | Microsoft.Sql/locations/deletedServerOperationResults/read | Gets in-progress operations on deleted server | Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL > | Microsoft.Sql/servers/administrators/read | Gets a specific Azure Active Directory administrator object | > | Microsoft.Sql/servers/administrators/write | Adds or updates a specific Azure Active Directory administrator object | > | Microsoft.Sql/servers/administrators/delete | Deletes a specific Azure Active Directory administrator object |+> | Microsoft.Sql/servers/advancedThreatProtectionSettings/write | Change the server Advanced Threat Protection settings for a given server | +> | Microsoft.Sql/servers/advancedThreatProtectionSettings/read | Retrieve a list of server Advanced Threat Protection settings configured for a given server | > | Microsoft.Sql/servers/advisors/read | Returns list of advisors available for the server | > | Microsoft.Sql/servers/advisors/write | Updates auto-execute status of an advisor on server level. | > | Microsoft.Sql/servers/advisors/recommendedActions/read | Returns list of recommended actions of specified advisor for the server | Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL > | Microsoft.Sql/servers/databases/import/action | Import Azure SQL Database | > | Microsoft.Sql/servers/databases/failover/action | Customer initiated database failover. | > | Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/action | Execute vulnerability assessment database scan. |+> | Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write | Change the database Advanced Threat Protection settings for a given database | +> | Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read | Retrieve a list of database Advanced Threat Protection settings configured for a given database | > | Microsoft.Sql/servers/databases/advisors/read | Returns list of advisors available for the database | > | Microsoft.Sql/servers/databases/advisors/write | Update auto-execute status of an advisor on database level. | > | Microsoft.Sql/servers/databases/advisors/recommendedActions/read | Returns list of recommended actions of specified advisor for the database | Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL > | Microsoft.Sql/servers/databases/dataWarehouseQueries/read | Returns the data warehouse distribution query information for selected query ID | > | Microsoft.Sql/servers/databases/dataWarehouseQueries/dataWarehouseQuerySteps/read | Returns the distributed query step information of data warehouse query for selected step ID | > | Microsoft.Sql/servers/databases/dataWarehouseUserActivities/read | Retrieves the user activities of a SQL Data Warehouse instance which includes running and suspended queries |+> | Microsoft.Sql/servers/databases/encryptionProtector/revalidate/action | Revalidate the database encryption protector | > | Microsoft.Sql/servers/databases/extendedAuditingSettings/read | Retrieve details of the extended blob auditing policy configured on a given database | > | Microsoft.Sql/servers/databases/extendedAuditingSettings/write | Change the extended blob auditing policy for a given database | > | Microsoft.Sql/servers/databases/extensions/write | Performs a database extension operation. | Azure service: [Azure SQL Database](../azure-sql/database/index.yml), [Azure SQL ### Microsoft.SqlVirtualMachine -Azure service: [SQL Server on Azure Virtual Machines](../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md) +Azure service: [SQL Server on Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview) > [!div class="mx-tableFixed"] > | Action | Description | Azure service: [Cognitive Services](../cognitive-services/index.yml) > | Microsoft.CognitiveServices/accounts/ImageSearch/search/action | Get relevant images for a given query. | > | Microsoft.CognitiveServices/accounts/ImageSearch/trending/action | Get currently trending images. | > | Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action | Creates an Immersive Reader session |-> | Microsoft.CognitiveServices/accounts/Language/query-dataverse/action | Query Dataverse | > | Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action | Answer Knowledgebase. | > | Microsoft.CognitiveServices/accounts/Language/query-text/action | Answer Text. |+> | Microsoft.CognitiveServices/accounts/Language/query-dataverse/action | Query Dataverse. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action | Analyzes the input conversation. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/action | Submit a collection of text documents for analysis. Specify a single unique task to be executed immediately. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversation/jobscancel/action | Cancel a long-running analysis job on conversation. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversation/jobs/action | Submit a long conversation for analysis. Specify one or more unique tasks to be executed as a long-running operation. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversation/jobs/read | Get the status of an analysis job. A job may consist of one or more tasks. Once all tasks are succeeded, the job will transition to the suceeded state and results will be available for each task. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/internal/projects/export/jobs/result/read | Get export job result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/internal/projects/models/read | Get a trained model info. Get trained models info.* | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/write | Creates a new or update a project. | Azure service: [Cognitive Services](../cognitive-services/index.yml) > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/export/jobs/read | Get export job status details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/export/jobs/result/read | Get export job result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/deletion-jobs/read | Get project deletion job status and result details. |-> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/languages/read | Get List of Supported languages. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/languages/read | Get List of Supported languages. Get List of Supported languages.* | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/prebuilt-entities/read | Get list of Supported prebuilts for conversational projects. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/prebuilts/read | Get list of Supported prebuilts for conversational projects. |+> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/global/training-config-versions/read | List all training config versions. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/import/jobs/read | Get import or replace project job status and result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/languages/read | Get List of Supported languages. |-> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/delete | Delete a trained model. | -> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/read | Get a trained model info. List all trained models.* | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/delete | Delete a trained model. Delete a trained model.* | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/read | Get a trained model info. List all trained models.* Get a trained model info.* | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/evaluation/read | Get trained model evaluation report. |+> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/evaluation/result/read | Get trained model evaluation result. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/evaluation/summary-result/read | Get trained model evaluation summary. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/models/verification/read | Get trained model verification report. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/prebuilts/read | Get list of Supported prebuilts for conversational projects. | > | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/train/jobs/read | Get training jobs. Get training job status and result details.* |+> | Microsoft.CognitiveServices/accounts/Language/analyze-conversations/projects/train/jobs/cancel/action | Cancels a running training job. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action | Submit a collection of text documents for analysis. Specify one or more unique tasks to be executed. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action | Cancel a long-running Text Analysis job. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/internal/projects/autotag/action | Trigger auto tagging job. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/internal/projects/autotag/jobs/read | Get autotagging jobs. Get auto tagging job status and result details.* | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/internal/projects/export/jobs/result/read | Get export job result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/internal/projects/models/read | Get a trained model info. Get trained models info.* |+> | Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/read | Get the status of an analysis job. A job may consist of one or more tasks. Once all tasks are completed, the job will transition to the completed state and results will be available for each task. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/write | Creates a new or update a project. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/delete | Deletes a project. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/read | Gets a project info. Returns the list of projects.* | Azure service: [Cognitive Services](../cognitive-services/index.yml) > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/export/jobs/result/read | Get export job result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/global/deletion-jobs/read | Get project deletion job status and result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/global/languages/read | Get List of Supported languages. |+> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/global/training-config-versions/read | List all training config versions. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/import/jobs/read | Get import or replace project job status and result details. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/languages/read | Get List of Supported languages. |-> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/delete | Delete a trained model. | -> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/read | Get a trained model info. List all trained models.* | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/delete | Delete a trained model. Delete a trained model.* | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/read | Get a trained model info. List all trained models.* Get a trained model info.* | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/evaluation/read | Get trained model evaluation report. |+> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/evaluation/result/read | Get trained model evaluation result. | +> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/evaluation/summary-result/read | Get trained model evaluation summary. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/models/verification/read | Get trained model verification report. | > | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/train/jobs/read | Get training jobs. Get training job status and result details.* |+> | Microsoft.CognitiveServices/accounts/Language/analyze-text/projects/train/jobs/cancel/action | Cancels a running training job. | > | Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/projects/read | List Projects. Get Project Details.* | > | Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/projects/write | Create Project. | > | Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/projects/delete | Delete Project. | Azure service: [Machine Learning](../machine-learning/index.yml) > | Microsoft.MachineLearningServices/locations/vmsizes/read | Get supported vm sizes | > | Microsoft.MachineLearningServices/locations/workspaceOperationsStatus/read | Gets the status of a particular workspace operation | > | Microsoft.MachineLearningServices/operations/read | Get all the operations for the Machine Learning Services Resource Provider |+> | Microsoft.MachineLearningServices/registries/read | Gets the Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/write | Creates or updates the Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/delete | Deletes the Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/assets/read | Reads assets in Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/assets/write | Creates or updates assets in Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/assets/delete | Deletes assets in Machine Learning Services Registry(ies) | +> | Microsoft.MachineLearningServices/registries/checkNameAvailability/read | Checks name for Machine Learning Services Registry(ies) | > | Microsoft.MachineLearningServices/virtualclusters/read | Gets the Machine Learning Services Virtual Cluster(s) | > | Microsoft.MachineLearningServices/virtualclusters/write | Creates or updates a Machine Learning Services Virtual Cluster(s) | > | Microsoft.MachineLearningServices/virtualclusters/delete | Deletes the Machine Learning Services Virtual Cluster(s) | Azure service: [Machine Learning](../machine-learning/index.yml) > | Microsoft.MachineLearningServices/workspaces/providers/Microsoft.Insights/diagnosticSettings/write | Creates or updates the diagnostic setting for the resource | > | Microsoft.MachineLearningServices/workspaces/providers/Microsoft.Insights/logDefinitions/read | Gets the available logs for Azure machine learning workspaces | > | Microsoft.MachineLearningServices/workspaces/providers/Microsoft.Insights/metricDefinitions/read | Gets the available metrics for Azure machine learning workspaces |+> | Microsoft.MachineLearningServices/workspaces/registries/read | Gets the Machine Learning Services Workspace Registry(ies) | +> | Microsoft.MachineLearningServices/workspaces/registries/write | Creates or updates the Machine Learning Services Workspace Registry(ies) | +> | Microsoft.MachineLearningServices/workspaces/registries/delete | Deletes the Machine Learning Services Workspace Workspace Registry(ies) | > | Microsoft.MachineLearningServices/workspaces/reports/read | Gets custom reports in Machine Learning Services Workspace(s) | > | Microsoft.MachineLearningServices/workspaces/reports/write | Creates or updates custom reports in Machine Learning Services Workspace(s) | > | Microsoft.MachineLearningServices/workspaces/reports/delete | Deletes custom reports in Machine Learning Services Workspace(s) | Azure service: [IoT Central](../iot-central/index.yml) > | Microsoft.IoTCentral/IoTApps/providers/Microsoft.Insights/diagnosticSettings/write | Set diagnostic settings for the resource | > | Microsoft.IoTCentral/IoTApps/providers/Microsoft.Insights/metricDefinitions/read | Read all the available metric definitions for IoT Central | > | Microsoft.IoTCentral/locations/operationResults/read | Get async operation results for IoT Central |+> | Microsoft.IoTCentral/locations/operationStatuses/read | Get async operation status for IoT Central | > | Microsoft.IoTCentral/operations/read | Get/List all the available operations for IoT Central | ### Microsoft.IoTSecurity Azure service: [IoT security](../iot-fundamentals/iot-security-architecture.md) > | Microsoft.IoTSecurity/locations/read | Gets location | > | Microsoft.IoTSecurity/locations/deviceGroups/alerts/read | Gets IoT Alerts | > | Microsoft.IoTSecurity/locations/deviceGroups/alerts/write | Updates IoT Alert properties |+> | Microsoft.IoTSecurity/locations/deviceGroups/alerts/learnAlert/action | Learn and close the alert | > | Microsoft.IoTSecurity/locations/deviceGroups/devices/read | Get devices | > | Microsoft.IoTSecurity/locations/deviceGroups/devices/write | Updates device properties | > | Microsoft.IoTSecurity/locations/deviceGroups/devices/delete | Deletes device | Azure service: [Notification Hubs](../notification-hubs/index.yml) > | Microsoft.NotificationHubs/Namespaces/NotificationHubs/authorizationRules/listkeys/action | Get the Connection String to the Notification Hub | > | Microsoft.NotificationHubs/Namespaces/NotificationHubs/authorizationRules/regenerateKeys/action | Notification Hub Authorization Rule Regenerate Primary/SecondaryKey, Specify the Key that needs to be regenerated | > | Microsoft.NotificationHubs/Namespaces/NotificationHubs/metricDefinitions/read | Get list of Namespace metrics Resource Descriptions |+> | Microsoft.NotificationHubs/Namespaces/NotificationHubs/vapidkeys/read | Get new pair of VAPID keys for a Notification Hub | > | Microsoft.NotificationHubs/namespaces/privateEndpointConnectionProxies/validate/action | Validate Private Endpoint Connection Proxy | > | Microsoft.NotificationHubs/namespaces/privateEndpointConnectionProxies/read | Get Private Endpoint Connection Proxy | > | Microsoft.NotificationHubs/namespaces/privateEndpointConnectionProxies/write | Create Private Endpoint Connection Proxy | Azure service: [API Management](../api-management/index.yml) > | Microsoft.ApiManagement/service/policy/write | Create policy configuration at Tenant level | > | Microsoft.ApiManagement/service/policy/delete | Delete the policy configuration at Tenant level | > | Microsoft.ApiManagement/service/policyDescriptions/read | Lists all policy descriptions. |+> | Microsoft.ApiManagement/service/policyFragments/read | Gets all policy fragments. or Gets a policy fragment. | +> | Microsoft.ApiManagement/service/policyFragments/write | Creates or updates a policy fragment. | +> | Microsoft.ApiManagement/service/policyFragments/delete | Deletes a policy fragment. | +> | Microsoft.ApiManagement/service/policyFragments/listReferences/action | Lists policy resources that reference the policy fragment. | > | Microsoft.ApiManagement/service/policySnippets/read | Lists all policy snippets. |+> | Microsoft.ApiManagement/service/portalConfigs/read | Lists a collection of developer portal config entities. or Gets developer portal config specified by its identifier. | +> | Microsoft.ApiManagement/service/portalConfigs/write | Creates a new developer portal config. or Updates the description of specified portal config or makes it current. | +> | Microsoft.ApiManagement/service/portalConfigs/listDelegationSecrets/action | Gets validation key of portal delegation settings. | > | Microsoft.ApiManagement/service/portalRevisions/read | Lists a collection of developer portal revision entities. or Gets developer portal revision specified by its identifier. | > | Microsoft.ApiManagement/service/portalRevisions/write | Creates a new developer portal revision. or Updates the description of specified portal revision or makes it current. | > | Microsoft.ApiManagement/service/portalSettings/read | Lists a collection of portal settings. or Get Sign In Settings for the Portal or Get Sign Up Settings for the Portal or Get Delegation Settings for the Portal. | Azure service: [API Management](../api-management/index.yml) > | Microsoft.ApiManagement/service/users/identities/read | List of all user identities. | > | Microsoft.ApiManagement/service/users/keys/read | Get keys associated with user | > | Microsoft.ApiManagement/service/users/subscriptions/read | Lists the collection of subscriptions of the specified user. |+> | Microsoft.ApiManagement/service/workspaces/read | Lists a collection of Workspaces defined within a service instance. or Gets the details of the Workspace specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/write | Creates Workspace. or Updates the details of the Workspace specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/delete | Deletes specific Workspace of the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/apis/read | Lists all APIs of the API Management service instance. or Gets the details of the API specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/apis/write | Creates new or updates existing specified API of the API Management service instance. or Updates the specified API of the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/apis/delete | Deletes the specified API of the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/read | Lists a collection of the operations for the specified API. or Gets the details of the API Operation specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/write | Creates a new operation in the API or updates an existing one. or Updates the details of the operation in the API specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/delete | Deletes the specified operation in the API. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/policies/read | Get the list of policy configuration at the API Operation level. or Get the policy configuration at the API Operation level. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/policies/write | Creates or updates policy configuration for the API Operation level. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/policies/delete | Deletes the policy configuration at the Api Operation. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/tags/read | Lists all Tags associated with the Operation. or Get tag associated with the Operation. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/tags/write | Assign tag to the Operation. | +> | Microsoft.ApiManagement/service/workspaces/apis/operations/tags/delete | Detach the tag from the Operation. | +> | Microsoft.ApiManagement/service/workspaces/apis/operationsByTags/read | Lists a collection of operations associated with tags. | +> | Microsoft.ApiManagement/service/workspaces/apis/policies/read | Get the policy configuration at the API level. or Get the policy configuration at the API level. | +> | Microsoft.ApiManagement/service/workspaces/apis/policies/write | Creates or updates policy configuration for the API. | +> | Microsoft.ApiManagement/service/workspaces/apis/policies/delete | Deletes the policy configuration at the Api. | +> | Microsoft.ApiManagement/service/workspaces/apis/products/read | Lists all Products, which the API is part of. | +> | Microsoft.ApiManagement/service/workspaces/apis/schemas/read | Get the schema configuration at the API level. or Get the schema configuration at the API level. | +> | Microsoft.ApiManagement/service/workspaces/apis/schemas/write | Creates or updates schema configuration for the API. | +> | Microsoft.ApiManagement/service/workspaces/apis/schemas/delete | Deletes the schema configuration at the Api. | +> | Microsoft.ApiManagement/service/workspaces/apis/schemas/document/read | Get the document describing the Schema | +> | Microsoft.ApiManagement/service/workspaces/apis/schemas/document/write | Update the document describing the Schema | +> | Microsoft.ApiManagement/service/workspaces/apis/tagDescriptions/read | Lists all Tags descriptions in scope of API. Model similar to swagger - tagDescription is defined on API level but tag may be assigned to the Operations or Get Tag description in scope of API | +> | Microsoft.ApiManagement/service/workspaces/apis/tagDescriptions/write | Create/Update tag description in scope of the Api. | +> | Microsoft.ApiManagement/service/workspaces/apis/tagDescriptions/delete | Delete tag description for the Api. | +> | Microsoft.ApiManagement/service/workspaces/apis/tags/read | Lists all Tags associated with the API. or Get tag associated with the API. | +> | Microsoft.ApiManagement/service/workspaces/apis/tags/write | Assign tag to the Api. | +> | Microsoft.ApiManagement/service/workspaces/apis/tags/delete | Detach the tag from the Api. | +> | Microsoft.ApiManagement/service/workspaces/apiVersionSets/read | Lists a collection of API Version Sets in the specified service instance. or Gets the details of the Api Version Set specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/apiVersionSets/write | Creates or Updates a Api Version Set. or Updates the details of the Api VersionSet specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/apiVersionSets/delete | Deletes specific Api Version Set. | +> | Microsoft.ApiManagement/service/workspaces/apiVersionSets/versions/read | Get list of version entities | +> | Microsoft.ApiManagement/service/workspaces/namedValues/read | Lists a collection of named values defined within a service instance. or Gets the details of the named value specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/namedValues/write | Creates or updates named value. or Updates the specific named value. | +> | Microsoft.ApiManagement/service/workspaces/namedValues/delete | Deletes specific named value from the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/namedValues/listValue/action | Gets the secret of the named value specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/namedValues/refreshSecret/action | Refreshes named value by fetching it from Key Vault. | +> | Microsoft.ApiManagement/service/workspaces/products/read | Lists a collection of products in the specified service instance. or Gets the details of the product specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/products/write | Creates or Updates a product. or Update existing product details. | +> | Microsoft.ApiManagement/service/workspaces/products/delete | Delete product. | +> | Microsoft.ApiManagement/service/workspaces/products/apis/read | Lists a collection of the APIs associated with a product. | +> | Microsoft.ApiManagement/service/workspaces/products/apis/write | Adds an API to the specified product. | +> | Microsoft.ApiManagement/service/workspaces/products/apis/delete | Deletes the specified API from the specified product. | +> | Microsoft.ApiManagement/service/workspaces/products/groups/read | Lists the collection of developer groups associated with the specified product. | +> | Microsoft.ApiManagement/service/workspaces/products/groups/write | Adds the association between the specified developer group with the specified product. | +> | Microsoft.ApiManagement/service/workspaces/products/groups/delete | Deletes the association between the specified group and product. | +> | Microsoft.ApiManagement/service/workspaces/products/policies/read | Get the policy configuration at the Product level. or Get the policy configuration at the Product level. | +> | Microsoft.ApiManagement/service/workspaces/products/policies/write | Creates or updates policy configuration for the Product. | +> | Microsoft.ApiManagement/service/workspaces/products/policies/delete | Deletes the policy configuration at the Product. | +> | Microsoft.ApiManagement/service/workspaces/products/subscriptions/read | Lists the collection of subscriptions to the specified product. | +> | Microsoft.ApiManagement/service/workspaces/products/tags/read | Lists all Tags associated with the Product. or Get tag associated with the Product. | +> | Microsoft.ApiManagement/service/workspaces/products/tags/write | Assign tag to the Product. | +> | Microsoft.ApiManagement/service/workspaces/products/tags/delete | Detach the tag from the Product. | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/read | Lists all subscriptions of the API Management service instance. or Gets the specified Subscription entity (without keys). | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/write | Creates or updates the subscription of specified user to the specified product. or Updates the details of a subscription specified by its identifier. | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/delete | Deletes the specified subscription. | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/regeneratePrimaryKey/action | Regenerates primary key of existing subscription of the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/regenerateSecondaryKey/action | Regenerates secondary key of existing subscription of the API Management service instance. | +> | Microsoft.ApiManagement/service/workspaces/subscriptions/listSecrets/action | Gets the specified Subscription keys. | ### Microsoft.AppConfiguration Azure service: core > | | | > | Microsoft.AzureStack/register/action | Subscription Registration Action | > | Microsoft.AzureStack/register/action | Registers Subscription with Microsoft.AzureStack resource provider |+> | Microsoft.AzureStack/generateDeploymentLicense/action | Generates a temporary license to deploy an Azure Stack device. | > | Microsoft.AzureStack/cloudManifestFiles/read | Gets the Cloud Manifest File | > | Microsoft.AzureStack/linkedSubscriptions/read | Get the properties of an Azure Stack Linked Subscription | > | Microsoft.AzureStack/linkedSubscriptions/write | Create or updates an linked subscription | Azure service: [Azure Stack Edge](../databox-online/azure-stack-edge-overview.md > | Action | Description | > | | | > | Microsoft.DataBoxEdge/availableSkus/read | Lists or gets the available skus |+> | Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/action | Performs Device Capacity Check and Returns Feasibility | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/write | Creates or updates the Data Box Edge devices | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/read | Lists or gets the Data Box Edge devices | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/delete | Deletes the Data Box Edge devices | Azure service: [Azure Stack Edge](../databox-online/azure-stack-edge-overview.md > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/write | Creates or updates the bandwidth schedules | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/delete | Deletes the bandwidth schedules | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/operationResults/read | Lists or gets the operation result |+> | Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/operationResults/read | Lists or gets the operation result | +> | Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityInfo/read | Lists or gets the device capacity information | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/diagnosticProactiveLogCollectionSettings/operationResults/read | Lists or gets the operation result | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/diagnosticRemoteSupportSettings/operationResults/read | Lists or gets the operation result | > | Microsoft.DataBoxEdge/dataBoxEdgeDevices/jobs/read | Lists or gets the jobs | Azure service: [Service Bus](../service-bus-messaging/index.yml) > | Microsoft.ServiceBus/checkNameAvailability/action | Checks availability of namespace under given subscription. | > | Microsoft.ServiceBus/register/action | Registers the subscription for the ServiceBus resource provider and enables the creation of ServiceBus resources | > | Microsoft.ServiceBus/unregister/action | Registers the subscription for the ServiceBus resource provider and enables the creation of ServiceBus resources |-> | Microsoft.ServiceBus/locations/deleteVirtualNetworkOrSubnets/action | Deletes the VNet rules in ServiceBus Resource Provider for the specified VNet | > | Microsoft.ServiceBus/namespaces/write | Create a Namespace Resource and Update its properties. Tags and Capacity of the Namespace are the properties which can be updated. | > | Microsoft.ServiceBus/namespaces/read | Get the list of Namespace Resource Description | > | Microsoft.ServiceBus/namespaces/Delete | Delete Namespace Resource |-> | Microsoft.ServiceBus/namespaces/authorizationRules/action | Updates Namespace Authorization Rule. This API is deprecated. Please use a PUT call to update the Namespace Authorization Rule instead.. This operation is not supported on API version 2017-04-01. | +> | Microsoft.ServiceBus/namespaces/authorizationRules/action | Updates Namespace Authorization Rule. This API is deprecated. Please use a PUT call to update the Namespace Authorization Rule instead. | > | Microsoft.ServiceBus/namespaces/migrate/action | Migrate namespace operation |-> | Microsoft.ServiceBus/namespaces/removeAcsNamepsace/action | Remove ACS namespace | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionsApproval/action | Approve Private Endpoint Connection | > | Microsoft.ServiceBus/namespaces/authorizationRules/write | Create a Namespace level Authorization Rules and update its properties. The Authorization Rules Access Rights, the Primary and Secondary Keys can be updated. | > | Microsoft.ServiceBus/namespaces/authorizationRules/read | Get the list of Namespaces Authorization Rules description. | > | Microsoft.ServiceBus/namespaces/authorizationRules/delete | Delete Namespace Authorization Rule. The Default Namespace Authorization Rule cannot be deleted. | > | Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action | Get the Connection String to the Namespace | > | Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action | Regenerate the Primary or Secondary key to the Resource |-> | Microsoft.ServiceBus/namespaces/disasterrecoveryconfigs/checkNameAvailability/action | Checks availability of namespace alias under given subscription. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/write | Creates or Updates the Disaster Recovery configuration associated with the namespace. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/read | Gets the Disaster Recovery configuration associated with the namespace. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/delete | Deletes the Disaster Recovery configuration associated with the namespace. This operation can only be invoked via the primary namespace. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/breakPairing/action | Disables Disaster Recovery and stops replicating changes from primary to secondary namespaces. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/failover/action | Invokes a GEO DR failover and reconfigures the namespace alias to point to the secondary namespace. | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/authorizationRules/read | Get Disaster Recovery Primary Namespace's Authorization Rules | -> | Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/authorizationRules/listkeys/action | Gets the authorization rules keys for the Disaster Recovery primary namespace | -> | Microsoft.ServiceBus/namespaces/eventGridFilters/write | Creates or Updates the Event Grid filter associated with the namespace. | -> | Microsoft.ServiceBus/namespaces/eventGridFilters/read | Gets the Event Grid filter associated with the namespace. | -> | Microsoft.ServiceBus/namespaces/eventGridFilters/delete | Deletes the Event Grid filter associated with the namespace. | +> | Microsoft.ServiceBus/namespaces/diagnosticSettings/read | Get list of Namespace diagnostic settings Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/diagnosticSettings/write | Get list of Namespace diagnostic settings Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/eventhubs/write | Create or Update EventHub properties. | > | Microsoft.ServiceBus/namespaces/eventhubs/read | Get list of EventHub Resource Descriptions |-> | Microsoft.ServiceBus/namespaces/ipFilterRules/read | Get IP Filter Resource | -> | Microsoft.ServiceBus/namespaces/ipFilterRules/write | Create IP Filter Resource | -> | Microsoft.ServiceBus/namespaces/ipFilterRules/delete | Delete IP Filter Resource | -> | Microsoft.ServiceBus/namespaces/messagingPlan/read | Gets the Messaging Plan for a namespace.<br>This API is deprecated.<br>Properties exposed via the MessagingPlan resource are moved to the (parent) Namespace resource in later API versions..<br>This operation is not supported on API version 2017-04-01. | -> | Microsoft.ServiceBus/namespaces/messagingPlan/write | Updates the Messaging Plan for a namespace.<br>This API is deprecated.<br>Properties exposed via the MessagingPlan resource are moved to the (parent) Namespace resource in later API versions..<br>This operation is not supported on API version 2017-04-01. | -> | Microsoft.ServiceBus/namespaces/migrationConfigurations/write | Creates or Updates Migration configuration. This will start synchronizing resources from the standard to the premium namespace | -> | Microsoft.ServiceBus/namespaces/migrationConfigurations/read | Gets the Migration configuration which indicates the state of the migration and pending replication operations | -> | Microsoft.ServiceBus/namespaces/migrationConfigurations/delete | Deletes the Migration configuration. | -> | Microsoft.ServiceBus/namespaces/migrationConfigurations/revert/action | Reverts the standard to premium namespace migration | -> | Microsoft.ServiceBus/namespaces/migrationConfigurations/upgrade/action | Assigns the DNS associated with the standard namespace to the premium namespace which completes the migration and stops the syncing resources from standard to premium namespace | -> | Microsoft.ServiceBus/namespaces/networkruleset/read | Gets NetworkRuleSet Resource | -> | Microsoft.ServiceBus/namespaces/networkruleset/write | Create VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/networkruleset/delete | Delete VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/networkrulesets/read | Gets NetworkRuleSet Resource | -> | Microsoft.ServiceBus/namespaces/networkrulesets/write | Create VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/networkrulesets/delete | Delete VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/operationresults/read | Get the status of Namespace operation | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionProxies/validate/action | Validate Private Endpoint Connection Proxy | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionProxies/read | Get Private Endpoint Connection Proxy | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionProxies/write | Create Private Endpoint Connection Proxy | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionProxies/delete | Delete Private Endpoint Connection Proxy | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnectionProxies/operationstatus/read | Get the status of an asynchronous private endpoint operation | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnections/read | Get Private Endpoint Connection | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnections/write | Create or Update Private Endpoint Connection | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnections/delete | Removes Private Endpoint Connection | -> | Microsoft.ServiceBus/namespaces/privateEndpointConnections/operationstatus/read | Get the status of an asynchronous private endpoint operation | -> | Microsoft.ServiceBus/namespaces/privateLinkResources/read | Gets the resource types that support private endpoint connections | -> | Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/diagnosticSettings/read | Get list of Namespace diagnostic settings Resource Descriptions | -> | Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/diagnosticSettings/write | Get list of Namespace diagnostic settings Resource Descriptions | -> | Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/logDefinitions/read | Get list of Namespace logs Resource Descriptions | -> | Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/metricDefinitions/read | Get list of Namespace metrics Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/eventhubs/Delete | Operation to delete EventHub Resource | +> | Microsoft.ServiceBus/namespaces/eventhubs/authorizationRules/write | Create EventHub Authorization Rules and Update its properties. The Authorization Rules Access Rights can be updated. | +> | Microsoft.ServiceBus/namespaces/eventhubs/authorizationRules/read | Get the list of EventHub Authorization Rules | +> | Microsoft.ServiceBus/namespaces/eventhubs/authorizationRules/delete | Operation to delete EventHub Authorization Rules | +> | Microsoft.ServiceBus/namespaces/eventhubs/authorizationRules/listkeys/action | Get the Connection String to EventHub | +> | Microsoft.ServiceBus/namespaces/eventhubs/authorizationRules/regenerateKeys/action | Regenerate the Primary or Secondary key to the Resource | +> | Microsoft.ServiceBus/namespaces/eventHubs/consumergroups/write | Create or Update ConsumerGroup properties. | +> | Microsoft.ServiceBus/namespaces/eventHubs/consumergroups/read | Get list of ConsumerGroup Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/eventHubs/consumergroups/Delete | Operation to delete ConsumerGroup Resource | +> | Microsoft.ServiceBus/namespaces/logDefinitions/read | Get list of Namespace logs Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/messagingPlan/read | Gets the Messaging Plan for a namespace. This API is deprecated. Properties exposed via the MessagingPlan resource are moved to the (parent) Namespace resource in later API versions. | +> | Microsoft.ServiceBus/namespaces/messagingPlan/write | Updates the Messaging Plan for a namespace. This API is deprecated. Properties exposed via the MessagingPlan resource are moved to the (parent) Namespace resource in later API versions. | +> | Microsoft.ServiceBus/namespaces/messagingplan/write | Create or Update MessagingPlan properties. | +> | Microsoft.ServiceBus/namespaces/messagingplan/read | Get list of MessagingPlan Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/metricDefinitions/read | Get list of Namespace metrics Resource Descriptions | +> | Microsoft.ServiceBus/namespaces/operationresults/read | Get the list of Namespace Resource Description | > | Microsoft.ServiceBus/namespaces/queues/write | Create or Update Queue properties. | > | Microsoft.ServiceBus/namespaces/queues/read | Get list of Queue Resource Descriptions | > | Microsoft.ServiceBus/namespaces/queues/Delete | Operation to delete Queue Resource |-> | Microsoft.ServiceBus/namespaces/queues/authorizationRules/action | Operation to update Queue. This operation is not supported on API version 2017-04-01. Authorization Rules. Please use a PUT call to update Authorization Rule. | +> | Microsoft.ServiceBus/namespaces/queues/authorizationRules/action | Operation to update Queue Authorization Rules. Please use a PUT call to update Authorization Rule. | > | Microsoft.ServiceBus/namespaces/queues/authorizationRules/write | Create Queue Authorization Rules and Update its properties. The Authorization Rules Access Rights can be updated. | > | Microsoft.ServiceBus/namespaces/queues/authorizationRules/read | Get the list of Queue Authorization Rules | > | Microsoft.ServiceBus/namespaces/queues/authorizationRules/delete | Operation to delete Queue Authorization Rules | > | Microsoft.ServiceBus/namespaces/queues/authorizationRules/listkeys/action | Get the Connection String to Queue | > | Microsoft.ServiceBus/namespaces/queues/authorizationRules/regenerateKeys/action | Regenerate the Primary or Secondary key to the Resource |-> | Microsoft.ServiceBus/namespaces/skus/read | List Supported SKUs for Namespace | > | Microsoft.ServiceBus/namespaces/topics/write | Create or Update Topic properties. | > | Microsoft.ServiceBus/namespaces/topics/read | Get list of Topic Resource Descriptions | > | Microsoft.ServiceBus/namespaces/topics/Delete | Operation to delete Topic Resource |-> | Microsoft.ServiceBus/namespaces/topics/authorizationRules/action | Operation to update Topic. This operation is not supported on API version 2017-04-01. Authorization Rules. Please use a PUT call to update Authorization Rule. | +> | Microsoft.ServiceBus/namespaces/topics/authorizationRules/action | Operation to update Topic Authorization Rules. Please use a PUT call to update Authorization Rule. | > | Microsoft.ServiceBus/namespaces/topics/authorizationRules/write | Create Topic Authorization Rules and Update its properties. The Authorization Rules Access Rights can be updated. | > | Microsoft.ServiceBus/namespaces/topics/authorizationRules/read | Get the list of Topic Authorization Rules | > | Microsoft.ServiceBus/namespaces/topics/authorizationRules/delete | Operation to delete Topic Authorization Rules | Azure service: [Service Bus](../service-bus-messaging/index.yml) > | Microsoft.ServiceBus/namespaces/topics/subscriptions/rules/write | Create or Update Rule properties. | > | Microsoft.ServiceBus/namespaces/topics/subscriptions/rules/read | Get list of Rule Resource Descriptions | > | Microsoft.ServiceBus/namespaces/topics/subscriptions/rules/Delete | Operation to delete Rule Resource |-> | Microsoft.ServiceBus/namespaces/virtualNetworkRules/read | Gets VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/virtualNetworkRules/write | Create VNET Rule Resource | -> | Microsoft.ServiceBus/namespaces/virtualNetworkRules/delete | Delete VNET Rule Resource | > | Microsoft.ServiceBus/operations/read | Get Operations | > | Microsoft.ServiceBus/sku/read | Get list of Sku Resource Descriptions | > | Microsoft.ServiceBus/sku/regions/read | Get list of SkuRegions Resource Descriptions |-> | **DataAction** | **Description** | -> | Microsoft.ServiceBus/namespaces/messages/send/action | Send messages | -> | Microsoft.ServiceBus/namespaces/messages/receive/action | Receive messages | ## Identity Azure service: [Key Vault](../key-vault/index.yml) > | Microsoft.KeyVault/locations/deletedVaults/read | View the properties of a soft deleted key vault | > | Microsoft.KeyVault/locations/deletedVaults/purge/action | Purge a soft deleted key vault | > | Microsoft.KeyVault/locations/managedHsmOperationResults/read | Check the result of a long run operation |+> | Microsoft.KeyVault/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/write | Check if the configuration of the Network Security Perimeter needs updating. | > | Microsoft.KeyVault/locations/operationResults/read | Check the result of a long run operation | > | Microsoft.KeyVault/managedHSMs/read | View the properties of a Managed HSM | > | Microsoft.KeyVault/managedHSMs/write | Create a new Managed HSM or update the properties of an existing Managed HSM | Azure service: [Key Vault](../key-vault/index.yml) > | Microsoft.KeyVault/vaults/keys/read | List the keys in a specified vault, or read the current version of a specified key. | > | Microsoft.KeyVault/vaults/keys/write | Creates the first version of a new key if it does not exist. If it already exists, then the existing key is returned without any modification. This API does not create subsequent versions, and does not update existing keys. | > | Microsoft.KeyVault/vaults/keys/versions/read | List the versions of a specified key, or read the specified version of a key. |+> | Microsoft.KeyVault/vaults/networkSecurityPerimeterAssociationProxies/delete | Delete an association proxy to a Network Security Perimeter resource of Microsoft.Network provider. | +> | Microsoft.KeyVault/vaults/networkSecurityPerimeterAssociationProxies/read | Delete an association proxy to a Network Security Perimeter resource of Microsoft.Network provider. | +> | Microsoft.KeyVault/vaults/networkSecurityPerimeterAssociationProxies/write | Change the state of an association to a Network Security Perimeter resource of Microsoft.Network provider | +> | Microsoft.KeyVault/vaults/networkSecurityPerimeterConfigurations/read | Read the Network Security Perimeter configuration stored in a vault. | +> | Microsoft.KeyVault/vaults/networkSecurityPerimeterConfigurations/reconcile/action | Reconcile the Network Security Perimeter configuration stored in a vault with NRP's (Microsoft.Network Resource Provider) copy. | > | Microsoft.KeyVault/vaults/privateEndpointConnectionProxies/read | View the state of a connection proxy to a Private Endpoint resource of Microsoft.Network provider | > | Microsoft.KeyVault/vaults/privateEndpointConnectionProxies/write | Change the state of a connection proxy to a Private Endpoint resource of Microsoft.Network provider | > | Microsoft.KeyVault/vaults/privateEndpointConnectionProxies/delete | Delete a connection proxy to a Private Endpoint resource of Microsoft.Network provider | Azure service: [Microsoft Sentinel](../sentinel/index.yml) > | Microsoft.SecurityInsights/cases/comments/write | Creates the case comments | > | Microsoft.SecurityInsights/cases/investigations/read | Gets the case investigations | > | Microsoft.SecurityInsights/cases/investigations/write | Updates the metadata of a case |+> | Microsoft.SecurityInsights/ConfidentialWatchlists/read | Gets Confidential Watchlists | +> | Microsoft.SecurityInsights/ConfidentialWatchlists/write | Creates Confidential Watchlists | +> | Microsoft.SecurityInsights/ConfidentialWatchlists/delete | Deletes Confidential Watchlists | > | Microsoft.SecurityInsights/dataConnectors/read | Gets the data connectors | > | Microsoft.SecurityInsights/dataConnectors/write | Updates a data connector | > | Microsoft.SecurityInsights/dataConnectors/delete | Deletes a data connector | Azure service: [Microsoft Sentinel](../sentinel/index.yml) > | Microsoft.SecurityInsights/entities/relations/write | Updates a relation between the entity and related resources | > | Microsoft.SecurityInsights/entities/relations/delete | Deletes a relation between the entity and related resources | > | Microsoft.SecurityInsights/entityQueries/read | Gets the investigation expansions for entities |+> | Microsoft.SecurityInsights/fileimports/read | Reads File Import objects | +> | Microsoft.SecurityInsights/fileimports/write | Creates or updates a File Import | +> | Microsoft.SecurityInsights/fileimports/delete | Deletes a File Import | > | Microsoft.SecurityInsights/incidents/read | Gets an incident | > | Microsoft.SecurityInsights/incidents/write | Updates an incident | > | Microsoft.SecurityInsights/incidents/delete | Deletes an incident | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/read | Run queries over the data in the workspace | > | Microsoft.OperationalInsights/workspaces/query/AACAudit/read | Read data from the AACAudit table | > | Microsoft.OperationalInsights/workspaces/query/AACHttpRequest/read | Read data from the AACHttpRequest table |+> | Microsoft.OperationalInsights/workspaces/query/AADB2CRequestLogs/read | Read data from the AADB2CRequestLogs table | > | Microsoft.OperationalInsights/workspaces/query/AADDomainServicesAccountLogon/read | Read data from the AADDomainServicesAccountLogon table | > | Microsoft.OperationalInsights/workspaces/query/AADDomainServicesAccountManagement/read | Read data from the AADDomainServicesAccountManagement table | > | Microsoft.OperationalInsights/workspaces/query/AADDomainServicesDirectoryServiceAccess/read | Read data from the AADDomainServicesDirectoryServiceAccess table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/ACSCallDiagnostics/read | Read data from the ACSCallDiagnostics table | > | Microsoft.OperationalInsights/workspaces/query/ACSCallSummary/read | Read data from the ACSCallSummary table | > | Microsoft.OperationalInsights/workspaces/query/ACSChatIncomingOperations/read | Read data from the ACSChatIncomingOperations table |+> | Microsoft.OperationalInsights/workspaces/query/ACSNetworkTraversalDiagnostics/read | Read data from the ACSNetworkTraversalDiagnostics table | > | Microsoft.OperationalInsights/workspaces/query/ACSNetworkTraversalIncomingOperations/read | Read data from the ACSNetworkTraversalIncomingOperations table | > | Microsoft.OperationalInsights/workspaces/query/ACSSMSIncomingOperations/read | Read data from the ACSSMSIncomingOperations table | > | Microsoft.OperationalInsights/workspaces/query/ADAssessmentRecommendation/read | Read data from the ADAssessmentRecommendation table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/AgriFoodModelInferenceLogs/read | Read data from the AgriFoodModelInferenceLogs table | > | Microsoft.OperationalInsights/workspaces/query/AgriFoodProviderAuthLogs/read | Read data from the AgriFoodProviderAuthLogs table | > | Microsoft.OperationalInsights/workspaces/query/AgriFoodSatelliteLogs/read | Read data from the AgriFoodSatelliteLogs table |+> | Microsoft.OperationalInsights/workspaces/query/AgriFoodSensorManagementLogs/read | Read data from the AgriFoodSensorManagementLogs table | > | Microsoft.OperationalInsights/workspaces/query/AgriFoodWeatherLogs/read | Read data from the AgriFoodWeatherLogs table | > | Microsoft.OperationalInsights/workspaces/query/AGSGrafanaLoginEvents/read | Read data from the AGSGrafanaLoginEvents table | > | Microsoft.OperationalInsights/workspaces/query/AirflowDagProcessingLogs/read | Read data from the AirflowDagProcessingLogs table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/AppPageViews/read | Read data from the AppPageViews table | > | Microsoft.OperationalInsights/workspaces/query/AppPerformanceCounters/read | Read data from the AppPerformanceCounters table | > | Microsoft.OperationalInsights/workspaces/query/AppPlatformBuildLogs/read | Read data from the AppPlatformBuildLogs table |+> | Microsoft.OperationalInsights/workspaces/query/AppPlatformContainerEventLogs/read | Read data from the AppPlatformContainerEventLogs table | > | Microsoft.OperationalInsights/workspaces/query/AppPlatformIngressLogs/read | Read data from the AppPlatformIngressLogs table | > | Microsoft.OperationalInsights/workspaces/query/AppPlatformLogsforSpring/read | Read data from the AppPlatformLogsforSpring table | > | Microsoft.OperationalInsights/workspaces/query/AppPlatformSystemLogs/read | Read data from the AppPlatformSystemLogs table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/AWSCloudTrail/read | Read data from the AWSCloudTrail table | > | Microsoft.OperationalInsights/workspaces/query/AWSGuardDuty/read | Read data from the AWSGuardDuty table | > | Microsoft.OperationalInsights/workspaces/query/AWSVPCFlow/read | Read data from the AWSVPCFlow table |+> | Microsoft.OperationalInsights/workspaces/query/AZFWApplicationRule/read | Read data from the AZFWApplicationRule table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWApplicationRuleAggregation/read | Read data from the AZFWApplicationRuleAggregation table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWDnsQuery/read | Read data from the AZFWDnsQuery table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWIdpsSignature/read | Read data from the AZFWIdpsSignature table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWInternalFqdnResolutionFailure/read | Read data from the AZFWInternalFqdnResolutionFailure table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWNatRule/read | Read data from the AZFWNatRule table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWNatRuleAggregation/read | Read data from the AZFWNatRuleAggregation table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWNetworkRule/read | Read data from the AZFWNetworkRule table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWNetworkRuleAggregation/read | Read data from the AZFWNetworkRuleAggregation table | +> | Microsoft.OperationalInsights/workspaces/query/AZFWThreatIntel/read | Read data from the AZFWThreatIntel table | > | Microsoft.OperationalInsights/workspaces/query/AzureActivity/read | Read data from the AzureActivity table | > | Microsoft.OperationalInsights/workspaces/query/AzureActivityV2/read | Read data from the AzureActivityV2 table | > | Microsoft.OperationalInsights/workspaces/query/AzureAssessmentRecommendation/read | Read data from the AzureAssessmentRecommendation table |+> | Microsoft.OperationalInsights/workspaces/query/AzureAttestationDiagnostics/read | Read data from the AzureAttestationDiagnostics table | > | Microsoft.OperationalInsights/workspaces/query/AzureDevOpsAuditing/read | Read data from the AzureDevOpsAuditing table | > | Microsoft.OperationalInsights/workspaces/query/AzureDiagnostics/read | Read data from the AzureDiagnostics table |+> | Microsoft.OperationalInsights/workspaces/query/AzureLoadTestingOperation/read | Read data from the AzureLoadTestingOperation table | > | Microsoft.OperationalInsights/workspaces/query/AzureMetrics/read | Read data from the AzureMetrics table | > | Microsoft.OperationalInsights/workspaces/query/BaiClusterNodeEvent/read | Read data from the BaiClusterNodeEvent table | > | Microsoft.OperationalInsights/workspaces/query/BaiJobEvent/read | Read data from the BaiJobEvent table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/NWConnectionMonitorDNSResult/read | Read data from the NWConnectionMonitorDNSResult table | > | Microsoft.OperationalInsights/workspaces/query/NWConnectionMonitorPathResult/read | Read data from the NWConnectionMonitorPathResult table | > | Microsoft.OperationalInsights/workspaces/query/NWConnectionMonitorTestResult/read | Read data from the NWConnectionMonitorTestResult table |+> | Microsoft.OperationalInsights/workspaces/query/OEPAirFlowTask/read | Read data from the OEPAirFlowTask table | > | Microsoft.OperationalInsights/workspaces/query/OfficeActivity/read | Read data from the OfficeActivity table | > | Microsoft.OperationalInsights/workspaces/query/OLPSupplyChainEntityOperations/read | Read data from the OLPSupplyChainEntityOperations table |+> | Microsoft.OperationalInsights/workspaces/query/OLPSupplyChainEvents/read | Read data from the OLPSupplyChainEvents table | > | Microsoft.OperationalInsights/workspaces/query/Operation/read | Read data from the Operation table | > | Microsoft.OperationalInsights/workspaces/query/Perf/read | Read data from the Perf table | > | Microsoft.OperationalInsights/workspaces/query/PowerBIActivity/read | Read data from the PowerBIActivity table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/SecurityNestedRecommendation/read | Read data from the SecurityNestedRecommendation table | > | Microsoft.OperationalInsights/workspaces/query/SecurityRecommendation/read | Read data from the SecurityRecommendation table | > | Microsoft.OperationalInsights/workspaces/query/SecurityRegulatoryCompliance/read | Read data from the SecurityRegulatoryCompliance table |+> | Microsoft.OperationalInsights/workspaces/query/SentinelAudit/read | Read data from the SentinelAudit table | > | Microsoft.OperationalInsights/workspaces/query/SentinelHealth/read | Read data from the SentinelHealth table | > | Microsoft.OperationalInsights/workspaces/query/ServiceFabricOperationalEvent/read | Read data from the ServiceFabricOperationalEvent table | > | Microsoft.OperationalInsights/workspaces/query/ServiceFabricReliableActorEvent/read | Read data from the ServiceFabricReliableActorEvent table | Azure service: [Azure Monitor](../azure-monitor/index.yml) > | Microsoft.OperationalInsights/workspaces/query/Usage/read | Read data from the Usage table | > | Microsoft.OperationalInsights/workspaces/query/UserAccessAnalytics/read | Read data from the UserAccessAnalytics table | > | Microsoft.OperationalInsights/workspaces/query/UserPeerAnalytics/read | Read data from the UserPeerAnalytics table |+> | Microsoft.OperationalInsights/workspaces/query/VIAudit/read | Read data from the VIAudit table | > | Microsoft.OperationalInsights/workspaces/query/VMBoundPort/read | Read data from the VMBoundPort table | > | Microsoft.OperationalInsights/workspaces/query/VMComputer/read | Read data from the VMComputer table | > | Microsoft.OperationalInsights/workspaces/query/VMConnection/read | Read data from the VMConnection table | Azure service: [Cost Management](../cost-management-billing/index.yml) > | Microsoft.Consumption/operationstatus/read | List operationstatus | > | Microsoft.Consumption/pricesheets/read | List the Pricesheets data for a subscription or a management group. | > | Microsoft.Consumption/reservationDetails/read | List the utilization details for reserved instances by reservation order or management groups. The details data is per instance per day level. |+> | Microsoft.Consumption/reservationRecommendationDetails/read | List Reservation Recommendation Details | > | Microsoft.Consumption/reservationRecommendations/read | List single or shared recommendations for Reserved instances for a subscription. | > | Microsoft.Consumption/reservationSummaries/read | List the utilization summary for reserved instances by reservation order or management groups. The summary data is either at monthly or daily level. | > | Microsoft.Consumption/reservationTransactions/read | List the transaction history for reserved instances by management groups. | Azure service: Microsoft.DataProtection > | Microsoft.DataProtection/operations/read | Operation returns the list of Operations for a Resource Provider | > | Microsoft.DataProtection/subscriptions/providers/locations/checkFeatureSupport/action | Validates if a feature is supported | > | Microsoft.DataProtection/subscriptions/providers/resourceGuards/read | Gets list of ResourceGuards in a Subscription |-> | Microsoft.DataProtection/subscriptions/resourceGroups/providers/operationStatus/read | Returns Backup Operation Status for Backup Vault. | +> | Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/operationStatus/read | Returns Backup Operation Status for Backup Vault. | > | Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write | Create ResourceGuard operation creates an Azure resource of type 'ResourceGuard' | > | Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read | The Get ResourceGuard operation gets an object representing the Azure resource of type 'ResourceGuard' | > | Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete | The Delete ResourceGuard operation deletes the specified Azure resource of type 'ResourceGuard' | Azure service: [Azure Arc](../azure-arc/index.yml) > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnectionProxies/write | Writes an Azure Arc privateEndpointConnectionProxies | > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnectionProxies/delete | Deletes an Azure Arc privateEndpointConnectionProxies | > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnectionProxies/validate/action | Validates an Azure Arc privateEndpointConnectionProxies |+> | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnectionProxies/updatePrivateEndpointProperties/action | Updates an Azure Arc privateEndpointConnectionProxies with updated Private Endpoint details | > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read | Read any Azure Arc privateEndpointConnections | > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/write | Writes an Azure Arc privateEndpointConnections | > | Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/delete | Deletes an Azure Arc privateEndpointConnections | Azure service: [Site Recovery](../site-recovery/index.yml) > | Action | Description | > | | | > | Microsoft.RecoveryServices/register/action | Registers subscription for given Resource Provider |-> | Microsoft.RecoveryServices/Locations/backupCrossRegionRestore/action | Trigger Cross region restore. | -> | Microsoft.RecoveryServices/Locations/backupCrrJob/action | Get Cross Region Restore Job Details in the secondary region for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Locations/backupCrrJobs/action | List Cross Region Restore Jobs in the secondary region for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Locations/backupPreValidateProtection/action | | -> | Microsoft.RecoveryServices/Locations/backupStatus/action | Check Backup Status for Recovery Services Vaults | -> | Microsoft.RecoveryServices/Locations/backupValidateFeatures/action | Validate Features | +> | microsoft.recoveryservices/Locations/backupCrossRegionRestore/action | Trigger Cross region restore. | +> | microsoft.recoveryservices/Locations/backupCrrJob/action | Get Cross Region Restore Job Details in the secondary region for Recovery Services Vault. | +> | microsoft.recoveryservices/Locations/backupCrrJobs/action | List Cross Region Restore Jobs in the secondary region for Recovery Services Vault. | +> | microsoft.recoveryservices/Locations/backupPreValidateProtection/action | | +> | microsoft.recoveryservices/Locations/backupStatus/action | Check Backup Status for Recovery Services Vaults | +> | microsoft.recoveryservices/Locations/backupValidateFeatures/action | Validate Features | > | Microsoft.RecoveryServices/locations/allocateStamp/action | AllocateStamp is internal operation used by service | > | Microsoft.RecoveryServices/locations/checkNameAvailability/action | Check Resource Name Availability is an API to check if resource name is available | > | Microsoft.RecoveryServices/locations/allocatedStamp/read | GetAllocatedStamp is internal operation used by service |-> | Microsoft.RecoveryServices/Locations/backupAadProperties/read | Get AAD Properties for authentication in the third region for Cross Region Restore. | -> | Microsoft.RecoveryServices/Locations/backupCrrOperationResults/read | Returns CRR Operation Result for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Locations/backupCrrOperationsStatus/read | Returns CRR Operation Status for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Locations/backupProtectedItem/write | Create a backup Protected Item | -> | Microsoft.RecoveryServices/Locations/backupProtectedItems/read | Returns the list of all Protected Items. | +> | microsoft.recoveryservices/Locations/backupAadProperties/read | Get AAD Properties for authentication in the third region for Cross Region Restore. | +> | microsoft.recoveryservices/Locations/backupCrrOperationResults/read | Returns CRR Operation Result for Recovery Services Vault. | +> | microsoft.recoveryservices/Locations/backupCrrOperationsStatus/read | Returns CRR Operation Status for Recovery Services Vault. | +> | microsoft.recoveryservices/Locations/backupProtectedItem/write | Create a backup Protected Item | +> | microsoft.recoveryservices/Locations/backupProtectedItems/read | Returns the list of all Protected Items. | > | Microsoft.RecoveryServices/locations/operationStatus/read | Gets Operation Status for a given Operation | > | Microsoft.RecoveryServices/operations/read | Operation returns the list of Operations for a Resource Provider |-> | Microsoft.RecoveryServices/Vaults/backupJobsExport/action | Export Jobs | -> | Microsoft.RecoveryServices/Vaults/backupSecurityPIN/action | Returns Security PIN Information for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action | Validate Operation on Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupValidateOperation/action | Validate Operation on Protected Item | +> | microsoft.recoveryservices/Vaults/backupJobsExport/action | Export Jobs | +> | microsoft.recoveryservices/Vaults/backupSecurityPIN/action | Returns Security PIN Information for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupTriggerValidateOperation/action | Validate Operation on Protected Item | +> | microsoft.recoveryservices/Vaults/backupValidateOperation/action | Validate Operation on Protected Item | > | Microsoft.RecoveryServices/Vaults/write | Create Vault operation creates an Azure resource of type 'vault' | > | Microsoft.RecoveryServices/Vaults/read | The Get Vault operation gets an object representing the Azure resource of type 'vault' | > | Microsoft.RecoveryServices/Vaults/delete | The Delete Vault operation deletes the specified Azure resource of type 'vault' |-> | Microsoft.RecoveryServices/Vaults/backupconfig/read | Returns Configuration for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupconfig/write | Updates Configuration for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupEncryptionConfigs/read | Gets Backup Resource Encryption Configuration. | -> | Microsoft.RecoveryServices/Vaults/backupEncryptionConfigs/write | Updates Backup Resource Encryption Configuration | -> | Microsoft.RecoveryServices/Vaults/backupEngines/read | Returns all the backup management servers registered with vault. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action | Refreshes the container list | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/delete | Delete a backup Protection Intent | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read | Get a backup Protection Intent | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write | Create a backup Protection Intent | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read | Returns status of the operation | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read | Returns status of the operation | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read | Get all protectable containers | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete | Deletes the registered Container | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action | Do inquiry for workloads within a container | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read | Returns all registered containers | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write | Creates a registered container | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read | Get all items in a container | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read | Gets result of Operation performed on Protection Container. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationsStatus/read | Gets status of Operation performed on Protection Container. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action | Performs Backup for Protected Item. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/delete | Deletes Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read | Returns object details of the Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPointsRecommendedForMove/action | Get Recovery points recommended for move to another tier | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write | Create a backup Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read | Gets Result of Operation Performed on Protected Items. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read | Returns the status of Operation performed on Protected Items. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action | Get AccessToken for Cross Region Restore. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/move/action | Move Recovery point to another tier | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action | Provision Instant Item Recovery for Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read | Get Recovery Points for Protected Items. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action | Restore Recovery Points for Protected Items. | -> | Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action | Revoke Instant Item Recovery for Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupJobs/cancel/action | Cancel the Job | -> | Microsoft.RecoveryServices/Vaults/backupJobs/read | Returns all Job Objects | -> | Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read | Returns the Result of Job Operation. | -> | Microsoft.RecoveryServices/Vaults/backupJobs/operationsStatus/read | Returns the status of Job Operation. | -> | Microsoft.RecoveryServices/Vaults/backupOperationResults/read | Returns Backup Operation Result for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupOperations/read | Returns Backup Operation Status for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupPolicies/delete | Delete a Protection Policy | -> | Microsoft.RecoveryServices/Vaults/backupPolicies/read | Returns all Protection Policies | -> | Microsoft.RecoveryServices/Vaults/backupPolicies/write | Creates Protection Policy | -> | Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read | Get Results of Policy Operation. | -> | Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read | Get Status of Policy Operation. | -> | Microsoft.RecoveryServices/Vaults/backupProtectableItems/read | Returns list of all Protectable Items. | -> | Microsoft.RecoveryServices/Vaults/backupProtectedItems/read | Returns the list of all Protected Items. | -> | Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read | Returns all containers belonging to the subscription | -> | Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read | List all backup Protection Intents | -> | Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete | The Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy' | -> | Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read | Get the list of ResourceGuard proxies for a resource | -> | Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read | Get ResourceGuard proxy operation gets an object representing the Azure resource of type 'ResourceGuard proxy' | -> | Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action | Unlock delete ResourceGuard proxy operation unlocks the next delete critical operation | -> | Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write | Create ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy' | -> | Microsoft.RecoveryServices/Vaults/backupstorageconfig/read | Returns Storage Configuration for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupstorageconfig/write | Updates Storage Configuration for Recovery Services Vault. | -> | Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read | Returns summaries for Protected Items and Protected Servers for a Recovery Services . | -> | Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read | Validate Operation on Protected Item | -> | Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read | Validate Operation on Protected Item | +> | microsoft.recoveryservices/Vaults/backupconfig/read | Returns Configuration for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupconfig/write | Updates Configuration for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupEncryptionConfigs/read | Gets Backup Resource Encryption Configuration. | +> | microsoft.recoveryservices/Vaults/backupEncryptionConfigs/write | Updates Backup Resource Encryption Configuration | +> | microsoft.recoveryservices/Vaults/backupEngines/read | Returns all the backup management servers registered with vault. | +> | microsoft.recoveryservices/Vaults/backupFabrics/refreshContainers/action | Refreshes the container list | +> | microsoft.recoveryservices/Vaults/backupFabrics/backupProtectionIntent/delete | Delete a backup Protection Intent | +> | microsoft.recoveryservices/Vaults/backupFabrics/backupProtectionIntent/read | Get a backup Protection Intent | +> | microsoft.recoveryservices/Vaults/backupFabrics/backupProtectionIntent/write | Create a backup Protection Intent | +> | microsoft.recoveryservices/Vaults/backupFabrics/operationResults/read | Returns status of the operation | +> | microsoft.recoveryservices/Vaults/backupFabrics/operationsStatus/read | Returns status of the operation | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectableContainers/read | Get all protectable containers | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/delete | Deletes the registered Container | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/inquire/action | Do inquiry for workloads within a container | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/read | Returns all registered containers | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/write | Creates a registered container | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/items/read | Get all items in a container | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/operationResults/read | Gets result of Operation performed on Protection Container. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/operationsStatus/read | Gets status of Operation performed on Protection Container. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action | Performs Backup for Protected Item. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/delete | Deletes Protected Item | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/read | Returns object details of the Protected Item | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPointsRecommendedForMove/action | Get Recovery points recommended for move to another tier | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/write | Create a backup Protected Item | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read | Gets Result of Operation Performed on Protected Items. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read | Returns the status of Operation performed on Protected Items. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action | Get AccessToken for Cross Region Restore. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/move/action | Move Recovery point to another tier | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action | Provision Instant Item Recovery for Protected Item | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read | Get Recovery Points for Protected Items. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action | Restore Recovery Points for Protected Items. | +> | microsoft.recoveryservices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action | Revoke Instant Item Recovery for Protected Item | +> | microsoft.recoveryservices/Vaults/backupJobs/cancel/action | Cancel the Job | +> | microsoft.recoveryservices/Vaults/backupJobs/read | Returns all Job Objects | +> | microsoft.recoveryservices/Vaults/backupJobs/operationResults/read | Returns the Result of Job Operation. | +> | microsoft.recoveryservices/Vaults/backupJobs/operationsStatus/read | Returns the status of Job Operation. | +> | microsoft.recoveryservices/Vaults/backupOperationResults/read | Returns Backup Operation Result for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupOperations/read | Returns Backup Operation Status for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupPolicies/delete | Delete a Protection Policy | +> | microsoft.recoveryservices/Vaults/backupPolicies/read | Returns all Protection Policies | +> | microsoft.recoveryservices/Vaults/backupPolicies/write | Creates Protection Policy | +> | microsoft.recoveryservices/Vaults/backupPolicies/operationResults/read | Get Results of Policy Operation. | +> | microsoft.recoveryservices/Vaults/backupPolicies/operations/read | Get Status of Policy Operation. | +> | microsoft.recoveryservices/Vaults/backupProtectableItems/read | Returns list of all Protectable Items. | +> | microsoft.recoveryservices/Vaults/backupProtectedItems/read | Returns the list of all Protected Items. | +> | microsoft.recoveryservices/Vaults/backupProtectionContainers/read | Returns all containers belonging to the subscription | +> | microsoft.recoveryservices/Vaults/backupProtectionIntents/read | List all backup Protection Intents | +> | microsoft.recoveryservices/Vaults/backupResourceGuardProxies/delete | The Delete ResourceGuard proxy operation deletes the specified Azure resource of type 'ResourceGuard proxy' | +> | microsoft.recoveryservices/Vaults/backupResourceGuardProxies/read | Get the list of ResourceGuard proxies for a resource | +> | microsoft.recoveryservices/Vaults/backupResourceGuardProxies/read | Get ResourceGuard proxy operation gets an object representing the Azure resource of type 'ResourceGuard proxy' | +> | microsoft.recoveryservices/Vaults/backupResourceGuardProxies/unlockDelete/action | Unlock delete ResourceGuard proxy operation unlocks the next delete critical operation | +> | microsoft.recoveryservices/Vaults/backupResourceGuardProxies/write | Create ResourceGuard proxy operation creates an Azure resource of type 'ResourceGuard Proxy' | +> | microsoft.recoveryservices/Vaults/backupstorageconfig/read | Returns Storage Configuration for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupstorageconfig/write | Updates Storage Configuration for Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/backupUsageSummaries/read | Returns summaries for Protected Items and Protected Servers for a Recovery Services . | +> | microsoft.recoveryservices/Vaults/backupValidateOperationResults/read | Validate Operation on Protected Item | +> | microsoft.recoveryservices/Vaults/backupValidateOperationsStatuses/read | Validate Operation on Protected Item | > | Microsoft.RecoveryServices/Vaults/certificates/write | The Update Resource Certificate operation updates the resource/vault credential certificate. | > | Microsoft.RecoveryServices/Vaults/extendedInformation/read | The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault? | > | Microsoft.RecoveryServices/Vaults/extendedInformation/write | The Get Extended Info operation gets an object's Extended Info representing the Azure resource of type ?vault? | Azure service: [Site Recovery](../site-recovery/index.yml) > | Microsoft.RecoveryServices/Vaults/monitoringAlerts/write | Resolves the alert. | > | Microsoft.RecoveryServices/Vaults/monitoringConfigurations/read | Gets the Recovery services vault notification configuration. | > | Microsoft.RecoveryServices/Vaults/monitoringConfigurations/write | Configures e-mail notifications to Recovery services vault. |-> | Microsoft.RecoveryServices/Vaults/privateEndpointConnectionProxies/delete | Wait for a few minutes and then try the operation again. If the issue persists, please contact Microsoft support. | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnectionProxies/read | Get all protectable containers | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnectionProxies/validate/action | Get all protectable containers | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnectionProxies/write | Get all protectable containers | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnectionProxies/operationsStatus/read | Get all protectable containers | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnections/delete | Delete Private Endpoint requests. This call is made by Backup Admin. | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnections/write | Approve or Reject Private Endpoint requests. This call is made by Backup Admin. | -> | Microsoft.RecoveryServices/Vaults/privateEndpointConnections/operationsStatus/read | Returns the operation status for a private endpoint connection. | +> | microsoft.recoveryservices/Vaults/privateEndpointConnectionProxies/delete | Wait for a few minutes and then try the operation again. If the issue persists, please contact Microsoft support. | +> | microsoft.recoveryservices/Vaults/privateEndpointConnectionProxies/read | Get all protectable containers | +> | microsoft.recoveryservices/Vaults/privateEndpointConnectionProxies/validate/action | Get all protectable containers | +> | microsoft.recoveryservices/Vaults/privateEndpointConnectionProxies/write | Get all protectable containers | +> | microsoft.recoveryservices/Vaults/privateEndpointConnectionProxies/operationsStatus/read | Get all protectable containers | +> | microsoft.recoveryservices/Vaults/privateEndpointConnections/delete | Delete Private Endpoint requests. This call is made by Backup Admin. | +> | microsoft.recoveryservices/Vaults/privateEndpointConnections/write | Approve or Reject Private Endpoint requests. This call is made by Backup Admin. | +> | microsoft.recoveryservices/Vaults/privateEndpointConnections/operationsStatus/read | Returns the operation status for a private endpoint connection. | > | Microsoft.RecoveryServices/Vaults/providers/Microsoft.Insights/diagnosticSettings/read | Azure Backup Diagnostics | > | Microsoft.RecoveryServices/Vaults/providers/Microsoft.Insights/diagnosticSettings/write | Azure Backup Diagnostics | > | Microsoft.RecoveryServices/Vaults/providers/Microsoft.Insights/logDefinitions/read | Azure Backup Logs | Azure service: [Site Recovery](../site-recovery/index.yml) > | Microsoft.RecoveryServices/vaults/replicationVaultSettings/read | Read any | > | Microsoft.RecoveryServices/vaults/replicationVaultSettings/write | Create or Update any | > | Microsoft.RecoveryServices/vaults/replicationvCenters/read | Read any vCenters |-> | Microsoft.RecoveryServices/Vaults/usages/read | Returns usage details for a Recovery Services Vault. | +> | microsoft.recoveryservices/Vaults/usages/read | Returns usage details for a Recovery Services Vault. | > | Microsoft.RecoveryServices/vaults/usages/read | Read any Vault Usages | > | Microsoft.RecoveryServices/Vaults/vaultTokens/read | The Vault Token operation can be used to get Vault Token for vault level backend operations. | Azure service: [Azure Resource Manager](../azure-resource-manager/index.yml) > | Microsoft.Resources/templateSpecs/versions/delete | Deletes a template spec version | > | Microsoft.Resources/tenants/read | Gets the list of tenants. | -### Microsoft.Scheduler --Azure service: [Scheduler](../scheduler/index.yml) --> [!div class="mx-tableFixed"] -> | Action | Description | -> | | | -> | Microsoft.Scheduler/jobcollections/read | Get Job Collection | -> | Microsoft.Scheduler/jobcollections/write | Creates or updates job collection. | -> | Microsoft.Scheduler/jobcollections/delete | Deletes job collection. | -> | Microsoft.Scheduler/jobcollections/enable/action | Enables job collection. | -> | Microsoft.Scheduler/jobcollections/disable/action | Disables job collection. | -> | Microsoft.Scheduler/jobcollections/jobs/read | Gets job. | -> | Microsoft.Scheduler/jobcollections/jobs/write | Creates or updates job. | -> | Microsoft.Scheduler/jobcollections/jobs/delete | Deletes job. | -> | Microsoft.Scheduler/jobcollections/jobs/run/action | Runs job. | -> | Microsoft.Scheduler/jobcollections/jobs/generateLogicAppDefinition/action | Generates Logic App definition based on a Scheduler Job. | -> | Microsoft.Scheduler/jobcollections/jobs/jobhistories/read | Gets job history. | - ### Microsoft.Solutions Azure service: [Azure Managed Applications](../azure-resource-manager/managed-applications/index.yml) |
| role-based-access-control | Transfer Subscription | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/transfer-subscription.md | Several Azure resources have a dependency on a subscription or a directory. Depe | System-assigned managed identities | Yes | Yes | [List managed identities](#list-role-assignments-for-managed-identities) | You must disable and re-enable the managed identities. You must re-create the role assignments. | | User-assigned managed identities | Yes | Yes | [List managed identities](#list-role-assignments-for-managed-identities) | You must delete, re-create, and attach the managed identities to the appropriate resource. You must re-create the role assignments. | | Azure Key Vault | Yes | Yes | [List Key Vault access policies](#list-key-vaults) | You must update the tenant ID associated with the key vaults. You must remove and add new access policies. |-| Azure SQL databases with Azure AD authentication integration enabled | Yes | No | [Check Azure SQL databases with Azure AD authentication](#list-azure-sql-databases-with-azure-ad-authentication) | You cannot transfer an Azure SQL database with Azure AD authentication enabled to a different directory. For more information, see [Use Azure Active Directory authentication](../azure-sql/database/authentication-aad-overview.md). | +| Azure SQL databases with Azure AD authentication integration enabled | Yes | No | [Check Azure SQL databases with Azure AD authentication](#list-azure-sql-databases-with-azure-ad-authentication) | You cannot transfer an Azure SQL database with Azure AD authentication enabled to a different directory. For more information, see [Use Azure Active Directory authentication](/azure/azure-sql/database/authentication-aad-overview). | | Azure Storage and Azure Data Lake Storage Gen2 | Yes | Yes | | You must re-create any ACLs. | | Azure Data Lake Storage Gen1 | Yes | Yes | | You must re-create any ACLs. | | Azure Files | Yes | Yes | | You must re-create any ACLs. | When you create a key vault, it is automatically tied to the default Azure Activ ### List Azure SQL databases with Azure AD authentication -- Use [az sql server ad-admin list](/cli/azure/sql/server/ad-admin#az-sql-server-ad-admin-list) and the [az graph](/cli/azure/graph) extension to see if you are using Azure SQL databases with Azure AD authentication integration enabled. For more information, see [Configure and manage Azure Active Directory authentication with SQL](../azure-sql/database/authentication-aad-configure.md).+- Use [az sql server ad-admin list](/cli/azure/sql/server/ad-admin#az-sql-server-ad-admin-list) and the [az graph](/cli/azure/graph) extension to see if you are using Azure SQL databases with Azure AD authentication integration enabled. For more information, see [Configure and manage Azure Active Directory authentication with SQL](/azure/azure-sql/database/authentication-aad-configure). ```azurecli az sql server ad-admin list --ids $(az graph query -q 'resources | where type == "microsoft.sql/servers" | project id' -o tsv | cut -f1) |
| search | Search Howto Connecting Azure Sql Database To Azure Search Using Indexers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-howto-connecting-azure-sql-database-to-azure-search-using-indexers.md | This article supplements [**Create an indexer**](search-howto-create-indexers.md ## Prerequisites -+ An [Azure SQL database](../azure-sql/database/sql-database-paas-overview.md) with data in a single table or view. Use a table if you want the ability to [index incremental updates](#CaptureChangedRows) using SQL's native change detection capabilities. ++ An [Azure SQL database](/azure/azure-sql/database/sql-database-paas-overview) with data in a single table or view. Use a table if you want the ability to [index incremental updates](#CaptureChangedRows) using SQL's native change detection capabilities. + Read permissions. Azure Cognitive Search supports SQL Server authentication, where the user name and password are provided on the connection string. Alternatively, you can [set up a managed identity and use Azure roles](search-howto-managed-identities-sql.md) to omit credentials on the connection. Yes. However, you need to allow your search service to connect to your database. Not directly. We do not recommend or support a direct connection, as doing so would require you to open your databases to Internet traffic. Customers have succeeded with this scenario using bridge technologies like Azure Data Factory. For more information, see [Push data to an Azure Cognitive Search index using Azure Data Factory](../data-factory/v1/data-factory-azure-search-connector.md). -**Q: Can I use a secondary replica in a [failover cluster](../azure-sql/database/auto-failover-group-overview.md) as a data source?** +**Q: Can I use a secondary replica in a [failover cluster](/azure/azure-sql/database/auto-failover-group-overview) as a data source?** It depends. For full indexing of a table or view, you can use a secondary replica. |
| search | Search Howto Connecting Azure Sql Iaas To Azure Search Using Indexers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-howto-connecting-azure-sql-iaas-to-azure-search-using-indexers.md | Azure Cognitive Search requires an encrypted channel for all indexer requests ov After you set up the encrypted connection required by Azure Cognitive Search, there are additional configuration steps intrinsic to SQL Server on Azure VMs. If you haven't done so already, the next step is to finish configuration using either one of these articles: -+ For a **Resource Manager** VM, see [Connect to a SQL Server Virtual Machine on Azure using Resource Manager](../azure-sql/virtual-machines/windows/ways-to-connect-to-sql.md). ++ For a **Resource Manager** VM, see [Connect to a SQL Server Virtual Machine on Azure using Resource Manager](/azure/azure-sql/virtual-machines/windows/ways-to-connect-to-sql). + For a **Classic** VM, see [Connect to a SQL Server Virtual Machine on Azure Classic](/previous-versions/azure/virtual-machines/windows/sqlclassic/virtual-machines-windows-classic-sql-connect). |
| search | Search Howto Connecting Azure Sql Mi To Azure Search Using Indexers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-howto-connecting-azure-sql-mi-to-azure-search-using-indexers.md | Last updated 03/10/2022 If you are setting up an [Azure SQL indexer](search-howto-connecting-azure-sql-database-to-azure-search-using-indexers.md) that connects to an Azure SQL managed instance, you'll need to enable a public endpoint on the managed instance as a prerequisite. By default, an indexer connects to a managed instance over a public endpoint. -This article provides basic steps that include collecting information necessary for data source configuration. For more information and methodologies, see [Configure public endpoint in Azure SQL Managed Instance](../azure-sql/managed-instance/public-endpoint-configure.md). +This article provides basic steps that include collecting information necessary for data source configuration. For more information and methodologies, see [Configure public endpoint in Azure SQL Managed Instance](/azure/azure-sql/managed-instance/public-endpoint-configure). ## Enable a public endpoint |
| search | Search Howto Managed Identities Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-howto-managed-identities-sql.md | Before learning more about this feature, it is recommended that you have an unde * Azure AD admin role on SQL: - To assign read permissions on the database, you must be an Azure AD admin with a server in SQL Database or SQL Managed Instance. See [Configure and manage Azure AD authentication with Azure SQL](../azure-sql/database/authentication-aad-configure.md) and follow the steps to provision an Azure AD admin. + To assign read permissions on the database, you must be an Azure AD admin with a server in SQL Database or SQL Managed Instance. See [Configure and manage Azure AD authentication with Azure SQL](/azure/azure-sql/database/authentication-aad-configure) and follow the steps to provision an Azure AD admin. ## 1 - Assign permissions to read the database |
| search | Search Indexer Howto Access Ip Restricted | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-indexer-howto-access-ip-restricted.md | It can take five to ten minutes for the firewall rules to be updated, after whic - [Configure Azure Storage firewalls](../storage/common/storage-network-security.md) - [Configure IP firewall for Cosmos DB](../cosmos-db/how-to-configure-firewall.md)-- [Configure IP firewall for Azure SQL Server](../azure-sql/database/firewall-configure.md)+- [Configure IP firewall for Azure SQL Server](/azure/azure-sql/database/firewall-configure) |
| search | Search Indexer Troubleshooting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-indexer-troubleshooting.md | Details for configuring IP address range restrictions for each data source type * [Cosmos DB](../storage/common/storage-network-security.md#grant-access-from-an-internet-ip-range) -* [Azure SQL](../azure-sql/database/firewall-configure.md#create-and-manage-ip-firewall-rules) +* [Azure SQL](/azure/azure-sql/database/firewall-configure#create-and-manage-ip-firewall-rules) **Limitation**: As stated in the documentation above for Azure Storage, IP address range restrictions will only work if your search service and your storage account are in different regions. More details for accessing data in a SQL managed instance are outlined [here](se ## Azure SQL Database serverless indexing (error code 40613) -If your SQL database is on a [serverless compute tier](../azure-sql/database/serverless-tier-overview.md), make sure that the database is running (and not paused) when the indexer connects to it. +If your SQL database is on a [serverless compute tier](/azure/azure-sql/database/serverless-tier-overview), make sure that the database is running (and not paused) when the indexer connects to it. If the database is paused, the first login from your search service will auto-resume the database, but it will also return an error stating that the database is unavailable with error code 40613. After the database is running, retry the login to establish connectivity. |
| search | Search Security Rbac | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/search/search-security-rbac.md | Per-user access over search results (sometimes referred to as row-level security ## Built-in roles used in Search -Built-in roles include generally available and preview roles. +Built-in roles include generally available and preview roles. If these roles are insufficient, [create a custom role](#create-a-custom-role) instead. | Role | Description and availability | | - | - | In PowerShell, use [New-AzRoleAssignment](/powershell/module/az.resources/new-az If [built-in roles](#built-in-roles-used-in-search) don't provide the right combination of permissions, you can create a [custom role](../role-based-access-control/custom-roles.md) to support the operations you require -For example, you might want to augment a query execution (reader role) to include listing indexes by name. Normally, listing the indexes on a search service is considered an administrative right. +This example clones **Search Index Data Reader** and then adds the ability to list indexes by name. Normally, listing the indexes on a search service is considered an administrative right. ### [**Azure portal**](#tab/custom-role-portal) |
| security | Threat Modeling Tool Auditing And Logging | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/develop/threat-modeling-tool-auditing-and-logging.md | -| **References** | [Get Started with SQL Database Threat Detection](../../azure-sql/database/threat-detection-configure.md)| +| **References** | [Get Started with SQL Database Threat Detection](/azure/azure-sql/database/threat-detection-configure)| | **Steps** |<p>Threat Detection detects anomalous database activities indicating potential security threats to the database. It provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities.</p><p>Users can explore the suspicious events using Azure SQL Database Auditing to determine if they result from an attempt to access, breach or exploit data in the database.</p><p>Threat Detection makes it simple to address potential threats to the database without the need to be a security expert or manage advanced security monitoring systems</p>| ## <a id="analytics"></a>Use Azure Storage Analytics to audit access of Azure Storage |
| security | Threat Modeling Tool Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/develop/threat-modeling-tool-authentication.md | -| **References** | [Connecting to SQL Database By Using Azure Active Directory Authentication](../../azure-sql/database/authentication-aad-overview.md) | +| **References** | [Connecting to SQL Database By Using Azure Active Directory Authentication](/azure/azure-sql/database/authentication-aad-overview) | | **Steps** | **Minimum version:** Azure SQL Database V12 required to allow Azure SQL Database to use AAD Authentication against the Microsoft Directory | ## <a id="authn-account-pword"></a>When SQL authentication mode is used, ensure that account and password policy are enforced on SQL server |
| security | Threat Modeling Tool Configuration Management | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/develop/threat-modeling-tool-configuration-management.md | this.Response.Headers["X-Content-Type-Options"] = "nosniff"; | **SDL Phase** | Build | | **Applicable Technologies** | SQL Azure, OnPrem | | **Attributes** | N/A, SQL Version - V12 |-| **References** | [How to configure an Azure SQL Database firewall](../../azure-sql/database/firewall-configure.md), [Configure a Windows Firewall for Database Engine Access](/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access) | +| **References** | [How to configure an Azure SQL Database firewall](/azure/azure-sql/database/firewall-configure), [Configure a Windows Firewall for Database Engine Access](/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access) | | **Steps** | Firewall systems help prevent unauthorized access to computer resources. To access an instance of the SQL Server Database Engine through a firewall, you must configure the firewall on the computer running SQL Server to allow access | ## <a id="cors-api"></a>Ensure that only trusted origins are allowed if CORS is enabled on ASP.NET Web API |
| security | Best Practices And Patterns | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/best-practices-and-patterns.md | The articles below contain security best practices to use when youΓÇÖre designin The best practices are intended to be a resource for IT pros. This might include designers, architects, developers, and testers who build and deploy secure Azure solutions. * [Azure boundary security best practices](./network-best-practices.md#adopt-a-zero-trust-approach)-* [Azure database security best practices](../../azure-sql/database/security-best-practice.md) +* [Azure database security best practices](/azure/azure-sql/database/security-best-practice) * [Azure data security and encryption best practices](data-encryption-best-practices.md) * [Azure identity management and access control security best practices](identity-management-best-practices.md) * [Azure network security best practices](network-best-practices.md) |
| security | Database Security Checklist | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/database-security-checklist.md | To help improve security, Azure Database includes a number of built-in security These include: -- A firewall that enables you to create [firewall rules](../../azure-sql/database/firewall-configure.md) limiting connectivity by IP address,+- A firewall that enables you to create [firewall rules](/azure/azure-sql/database/firewall-configure) limiting connectivity by IP address, - Server-level firewall accessible from the Azure portal - Database-level firewall rules accessible from SSMS - Secure connectivity to your database using secure connection strings These include: Cloud computing requires new security paradigms that are unfamiliar to many application users, database administrators, and programmers. As a result, some organizations are hesitant to implement a cloud infrastructure for data management due to perceived security risks. However, much of this concern can be alleviated through a better understanding of the security features built into Microsoft Azure and Microsoft Azure SQL Database. ## Checklist-We recommend that you read the [Azure Database Security Best Practices](../../azure-sql/database/security-best-practice.md) article prior to reviewing this checklist. You will be able to get the most out of this checklist after you understand the best practices. You can then use this checklist to make sure that you've addressed the important issues in Azure database security. +We recommend that you read the [Azure Database Security Best Practices](/azure/azure-sql/database/security-best-practice) article prior to reviewing this checklist. You will be able to get the most out of this checklist after you understand the best practices. You can then use this checklist to make sure that you've addressed the important issues in Azure database security. |Checklist Category| Description| | | -- | |**Protect Data**|| | <br> Encryption in Motion/Transit| <ul><li>[Transport Layer Security](/windows-server/security/tls/transport-layer-security-protocol), for data encryption when data is moving to the networks.</li><li>Database requires secure communication from clients based on the [TDS(Tabular Data Stream)](/openspecs/windows_protocols/ms-tds/893fcc7e-8a39-4b3c-815a-773b7b982c50) protocol over TLS (Transport Layer Security).</li></ul> |-|<br>Encryption at rest| <ul><li>[Transparent Data Encryption](../../azure-sql/database/transparent-data-encryption-tde-overview.md), when inactive data is stored physically in any digital form.</li></ul>| +|<br>Encryption at rest| <ul><li>[Transparent Data Encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview), when inactive data is stored physically in any digital form.</li></ul>| |**Control Access**|| -|<br> Database Access | <ul><li>[Authentication](../../azure-sql/database/logins-create-manage.md) (Azure Active Directory Authentication) AD authentication uses identities managed by Azure Active Directory.</li><li>[Authorization](../../azure-sql/database/logins-create-manage.md) grant users the least privileges necessary.</li></ul> | -|<br>Application Access| <ul><li>[Row level Security](/sql/relational-databases/security/row-level-security) (Using Security Policy, at the same time restricting row-level access based on a user's identity,role, or execution context).</li><li>[Dynamic Data Masking](../../azure-sql/database/dynamic-data-masking-overview.md) (Using Permission & Policy, limits sensitive data exposure by masking it to non-privileged users)</li></ul>| +|<br> Database Access | <ul><li>[Authentication](/azure/azure-sql/database/logins-create-manage) (Azure Active Directory Authentication) AD authentication uses identities managed by Azure Active Directory.</li><li>[Authorization](/azure/azure-sql/database/logins-create-manage) grant users the least privileges necessary.</li></ul> | +|<br>Application Access| <ul><li>[Row level Security](/sql/relational-databases/security/row-level-security) (Using Security Policy, at the same time restricting row-level access based on a user's identity,role, or execution context).</li><li>[Dynamic Data Masking](/azure/azure-sql/database/dynamic-data-masking-overview) (Using Permission & Policy, limits sensitive data exposure by masking it to non-privileged users)</li></ul>| |**Proactive Monitoring**|| -| <br>Tracking & Detecting| <ul><li>[Auditing](../../azure-sql/database/auditing-overview.md) tracks database events and writes them to an Audit log/ Activity log in your [Azure Storage account](../../storage/common/storage-account-create.md).</li><li>Track Azure Database health using [Azure Monitor Activity Logs](../../azure-monitor/essentials/platform-logs-overview.md).</li><li>[Threat Detection](../../azure-sql/database/threat-detection-configure.md) detects anomalous database activities indicating potential security threats to the database. </li></ul> | +| <br>Tracking & Detecting| <ul><li>[Auditing](/azure/azure-sql/database/auditing-overview) tracks database events and writes them to an Audit log/ Activity log in your [Azure Storage account](../../storage/common/storage-account-create.md).</li><li>Track Azure Database health using [Azure Monitor Activity Logs](../../azure-monitor/essentials/platform-logs-overview.md).</li><li>[Threat Detection](/azure/azure-sql/database/threat-detection-configure) detects anomalous database activities indicating potential security threats to the database. </li></ul> | |<br>Microsoft Defender for Cloud| <ul><li>[Data Monitoring](../../security-center/security-center-remediate-recommendations.md) Use Microsoft Defender for Cloud as a centralized security monitoring solution for SQL and other Azure services.</li></ul>| ## Conclusion Azure Database is a robust database platform, with a full range of security feat ## Next steps You can improve the protection of your database against malicious users or unauthorized access with just a few simple steps. In this tutorial you learn to: -- Set up [firewall rules](../../azure-sql/database/firewall-configure.md) for your server and or database.+- Set up [firewall rules](/azure/azure-sql/database/firewall-configure) for your server and or database. - Protect your data with [encryption](/sql/relational-databases/security/encryption/sql-server-encryption).-- Enable [SQL Database auditing](../../azure-sql/database/auditing-overview.md).+- Enable [SQL Database auditing](/azure/azure-sql/database/auditing-overview). |
| security | Encryption Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/encryption-overview.md | This article provides an overview of how encryption is used in Microsoft Azure. ## Encryption of data at rest -Data at rest includes information that resides in persistent storage on physical media, in any digital format. The media can include files on magnetic or optical media, archived data, and data backups. Microsoft Azure offers a variety of data storage solutions to meet different needs, including file, disk, blob, and table storage. Microsoft also provides encryption to protect [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md), [Azure Cosmos DB](../../cosmos-db/database-encryption-at-rest.md), and Azure Data Lake. +Data at rest includes information that resides in persistent storage on physical media, in any digital format. The media can include files on magnetic or optical media, archived data, and data backups. Microsoft Azure offers a variety of data storage solutions to meet different needs, including file, disk, blob, and table storage. Microsoft also provides encryption to protect [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview), [Azure Cosmos DB](../../cosmos-db/database-encryption-at-rest.md), and Azure Data Lake. Data encryption at rest is available for services across the software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS) cloud models. This article summarizes and provides resources to help you use the Azure encryption options. Finally, you can also use the Azure Storage Client Library for Java to perform c ### Encryption of data at rest with Azure SQL Database -[Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md) is a general-purpose relational database service in Azure that supports structures such as relational data, JSON, spatial, and XML. SQL Database supports both server-side encryption via the Transparent Data Encryption (TDE) feature and client-side encryption via the Always Encrypted feature. +[Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) is a general-purpose relational database service in Azure that supports structures such as relational data, JSON, spatial, and XML. SQL Database supports both server-side encryption via the Transparent Data Encryption (TDE) feature and client-side encryption via the Always Encrypted feature. #### Transparent Data Encryption -[TDE](/sql/relational-databases/security/encryption/transparent-data-encryption-tde) is used to encrypt [SQL Server](https://www.microsoft.com/sql-server/sql-server-2016), [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md), and [Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md) data files in real time, using a Database Encryption Key (DEK), which is stored in the database boot record for availability during recovery. +[TDE](/sql/relational-databases/security/encryption/transparent-data-encryption-tde) is used to encrypt [SQL Server](https://www.microsoft.com/sql-server/sql-server-2016), [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview), and [Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md) data files in real time, using a Database Encryption Key (DEK), which is stored in the database boot record for availability during recovery. TDE protects data and log files, using AES and Triple Data Encryption Standard (3DES) encryption algorithms. Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and are decrypted when theyΓÇÖre read into memory. TDE is now enabled by default on newly created Azure SQL databases. Key Vault relieves organizations of the need to configure, patch, and maintain h - [Azure security overview](./overview.md) - [Azure network security overview](network-overview.md)-- [Azure database security overview](../../azure-sql/database/security-overview.md)+- [Azure database security overview](/azure/azure-sql/database/security-overview) - [Azure virtual machines security overview](virtual-machines-overview.md) - [Data encryption at rest](encryption-atrest.md) - [Data security and encryption best practices](data-encryption-best-practices.md) |
| security | Isolation Choices | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/isolation-choices.md | SQL Database is a relational database service in the Microsoft cloud based on th ### SQL Database Application Model -[Microsoft SQL Database](../../azure-sql/database/single-database-create-quickstart.md) is a cloud-based relational database service built on SQL Server technologies. It provides a highly available, scalable, multi-tenant database service hosted by Microsoft in cloud. +[Microsoft SQL Database](/azure/azure-sql/database/single-database-create-quickstart) is a cloud-based relational database service built on SQL Server technologies. It provides a highly available, scalable, multi-tenant database service hosted by Microsoft in cloud. From an application perspective, SQL Database provides the following hierarchy: Each level has one-to-many containment of levels below. |
| security | Paas Applications Using Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/paas-applications-using-sql.md | -In this article, we discuss a collection of [Azure SQL Database](../../azure-sql/database/sql-database-paas-overview.md) and [Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md) security best practices for securing your platform-as-a-service (PaaS) web and mobile applications. These best practices are derived from our experience with Azure and the experiences of customers like yourself. +In this article, we discuss a collection of [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) and [Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md) security best practices for securing your platform-as-a-service (PaaS) web and mobile applications. These best practices are derived from our experience with Azure and the experiences of customers like yourself. Azure SQL Database and Azure Synapse Analytics provide a relational database service for your internet-based applications. LetΓÇÖs look at services that help protect your applications and data when using Azure SQL Database and Azure Synapse Analytics in a PaaS deployment: Azure SQL Database can be configured to use one of two types of authentication: - Uses contained database users to authenticate identities at the database level. - Supports token-based authentication for applications connecting to SQL Database. - Supports domain federation with Active Directory Federation Services (ADFS) or native user/password authentication for a local Azure AD without domain synchronization.-- Supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes [Multi-Factor Authentication (MFA)](../../active-directory/authentication/concept-mfa-howitworks.md). MFA includes strong authentication with a range of easy verification options ΓÇö phone call, text message, smart cards with pin, or mobile app notification. For more information, see [Universal Authentication with SQL Database and Azure Synapse Analytics](../../azure-sql/database/authentication-mfa-ssms-overview.md).+- Supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes [Multi-Factor Authentication (MFA)](../../active-directory/authentication/concept-mfa-howitworks.md). MFA includes strong authentication with a range of easy verification options ΓÇö phone call, text message, smart cards with pin, or mobile app notification. For more information, see [Universal Authentication with SQL Database and Azure Synapse Analytics](/azure/azure-sql/database/authentication-mfa-ssms-overview). To learn more about Azure AD authentication, see: -- [Use Azure Active Directory Authentication for authentication with SQL Database, Managed Instance, or Azure Synapse Analytics](../../azure-sql/database/authentication-aad-overview.md)+- [Use Azure Active Directory Authentication for authentication with SQL Database, Managed Instance, or Azure Synapse Analytics](/azure/azure-sql/database/authentication-aad-overview) - [Authentication to Azure Synapse Analytics](../../synapse-analytics/sql-data-warehouse/sql-data-warehouse-authentication.md)-- [Token-based authentication support for Azure SQL Database using Azure AD authentication](../../azure-sql/database/authentication-aad-overview.md)+- [Token-based authentication support for Azure SQL Database using Azure AD authentication](/azure/azure-sql/database/authentication-aad-overview) > [!NOTE]-> To ensure that Azure Active Directory is a good fit for your environment, see [Azure AD features and limitations](../../azure-sql/database/authentication-aad-overview.md#azure-ad-features-and-limitations). +> To ensure that Azure Active Directory is a good fit for your environment, see [Azure AD features and limitations](/azure/azure-sql/database/authentication-aad-overview#azure-ad-features-and-limitations). ## Restrict access based on IP address SQL Database default source IP address restrictions allow access from any Azure To learn more about Azure SQL Firewall and IP restrictions, see: -- [Azure SQL Database and Azure Synapse Analytics access control](../../azure-sql/database/logins-create-manage.md)-- [Azure SQL Database and Azure Synapse Analytics firewall rules](../../azure-sql/database/firewall-configure.md)+- [Azure SQL Database and Azure Synapse Analytics access control](/azure/azure-sql/database/logins-create-manage) +- [Azure SQL Database and Azure Synapse Analytics firewall rules](/azure/azure-sql/database/firewall-configure) ## Encrypt data at rest |
| security | Services Technologies | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/services-technologies.md | Over time, this list will change and grow, just as Azure does. Make sure to chec ## Database security |Service|Description| ||--|-| [Azure SQL Firewall](../../azure-sql/database/firewall-configure.md)|A network access control feature that protects against network-based attacks to database. | +| [Azure SQL Firewall](/azure/azure-sql/database/firewall-configure)|A network access control feature that protects against network-based attacks to database. | |[Azure SQL Cell Level Encryption](/archive/blogs/sqlsecurity/recommendations-for-using-cell-level-encryption-in-azure-sql-database)| A database security technology that provides encryption at a granular level. |-| [Azure SQL Connection Encryption](../../azure-sql/database/logins-create-manage.md)|To provide security, SQL Database controls access with firewall rules limiting connectivity by IP address, authentication mechanisms requiring users to prove their identity, and authorization mechanisms limiting users to specific actions and data. | +| [Azure SQL Connection Encryption](/azure/azure-sql/database/logins-create-manage)|To provide security, SQL Database controls access with firewall rules limiting connectivity by IP address, authentication mechanisms requiring users to prove their identity, and authorization mechanisms limiting users to specific actions and data. | | [Azure SQL Always Encryption](/sql/relational-databases/security/encryption/always-encrypted-database-engine)|Protects sensitive data, such as credit card numbers or national identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database or SQL Server databases. | | [Azure SQL Transparent Data Encryption](/sql/relational-databases/security/encryption/transparent-data-encryption-azure-sql)| A database security feature that encrypts the storage of an entire database. |-| [Azure SQL Database Auditing](../../azure-sql/database/auditing-overview.md)|A database auditing feature that tracks database events and writes them to an audit log in your Azure storage account. | +| [Azure SQL Database Auditing](/azure/azure-sql/database/auditing-overview)|A database auditing feature that tracks database events and writes them to an audit log in your Azure storage account. | ## Identity and access management |
| sentinel | Authentication Normalization Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/authentication-normalization-schema.md | The following list mentions fields that have specific guidelines for authenticat | Field | Class | Type | Description | ||-||--| | **EventType** | Mandatory | Enumerated | Describes the operation reported by the record. <br><br>For Authentication records, supported values include: <br>- `Logon` <br>- `Logoff`|-| <a name ="eventresultdetails"></a>**EventResultDetails** | Optional | String | One of the following values: <br><br>- `No such user or password`. This value should be used also when the original event reports that there is no such user, without reference to a password. <br>- `Incorrect password`<br>- `Account expired`<br>- `Password expired`<br>- `User locked`<br>- `User disabled`<br>- `Logon violates policy`. This value should be used when the original event reports, for example: MFA required, logon outside of working hours, conditional access restrictions, or too frequent attempts.<br>- `Session expired`<br>- `Other`<br><br>**Note**: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the field [EventOriginalResultDetails](normalization-common-fields.md#eventoriginalresultdetails)| +| <a name ="eventresultdetails"></a>**EventResultDetails** | Recommended | String | One of the following values: <br><br>- `No such user or password`. This value should be used also when the original event reports that there is no such user, without reference to a password. <br>- `Incorrect password`<br>- `Account expired`<br>- `Password expired`<br>- `User locked`<br>- `User disabled`<br>- `Logon violates policy`. This value should be used when the original event reports, for example: MFA required, logon outside of working hours, conditional access restrictions, or too frequent attempts.<br>- `Session expired`<br>- `Other`<br><br>**Note**: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the field [EventOriginalResultDetails](normalization-common-fields.md#eventoriginalresultdetails)| | **EventSubType** | Optional | String | The sign-in type. Allowed values include: `System`, `Interactive`, `Service`, `RemoteInteractive`, `RemoteService`, `AssumeRole`. <br><br>Example: `Interactive`. Store the original value in [EventOriginalSubType](normalization-common-fields.md#eventoriginalsubtype). | | **EventSchemaVersion** | Mandatory | String | The version of the schema. The version of the schema documented here is `0.1.1` | | **EventSchema** | Optional | String | The name of the schema documented here is **Authentication**. | |
| sentinel | Configure Fusion Rules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/configure-fusion-rules.md | This detection is enabled by default in Microsoft Sentinel. To check or change i - Review the **tactics and techniques** in your analytics rule details. The Fusion ML algorithm uses [MITRE ATT&CK](https://attack.mitre.org/) information for detecting multi-stage attacks, and the tactics and techniques you label the analytics rules with will show up in the resulting incidents. Fusion calculations may be affected if incoming alerts are missing tactic information. -1. Fusion can also detect scenario-based threats using rules based on the following **scheduled analytics rule templates**, which can be found in the **Rule templates** tab in the **Analytics** blade. To enable these detections, select the rule name in the templates gallery, and click **Create rule** in the details pane. +1. Fusion can also detect scenario-based threats using rules based on the following **scheduled analytics rule templates**. ++ To enable the queries availiable as templates in the **Analytics** blade, go to the **Rule templates** tab, select the rule name in the templates gallery, and click **Create rule** in the details pane. - [Cisco - firewall block but success logon to Azure AD](https://github.com/Azure/Azure-Sentinel/blob/60e7aa065b196a6ed113c748a6e7ae3566f8c89c/Detections/MultipleDataSources/SigninFirewallCorrelation.yaml) - [Fortinet - Beacon pattern detected](https://github.com/Azure/Azure-Sentinel/blob/83c6d8c7f65a5f209f39f3e06eb2f7374fd8439c/Detections/CommonSecurityLog/Fortinet-NetworkBeaconPattern.yaml) This detection is enabled by default in Microsoft Sentinel. To check or change i - [Rare application consent](https://github.com/Azure/Azure-Sentinel/blob/83c6d8c7f65a5f209f39f3e06eb2f7374fd8439c/Detections/AuditLogs/RareApplicationConsent.yaml) - [SharePointFileOperation via previously unseen IPs](https://github.com/Azure/Azure-Sentinel/blob/master/Detections/OfficeActivity/SharePoint_Downloads_byNewIP.yaml) - [Suspicious Resource deployment](https://github.com/Azure/Azure-Sentinel/blob/83c6d8c7f65a5f209f39f3e06eb2f7374fd8439c/Detections/AzureActivity/NewResourceGroupsDeployedTo.yaml)+ - [Palo Alto Threat signatures from Unusual IP addresses](https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/PaloAlto-UnusualThreatSignatures.yaml) + + To add queries that are not currently availiable as a rule template, see [create a custom analytics rule with a scheduled query](detect-threats-custom.md#create-a-custom-analytics-rule-with-a-scheduled-query). + + - [New Admin account activity seen which was not seen historically](https://github.com/Azure/Azure-Sentinel/blob/83c6d8c7f65a5f209f39f3e06eb2f7374fd8439c/Hunting%20Queries/OfficeActivity/new_adminaccountactivity.yaml) + For more information, see [Fusion Advanced Multistage Attack Detection Scenarios with Scheduled Analytics Rules](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-fusion-advanced-multistage-attack-detection-scenarios/ba-p/2337497). + > [!NOTE] > For the set of scheduled analytics rules used by Fusion, the ML algorithm does fuzzy matching for the KQL queries provided in the templates. Renaming the templates will not impact Fusion detections. |
| sentinel | Normalization Common Fields | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/normalization-common-fields.md | The following fields are defined by ASIM for all schemas: | <a name="eventtype"></a>**EventType** | Mandatory | Enumerated | Describes the operation reported by the record. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalType](#eventoriginaltype) field. | | <a name="eventsubtype"></a>**EventSubType** | Optional | Enumerated | Describes a subdivision of the operation reported in the [EventType](#eventtype) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalSubType](#eventoriginalsubtype) field. | | <a name="eventresult"></a>**EventResult** | Mandatory | Enumerated | One of the following values: **Success**, **Partial**, **Failure**, **NA** (Not Applicable).<br> <br>The value might be provided in the source record by using different terms, which should be normalized to these values. Alternatively, the source might provide only the [EventResultDetails](#eventresultdetails) field, which should be analyzed to derive the EventResult value.<br><br>Example: `Success`|-| <a name="eventresultdetails"></a>**EventResultDetails** | Mandatory | Enumerated | Reason or details for the result reported in the [EventResult](#eventresult) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalResultDetails](#eventoriginalresultdetails) field.<br><br>Example: `NXDOMAIN`| +| <a name="eventresultdetails"></a>**EventResultDetails** | Recommended | Enumerated | Reason or details for the result reported in the [EventResult](#eventresult) field. Each schema documents the list of values valid for this field. The original, source specific, value is stored in the [EventOriginalResultDetails](#eventoriginalresultdetails) field.<br><br>Example: `NXDOMAIN`| | <a name="eventoriginaluid"></a>**EventOriginalUid** | Optional | String | A unique ID of the original record, if provided by the source.<br><br>Example: `69f37748-ddcd-4331-bf0f-b137f1ea83b`| | <a name="eventoriginaltype"></a>**EventOriginalType** | Optional | String | The original event type or ID, if provided by the source. For example, this field will be used to store the original Windows event ID. This value is used to derive [EventType](#eventtype), which should have only one of the values documented for each schema.<br><br>Example: `4624`| | <a name="eventoriginalsubtype"></a>**EventOriginalSubType** | Optional | String | The original event subtype or ID, if provided by the source. For example, this field will be used to store the original Windows logon type. This value is used to derive [EventSubType](#eventsubtype), which should have only one of the values documented for each schema.<br><br>Example: `2`| |
| sentinel | Notebook Get Started | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/notebook-get-started.md | The Azure CLI component on the Compute instance caches a *refresh token* that it To authenticate using Azure CLI enter the following into an empty cell and run it: -```python +```azurecli !az login ``` |
| sentinel | User Management Normalization Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/user-management-normalization-schema.md | The following list mentions fields that have specific guidelines for process act | **EventType** | Mandatory | Enumerated | Describes the operation reported by the record.<br><br> For User Management activity, the supported values are:<br> - `UserCreated`<br> - `UserDeleted`<br> - `UserModified`<br> - `UserLocked`<br> - `UserUnlocked`<br> - `UserDisabled`<br> - `UserEnabled`<br> - `PasswordChanged`<br> - `PasswordReset`<br> - `GroupCreated`<br> - `GroupDeleted`<br> - `GroupModified`<br> - `UserAddedToGroup`<br> - `UserRemovedFromGroup`<br> - `GroupEnumerated`<br> - `UserRead`<br> - `GroupRead`<br> | | <a name="eventsubtype"></a>**EventSubType** | Optional | Enumerated | The following sub-types are supported:<br> - `UserRead`: Password, Hash<br> - `UserCreated`, `GroupCreated`, `UserModified`, `GroupModified`. For more information, see [UpdatedPropertyName](#updatedpropertyname) | | **EventResult** | Mandatory | Enumerated | While failure is possible, most systems report only successful user management events. The expected value for successful events is `Success`. |-| **EventResultDetails** | Optional | Enumerated | The valid values are `NotAuthorized` and `Other`. | +| **EventResultDetails** | Recommended | Enumerated | The valid values are `NotAuthorized` and `Other`. | | **EventSeverity** | Mandatory | Enumerated | While any valid severity value is allowed, the severity of user management events is typically `Informational`. | | **EventSchema** | Mandatory | String | The name of the schema documented here is `UserManagement`. | | **EventSchemaVersion** | Mandatory | String | The version of the schema. The version of the schema documented here is `0.1.1`. | |
| sentinel | Web Normalization Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/web-normalization-schema.md | The following list mentions fields that have specific guidelines for Web Session ||-||--| | **EventType** | Mandatory | Enumerated | Describes the operation reported by the record and should be set to `HTTPsession`. | | **EventResult** | Mandatory | Enumerated | Describes the event result, normalized to one of the following values: <br> - `Success` <br> - `Partial` <br> - `Failure` <br> - `NA` (not applicable) <br><br>For an HTTP session, `Success` is defined as a status code lower than `400`, and `Failure` is defined as a status code higher than `400`. For a list of HTTP status codes refer to [W3 Org](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html).<br><br>The source may provide only a value for the [EventResultDetails](#eventresultdetails) field, which must be analyzed to get the **EventResult** value. |-| <a name="eventresultdetails"></a>**EventResultDetails** | Optional | String | For HTTP sessions, the value should be the HTTP status code. <br><br>**Note**: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the **EventOriginalResultDetails** field.| +| <a name="eventresultdetails"></a>**EventResultDetails** | Mandatory | String | For HTTP sessions, the value should be the HTTP status code. <br><br>**Note**: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the **EventOriginalResultDetails** field.| | **EventSchema** | Mandatory | String | The name of the schema documented here is `WebSession`. | | **EventSchemaVersion** | Mandatory | String | The version of the schema. The version of the schema documented here is `0.2.2` | | **Dvc** fields| | | For Web Session events, device fields refer to the system reporting the Web Session event. | |
| service-bus-messaging | Advanced Features Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/advanced-features-overview.md | Autodelete on idle enables you to specify an idle interval after which a queue o ## Duplicate detection The duplicate detection feature enables the sender to resend the same message again and for the broker to drop a potential duplicate. For more information, see [Duplicate detection](duplicate-detection.md). +## Support ordering +The **Support ordering** feature allows you to specify whether messages that are sent to a topic will be forwarded to the subscription in the same order in which they were sent. This feature doesn't support partitioned topics. For more information, see [TopicProperties.SupportOrdering](/dotnet/api/azure.messaging.servicebus.administration.topicproperties.supportordering) in .NET or [TopicProperties.setOrderingSupported](/java/api/com.azure.messaging.servicebus.administration.models.topicproperties.setorderingsupported) in Java. + ## Geo-disaster recovery When an Azure region experiences downtime, the disaster recovery feature enables message processing to continue operating in a different region or data center. The feature keeps a structural mirror of a namespace available in the secondary region and allows the namespace identity to switch to the secondary namespace. Already posted messages remain in the former primary namespace for recovery once the availability episode subsides. For more information, see [Azure Service Bus Geo-disaster recovery](service-bus-geo-dr.md). |
| service-bus-messaging | Service Bus Outages Disasters | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/service-bus-outages-disasters.md | To learn more about disaster recovery, see these articles: [BrokeredMessage.MessageId]: /dotnet/api/microsoft.servicebus.messaging.brokeredmessage [BrokeredMessage.Label]: /dotnet/api/microsoft.servicebus.messaging.brokeredmessage [Geo-replication with Service Bus Standard Tier]: https://github.com/Azure/azure-service-bus/tree/master/samples/DotNet/Microsoft.ServiceBus.Messaging/GeoReplication-[Azure SQL Database Business Continuity]:../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md +[Azure SQL Database Business Continuity]:/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview [Azure resiliency technical guidance]: /azure/architecture/framework/resiliency/app-design [1]: ./media/service-bus-outages-disasters/az.png |
| service-fabric | Service Fabric Containers Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-fabric/service-fabric-containers-overview.md | Here are typical examples where a container is a good choice: Service Fabric supports the deployment of Docker containers on Linux, and Windows Server containers on Windows Server 2016 and later, along with support for Hyper-V isolation mode. -> [!NOTE] -> Containers are not supported on local single node Service Fabric clusters (neither Linux clusters on OneBox, nor Windows clusters on local Service Fabric installations). - > [!NOTE] > A Service Fabric cluster is single tenant by design and hosted applications are considered **trusted**. If you are considering hosting **untrusted applications**, please see [Hosting untrusted applications in a Service Fabric cluster](service-fabric-best-practices-security.md#hosting-untrusted-applications-in-a-service-fabric-cluster). |
| service-fabric | Service Fabric Disaster Recovery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-fabric/service-fabric-disaster-recovery.md | In both standalone Service Fabric clusters and Azure, the primary node type is t - Learn how to simulate various failures by using the [testability framework](service-fabric-testability-overview.md). - Read other disaster-recovery and high-availability resources. Microsoft has published a large amount of guidance on these topics. Although some of these resources refer to specific techniques for use in other products, they contain many general best practices that you can apply in the Service Fabric context: - [Availability checklist](/azure/architecture/checklist/resiliency-per-service)- - [Performing a disaster recovery drill](../azure-sql/database/disaster-recovery-drills.md) + - [Performing a disaster recovery drill](/azure/azure-sql/database/disaster-recovery-drills) - [Disaster recovery and high availability for Azure applications][dr-ha-guide] - Learn about [Service Fabric support options](service-fabric-support.md). |
| service-fabric | Service Fabric Host App In A Container | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-fabric/service-fabric-host-app-in-a-container.md | -This tutorial shows you how to containerize an existing ASP.NET application and package it as a Service Fabric application. Run the containers locally on the Service Fabric development cluster and then deploy the application to Azure. The application persists data in [Azure SQL Database](../azure-sql/database/sql-database-paas-overview.md). +This tutorial shows you how to containerize an existing ASP.NET application and package it as a Service Fabric application. Run the containers locally on the Service Fabric development cluster and then deploy the application to Azure. The application persists data in [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview). In this tutorial, you learn how to: In this tutorial, you learn how to: When running the Fabrikam Fiber CallCenter application in production, the data needs to be persisted in a database. There is currently no way to guarantee persistent data in a container, therefore you cannot store production data in SQL Server in a container. -We recommend [Azure SQL Database](../azure-sql/database/powershell-script-content-guide.md). To set up and run a managed SQL Server DB in Azure, run the following script. Modify the script variables as necessary. *clientIP* is the IP address of your development computer. Take note of the name of the server outputted by the script. +We recommend [Azure SQL Database](/azure/azure-sql/database/powershell-script-content-guide). To set up and run a managed SQL Server DB in Azure, run the following script. Modify the script variables as necessary. *clientIP* is the IP address of your development computer. Take note of the name of the server outputted by the script. ```powershell $subscriptionID="<subscription ID>" You can confirm the installation by opening **Manage User Certificates** from th ## Allow your application running in Azure to access SQL Database -Previously, you created a SQL firewall rule to give access to your application running locally. Next, you need to enable the application running in Azure to access the SQL DB. Create a [virtual network service endpoint](../azure-sql/database/vnet-service-endpoint-rule-overview.md) for the Service Fabric cluster and then create a rule to allow that endpoint to access the SQL DB. Be sure to specify the cluster resource group variable that you took note of when creating the cluster. +Previously, you created a SQL firewall rule to give access to your application running locally. Next, you need to enable the application running in Azure to access the SQL DB. Create a [virtual network service endpoint](/azure/azure-sql/database/vnet-service-endpoint-rule-overview) for the Service Fabric cluster and then create a rule to allow that endpoint to access the SQL DB. Be sure to specify the cluster resource group variable that you took note of when creating the cluster. ```powershell # Create a virtual network service endpoint |
| site-recovery | Exclude Disks Replication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/exclude-disks-replication.md | Our paging file settings on the Azure VM are as follows: - Learn more about guidelines for the temporary storage disk: - [Learn about](https://cloudblogs.microsoft.com/sqlserver/2014/09/25/using-ssds-in-azure-vms-to-store-sql-server-tempdb-and-buffer-pool-extensions/) using SSDs in Azure VMs to store SQL Server TempDB and Buffer Pool Extensions- - [Review ](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) performance best practices for SQL Server in Azure VMs. + - [Review ](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) performance best practices for SQL Server in Azure VMs. - After your deployment is set up and running, [learn more](failover-failback-overview.md) about different types of failover. |
| site-recovery | Site Recovery Sql | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/site-recovery-sql.md | SQL Server on an Azure IaaS VM or at on-premises.| Replication with Azure Site R > * Ensure that the data change rate observed on the machine is within [Site Recovery limits](vmware-physical-azure-support-matrix.md#churn-limits). The change rate is measured in write bytes per second. For machines running Windows, you can view this change rate by selecting the **Performance** tab in Task Manager. Observe the write speed for each disk. > * Site Recovery supports replication of Failover Cluster Instances on Storage Spaces Direct. To learn more, see [how to enable Storage Spaces Direct replication](azure-to-azure-how-to-enable-replication-s2d-vms.md). > -> When you migrate your SQL Workload to Azure, it is recommended to apply the [Performance guidelines for SQL Server on Azure Virtual Machines](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md). +> When you migrate your SQL Workload to Azure, it is recommended to apply the [Performance guidelines for SQL Server on Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist). ## Disaster recovery of an application After the database tier is running in the target Azure region, ensure that you h To understand how you can design applications for connectivity considerations, see these examples: -* [Design an application for cloud disaster recovery](../azure-sql/database/designing-cloud-solutions-for-disaster-recovery.md) -* [Elastic pool Disaster Recovery strategies](../azure-sql/database/disaster-recovery-strategies-for-applications-with-elastic-pool.md) +* [Design an application for cloud disaster recovery](/azure/azure-sql/database/designing-cloud-solutions-for-disaster-recovery) +* [Elastic pool Disaster Recovery strategies](/azure/azure-sql/database/disaster-recovery-strategies-for-applications-with-elastic-pool) ### Step 3: Interoperate with Always On, active geo-replication, and auto-failover groups Site Recovery is application agnostic. Site Recovery can help protect any versio ## Next steps * Learn more about [Site Recovery architecture](./azure-to-azure-architecture.md).-* For SQL Server in Azure, learn more about [high availability solutions](../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md#azure-only-high-availability-solutions) for recovery in a secondary Azure region. -* For SQL Database, learn more about the [business continuity](../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md) and [high availability](../azure-sql/database/high-availability-sla.md) options for recovery in a secondary Azure region. -* For SQL Server machines at on-premises, learn more about the [high availability options](../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md#hybrid-it-disaster-recovery-solutions) for recovery in Azure Virtual Machines. +* For SQL Server in Azure, learn more about [high availability solutions](/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview#azure-only-high-availability-solutions) for recovery in a secondary Azure region. +* For SQL Database, learn more about the [business continuity](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview) and [high availability](/azure/azure-sql/database/high-availability-sla) options for recovery in a secondary Azure region. +* For SQL Server machines at on-premises, learn more about the [high availability options](/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview#hybrid-it-disaster-recovery-solutions) for recovery in Azure Virtual Machines. |
| spatial-anchors | Coarse Reloc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/spatial-anchors/concepts/coarse-reloc.md | You can refer to one of these tutorials to set up coarse relocalization in your ### Platform availability -You can send these types of sensor data to the anchor service: +The following types of sensors can be used in conjunction with coarse relocation (see details in table below): -* GPS position: latitude, longitude, altitude -* Signal strength of Wi-Fi access points in range -* Signal strength of Bluetooth beacons in range +* **GPS position**: latitude, longitude, altitude +* Signal strength of **Wi-Fi** access points in range +* Signal strength of **Bluetooth** beacons in range This table summarizes the availability of the sensor data on supported platforms and provides information that you should be aware of: | | HoloLens | Android | iOS | |--|-||--|-| **GPS** | No<sup>1</sup> | Yes<sup>2</sup> | Yes<sup>3</sup> | -| **Wi-Fi** | Yes<sup>4</sup> | Yes<sup>5</sup> | No | -| **BLE beacons** | Yes<sup>6</sup> | Yes<sup>6</sup> | Yes<sup>6</sup>| +| **GPS** | No<sup>1</sup> | Yes<sup>4</sup> | Yes<sup>6, 7</sup> | +| **Wi-Fi** | Yes<sup>2</sup> | Yes<sup>5</sup> | Yes<sup>7</sup> | +| **BLE beacons** | Yes<sup>3</sup> | Yes<sup>3</sup> | Yes<sup>3, 7</sup>| <sup>1</sup> An external GPS device can be associated with HoloLens. Handle the [UpdatedSensorFingerprintRequired](/dotnet/api/microsoft.azure.spatialanchors.cloudspatialanchorsession.updatedsensorfingerprintrequired) event to submit [GeoLocation](/dotnet/api/microsoft.azure.spatialanchors.geolocation) readings if you are using HoloLens with an external GPS tracker.<br/>-<sup>2</sup> Supported through [LocationManager][3] APIs (both GPS and NETWORK).<br/> -<sup>3</sup> Supported through [CLLocationManager][4] APIs.<br/> -<sup>4</sup> Supported at a rate of approximately one scan every 3 seconds. <br/> +<sup>2</sup> Supported at a rate of approximately one scan every 3 seconds. <br/> +<sup>3</sup> Limited to [Eddystone][1] and [iBeacon][2].<br/> +<sup>4</sup> Supported through [LocationManager][3] APIs (both GPS and NETWORK).<br/> <sup>5</sup> Starting with API level 28, Wi-Fi scans are throttled to four calls every 2 minutes. Starting with Android 10, you can disable this throttling from the **Developer settings** menu. For more information, see the [Android documentation][5].<br/>-<sup>6</sup> Limited to [Eddystone][1] and [iBeacon][2]. +<sup>6</sup> Supported directly through iOS.<br/> +<sup>7</sup> Supported indirectly through [CLLocationManager][4] APIs.<br/> ### Which sensor to enable |
| spring-cloud | How To Log Streaming | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/spring-cloud/how-to-log-streaming.md | az spring-cloud app logs --help When the [Structured application log](./structured-app-log.md) is enabled for the app, the logs are printed in JSON format. This makes it difficult to read. The `--format-json` argument can be used to format the JSON logs into human readable format. -```shell +```azurecli # Raw JSON log $ az spring-cloud app logs --name auth-service {"timestamp":"2021-05-26T03:35:27.533Z","logger":"com.netflix.discovery.DiscoveryClient","level":"INFO","thread":"main","mdc":{},"message":"Disable delta property : false"} $ az spring-cloud app logs --name auth-service --format-json The `--format-json` argument also takes optional customized format, using the keyword argument [format string syntax](https://docs.python.org/3/library/string.html#format-string-syntax). -```shell +```azurecli # Custom format $ az spring-cloud app logs --name auth-service --format-json="{message}{n}" Disable delta property : false |
| spring-cloud | Quickstart Deploy Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/spring-cloud/quickstart-deploy-apps.md | If you've been using the Azure Cloud Shell up to this point, switch to a local c Make sure that the command prompt is in the project folder before running the following command. - ```console + ```azurecli az spring-cloud app deploy -n planet-weather-provider --runtime-version NetCore_31 --main-entry Microsoft.Azure.SpringCloud.Sample.PlanetWeatherProvider.dll --artifact-path ./publish-deploy-planet.zip ``` If you've been using the Azure Cloud Shell up to this point, switch to a local c 1. Deploy to Azure. - ```console + ```azurecli az spring-cloud app deploy -n solar-system-weather --runtime-version NetCore_31 --main-entry Microsoft.Azure.SpringCloud.Sample.SolarSystemWeather.dll --artifact-path ./publish-deploy-solar.zip ``` |
| spring-cloud | Quickstart | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/spring-cloud/quickstart.md | The following procedure builds and deploys the project that you created earlier. 1. Create an app in your Azure Spring Cloud instance with a public endpoint assigned. Use the same application name "hello-world" that you specified in *appsettings.json*. - ```console + ```azurecli az spring-cloud app create -n hello-world -s <service instance name> -g <resource group name> --assign-endpoint --runtime-version NetCore_31 ``` |
| sql-database | Sql Database Import Purview Labels | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sql-database/scripts/sql-database-import-purview-labels.md | Last updated 02/17/2021 # Classify your Azure SQL data using Microsoft Purview labels This document describes how to add Microsoft Purview labels in your Azure SQL Database and Azure Synapse Analytics (formerly SQL DW). foreach ($referredEntity in $referredEntities.psobject.Properties.GetEnumerator( For more information on the Azure PowerShell, see [Azure PowerShell documentation](/powershell/). -For more information on Microsoft Purview, see [Microsoft Purview documentation](../../purview/index.yml). +For more information on Microsoft Purview, see [Microsoft Purview documentation](../../purview/index.yml). |
| static-web-apps | Application Settings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/static-web-apps/application-settings.md | You can use the `az staticwebapp appsettings` command to update your settings in - In a terminal or command line, execute the following command to add or update a setting named `message` with a value of `Hello world`. Make sure to replace the placeholder `<YOUR_APP_ID>` with your value. - ```bash + ```azurecli az staticwebapp appsettings set --name <YOUR_APP_ID> --setting-names "message=Hello world" ``` Application settings are available to view through the Azure CLI. - In a terminal or command line, execute the following command. Make sure to replace the placeholder `<YOUR_APP_ID>` with your value. - ```bash + ```azurecli az staticwebapp appsettings list --name <YOUR_APP_ID> ``` Application settings can be deleted through the Azure CLI. - In a terminal or command line, execute the following command to delete a setting named `message`. Make sure to replace the placeholder `<YOUR_APP_ID>` with your value. - ```bash + ```azurecli az staticwebapp appsettings delete --name <YOUR_APP_ID> --setting-names "message" ``` |
| static-web-apps | Build Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/static-web-apps/build-configuration.md | inputs: ## Skip building the API If you want to skip building the API, you can bypass the automatic build and deploy the API built in a previous step.-> [!NOTE] -> Currently the `skip_api_build` is only supported in GitHub Actions and not Azure Pipelines. Steps to skip building the API: |
| static-web-apps | Get Started Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/static-web-apps/get-started-cli.md | Now that the repository is created, you can create a static web app from the Azu 1. Create a resource group. - ```bash + ```azurecli az group create \ --name my-swa-group \ --location "eastus2" Before you can navigate to your new static site, the deployment build must first 1. Return to your console window and run the following command to list the URLs associated with your app. - ```bash + ```azurecli az staticwebapp show \ --name my-first-static-web-app \ --query "repositoryUrl" Before you can navigate to your new static site, the deployment build must first 1. Run the following command to query for your website's URL. - ```bash + ```azurecli az staticwebapp show \ --name my-first-static-web-app \ --query "defaultHostname" |
| storage | Data Lake Storage Migrate Gen1 To Gen2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/data-lake-storage-migrate-gen1-to-gen2.md | This table compares the capabilities of Gen1 to that of Gen2. |VNET Support|[VNET Integration](../../data-lake-store/data-lake-store-network-security.md)|[Service Endpoints](../common/storage-network-security.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json), [Private Endpoints](../common/storage-private-endpoints.md)| |Developer experience|[REST](../../data-lake-store/data-lake-store-data-operations-rest-api.md), [.NET](../../data-lake-store/data-lake-store-data-operations-net-sdk.md), [Java](../../data-lake-store/data-lake-store-get-started-java-sdk.md), [Python](../../data-lake-store/data-lake-store-data-operations-python.md), [PowerShell](../../data-lake-store/data-lake-store-get-started-powershell.md), [Azure CLI](../../data-lake-store/data-lake-store-get-started-cli-2.0.md)|Generally available - [REST](/rest/api/storageservices/data-lake-storage-gen2), [.NET](data-lake-storage-directory-file-acl-dotnet.md), [Java](data-lake-storage-directory-file-acl-java.md), [Python](data-lake-storage-directory-file-acl-python.md)<br>Public preview - [JavaScript](data-lake-storage-directory-file-acl-javascript.md), [PowerShell](data-lake-storage-directory-file-acl-powershell.md), [Azure CLI](data-lake-storage-directory-file-acl-cli.md)| |Resource logs|Classic logs<br>[Azure Monitor integrated](../../data-lake-store/data-lake-store-diagnostic-logs.md)|[Classic logs](../common/storage-analytics-logging.md) - Generally available<br>[Azure Monitor integrated](monitor-blob-storage.md) - Preview|-|Ecosystem|[HDInsight (3.6)](../../data-lake-store/data-lake-store-hdinsight-hadoop-use-portal.md), [Azure Databricks (3.1 and above)](https://docs.databricks.com/dat)| +|Ecosystem|[HDInsight (3.6)](../../data-lake-store/data-lake-store-hdinsight-hadoop-use-portal.md), [Azure Databricks (3.1 and above)](https://docs.databricks.com/dat)| <a id="migration-patterns"></a> |
| storage | Data Lake Storage Supported Azure Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/data-lake-storage-supported-azure-services.md | This table lists the Azure services that you can use with Azure Data Lake Storag |SQL Server Integration Services (SSIS)|Generally available|Yes|Yes|<ul><li>[Azure Storage connection manager](/sql/integration-services/connection-manager/azure-storage-connection-manager)</li></ul>| |Azure Data Explorer|Generally available|Yes|Yes|<ul><li>[Query data in Azure Data Lake using Azure Data Explorer](/azure/data-explorer/data-lake-query-data)</li></ul>| |Azure Cognitive Search|Generally available|Yes|Yes|<ul><li>[Index and search Azure Data Lake Storage Gen2 documents](../../search/search-howto-index-azure-data-lake-storage.md)</li></ul>|-|Azure SQL Managed Instance|Preview|No|Yes|<ul><li>[Data virtualization with Azure SQL Managed Instance (preview)](../../azure-sql/managed-instance/data-virtualization-overview.md)</li></ul>| +|Azure SQL Managed Instance|Preview|No|Yes|<ul><li>[Data virtualization with Azure SQL Managed Instance (preview)](/azure/azure-sql/managed-instance/data-virtualization-overview)</li></ul>| |Azure Content Delivery Network|Not yet supported|Not applicable|Not applicable|<ul><li>[Index and search Azure Data Lake Storage Gen2 documents (preview)](../../cdn/cdn-overview.md)</li></ul>|-|Azure SQL Database|Not yet supported|Not applicable|Not applicable|<ul><li>[What is Azure SQL Database?](../../azure-sql/database/sql-database-paas-overview.md)</li></ul>| +|Azure SQL Database|Not yet supported|Not applicable|Not applicable|<ul><li>[What is Azure SQL Database?](/azure/azure-sql/database/sql-database-paas-overview)</li></ul>| > [!TIP] > To see how services organized into categories such as ingest, download, process, and visualize, see [Ingest, process, and analyze](./data-lake-storage-best-practices.md#ingest-process-and-analyze). |
| storage | Data Lake Storage Tutorial Extract Transform Load Hive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/data-lake-storage-tutorial-extract-transform-load-hive.md | If you don't have an Azure subscription, [create a free account](https://azure.m See [Quickstart: Get started with Apache Hadoop and Apache Hive in Azure HDInsight using the Azure portal](../../hdinsight/hadoop/apache-hadoop-linux-create-cluster-get-started-portal.md). -- **Azure SQL Database**: You use Azure SQL Database as a destination data store. If you don't have a database in SQL Database, see [Create a database in Azure SQL Database in the Azure portal](../../azure-sql/database/single-database-create-quickstart.md).+- **Azure SQL Database**: You use Azure SQL Database as a destination data store. If you don't have a database in SQL Database, see [Create a database in Azure SQL Database in the Azure portal](/azure/azure-sql/database/single-database-create-quickstart). - **Azure CLI**: If you haven't installed the Azure CLI, see [Install the Azure CLI](/cli/azure/install-azure-cli). |
| storage | Encryption Scope Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/encryption-scope-manage.md | az storage account encryption-scope update \ Next, call the **az storage account encryption-scope update** command, pass in the `--key-uri` parameter, and pass in the `--key-source` parameter with the value `Microsoft.KeyVault`: -```powershell +```azurecli az storage account encryption-scope update \ --resource-group <resource-group> \ --account-name <storage-account> \ |
| storage | Storage Blob Container Create Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-container-create-javascript.md | + + Title: Create a blob container with JavaScript - Azure Storage +description: Learn how to create a blob container in your Azure Storage account using the JavaScript client library. +++++ Last updated : 03/28/2022+++ms.devlang: javascript ++++# Create a container in Azure Storage with JavaScript ++Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. This article shows how to create containers with the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++## Name a container ++A container name must be a valid DNS name, as it forms part of the unique URI used to address the container or its blobs. Follow these rules when naming a container: ++- Container names can be between 3 and 63 characters long. +- Container names must start with a letter or number, and can contain only lowercase letters, numbers, and the dash (-) character. +- Two or more consecutive dash characters aren't permitted in container names. ++The URI for a container is in this format: ++`https://myaccount.blob.core.windows.net/mycontainer` ++## Create a container ++To create a container, call the following method from the BlobStorageClient: ++- [BlobServiceClient.createContainer](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-createcontainer) ++Containers are created immediately beneath the storage account. It's not possible to nest one container beneath another. An exception is thrown if a container with the same name already exists. ++The following example creates a container asynchronously: ++```javascript +async function createContainer(blobServiceClient, containerName){ ++ // public access at container level + const options = { + access: 'container' + }; ++ // creating client also creates container + const containerClient = await blobServiceClient.createContainer(containerName, options); + console.log(`container ${containerName} created`); ++ // do something with container + // ... ++ return containerClient; +} +``` ++## Understand the root container ++A root container, with the specific name `$root`, enables you to reference a blob at the top level of the storage account hierarchy. For example, you can reference a blob _without using a container name in the URI_: ++`https://myaccount.blob.core.windowsJavaScript/default.html` ++The root container must be explicitly created or deleted. It isn't created by default as part of service creation. The same code displayed in the previous section can create the root. The container name is `$root`. ++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) +- [Create Container operation](/rest/api/storageservices/create-container) +- [Delete Container operation](/rest/api/storageservices/delete-container) |
| storage | Storage Blob Container Delete Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-container-delete-javascript.md | + + Title: Delete and restore a blob container with JavaScript - Azure Storage +description: Learn how to delete and restore a blob container in your Azure Storage account using the JavaScript client library. +++++ Last updated : 03/28/2022+++ms.devlang: javascript ++++# Delete and restore a container in Azure Storage with JavaScript ++This article shows how to delete containers with the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). If you've enabled container soft delete, you can restore deleted containers. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++## Delete a container ++To delete a container in JavaScript, use one of the following methods: ++- BlobServiceClient.[deleteContainer](/javascript/api/@azure/storage-blob/blobserviceclien#@azure-storage-blob-blobserviceclient-deletecontainer) +- ContainerClient.[delete](/javascript/api/@azure/storage-blob/containerclien#@azure-storage-blob-containerclient-delete) +- ContainerClient.[deleteIfExists](/javascript/api/@azure/storage-blob/containerclien#@azure-storage-blob-containerclient-deleteifexists) ++After you delete a container, you can't create a container with the same name for at *least* 30 seconds. Attempting to create a container with the same name will fail with HTTP error code 409 (Conflict). Any other operations on the container or the blobs it contains will fail with HTTP error code 404 (Not Found). ++## Delete container with BlobServiceClient ++The following example deletes the specified container. Use the **BlobServiceClient** for the container: ++```javascript +// delete container immediately on blobServiceClient +async function deleteContainerImmediately(blobServiceClient, containerName) { + const response = await blobServiceClient.deleteContainer(containerName); ++ if (!response.errorCode) { + console.log(`deleted ${containerItem.name} container`); + } +} +``` ++## Delete container with ContainerClient ++The following example shows how to delete all of the containers whose name starts with a specified prefix. ++```javascript +async function deleteContainersWithPrefix(blobServiceClient, blobNamePrefix){ ++ const containerOptions = { + includeDeleted: false, + includeMetadata: false, + includeSystem: true, + prefix: blobNamePrefix + } ++ for await (const containerItem of blobServiceClient.listContainers(containerOptions)) { ++ const containerClient = blobServiceClient.getContainerClient(containerItem.name); ++ const response = await containerClient.delete(); ++ if(!response.errorCode){ + console.log(`deleted ${containerItem.name} container`); + } + } +} +``` ++## Restore a deleted container ++When container soft delete is enabled for a storage account, a container and its contents may be recovered after it has been deleted, within a retention period that you specify. You can restore a soft deleted container by calling. ++- BlobServiceClient.[undeleteContainer](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-undeletecontainer) ++The following example finds a deleted container, gets the version ID of that deleted container, and then passes that ID into the **undeleteContainer** method to restore the container. ++```javascript +// Undelete specific container - last version +async function undeleteContainer(blobServiceClient, containerName) { ++ // version to undelete + let containerVersion; ++ const containerOptions = { + includeDeleted: true, + prefix: containerName + } ++ // container listing returns version (timestamp) in the ContainerItem + for await (const containerItem of blobServiceClient.listContainers(containerOptions)) { ++ // if there are multiple deleted versions of the same container, + // the versions are in asc time order + // the last version is the most recent + if (containerItem.name === containerName) { + containerVersion = containerItem.version; + } + } ++ const containerClient = await blobServiceClient.undeleteContainer( + containerName, + containerVersion, ++ // optional/new container name - if unused, original container name is used + //newContainerName + ); ++ // undelete was successful + console.log(`${containerName} is undeleted`); ++ // do something with containerClient + // ... +} +``` ++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) +- [Soft delete for containers](soft-delete-container-overview.md) +- [Enable and manage soft delete for containers](soft-delete-container-enable.md) +- [Restore Container](/rest/api/storageservices/restore-container) |
| storage | Storage Blob Container Properties Metadata Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-container-properties-metadata-javascript.md | + + Title: Use JavaScript to manage properties and metadata for a blob container ++description: Learn how to set and retrieve system properties and store custom metadata on blob containers in your Azure Storage account using the JavaScript client library. +++++ Last updated : 03/28/2022++ms.devlang: javascript ++++# Manage container properties and metadata with JavaScript ++Blob containers support system properties and user-defined metadata, in addition to the data they contain. This article shows how to manage system properties and user-defined metadata with the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). ++## About properties and metadata ++| Type|Description| +|--|--| +|[System properties](/javascript/api/@azure/storage-blob/containerproperties#@azure-storage-blob-containerproperties-lastmodified)|System properties exist on each Blob storage resource. Some of them can be read or set, while others are read-only. Under the covers, some system properties correspond to certain standard HTTP headers. The Azure Storage client library for JavaScript maintains these properties for you. <br><br>Examples:<br>* lastModified<br>* leaseStatus| +|**User-defined metadata**|User-defined metadata consists of one or more name-value pairs that you specify for a Blob storage resource. You can use metadata to store additional values with the resource. Metadata values are for your own purposes only, and do not affect how the resource behaves.<br><br>Examples:<br>`project`:`metrics-reporting`<br>`manager`:`johnh`| ++Metadata name/value pairs are valid HTTP headers, and so should adhere to all restrictions governing HTTP headers. Metadata names must be valid HTTP header names and should be treated as case-insensitive. Metadata values containing non-ASCII characters should be Base64-encoded or URL-encoded. ++## Retrieve container properties ++To retrieve container properties, use: ++- [ContainerClient.getProperties()](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-getproperties) which returns [ContainerProperties](/javascript/api/@azure/storage-blob/containerproperties) ++The following code example fetches a container's properties and writes the property values to a console window: ++```javascript +async function getContainerProperties(containerClient) { ++ // Get Properties including existing metadata + const containerProperties = await containerClient.getProperties(); + if(!containerProperties.errorCode){ + console.log(containerProperties); + } +} +``` ++## Set and retrieve metadata ++You can specify metadata as one or more name-value pairs container resource. To set metadata, use: ++- [ContainerClient.setMetadata](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-setmetadata) ++The name of your metadata must conform to the naming conventions for JavaScript identifiers. Metadata names preserve the case with which they were created, but are case-insensitive when set or read. If two or more metadata headers with the same name are submitted for a resource, Blob storage comma-separates and concatenates the two values and return HTTP response code 200 (OK). ++The following code example sets metadata on a container. ++```javascript +/* +const metadata = { + // values must be strings + lastFileReview: currentDate.toString(), + reviewer: `johnh` +} +*/ +async function setContainerMetadata(containerClient, metadata) { ++ await containerClient.setMetadata(metadata); ++} +``` ++To retrieve metadata, [get the container properties](#retrieve-container-properties) then use the returned **metadata** property. ++- [ContainerClient.getProperties](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-getproperties) which returns metadata inside the ContainerProperties object. +++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) +- [Get Container Properties operation](/rest/api/storageservices/get-container-properties) +- [Set Container Metadata operation](/rest/api/storageservices/set-container-metadata) +- [Get Container Metadata operation](/rest/api/storageservices/get-container-metadata) |
| storage | Storage Blob Containers List Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-containers-list-javascript.md | + + Title: List blob containers with JavaScript - Azure Storage +description: Learn how to list blob containers in your Azure Storage account using the JavaScript client library. +++++ Last updated : 03/28/2022+++ms.devlang: javascript ++++# List blob containers with JavaScript ++When you list the containers in an Azure Storage account from your code, you can specify a number of options to manage how results are returned from Azure Storage. This article shows how to list containers using the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++## Understand container listing options ++To list containers in your storage account, call the following method: ++- BlobServiceClient.[listContainers](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-listcontainers) ++### List containers with optional prefix ++By default, a listing operation returns up to 5000 results at a time. ++The BlobServiceClient.[listContainers](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-listcontainers) returns a list of [ContainerItem](/javascript/api/@azure/storage-blob/containeritem) objects. Use the containerItem.name to create a [ContainerClient](/javascript/api/@azure/storage-blob/containerclient) in order to get a more complete [ContainerProperties](/javascript/api/@azure/storage-blob/containerproperties) object. ++```javascript +async function listContainers(blobServiceClient, containerNamePrefix) { ++ const options = { + includeDeleted: false, + includeMetadata: true, + includeSystem: true, + prefix: containerNamePrefix + } ++ for await (const containerItem of blobServiceClient.listContainers(options)) { ++ // ContainerItem + console.log(`For-await list: ${containerItem.name}`); ++ // ContainerClient + const containerClient = blobServiceClient.getContainerClient(containerItem.name); ++ // ... do something with container + } +} +``` ++## List containers with paging ++To return a smaller set of results, provide a nonzero value for the size of the page of results to return. ++If your storage account contains more than 5000 containers, or if you have specified a page size such that the listing operation returns a subset of containers in the storage account, then Azure Storage returns a *continuation token* with the list of containers. A continuation token is an opaque value that you can use to retrieve the next set of results from Azure Storage. ++In your code, check the value of the continuation token to determine whether it is empty. When the continuation token is empty, then the set of results is complete. If the continuation token is not empty, then call the listing method again, passing in the continuation token to retrieve the next set of results, until the continuation token is empty. ++```javascript +async function listContainersWithPagingMarker(blobServiceClient) { ++ // add prefix to filter list + const containerNamePrefix = ''; ++ // page size + const maxPageSize = 2; ++ const options = { + includeDeleted: false, + includeMetadata: true, + includeSystem: true, + prefix: containerNamePrefix + } + + let i = 1; + let marker; + let iterator = blobServiceClient.listContainers(options).byPage({ maxPageSize }); + let response = (await iterator.next()).value; ++ // Prints 2 container names + if (response.containerItems) { + for (const container of response.containerItems) { + console.log(`IteratorPaged: Container ${i++}: ${container.name}`); + } + } ++ // Gets next marker + marker = response.continuationToken; ++ // Passing next marker as continuationToken + iterator = blobServiceClient.listContainers().byPage({ continuationToken: marker, maxPageSize: maxPageSize * 2 }); + response = (await iterator.next()).value; ++ // Print next 4 container names + if (response.containerItems) { + for (const container of response.containerItems) { + console.log(`Container ${i++}: ${container.name}`); + } + } +} +``` ++Use the options parameter to the **listContainers** method to filter results with a prefix. ++### Filter results with a prefix ++To filter the list of containers, specify a string for the **prefix** property. The prefix string can include one or more characters. Azure Storage then returns only the containers whose names start with that prefix. ++```javascript +async function listContainers(blobServiceClient, containerNamePrefix) { ++ const options = { + includeDeleted: false, + includeMetadata: true, + includeSystem: true, ++ // filter with prefix + prefix: containerNamePrefix + } ++ for await (const containerItem of blobServiceClient.listContainers(options)) { ++ // do something with containerItem ++ } +} +``` ++### Include metadata in results ++To return container metadata with the results, specify the **metadata** value for the BlobContainerTraits enum. Azure Storage includes metadata with each container returned, so you do not need to fetch the container metadata as a separate operation. ++```javascript +async function listContainers(blobServiceClient, containerNamePrefix) { ++ const options = { + includeDeleted: false, + includeSystem: true, + prefix: containerNamePrefix, ++ // include metadata + includeMetadata: true, + } ++ for await (const containerItem of blobServiceClient.listContainers(options)) { ++ // do something with containerItem ++ } +} +``` ++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-dotnet-get-started.md) +- [List Containers](/rest/api/storageservices/list-containers2) +- [Enumerating Blob Resources](/rest/api/storageservices/enumerating-blob-resources) |
| storage | Storage Blob Copy Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-copy-javascript.md | + + Title: Copy a blob with JavaScript - Azure Storage +description: Learn how to copy a blob in Azure Storage by using the JavaScript client library. ++++ Last updated : 03/28/2022++++ms.devlang: javascript ++++# Copy a blob with Azure Storage using the JavaScript client library ++This article demonstrates how to copy a blob in an Azure Storage account. It also shows how to abort an asynchronous copy operation. The example code uses the Azure Storage client libraries. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++> [!NOTE] +> The examples in this article assume that you've created a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object by using the guidance in the [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) article. Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. To learn how to create a container, see [Create a container in Azure Storage with JavaScript](storage-blob-container-create.md). ++## About copying blobs ++When you copy a blob within the same storage account, it's a synchronous operation. When you copy across accounts it's an asynchronous operation. ++The source blob for a copy operation may be a block blob, an append blob, a page blob, or a snapshot. If the destination blob already exists, it must be of the same blob type as the source blob. An existing destination blob will be overwritten. ++The destination blob can't be modified while a copy operation is in progress. A destination blob can only have one outstanding copy operation. In other words, a blob can't be the destination for multiple pending copy operations. ++The entire source blob or file is always copied. Copying a range of bytes or set of blocks is not supported. ++When a blob is copied, its system properties are copied to the destination blob with the same values. ++A copy operation can take any of the following forms: ++- Copy a source blob to a destination blob with a different name. The destination blob can be an existing blob of the same blob type (block, append, or page), or can be a new blob created by the copy operation. +- Copy a source blob to a destination blob with the same name, effectively replacing the destination blob. Such a copy operation removes any uncommitted blocks and overwrites the destination blob's metadata. +- Copy a source file in the Azure File service to a destination blob. The destination blob can be an existing block blob, or can be a new block blob created by the copy operation. Copying from files to page blobs or append blobs is not supported. +- Copy a snapshot over its base blob. By promoting a snapshot to the position of the base blob, you can restore an earlier version of a blob. +- Copy a snapshot to a destination blob with a different name. The resulting destination blob is a writeable blob and not a snapshot. ++## Copy a blob ++To copy a blob, use the [BlobClient.beginCopyFromURL method](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-begincopyfromurl). The following code example gets a [BlobClient](/javascript/api/@azure/storage-blob/blobclient) representing a previously created blob and copies it to a new blob: ++```javascript +async function copyBlob( + blobServiceClient, + sourceBlobContainerName, + sourceBlobName, + destinationBlobContainerName, + destinationBlobName) { ++ // create container clients + const sourceContainerClient = blobServiceClient.getContainerClient(sourceBlobContainerName); + const destinationContainerClient = blobServiceClient.getContainerClient(destinationBlobContainerName); + + // create blob clients + const sourceBlobClient = await sourceContainerClient.getBlobClient(sourceBlobName); + const destinationBlobClient = await destinationContainerClient.getBlobClient(destinationBlobName); ++ // start copy + const copyPoller = await destinationBlobClient.beginCopyFromURL(sourceBlobClient.url); + console.log('start copy from A to B'); ++ // wait until done + await copyPoller.pollUntilDone(); +} +``` ++## Cancel a copy operation ++When you abort a copy operation, the destination blob's property, [copyStatus](/javascript/api/@azure/storage-blob/blobbegincopyfromurlresponse#properties), is set to [aborted](/javascript/api/@azure/storage-blob/copystatustype). ++```javascript +async function copyThenAbortBlob( + blobServiceClient, + sourceBlobContainerName, + sourceBlobName, + destinationBlobContainerName, + destinationBlobName) { ++ // create container clients + const sourceContainerClient = blobServiceClient.getContainerClient(sourceBlobContainerName); + const destinationContainerClient = blobServiceClient.getContainerClient(destinationBlobContainerName); + + // create blob clients + const sourceBlobClient = await sourceContainerClient.getBlobClient(sourceBlobName); + const destinationBlobClient = await destinationContainerClient.getBlobClient(destinationBlobName); ++ // start copy + const copyPoller = await destinationBlobClient.beginCopyFromURL(sourceBlobClient.url); + console.log('start copy from A to C'); ++ // cancel operation after starting it - + // sample file may be too small to be canceled. + try { + await copyPoller.cancelOperation(); + console.log('request to cancel copy from A to C'); ++ // calls to get the result now throw PollerCancelledError + await copyPoller.getResult(); + } catch (err) { + if (err.name === 'PollerCancelledError') { + console.log('The copy was cancelled.'); + } + } +} +``` ++## Abort a copy operation ++Aborting a copy operation, with [BlobClient.abortCopyFromURL](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-abortcopyfromurl) results in a destination blob of zero length. However, the metadata for the destination blob will have the new values copied from the source blob or set explicitly during the copy operation. To keep the original metadata from before the copy, make a snapshot of the destination blob before calling one of the copy methods. The final blob will be committed when the copy completes. ++## See also ++- [Copy Blob](/rest/api/storageservices/copy-blob) +- [Abort Copy Blob](/rest/api/storageservices/abort-copy-blob) +- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) |
| storage | Storage Blob Delete Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-delete-javascript.md | + + Title: Delete and restore a blob with JavaScript - Azure Storage +description: Learn how to delete and restore a blob in your Azure Storage account using the JavaScript client library ++++ Last updated : 03/28/2022++++ms.devlang: javascript ++++# Delete and restore a blob in your Azure Storage account using the JavaScript client library ++This article shows how to delete blobs with the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). If you've enabled blob soft delete, you can restore deleted blobs. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++> [!NOTE] +> The examples in this article assume that you've created a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object by using the guidance in the [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) article. Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. To learn how to create a container, see [Create a container in Azure Storage with JavaScript](storage-blob-container-create.md). ++## Delete a blob ++To delete a blob, call either of these methods: ++- [BlobClient.delete](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-delete) +- [BlobClient.deleteIfExists](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-deleteifexists) ++The following example deletes a blob. ++```javascript +async function deleteBlob(containerClient, blobName){ ++ // include: Delete the base blob and all of its snapshots. + // only: Delete only the blob's snapshots and not the blob itself. + const options = { + deleteSnapshots: 'include' // or 'only' + } ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ await blockBlobClient.delete(options); ++ console.log(`deleted blob ${blobName}`); ++} +``` ++The following example deletes a blob if it exists. ++```javascript +async function deleteBlobIfItExists(containerClient, blobName){ ++ // include: Delete the base blob and all of its snapshots. + // only: Delete only the blob's snapshots and not the blob itself. + const options = { + deleteSnapshots: 'include' // or 'only' + } ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ await blockBlobClient.deleteIfExists(options); ++ console.log(`deleted blob ${blobName}`); ++} +``` ++## Restore a deleted blob ++Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time. During the retention period, you can restore the blob to its state at deletion. After the retention period has expired, the blob is permanently deleted. For more information about blob soft delete, see [Soft delete for blobs](soft-delete-blob-overview.md). ++You can use the Azure Storage client libraries to restore a soft-deleted blob or snapshot. ++#### Restore soft-deleted objects when versioning is disabled ++To restore deleted blobs, call the following method: ++- [ContainerClient.undelete](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-undelete) ++This method restores soft-deleted blobs and any deleted snapshots associated with it. Calling this method for a blob that has not been deleted has no effect. ++```javascript +async function undeleteBlob(containerClient, blobName){ ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ await blockBlobClient.undelete(); ++ console.log(`undeleted blob ${blobName}`); ++} +``` ++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) +- [Delete Blob](/rest/api/storageservices/delete-blob) (REST API) +- [Soft delete for blobs](soft-delete-blob-overview.md) +- [Undelete Blob](/rest/api/storageservices/undelete-blob) (REST API) |
| storage | Storage Blob Download Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-download-javascript.md | + + Title: Download a blob with JavaScript - Azure Storage +description: Learn how to download a blob in Azure Storage by using the JavaScript client library. ++++ Last updated : 03/28/2022++++ms.devlang: javascript ++++# Download a blob in Azure Storage using the JavaScript client library ++You can download a blob by using any of the following methods: ++- Blob.[download](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-download) +- Blob.[downloadToBuffer](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-downloadtobuffer-1) +- Blob.[downloadToFile](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-downloadtofile) +++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++> [!NOTE] +> The examples in this article assume that you've created a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object by using the guidance in the [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) article. Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. To learn how to create a container, see [Create a container in Azure Storage with JavaScript](storage-blob-container-create.md). + +## Download to a file path ++The following example downloads a blob by using a file path with the [BlobClient.downloadToFile](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-downloadtofile) method: ++```javascript +async function downloadBlobToFile(containerClient, blobName, fileNameWithPath) { ++ const blobClient = await containerClient.getBlobClient(blobName); + + await blobClient.downloadToFile(fileNameWithPath); + console.log(`download of ${blobName} success`); +} +``` ++## Download as a stream ++The following example downloads a blob by creating a Node.js writable stream object and then piping to that stream with the [BlobClient.download](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-download) method. ++```javascript +async function downloadBlobAsStream(containerClient, blobName, writableStream) { ++ const blobClient = await containerClient.getBlobClient(blobName); ++ const downloadResponse = await blobClient.download(); ++ downloadResponse.readableStreamBody.pipe(writableStream); + console.log(`download of ${blobName} succeeded`); +} +``` ++## Download to a string ++The following example downloads a blob to a string with [BlobClient.download](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-download) method. ++```javascript ++async function downloadBlobToString(containerClient, blobName) { ++ const blobClient = await containerClient.getBlobClient(blobName); ++ const downloadResponse = await blobClient.download(); ++ const downloaded = await streamToBuffer(downloadResponse.readableStreamBody); + console.log('Downloaded blob content:', downloaded.toString()); +} ++async function streamToBuffer(readableStream) { + return new Promise((resolve, reject) => { + const chunks = []; + readableStream.on('data', (data) => { + chunks.push(data instanceof Buffer ? data : Buffer.from(data)); + }); + readableStream.on('end', () => { + resolve(Buffer.concat(chunks)); + }); + readableStream.on('error', reject); + }); +} +``` ++## See also ++- [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) +- [DownloadStreaming]() +- [Get Blob](/rest/api/storageservices/get-blob) (REST API) |
| storage | Storage Blob Javascript Get Started | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-javascript-get-started.md | + + Title: Get started with Azure Blob Storage and JavaScript ++description: Get started developing a JavaScript application that works with Azure Blob Storage. This article helps you set up a project and authorizes access to an Azure Blob Storage endpoint. +++++ Last updated : 03/30/2022+++++++# Get started with Azure Blob Storage and JavaScript ++This article shows you how to connect to Azure Blob Storage by using the Azure Blob Storage client library v12 for JavaScript. Once connected, your code can operate on containers, blobs, and features of the Blob Storage service. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++[Package (npm)](https://www.npmjs.com/package/@azure/storage-blob) | [Samples](../common/storage-samples-javascript.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json#blob-samples) | [API reference](/javascript/api/preview-docs/@azure/storage-blob) | [Library source code](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob) | [Give Feedback](https://github.com/Azure/azure-sdk-for-js/issues) ++## SDK Objects for service, container, and blob ++The [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object is the top object in the SDK. This client allows you to manipulate the service, containers and blobs. From the BlobServiceClient, you can get to the ContainerClient. The [ContainerClient](/javascript/api/@azure/storage-blob/containerclient) object allows you to interact with a container and its blobs. The [BlobClient](/javascript/api/@azure/storage-blob/blobclient) allows you to manipulate blobs. ++| Client | Allows access to | Accessed | +|--|--|--| +|Account: [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient)|Controls your service resource, provides access to container and blobs.|Directly from SDK via require statement.| +|Container: [ContainerClient](/javascript/api/@azure/storage-blob/containerclient)| Controls a specific container, provides access to blobs.|Directly from SDK via require statement or from [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient).| +|Blob: [BlobClient](/javascript/api/@azure/storage-blob/blobclient)|Access to a blob of any kind: [block](/javascript/api/@azure/storage-blob/blockblobclient), [append](/javascript/api/@azure/storage-blob/appendblobclient), [page](/javascript/api/@azure/storage-blob/pageblobclient).|Directly from SDK via require statement or from [ContainerClient](/javascript/api/@azure/storage-blob/containerclient).| ++ ++## Prerequisites ++- Azure subscription - [create one for free](https://azure.microsoft.com/free/) +- Azure storage account - [create a storage account](../common/storage-account-create.md) +- [Node.js LTS](https://nodejs.org/) +- Optionally, you need [bundling tools](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Bundling.md) if you're developing for a web client. ++## Set up your project ++1. Open a command prompt and change into your project folder: ++ ```bash + cd YOUR-DIRECTORY + ``` ++1. If you don't have a `package.json` file already in your directory, initialize the project to create the file: ++ ```bash + npm init -y + ``` ++1. Install the Azure Blob Storage client library for JavaScript: ++ ```bash + npm install @azure/storage-blob + ``` ++1. If you want to connect with managed identity, install the Azure Identity client library for JavaScript: ++ ```bash + npm install @azure/identity + ``` ++1. In your `index.js` file, add the package: ++ ```javascript + const { BlobServiceClient, StorageSharedKeyCredential } = require('@azure/storage-blob'); ++ // optional but suggested - connect with managed identity + const { DefaultAzureCredential } = require('@azure/identity'); + ``` ++++## Connect with an account name and key ++Create a [StorageSharedKeyCredential](/javascript/api/@azure/storage-blob/storagesharedkeycredential) by using the storage account name and account key. Then use the StorageSharedKeyCredential to initialize a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient). ++```javascript +const { BlobServiceClient, StorageSharedKeyCredential } = require('@azure/storage-blob'); +require('dotenv').config() ++const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME; +const accountKey = process.env.AZURE_STORAGE_ACCOUNT_KEY; +if (!accountName) throw Error('Azure Storage accountName not found'); +if (!accountKey) throw Error('Azure Storage accountKey not found'); ++const sharedKeyCredential = new StorageSharedKeyCredential(accountName, accountKey); ++const blobServiceClient = new BlobServiceClient( + `https://${accountName}.blob.core.windows.net`, + sharedKeyCredential +); ++async function main(){ + const serviceGetPropertiesResponse = await blobServiceClient.getProperties(); + console.log(`${JSON.stringify(serviceGetPropertiesResponse)}`); +} ++main() + .then(() => console.log(`done`)) + .catch((ex) => console.log(ex.message)); +``` ++For information about how to obtain account keys and best practice guidelines for properly managing and safeguarding your keys, see [Manage storage account access keys](../common/storage-account-keys-manage.md). ++## Connect with a connection string ++Create a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) by using a connection string. ++```javascript +const { BlobServiceClient } = require('@azure/storage-blob'); +require('dotenv').config() ++const connString = process.env.AZURE_STORAGE_CONNECTION_STRING; +if (!connString) throw Error('Azure Storage Connection string not found'); ++const blobServiceClient = BlobServiceClient.fromConnectionString(connString); ++async function main(){ + const serviceGetPropertiesResponse = await blobServiceClient.getProperties(); + console.log(`${JSON.stringify(serviceGetPropertiesResponse)}`); +} ++main() + .then(() => console.log(`done`)) + .catch((ex) => console.log(ex.message)); +``` ++For information about how to obtain account keys and best practice guidelines for properly managing and safeguarding your keys, see [Manage storage account access keys](../common/storage-account-keys-manage.md). ++## Object Authorization with a SAS token ++Create a Uri to your resource by using the blob service endpoint and SAS token. Then, create a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) with the Uri. ++```javascript +const { BlobServiceClient } = require('@azure/storage-blob'); +require('dotenv').config() ++const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME; +const sasToken = process.env.AZURE_STORAGE_SAS_TOKEN; +if (!accountName) throw Error('Azure Storage accountName not found'); +if (!sasToken) throw Error('Azure Storage accountKey not found'); ++const blobServiceUri = `https://${accountName}.blob.core.windows.net`; ++const blobServiceClient = new BlobServiceClient( + `${blobServiceUri}${sasToken}`, + null +); ++async function main(){ + const serviceGetPropertiesResponse = await blobServiceClient.getProperties(); + console.log(`${JSON.stringify(serviceGetPropertiesResponse)}`); +} ++main() + .then(() => console.log(`done`)) + .catch((ex) => console.log(`error: ${ex.message}`)); +``` ++To generate and manage SAS tokens, see any of these articles: ++- [Grant limited access to Azure Storage resources using shared access signatures (SAS)](../common/storage-sas-overview.md?toc=/azure/storage/blobs/toc.json) ++- [Create a service SAS for a container or blob](sas-service-create.md) +++## Object authorization with Azure AD ++To authorize with Azure AD, you'll need to use an Azure credential. Which type of credential you need depends on where your application runs. Use this table as a guide. ++| Where the application runs | Security principal | Guidance | +|--|--|| +| Local machine (developing and testing) | User identity or service principal | [Use the Azure Identity library to get an access token for authorization](../common/identity-library-acquire-token.md) | +| Azure | Managed identity | [Authorize access to blob data with managed identities for Azure resources](authorize-managed-identity.md) | +| Servers or clients outside of Azure | Service principal | [Authorize access to blob or queue data from a native or web application](../common/storage-auth-aad-app.md?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json) | ++If you're testing on a local machine, or your application will run in Azure virtual machines (VMs), Functions apps, virtual machine scale sets, or in other Azure services, obtain an OAuth token by creating a [DefaultAzureCredential](/javascript/api/overview/azure/identity-readme#defaultazurecredential) instance. Use that object to create a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient). ++```javascript +const { BlobServiceClient } = require('@azure/storage-blob'); +const { DefaultAzureCredential } = require('@azure/identity'); +require('dotenv').config() ++const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME; +if (!accountName) throw Error('Azure Storage accountName not found'); ++const blobServiceClient = new BlobServiceClient( + `https://${accountName}.blob.core.windows.net`, + new DefaultAzureCredential() +); ++async function main(){ + const serviceGetPropertiesResponse = await blobServiceClient.getProperties(); + console.log(`${JSON.stringify(serviceGetPropertiesResponse)}`); +} ++main() + .then(() => console.log(`done`)) + .catch((ex) => console.log(`error: ${ex.message}`)); +``` ++If you plan to deploy the application to servers and clients that run outside of Azure, you can obtain an OAuth token by using other classes in the [Azure Identity client library for JavaScript](/javascript/api/overview/azure/identity-readme) which derive from the [TokenCredential](/javascript/api/@azure/core-auth/tokencredential) class. ++## Connect anonymously ++If you explicitly enable anonymous access, then you can connect to Blob Storage without authorization for your request. You can create a new BlobServiceClient object for anonymous access by providing the Blob storage endpoint for the account. This requires you to know the account and container names. To learn how to enable anonymous access, see [Configure anonymous public read access for containers and blobs](anonymous-read-access-configure.md). ++```javascript +const { BlobServiceClient, AnonymousCredential } = require('@azure/storage-blob'); +require('dotenv').config() ++const accountName = process.env.AZURE_STORAGE_ACCOUNT_NAME; +if (!accountName) throw Error('Azure Storage accountName not found'); ++const blobServiceUri = `https://${accountName}.blob.core.windows.net`; ++const blobServiceClient = new BlobServiceClient( + blobServiceUri, + new AnonymousCredential() +); ++async function getContainerProperties(){ ++ // Access level: 'container' + const containerName = `blob-storage-dev-guide-1`; ++ const containerClient = blobServiceClient.getContainerClient(containerName); + const containerProperties = await containerClient.getProperties(); + console.log(JSON.stringify(containerProperties)); ++} ++getContainerProperties() + .then(() => console.log(`done`)) + .catch((ex) => console.log(`error: ${ex.message}`)); +``` ++Each type of resource is represented by one or more associated JavaScript clients: ++| Class | Description | +||| +| [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) | Represents the Blob Storage endpoint for your storage account. | +| [ContainerClient](/javascript/api/@azure/storage-blob/containerclient) | Allows you to manipulate Azure Storage containers and their blobs. | +| [BlobClient](/javascript/api/@azure/storage-blob/blobclient) | Allows you to manipulate Azure Storage blobs.| ++The following guides show you how to use each of these clients to build your application. The [sample code](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) shown is this guide is available on GitHub. ++| Guide | Description | +|--|| +| [Create a container](storage-blob-container-create-javascript.md) | Create containers. | +| [Delete and restore containers](storage-blob-container-delete-javascript.md) | Delete containers, and if soft-delete is enabled, restore deleted containers. | +| [List containers](storage-blob-containers-list-javascript.md) | List containers in an account and the various options available to customize a listing. | +| [Manage properties and metadata](storage-blob-container-properties-metadata-javascript.md) | Get and set properties and metadata for containers. | +| [Upload blobs](storage-blob-upload-javascript.md) | Learn how to upload blobs by using strings, streams, file paths, and other methods. | +| [Download blobs](storage-blob-download-javascript.md) | Download blobs by using strings, streams, and file paths. | +| [Copy blobs](storage-blob-copy-javascript.md) | Copy a blob from one account to another account. | +| [List blobs](storage-blobs-list-javascript.md) | List blobs in different ways. | +| [Delete and restore](storage-blob-delete-javascript.md) | Delete blobs, and if soft-delete is enabled, restore deleted blobs. | +| [Find blobs using tags](storage-blob-tags-javascript.md) | Set and retrieve indexed tags then use tags to find blobs. | +| [Manage properties and metadata](storage-blob-properties-metadata-javascript.md) | Get all system properties and set HTTP properties and metadata for blobs. | ++## See also ++- [Package (npm)](https://www.npmjs.com/package/@azure/storage-blob) +- [Samples](../common/storage-samples-javascript.md?toc=%2fazure%2fstorage%2fblobs%2ftoc.json#blob-samples) +- [API reference](/javascript/api/@azure/storage-blob/) +- [Library source code](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob) +- [Give Feedback](https://github.com/Azure/azure-sdk-for-js/issues) |
| storage | Storage Blob Properties Metadata Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-properties-metadata-javascript.md | + + Title: Manage properties and metadata for a blob with JavaScript - Azure Storage +description: Learn how to set and retrieve system properties and store custom metadata on blobs in your Azure Storage account using the JavaScript client library. ++++ Last updated : 03/28/2022++++ms.devlang: csharp ++++# Manage blob properties and metadata with JavaScript ++In addition to the data they contain, blobs support system properties and user-defined metadata. This article shows how to manage system properties and user-defined metadata with the [Azure Storage client library for JavaScript](https://www.npmjs.com/package/@azure/storage-blob). ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++## About properties and metadata ++- **System properties**: System properties exist on each Blob storage resource. Some of them can be read or set, while others are read-only. Under the covers, some system properties correspond to certain standard HTTP headers. The Azure Storage client library for JavaScript maintains these properties for you. ++- **User-defined metadata**: User-defined metadata consists of one or more name-value pairs that you specify for a Blob storage resource. You can use metadata to store additional values with the resource. Metadata values are for your own purposes only, and don't affect how the resource behaves. ++> [!NOTE] +> Blob index tags also provide the ability to store arbitrary user-defined key/value attributes alongside an Azure Blob storage resource. While similar to metadata, only blob index tags are automatically indexed and made searchable by the native blob service. Metadata cannot be indexed and queried unless you utilize a separate service such as Azure Search. +> +> To learn more about this feature, see [Manage and find data on Azure Blob storage with blob index (preview)](storage-manage-find-blobs.md). ++## Set blob http headers ++The following code example sets blob HTTP system properties on a blob. ++To set the HTTP properties for a blob, call [BlobClient.setHTTPHeaders](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-sethttpheaders). Review the [BlobHTTPHeaders properties](/javascript/api/@azure/storage-blob/blobhttpheaders) to know which HTTP properties you want to set. Any HTTP properties not explicitly set are cleared. ++```javascript +/* +properties= { + blobContentType: 'text/plain', + blobContentLanguage: 'en-us', + blobContentEncoding: 'utf-8', + // all other http properties are cleared + } +*/ +async function setHTTPHeaders(blobClient, headers) { ++ await blobClient.setHTTPHeaders(headers); ++ console.log(`headers set successfully`); +} +``` +++## Set metadata ++You can specify metadata as one or more name-value pairs on a blob or container resource. To set metadata, send a JSON object of name-value pairs with ++- [BlobClient.setMetadata](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-setmetadata) returns a [BlobGetPropertiesResponse object](/javascript/api/@azure/storage-blob/blobgetpropertiesresponse). ++Metadata name/value pairs are valid HTTP headers and should adhere to all restrictions governing HTTP headers. Metadata names must be valid HTTP header names and valid C# identifiers, may contain only ASCII characters, and should be treated as case-insensitive. Either [Base64-encode](/dotnet/api/system.convert.tobase64string) or [URL-encode](/dotnet/api/system.web.httputility.urlencode) your metadata values containing non-ASCII characters. ++Metadata names maintain the case used when they were created, but are case-insensitive when set or read. If two or more metadata headers using the same name are submitted for a resource, Azure Blob storage returns HTTP error code 400 (Bad Request). ++The following code example sets metadata on a blob. ++```javascript +/* +metadata= { + reviewedBy: 'Bob', + releasedBy: 'Jill', +} +*/ +async function setBlobMetadata(blobClient, metadata) { ++ await blobClient.setMetadata(metadata); ++ console.log(`metadata set successfully`); ++} +``` ++To read the metadata, get the blob's properties (shown below), specifically referencing the `metadata` property. ++## Get blob properties ++The following code example gets a blob's system properties, including HTTP headers and metadata, and displays those values. ++```javascript +async function getProperties(blobClient) { ++ const properties = await blobClient.getProperties(); + console.log(blobClient.name + ' properties: '); ++ for (const property in properties) { ++ switch (property) { + // nested properties are stringified and returned as strings + case 'metadata': + case 'objectReplicationRules': + console.log(` ${property}: ${JSON.stringify(properties[property])}`); + break; + default: + console.log(` ${property}: ${properties[property]}`); + break; + } + } +} +``` ++The output for these console.log lines looks like: ++```console +my-blob.txt properties: + lastModified: Thu Apr 21 2022 13:02:53 GMT-0700 (Pacific Daylight Time) + createdOn: Thu Apr 21 2022 13:02:53 GMT-0700 (Pacific Daylight Time) + metadata: {"releasedby":"Jill","reviewedby":"Bob"} + objectReplicationPolicyId: undefined + objectReplicationRules: {} + blobType: BlockBlob + copyCompletedOn: undefined + copyStatusDescription: undefined + copyId: undefined + copyProgress: undefined + copySource: undefined + copyStatus: undefined + isIncrementalCopy: undefined + destinationSnapshot: undefined + leaseDuration: undefined + leaseState: available + leaseStatus: unlocked + contentLength: 19 + contentType: text/plain + etag: "0x8DA23D1EBA8E607" + contentMD5: undefined + contentEncoding: utf-8 + contentDisposition: undefined + contentLanguage: en-us + cacheControl: undefined + blobSequenceNumber: undefined + clientRequestId: 58da0441-7224-4837-9b4a-547f9a0c7143 + requestId: 26acb38a-001e-0046-27ba-55ef22000000 + version: 2021-04-10 + date: Thu Apr 21 2022 13:02:52 GMT-0700 (Pacific Daylight Time) + acceptRanges: bytes + blobCommittedBlockCount: undefined + isServerEncrypted: true + encryptionKeySha256: undefined + encryptionScope: undefined + accessTier: Hot + accessTierInferred: true + archiveStatus: undefined + accessTierChangedOn: undefined + versionId: undefined + isCurrentVersion: undefined + tagCount: undefined + expiresOn: undefined + isSealed: undefined + rehydratePriority: undefined + lastAccessed: undefined + immutabilityPolicyExpiresOn: undefined + immutabilityPolicyMode: undefined + legalHold: undefined + errorCode: undefined + body: true + _response: [object Object] + objectReplicationDestinationPolicyId: undefined + objectReplicationSourceProperties: +``` +++## See also ++- [Set Blob Properties operation](/rest/api/storageservices/set-blob-properties) +- [Get Blob Properties operation](/rest/api/storageservices/get-blob-properties) +- [Set Blob Metadata operation](/rest/api/storageservices/set-blob-metadata) +- [Get Blob Metadata operation](/rest/api/storageservices/get-blob-metadata) |
| storage | Storage Blob Tags Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-tags-javascript.md | + + Title: Use blob index tags to find data in Azure Blob Storage (JavaScript) +description: Learn how to categorize, manage, and query for blob objects by using the JavaScript client library. ++++ Last updated : 03/28/2022++++ms.devlang: javascript ++++# Use blob index tags to manage and find data in Azure Blob Storage (JavaScript) ++Blob index tags categorize data in your storage account using key-value tag attributes. These tags are automatically indexed and exposed as a searchable multi-dimensional index to easily find data. This article shows you how to set, get, and find data using blob index tags. ++To learn more about this feature along with known issues and limitations, see [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md). ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++> [!NOTE] +> The examples in this article assume that you've created a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object by using the guidance in the [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) article. Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. To learn how to create a container, see [Create a container in Azure Storage with JavaScript](storage-blob-container-create.md). ++## Set and retrieve index tags ++You can set and get index tags if your code has authorized access by using an account key or if your code uses a security principal that has been given the appropriate role assignments. For more information, see [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md). ++#### Set tags ++You can set tags at blob upload time or by using the following method: ++- [BlobClient.setTags](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-settags) ++The following example performs this task. ++```javascript +// A blob can have up to 10 tags. +// +// const tags = { +// project: 'End of month billing summary', +// reportOwner: 'John Doe', +// reportPresented: 'April 2022' +// } +async function setTags(containerClient, blobName, tags) { ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // Set tags + await blockBlobClient.setTags(tags); ++ console.log(`uploading blob ${blobName}`); +} +``` ++You can delete all tags by passing an empty JSON object into the setTags method. ++| Related articles | +|--| +| [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md) | +| [Set Blob Tags](/rest/api/storageservices/set-blob-tags) (REST API) | ++#### Get tags ++You can get tags by using either of the following methods: ++- [BlobClient.getTags](/javascript/api/@azure/storage-blob/blobclient#@azure-storage-blob-blobclient-gettags +) ++The following example shows how to get and iterate over the blob's tags. ++```javascript +async function getTags(containerClient, blobName) { ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // Get tags + const result = await blockBlobClient.getTags(); ++ for (const tag in result.tags) { ++ console.log(`TAG: ${tag}: ${result.tags[tag]}`); + } +} +``` ++## Filter and find data with blob index tags ++You can use index tags to find and filter data if your code has authorized access by using an account key or if your code uses a security principal that has been given the appropriate role assignments. For more information, see [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md). ++> [!NOTE] +> You can't use index tags to retrieve previous versions. Tags for previous versions aren't passed to the blob index engine. For more information, see [Conditions and known issues](storage-manage-find-blobs.md#conditions-and-known-issues). ++Data is queried with a JSON object sent as a string. The properties don't need to have additional string quotes but the values do need additional string quotes. ++The following table shows some query strings: ++|Query string for tags (tagOdataQuery)|Description| +|--|--| +|`id='1' AND project='billing'`|Filter blobs across all containers based on these two properties| +|`owner='PhillyProject' AND createdOn >= '2021-12' AND createdOn <= '2022-06'`|Filter blobs across all containers based on strict property value for `owner` and range of dates for `createdOn` property.| +|`@container = 'my-container' AND createdBy = 'Jill'`|**Filter by container** and specific property. In this query, `createdBy` is a text match and doesn't indicate an authorization match through Active Directory. | +++You can find data by using the following method: ++- [BlobServiceClient.findBlobsByTags](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-findblobsbytags) ++The following example finds all blobs matching the tagOdataQuery parameter. ++```javascript +async function findBlobsByQuery(blobServiceClient, tagOdataQuery) { ++ // page size + const maxPageSize = 10; ++ let i = 1; + let marker; ++ const listOptions = { + includeMetadata: true, + includeSnapshots: false, + includeTags: true, + includeVersions: false + }; ++ let iterator = blobServiceClient.findBlobsByTags(tagOdataQuery, listOptions).byPage({ maxPageSize }); + let response = (await iterator.next()).value; ++ // Prints blob names + if (response.blobs) { + for (const blob of response.blobs) { + console.log(`Blob ${i++}: ${blob.name} - ${JSON.stringify(blob.tags)}`); + } + } ++ // Gets next marker + marker = response.continuationToken; + + // no more blobs + if (!marker) return; + + // Passing next marker as continuationToken + iterator = blobServiceClient + .findBlobsByTags(tagOdataQuery, listOptions) + .byPage({ continuationToken: marker, maxPageSize }); + response = (await iterator.next()).value; ++ // Prints blob names + if (response.blobs) { + for (const blob of response.blobs) { + console.log(`Blob ${i++}: ${blob.name} - ${JSON.stringify(blob.tags)}`); + } + } +} +``` ++And example output for this function shows the matched blobs and their tags, based on the console.log code in the preceding function: ++|Response| +|-| +|Blob 1: set-tags-1650565920363-query-by-tag-blob-a-1.txt - {"createdOn":"2022-01","owner":"PhillyProject","project":"set-tags-1650565920363"}| ++## See also ++- [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md) +- [Get Blob Tags](/rest/api/storageservices/get-blob-tags) (REST API) +- [Find Blobs by Tags](/rest/api/storageservices/find-blobs-by-tags) (REST API) |
| storage | Storage Blob Upload Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-upload-javascript.md | + + Title: Upload a blob using JavaScript - Azure Storage +description: Learn how to upload a blob to your Azure Storage account using the JavaScript client library. ++++ Last updated : 03/28/2022++++ms.devlang: javascript ++++# Upload a blob to Azure Storage by using the JavaScript client library ++You can upload a blob, open a blob stream and write to that, or upload large blobs in blocks. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++> [!NOTE] +> The examples in this article assume that you've created a [BlobServiceClient](/javascript/api/@azure/storage-blob/blobserviceclient) object by using the guidance in the [Get started with Azure Blob Storage and JavaScript](storage-blob-javascript-get-started.md) article. Blobs in Azure Storage are organized into containers. Before you can upload a blob, you must first create a container. To learn how to create a container, see [Create a container in Azure Storage with JavaScript](storage-blob-container-create.md). +++## Upload by using a file path ++The following example uploads a local file to blob storage with the [BlockBlobClient](/javascript/api/@azure/storage-blob/blockblobclient) object. The [options](/javascript/api/@azure/storage-blob/blockblobparalleluploadoptions) object allows you to pass in your own metadata and [tags](storage-manage-find-blobs.md#blob-index-tags-and-data-management), used for indexing, at upload time: ++```javascript +// uploadOptions: { +// metadata: { reviewer: 'john', reviewDate: '2022-04-01' }, +// tags: {project: 'xyz', owner: 'accounts-payable'} +// } +async function createBlobFromLocalPath(containerClient, blobName, localFileWithPath, uploadOptions){ ++ // create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // upload file to blob storage + await blockBlobClient.uploadFile(localFileWithPath, uploadOptions); + console.log(`${blobName} succeeded`); +} +``` ++## Upload by using a Stream ++The following example uploads a readable stream to blob storage with the [BlockBlobClient](/javascript/api/@azure/storage-blob/blockblobclient) object. Pass in the BlockBlobUploadStream [options](/javascript/api/@azure/storage-blob/blockblobuploadstreamoptions) to affect the upload: ++```javascript +// uploadOptions: { +// metadata: { reviewer: 'john', reviewDate: '2022-04-01' }, +// tags: {project: 'xyz', owner: 'accounts-payable'}, +// } +async function createBlobFromReadStream(containerClient, blobName, readableStream, uploadOptions) { ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // Size of every buffer allocated, also + // the block size in the uploaded block blob. + // Default value is 8MB + const bufferSize = 4 * 1024 * 1024; ++ // Max concurrency indicates the max number of + // buffers that can be allocated, positive correlation + // with max uploading concurrency. Default value is 5 + const maxConcurrency = 20; ++ // use transform per chunk - only to see chunck + const transformedReadableStream = readableStream.pipe(myTransform); ++ // Upload stream + await blockBlobClient.uploadStream(transformedReadableStream, bufferSize, maxConcurrency, uploadOptions); ++ // do something with blob + const getTagsResponse = await blockBlobClient.getTags(); + console.log(`tags for ${blobName} = ${JSON.stringify(getTagsResponse.tags)}`); +} ++// Transform stream +// Reasons to transform: +// 1. Sanitize the data - remove PII +// 2. Compress or uncompress +const myTransform = new Transform({ + transform(chunk, encoding, callback) { + // see what is in the artificially + // small chunk + console.log(chunk); + callback(null, chunk); + }, + decodeStrings: false +}); ++``` ++## Upload by using a BinaryData object ++The following example uploads a Node.js buffer to blob storage with the [BlockBlobClient](/javascript/api/@azure/storage-blob/blockblobclient) object. Pass in the BlockBlobParallelUpload [options](/javascript/api/@azure/storage-blob/blockblobparalleluploadoptions) to affect the upload: ++```javascript +// uploadOptions: { +// blockSize: destination block blob size in bytes, +// concurrency: concurrency of parallel uploading - must be greater than or equal to 0, +// maxSingleShotSize: blob size threshold in bytes to start concurrency uploading +// metadata: { reviewer: 'john', reviewDate: '2022-04-01' }, +// tags: {project: 'xyz', owner: 'accounts-payable'} +// } +async function createBlobFromBuffer(containerClient, blobName, buffer, uploadOptions) { ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // Upload buffer + await blockBlobClient.uploadData(buffer, uploadOptions); ++ // do something with blob + const getTagsResponse = await blockBlobClient.getTags(); + console.log(`tags for ${blobName} = ${JSON.stringify(getTagsResponse.tags)}`); +} +``` ++## Upload a string ++The following example uploads a string to blob storage with the [BlockBlobClient](/javascript/api/@azure/storage-blob/blockblobclient) object. Pass in the BlockBlobUploadOptions [options](/javascript/api/@azure/storage-blob/blockblobuploadoptions) to affect the upload: ++```javascript +// uploadOptions: { +// metadata: { reviewer: 'john', reviewDate: '2022-04-01' }, +// tags: {project: 'xyz', owner: 'accounts-payable'} +// } +async function createBlobFromString(containerClient, blobName, fileContentsAsString, uploadOptions){ ++ // Create blob client from container client + const blockBlobClient = await containerClient.getBlockBlobClient(blobName); ++ // Upload string + await blockBlobClient.upload(fileContentsAsString, fileContentsAsString.length, uploadOptions); ++ // do something with blob + const getTagsResponse = await blockBlobClient.getTags(); + console.log(`tags for ${blobName} = ${JSON.stringify(getTagsResponse.tags)}`); +} +``` ++## See also ++- [Manage and find Azure Blob data with blob index tags](storage-manage-find-blobs.md) +- [Use blob index tags to manage and find data on Azure Blob Storage](storage-blob-index-how-to.md) +- [Put Blob](/rest/api/storageservices/put-blob) (REST API) +- [Put Blob From URL](/rest/api/storageservices/put-blob-from-url) (REST API) |
| storage | Storage Blobs List Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blobs-list-javascript.md | + + Title: List blobs with JavaScript - Azure Storage +description: Learn how to list blobs in your storage account using the Azure Storage client library for JavaScript. Code examples show how to list blobs in a flat listing, or how to list blobs hierarchically, as though they were organized into directories or folders. +++++ Last updated : 03/28/2022+++ms.devlang: javascript ++++# List blobs using the Azure Storage client library for JavaScript ++When you list blobs from your code, you can specify a number of options to manage how results are returned from Azure Storage. You can specify the number of results to return in each set of results, and then retrieve the subsequent sets. You can specify a prefix to return blobs whose names begin with that character or string. And you can list blobs in a flat listing structure, or hierarchically. A hierarchical listing returns blobs as though they were organized into folders. ++The [sample code snippets](https://github.com/Azure-Samples/AzureStorageSnippets/tree/master/blobs/howto/JavaScript/NodeJS-v12/dev-guide) are available in GitHub as runnable Node.js files. ++## Understand blob listing options ++To list the blobs in a storage account, call one of these methods: +++- [ContainerClient.listBlobsByHierarcy](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-listblobsbyhierarchy) +- [ContainerClient.listBlobsFlat](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-listblobsflat) ++Related functionality can be found in the following methods: ++- [BlobServiceClient.findBlobsByTag](/javascript/api/@azure/storage-blob/blobserviceclient#@azure-storage-blob-blobserviceclient-findblobsbytags) +- [ContainerClient.findBlobsByTag](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-findblobsbytags) ++### Manage how many results are returned ++By default, a listing operation returns up to 5000 results at a time, but you can specify the number of results that you want each listing operation to return. The examples presented in this article show you how to return results in pages. ++### Filter results with a prefix ++To filter the list of blobs, specify a string for the `prefix` property in the [list options](/javascript/api/@azure/storage-blob/containerlistblobsoptions). The prefix string can include one or more characters. Azure Storage then returns only the blobs whose names start with that prefix. ++```javascript +const listOptions = { + includeCopy: false, // include metadata from previous copies + includeDeleted: false, // include deleted blobs + includeDeletedWithVersions: false, // include deleted blobs with versions + includeLegalHost: false, // include legal host id + includeMetadata: true, // include custom metadata + includeSnapshots: true, // include snapshots + includeTags: true, // include indexable tags + includeUncommittedBlobs: false, // include uncommitted blobs + includeVersions: false, // include all blob version + prefix: '' // filter by blob name prefix +}; +``` ++### Return metadata ++You can return blob metadata with the results by specifying the `includeMetadata` property in the [list options](/javascript/api/@azure/storage-blob/containerlistblobsoptions). ++### Flat listing versus hierarchical listing ++Blobs in Azure Storage are organized in a flat paradigm, rather than a hierarchical paradigm (like a classic file system). However, you can organize blobs into *virtual directories* in order to mimic a folder structure. A virtual directory forms part of the name of the blob and is indicated by the delimiter character. ++To organize blobs into virtual directories, use a delimiter character in the blob name. The default delimiter character is a forward slash (/), but you can specify any character as the delimiter. ++If you name your blobs using a delimiter, then you can choose to list blobs hierarchically. For a hierarchical listing operation, Azure Storage returns any virtual directories and blobs beneath the parent object. You can call the listing operation recursively to traverse the hierarchy, similar to how you would traverse a classic file system programmatically. ++If you've enabled the hierarchical namespace feature on your account, directories are not virtual. Instead, they are concrete, independent objects. Therefore, directories appear in the list as zero-length blobs. ++## Use a flat listing ++By default, a listing operation returns blobs in a flat listing. In a flat listing, blobs are not organized by virtual directory. ++The following example lists the blobs in the specified container using a flat listing. ++```javascript +async function listBlobsFlatWithPageMarker(containerClient) { ++ // page size - artificially low as example + const maxPageSize = 2; ++ let i = 1; + let marker; ++ // some options for filtering list + const listOptions = { + includeMetadata: true, + includeSnapshots: false, + includeTags: true, + includeVersions: false, + prefix: '' + }; ++ let iterator = containerClient.listBlobsFlat(listOptions).byPage({ maxPageSize }); + let response = (await iterator.next()).value; ++ // Prints blob names + for (const blob of response.segment.blobItems) { + console.log(`Flat listing: ${i++}: ${blob.name}`); + } ++ // Gets next marker + marker = response.continuationToken; ++ // Passing next marker as continuationToken + iterator = containerClient.listBlobsFlat().byPage({ + continuationToken: marker, + maxPageSize: maxPageSize * 2 + }); + response = (await iterator.next()).value; ++ // Prints next blob names + for (const blob of response.segment.blobItems) { + console.log(`Flat listing: ${i++}: ${blob.name}`); + } +} +``` ++The sample output is similar to: ++```console +Flat listing: 1: a0/blob-0.txt +Flat listing: 2: a1/blob-1.txt +Flat listing: 3: a2/blob-2.txt +``` ++## Use a hierarchical listing ++When you call a listing operation hierarchically, Azure Storage returns the virtual directories and blobs at the first level of the hierarchy. ++To list blobs hierarchically, call the [BlobContainerClient.listBlobsByHierarchy](/javascript/api/@azure/storage-blob/containerclient#@azure-storage-blob-containerclient-listblobsbyhierarchy) method. ++The following example lists the blobs in the specified container using a hierarchical listing, with an optional segment size specified, and writes the blob name to the console window. ++```javascript +// Recursively list virtual folders and blobs +async function listBlobHierarchical(containerClient, virtualHierarchyDelimiter='/') { ++ // page size - artificially low as example + const maxPageSize = 2; ++ // some options for filtering list + const listOptions = { + includeMetadata: true, + includeSnapshots: false, + includeTags: true, + includeVersions: false, + prefix: '' + }; ++ let i = 1; + console.log(`Folder ${virtualHierarchyDelimiter}`); ++ for await (const response of containerClient + .listBlobsByHierarchy(virtualHierarchyDelimiter, listOptions) + .byPage({ maxPageSize })) { ++ console.log(` Page ${i++}`); + const segment = response.segment; ++ if (segment.blobPrefixes) { ++ // Do something with each virtual folder + for await (const prefix of segment.blobPrefixes) { ++ // build new virtualHierarchyDelimiter from current and next + await listBlobHierarchical(containerClient, `${virtualHierarchyDelimiter}${prefix.name}`); + } + } ++ for (const blob of response.segment.blobItems) { ++ // Do something with each blob + console.log(`\tBlobItem: name - ${blob.name}`); + } + } +} +``` ++The sample output is similar to: ++```console +Hier listing: Folder / + Page 1 +Hier listing: Folder /a0/ + Page 1 + BlobItem: name - a0/blob-0.txt + BlobItem: name - a1/blob-1.txt + Page 2 + BlobItem: name - a2/blob-2.txt +Hier listing: Folder /a1/ + Page 1 + BlobItem: name - a0/blob-0.txt + BlobItem: name - a1/blob-1.txt + Page 2 + BlobItem: name - a2/blob-2.txt + Page 2 +Hier listing: Folder /a2/ + Page 1 + BlobItem: name - a0/blob-0.txt + BlobItem: name - a1/blob-1.txt + Page 2 + BlobItem: name - a2/blob-2.txt +``` ++> [!NOTE] +> Blob snapshots cannot be listed in a hierarchical listing operation. ++## Next steps ++- [List Blobs](/rest/api/storageservices/list-blobs) +- [Enumerating Blob Resources](/rest/api/storageservices/enumerating-blob-resources) +- [Blob versioning](versioning-overview.md) |
| storage | Storage Account Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/common/storage-account-overview.md | The following table describes the types of storage accounts recommended by Micro | Premium file shares<sup>3</sup> | Azure Files | LRS<br /><br />ZRS<sup>2</sup> | Premium storage account type for file shares only. Recommended for enterprise or high-performance scale applications. Use this account type if you want a storage account that supports both Server Message Block (SMB) and NFS file shares. | | Premium page blobs<sup>3</sup> | Page blobs only | LRS | Premium storage account type for page blobs only. [Learn more about page blobs and sample use cases.](../blobs/storage-blob-pageblob-overview.md) | -<sup>1</sup> Data Lake Storage is a set of capabilities dedicated to big data analytics, built on Azure Blob storage. For more information, see [Introduction to Data Lake Storage Gen2](../blobs/data-lake-storage-introduction.md) and [Create a storage account to use with Data Lake Storage Gen2](../blobs/create-data-lake-storage-account.md). +<sup>1</sup> Data Lake Storage is a set of capabilities dedicated to big data analytics, built on Azure Blob Storage. For more information, see [Introduction to Data Lake Storage Gen2](../blobs/data-lake-storage-introduction.md) and [Create a storage account to use with Data Lake Storage Gen2](../blobs/create-data-lake-storage-account.md). <sup>2</sup> ZRS, GZRS, and RA-GZRS are available only for standard general-purpose v2, premium block blobs, and premium file shares accounts in certain regions. For more information, see [Azure Storage redundancy](storage-redundancy.md). |
| storage | Storage Network Security | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/common/storage-network-security.md | You can use the same technique for an account that has the hierarchical namespac | Microsoft Purview | Microsoft.Purview/accounts | Allows Microsoft Purview to access storage accounts. | | Azure Remote Rendering | Microsoft.MixedReality/remoteRenderingAccounts | Allows access to storage accounts through Remote Rendering. | | Azure Site Recovery | Microsoft.RecoveryServices/vaults | Allows access to storage accounts through Site Recovery. |-| Azure SQL Database | Microsoft.Sql | Allows [writing](../../azure-sql/database/audit-write-storage-account-behind-vnet-firewall.md) audit data to storage accounts behind firewall. | -| Azure Synapse Analytics | Microsoft.Sql | Allows import and export of data from specific SQL databases using the COPY statement or PolyBase (in dedicated pool), or the `openrowset` function and external tables in serverless pool. [Learn more](../../azure-sql/database/vnet-service-endpoint-rule-overview.md). | +| Azure SQL Database | Microsoft.Sql | Allows [writing](/azure/azure-sql/database/audit-write-storage-account-behind-vnet-firewall) audit data to storage accounts behind firewall. | +| Azure Synapse Analytics | Microsoft.Sql | Allows import and export of data from specific SQL databases using the COPY statement or PolyBase (in dedicated pool), or the `openrowset` function and external tables in serverless pool. [Learn more](/azure/azure-sql/database/vnet-service-endpoint-rule-overview). | | Azure Stream Analytics | Microsoft.StreamAnalytics | Allows data from a streaming job to be written to Blob storage. [Learn more](../../stream-analytics/blob-output-managed-identity.md). | | Azure Synapse Analytics | Microsoft.Synapse/workspaces | Enables access to data in Azure Storage from Azure Synapse Analytics. | |
| storage | Storage Use Azcopy V10 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/common/storage-use-azcopy-v10.md | Title: Copy or move data to Azure Storage by using AzCopy v10 | Microsoft Docs -description: AzCopy is a command-line utility that you can use to copy data to, from, or between storage accounts. This article helps you download AzCopy, connect to your storage account, and then transfer files. +description: AzCopy is a command-line utility that you can use to copy data to, from, or between storage accounts. This article helps you download AzCopy, connect to your storage account, and then transfer data. -AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account. This article helps you download AzCopy, connect to your storage account, and then transfer files. +AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account. This article helps you download AzCopy, connect to your storage account, and then transfer data. > [!NOTE] > AzCopy **V10** is the currently supported version of AzCopy. |
| storage | File Sync Networking Endpoints | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/file-sync/file-sync-networking-endpoints.md | IP4Address : 192.168.0.5 If you have a virtual machine inside of your virtual network, or you've configured DNS forwarding as described in [Configuring DNS forwarding for Azure Files](../files/storage-files-networking-dns.md?toc=%2fazure%2fstorage%2ffilesync%2ftoc.json), you can test that your private endpoint has been set up correctly with the following commands: -```bash +```azurecli httpEndpoint=$(az storage account show \ --resource-group $storageAccountResourceGroupName \ --name $storageAccountName \ foreach($ipFqdn in $privateEndpointIpFqdnMappings) { # [Azure CLI](#tab/azure-cli) To create a private endpoint for your Storage Sync Service, first you will need to get a reference to your Storage Sync Service. Remember to replace `<storage-sync-service-resource-group>` and `<storage-sync-service>` with the correct values for your environment. The following CLI commands assume that you are using have already populated the virtual network information from above. -```bash +```azurecli storageSyncServiceResourceGroupName="<storage-sync-service-resource-group>" storageSyncServiceName="<storage-sync-service>" storageSyncServiceRegion=$(az resource show \ To create a private endpoint, you must first ensure that the subnet's private endpoint network policy is set to disabled. Then you can create a private endpoint with the `az network private-endpoint create` command. -```bash +```azurecli # Disable private endpoint network policies az network vnet subnet update \ --ids $subnet \ privateEndpoint=$(az network private-endpoint create \ Creating an Azure private DNS zone enables the host names for the Storage Sync Service, such as `mysssmanagement.westus2.afs.azure.net`, to resolve to the correct private IPs for the Storage Sync Service inside of the virtual network. Although optional from the perspective of creating a private endpoint, it is explicitly required for the Azure File Sync agent to access the Storage Sync Service. -```bash +```azurecli # Get the desired storage account suffix (afs.azure.net for public cloud). # This is done like this so this script will seamlessly work for non-public Azure. azureEnvironment=$(az cloud show \ |
| storage | Files Smb Protocol | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/files-smb-protocol.md | echo $protocolSettings To enable/disable SMB Multichannel, use the `az storage account file-service-properties update` command. -```bash +```azurecli az storage account file-service-properties update \ --resource-group $resourceGroupName \ --account-name $storageAccountName \ Depending on your organizations security, performance, and compatibility require > [!Important] > Restricting SMB Azure file shares to only the most secure options may result in some clients not being able to connect if they do not meet the requirements. For example, AES-256-GCM was introduced as an option for SMB channel encryption starting in Windows Server 2022 and Windows 11. This means that older clients that do not support AES-256-GCM will not be able to connect. -```bash +```azurecli az storage account file-service-properties update \ --resource-group $resourceGroupName \ --account-name $storageAccountName \ |
| storage | Storage Files Configure P2s Vpn Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/storage-files-configure-p2s-vpn-linux.md | Remember to replace `<desired-vpn-name-here>` with the name you would like for t > > P2S IKEv2/OpenVPN connections are not supported with the **Basic** SKU. This script uses the **VpnGw1** SKU for the virtual network gateway, accordingly. -```bash +```azurecli vpnName="<desired-vpn-name-here>" publicIpAddressName="$vpnName-PublicIP" az network vnet-gateway root-cert create \ ## Configure the VPN client The Azure virtual network gateway will create a downloadable package with configuration files required to initialize the VPN connection on your on-premises Linux machine. The following script will place the certificates you created in the correct spot and configure the `ipsec.conf` file with the correct values from the configuration file in the downloadable package. -```bash +```azurecli vpnClient=$(az network vnet-gateway vpn-client generate \ --resource-group $resourceGroupName \ --name $vpnName \ |
| storage | Storage Files Enable Soft Delete | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/storage-files-enable-soft-delete.md | Get-AzStorageFileServiceProperty ` # [Azure CLI](#tab/azure-cli) To enable soft delete, you must update a file client's service properties. The following example enables soft delete for all file shares in a storage account. Remember to replace `<resource-group>` and `<storage-account>` with the appropriate values for your environment. -```bash +```azurecli resourceGroupName="<resource-group>" storageAccountName="<storage-account>" az storage account file-service-properties update \ You can verify if soft delete is enabled and view its retention policy with the following command: -```bash +```azurecli az storage account file-service-properties show \ -resource-group $resourceGroupName \ -account-name $storageAccountName Restore-AzRmStorageShare ` # [Azure CLI](#tab/azure-cli) To restore a soft deleted file share, you must first get the `--deleted-version` value of the share. To get that value, use the following command to list out all the deleted shares for your storage account. -```bash +```azurecli az storage share-rm list \ --resource-group $resourceGroupName \ --storage-account $storageAccountName \ az storage share-rm list \ Once you've identified the share you'd like to restore, you can use it with the following command to restore it: -```bash +```azurecli az storage share-rm restore -n deletedshare --deleted-version 01D64EB9886F00C4 -g yourResourceGroup --storage-account yourStorageaccount ``` Update-AzStorageFileServiceProperty ` # [Azure CLI](#tab/azure-cli) You can use the following command to disable soft delete on your storage account. -```bash +```azurecli az storage account file-service-properties update \ --resource-group $resourceGroupName \ --storage-account $storageAccountName \ |
| storage | Storage Files Networking Endpoints | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/storage-files-networking-endpoints.md | IP4Address : 192.168.0.5 If you have a virtual machine inside of your virtual network, or you've configured DNS forwarding as described in [Configuring DNS forwarding for Azure Files](storage-files-networking-dns.md), you can test that your private endpoint has been set up correctly with the following commands: -```bash +```azurecli httpEndpoint=$(az storage account show \ --resource-group $storageAccountResourceGroupName \ --name $storageAccountName \ |
| storage | Storage How To Use Files Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/storage-how-to-use-files-linux.md | Next, mount the file share using the `mount` command. In the following example, > [!Note] > Starting in Linux kernel version 5.0, SMB 3.1.1 is the default negotiated protocol. If you're using a version of the Linux kernel older than 5.0, specify `vers=3.1.1` in the mount options list. -```bash +```azurecli # This command assumes you have logged in with az login httpEndpoint=$(az storage account show \ --resource-group $resourceGroupName \ sudo mount -t cifs $smbPath $mntPath -o username=$storageAccountName,password=$s ``` # [SMB 3.0](#tab/smb30)-```bash +```azurecli # This command assumes you have logged in with az login httpEndpoint=$(az storage account show \ --resource-group $resourceGroupName \ sudo mount -t cifs $smbPath $mntPath -o vers=3.0,username=$storageAccountName,pa ``` # [SMB 2.1](#tab/smb21)-```bash +```azurecli # This command assumes you have logged in with az login httpEndpoint=$(az storage account show \ --resource-group $resourceGroupName \ |
| storage | Storage Dotnet How To Use Queues | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/queues/storage-dotnet-how-to-use-queues.md | Now that you've learned the basics of Queue Storage, follow these links to learn - View more feature guides to learn about additional options for storing data in Azure. - [Get started with Azure Table Storage using .NET](../../cosmos-db/tutorial-develop-table-dotnet.md) to store structured data. - [Get started with Azure Blob Storage using .NET](../blobs/storage-quickstart-blobs-dotnet.md) to store unstructured data.- - [Connect to SQL Database by using .NET (C#)](../../azure-sql/database/connect-query-dotnet-core.md) to store relational data. + - [Connect to SQL Database by using .NET (C#)](/azure/azure-sql/database/connect-query-dotnet-core) to store relational data. - Learn how to simplify the code you write to work with Azure Storage by using the [Azure WebJobs SDK](https://github.com/Azure/azure-webjobs-sdk/wiki). |
| stream-analytics | Sql Database Output Managed Identity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/sql-database-output-managed-identity.md | After you've created a managed identity, you select an Active Directory admin.  - The Active Directory admin page shows all members and groups of your Active Directory. Grayed out users or groups can't be selected as they're not supported as Azure Active Directory administrators. See the list of supported admins in the **Azure Active Directory Features and Limitations** section of [Use Azure Active Directory Authentication for authentication with SQL Database or Azure Synapse](../azure-sql/database/authentication-aad-overview.md#azure-ad-features-and-limitations). + The Active Directory admin page shows all members and groups of your Active Directory. Grayed out users or groups can't be selected as they're not supported as Azure Active Directory administrators. See the list of supported admins in the **Azure Active Directory Features and Limitations** section of [Use Azure Active Directory Authentication for authentication with SQL Database or Azure Synapse](/azure/azure-sql/database/authentication-aad-overview#azure-ad-features-and-limitations). 1. Select **Save** on the **Active Directory admin** page. The process for changing admin takes a few minutes. After you've created a managed identity, you select an Active Directory admin. Next, you create a contained database user in your Azure SQL or Azure Synapse database that is mapped to the Azure Active Directory identity. The contained database user doesn't have a login for the primary database, but it maps to an identity in the directory that is associated with the database. The Azure Active Directory identity can be an individual user account or a group. In this case, you want to create a contained database user for your Stream Analytics job. -For more information, review the following article for background on Azure AD integration: [Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](../azure-sql/database/authentication-mfa-ssms-overview.md) +For more information, review the following article for background on Azure AD integration: [Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](/azure/azure-sql/database/authentication-mfa-ssms-overview) 1. Connect to your Azure SQL or Azure Synapse database using SQL Server Management Studio. The **User name** is an Azure Active Directory user with the **ALTER ANY USER** permission. The admin you set on the SQL Server is an example. Use **Azure Active Directory – Universal with MFA** authentication. |
| stream-analytics | Sql Database Output | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/sql-database-output.md | Last updated 05/30/2021 You can use [Azure SQL Database](https://azure.microsoft.com/services/sql-database/) as an output for data that's relational in nature or for applications that depend on content being hosted in a relational database. Azure Stream Analytics jobs write to an existing table in SQL Database. The table schema must exactly match the fields and their types in your job's output. You can also specify [Azure Synapse Analytics](https://azure.microsoft.com/documentation/services/sql-data-warehouse/) as an output via the SQL Database output option. To learn about ways to improve write throughput, see the [Stream Analytics with Azure SQL Database as output](stream-analytics-sql-output-perf.md) article. -You can also use [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) as an output. You have to [configure public endpoint in SQL Managed Instance](../azure-sql/managed-instance/public-endpoint-configure.md) and then manually configure the following settings in Azure Stream Analytics. Azure virtual machine running SQL Server with a database attached is also supported by manually configuring the settings below. +You can also use [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) as an output. You have to [configure public endpoint in SQL Managed Instance](/azure/azure-sql/managed-instance/public-endpoint-configure) and then manually configure the following settings in Azure Stream Analytics. Azure virtual machine running SQL Server with a database attached is also supported by manually configuring the settings below. ## Output configuration Partitioning needs to enabled and is based on the PARTITION BY clause in the que ## Output batch size -You can configure the max message size by using **Max batch count**. The default maximum is 10,000 and the default minimum is 100 rows per single bulk insert. For more information, see [Azure SQL limits](../azure-sql/database/resource-limits-logical-server.md). Every batch is initially bulk inserted with maximum batch count. Batch is split in half (until minimum batch count) based on retryable errors from SQL. +You can configure the max message size by using **Max batch count**. The default maximum is 10,000 and the default minimum is 100 rows per single bulk insert. For more information, see [Azure SQL limits](/azure/azure-sql/database/resource-limits-logical-server). Every batch is initially bulk inserted with maximum batch count. Batch is split in half (until minimum batch count) based on retryable errors from SQL. ## Limitation |
| stream-analytics | Sql Database Upsert | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/sql-database-upsert.md | You can now test the wiring between the local function and the database by debug [{"DeviceId":3,"Value":13.4,"Timestamp":"2021-11-30T03:22:12.991Z"},{"DeviceId":4,"Value":41.4,"Timestamp":"2021-11-30T03:22:12.991Z"}] ``` -The function can now be [published](../azure-functions/create-first-function-vs-code-csharp.md#publish-the-project-to-azure) to Azure. An [application setting](../azure-functions/functions-how-to-use-azure-function-app-settings.md?tabs=portal#settings) should be set for `SqlConnectionString`. The Azure SQL **Server** firewall should [allow Azure services](../azure-sql/database/network-access-controls-overview.md) in for the live function to reach it. +The function can now be [published](../azure-functions/create-first-function-vs-code-csharp.md#publish-the-project-to-azure) to Azure. An [application setting](../azure-functions/functions-how-to-use-azure-function-app-settings.md?tabs=portal#settings) should be set for `SqlConnectionString`. The Azure SQL **Server** firewall should [allow Azure services](/azure/azure-sql/database/network-access-controls-overview) in for the live function to reach it. The function can then be defined as an output in the ASA job, and used to replace records instead of inserting them. You can now test the wiring between the local function and the database by debug [{"DeviceId":3,"Value":13.4,"Timestamp":"2021-11-30T03:22:12.991Z"},{"DeviceId":4,"Value":41.4,"Timestamp":"2021-11-30T03:22:12.991Z"}] ``` -The function can now be [published](../azure-functions/create-first-function-vs-code-csharp.md#publish-the-project-to-azure) to Azure. An [application setting](../azure-functions/functions-how-to-use-azure-function-app-settings.md?tabs=portal#settings) should be set for `SqlConnectionString`. The Azure SQL **Server** firewall should [allow Azure services](../azure-sql/database/network-access-controls-overview.md) in for the live function to reach it. +The function can now be [published](../azure-functions/create-first-function-vs-code-csharp.md#publish-the-project-to-azure) to Azure. An [application setting](../azure-functions/functions-how-to-use-azure-function-app-settings.md?tabs=portal#settings) should be set for `SqlConnectionString`. The Azure SQL **Server** firewall should [allow Azure services](/azure/azure-sql/database/network-access-controls-overview) in for the live function to reach it. The function can then be defined as an output in the ASA job, and used to replace records instead of inserting them. |
| stream-analytics | Sql Reference Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/sql-reference-data.md | Please see [delta query](sql-reference-data.md#delta-query).  -3. Test the snapshot query in the SQL query editor. For more information, see [Use the Azure portal's SQL query editor to connect and query data](../azure-sql/database/connect-query-portal.md) +3. Test the snapshot query in the SQL query editor. For more information, see [Use the Azure portal's SQL query editor to connect and query data](/azure/azure-sql/database/connect-query-portal) ### Specify storage account in Job config Use the following steps to add Azure SQL Database as a reference input source us ### Create a SQL Database table -Use SQL Server Management Studio to create a table to store your reference data. See [Design your first Azure SQL Database using SSMS](../azure-sql/database/design-first-database-tutorial.md) for details. +Use SQL Server Management Studio to create a table to store your reference data. See [Design your first Azure SQL Database using SSMS](/azure/azure-sql/database/design-first-database-tutorial) for details. The example table used in the following example was created from the following statement: Before deploying the job to Azure, you can test the query logic locally against ## Delta query -When using the delta query, [temporal tables in Azure SQL Database](../azure-sql/temporal-tables.md) are recommended. +When using the delta query, [temporal tables in Azure SQL Database](/azure/azure-sql/temporal-tables) are recommended. 1. Create a temporal table in Azure SQL Database. |
| stream-analytics | Stream Analytics Sql Output Perf | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/stream-analytics-sql-output-perf.md | Last updated 03/18/2019 This article discusses tips to achieve better write throughput performance when you're loading data into Azure SQL Database using Azure Stream Analytics. -SQL output in Azure Stream Analytics supports writing in parallel as an option. This option allows for [fully parallel](stream-analytics-parallelization.md#embarrassingly-parallel-jobs) job topologies, where multiple output partitions are writing to the destination table in parallel. Enabling this option in Azure Stream Analytics however may not be sufficient to achieve higher throughputs, as it depends significantly on your database configuration and table schema. The choice of indexes, clustering key, index fill factor, and compression have an impact on the time to load tables. For more information about how to optimize your database to improve query and load performance based on internal benchmarks, see [SQL Database performance guidance](../azure-sql/database/performance-guidance.md). Ordering of writes is not guaranteed when writing in parallel to SQL Database. +SQL output in Azure Stream Analytics supports writing in parallel as an option. This option allows for [fully parallel](stream-analytics-parallelization.md#embarrassingly-parallel-jobs) job topologies, where multiple output partitions are writing to the destination table in parallel. Enabling this option in Azure Stream Analytics however may not be sufficient to achieve higher throughputs, as it depends significantly on your database configuration and table schema. The choice of indexes, clustering key, index fill factor, and compression have an impact on the time to load tables. For more information about how to optimize your database to improve query and load performance based on internal benchmarks, see [SQL Database performance guidance](/azure/azure-sql/database/performance-guidance). Ordering of writes is not guaranteed when writing in parallel to SQL Database. Here are some configurations within each service that can help improve overall throughput of your solution. |
| stream-analytics | Stream Analytics Troubleshoot Output | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/stream-analytics-troubleshoot-output.md | When a Stream Analytics job with SQL output receives the first batch of events, During these steps, the SQL output can experience following types of errors: -* Transient [errors](../azure-sql/database/troubleshoot-common-errors-issues.md#transient-fault-error-messages-40197-40613-and-others) that are retried using an exponential backoff retry strategy. The minimum retry interval depends on the individual error code, but the intervals are typically less than 60 seconds. The upper limit can be at most five minutes. +* Transient [errors](/azure/azure-sql/database/troubleshoot-common-errors-issues#transient-fault-error-messages-40197-40613-and-others) that are retried using an exponential backoff retry strategy. The minimum retry interval depends on the individual error code, but the intervals are typically less than 60 seconds. The upper limit can be at most five minutes. - [Login failures](../azure-sql/database/troubleshoot-common-errors-issues.md#unable-to-log-in-to-the-server-errors-18456-40531) and [firewall issues](../azure-sql/database/troubleshoot-common-errors-issues.md#cannot-connect-to-server-due-to-firewall-issues) are retried at least 5 minutes after the previous try and are retried until they succeed. + [Login failures](/azure/azure-sql/database/troubleshoot-common-errors-issues#unable-to-log-in-to-the-server-errors-18456-40531) and [firewall issues](/azure/azure-sql/database/troubleshoot-common-errors-issues#cannot-connect-to-server-due-to-firewall-issues) are retried at least 5 minutes after the previous try and are retried until they succeed. * Data errors, such as casting errors and schema constraint violations, are handled with output error policy. These errors are handled by retrying binary split batches until the individual record causing the error is handled by skip or retry. Primary Unique key constraint violation is [always handled](./stream-analytics-troubleshoot-output.md#key-violation-warning-with-azure-sql-database-output). |
| stream-analytics | Stream Analytics Use Reference Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/stream-analytics-use-reference-data.md | With the delta query option, Stream Analytics runs the snapshot query initially To configure your SQL Database reference data, you first need to create reference data input. The following table explains each property you need to provide when you create the reference data input with its description. For more information, see [Use reference data from a SQL Database for a Stream Analytics job](sql-reference-data.md). -You can use [Azure SQL Managed Instance](../azure-sql/managed-instance/sql-managed-instance-paas-overview.md) as a reference data input. You must [configure a public endpoint in SQL Managed Instance](../azure-sql/managed-instance/public-endpoint-configure.md). Then you manually configure the following settings in Stream Analytics. An Azure virtual machine running SQL Server with a database attached is also supported by manually configuring these settings. +You can use [Azure SQL Managed Instance](/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview) as a reference data input. You must [configure a public endpoint in SQL Managed Instance](/azure/azure-sql/managed-instance/public-endpoint-configure). Then you manually configure the following settings in Stream Analytics. An Azure virtual machine running SQL Server with a database attached is also supported by manually configuring these settings. |Property name|Description | ||| |
| synapse-analytics | Security White Paper Access Control | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/guidance/security-white-paper-access-control.md | In addition to securing SQL tables in Azure Synapse, dedicated SQL pool (formerl ## Dynamic data masking -[Dynamic data masking](../../azure-sql/database/dynamic-data-masking-overview.md) allows security administrators to restrict sensitive data exposure by masking it on read to non-privileged users. It helps prevent unauthorized access to sensitive data by enabling administrators to determine how the data is displayed at query time. Based on the identity of the authenticated user and their group assignment in the SQL pool, a query returns either masked or unmasked data. Masking is always applied regardless of whether data is accessed directly from a table or by using a view or stored procedure. +[Dynamic data masking](/azure/azure-sql/database/dynamic-data-masking-overview) allows security administrators to restrict sensitive data exposure by masking it on read to non-privileged users. It helps prevent unauthorized access to sensitive data by enabling administrators to determine how the data is displayed at query time. Based on the identity of the authenticated user and their group assignment in the SQL pool, a query returns either masked or unmasked data. Masking is always applied regardless of whether data is accessed directly from a table or by using a view or stored procedure. > [!NOTE] > Dynamic data masking is supported in Azure Synapse and dedicated SQL pool (formerly SQL DW), but it's not supported for Apache Spark pool and serverless SQL pool. |
| synapse-analytics | Security White Paper Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/guidance/security-white-paper-authentication.md | Last updated 01/14/2022 [!INCLUDE [security-white-paper-context](includes/security-white-paper-context.md)] -Authentication is the process of proving the user is who they claim to be. Authentication activities can be logged with [Azure SQL Auditing](../../azure-sql/database/auditing-overview.md), and an IT administrator can configure reports and alerts whenever a login from a suspicious location is attempted. +Authentication is the process of proving the user is who they claim to be. Authentication activities can be logged with [Azure SQL Auditing](/azure/azure-sql/database/auditing-overview), and an IT administrator can configure reports and alerts whenever a login from a suspicious location is attempted. ## Benefits Some of the benefits of these robust authentication mechanisms include: - Strong password policies to deter brute force attacks. - User password encryption.-- [Firewall rules](../../azure-sql/database/firewall-configure.md).+- [Firewall rules](/azure/azure-sql/database/firewall-configure). - SQL endpoints with [Multi-factor authentication](../sql/mfa-authentication.md). - Elimination of the need to manage credentials with [managed identity](../../data-factory/data-factory-service-identity.md). |
| synapse-analytics | Security White Paper Data Protection | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/guidance/security-white-paper-data-protection.md | Once the data discovery process is complete, it provides classification recommen Azure Synapse provides two options for data discovery and classification: -- [Data Discovery & Classification](../../azure-sql/database/data-discovery-and-classification-overview.md), which is built into Azure Synapse and dedicated SQL pool (formerly SQL DW).+- [Data Discovery & Classification](/azure/azure-sql/database/data-discovery-and-classification-overview), which is built into Azure Synapse and dedicated SQL pool (formerly SQL DW). - [Microsoft Purview](https://azure.microsoft.com/services/purview/), which is a unified data governance solution that helps manage and govern on-premises, multicloud, and software-as-a-service (SaaS) data. It can automate data discovery, lineage identification, and data classification. By producing a unified map of data assets and their relationships, it makes data easily discoverable. > [!NOTE] Data is encrypted at rest and in transit. By default, Azure Storage [automatically encrypts all data](../../storage/common/storage-service-encryption.md) using 256-bit Advanced Encryption Standard encryption (AES 256). It's one of the strongest block ciphers available and is FIPS 140-2 compliant. The platform manages the encryption key, and it forms the *first layer* of data encryption. This encryption applies to both user and system databases, including the **master** database. -Enabling [Transparent Data Encryption](../../azure-sql/database/transparent-data-encryption-tde-overview.md) (TDE) can add a *second layer* of data encryption for dedicated SQL pools. It performs real-time I/O encryption and decryption of database files, transaction logs files, and backups at rest without requiring any changes to the application. By default, it uses AES 256. +Enabling [Transparent Data Encryption](/azure/azure-sql/database/transparent-data-encryption-tde-overview) (TDE) can add a *second layer* of data encryption for dedicated SQL pools. It performs real-time I/O encryption and decryption of database files, transaction logs files, and backups at rest without requiring any changes to the application. By default, it uses AES 256. By default, TDE protects the database encryption key (DEK) with a built-in server certificate (service managed). There's an option to bring your own key (BYOK) that can be securely stored in [Azure Key Vault](../../key-vault/general/basic-concepts.md). |
| synapse-analytics | Security White Paper Threat Protection | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/guidance/security-white-paper-threat-protection.md | Azure Synapse provides SQL Auditing, SQL Threat Detection, and Vulnerability Ass ## Auditing -[Auditing for Azure SQL Database](../../azure-sql/database/auditing-overview.md#overview) and Azure Synapse tracks database events and writes them to an audit log in an Azure storage account, Log Analytics workspace, or Event Hubs. For any database, auditing is important. It produces an audit trail over time to help understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations. -Used with [Data discovery and classification](../../azure-sql/database/data-discovery-and-classification-overview.md), when any sensitive columns or tables are queried by users, entries will appear in a field named **data_sensitivity_information** of the **sql_audit_information** table. +[Auditing for Azure SQL Database](/azure/azure-sql/database/auditing-overview#overview) and Azure Synapse tracks database events and writes them to an audit log in an Azure storage account, Log Analytics workspace, or Event Hubs. For any database, auditing is important. It produces an audit trail over time to help understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations. +Used with [Data discovery and classification](/azure/azure-sql/database/data-discovery-and-classification-overview), when any sensitive columns or tables are queried by users, entries will appear in a field named **data_sensitivity_information** of the **sql_audit_information** table. > [!NOTE] > Azure SQL Auditing applies to Azure Synapse, dedicated SQL pool (formerly SQL DW), and serverless SQL pool, but it doesn't apply to Apache Spark pool. Used with [Data discovery and classification](../../azure-sql/database/data-disc [Microsoft Defender for Cloud](../../defender-for-cloud/defender-for-cloud-introduction.md) is a tool for security posture management and threat detection. It protects workloads running in Azure, including (but not exclusively) servers, app service, key vaults, Kubernetes services, storage accounts, and Azure SQL Databases. -As one of the options available with Microsoft Defender for Cloud, [Microsoft Defender for SQL](../../azure-sql/database/azure-defender-for-sql.md) extends Defender for Cloud's data security package to secure databases. It can discover and mitigate potential database vulnerabilities by detecting anomalous activities that could be a potential threat to the database. Specifically, it continually monitors your database for: +As one of the options available with Microsoft Defender for Cloud, [Microsoft Defender for SQL](/azure/azure-sql/database/azure-defender-for-sql) extends Defender for Cloud's data security package to secure databases. It can discover and mitigate potential database vulnerabilities by detecting anomalous activities that could be a potential threat to the database. Specifically, it continually monitors your database for: > [!div class="checklist"] > - Potential SQL injection attacks Alert notifications include details of the incident, and recommendations on how ## Vulnerability assessment -[SQL vulnerability assessment](../../azure-sql/database/sql-vulnerability-assessment.md) is part of the Microsoft Defender for SQL offering. It continually monitors the data warehouse, ensuring that databases are always maintained at a high level of security and that organizational policies are met. It provides a comprehensive security report along with actionable remediation steps for each issue found, making it easy to proactively manage database security stature even if you're not a security expert. +[SQL vulnerability assessment](/azure/azure-sql/database/sql-vulnerability-assessment) is part of the Microsoft Defender for SQL offering. It continually monitors the data warehouse, ensuring that databases are always maintained at a high level of security and that organizational policies are met. It provides a comprehensive security report along with actionable remediation steps for each issue found, making it easy to proactively manage database security stature even if you're not a security expert. > [!NOTE] > SQL vulnerability assessment applies to Azure Synapse and dedicated SQL pool (formerly SQL DW). It doesn't apply to serverless SQL pool or Apache Spark pool. |
| synapse-analytics | How To Recover Workspace After Tenant Move | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/how-to-recover-workspace-after-tenant-move.md | After transferring the subscription to another tenant, follow the below steps to 1. [Disable and re-enable the system Assigned Managed Identity](#disablereenable). More information later in this article. 2. [Assign Azure RBAC (role based access control) permissions to the required Azure AD users, groups, and managed identities](../role-based-access-control/transfer-subscription.md#step-3-re-create-resources) on the Synapse Analytics workspace and required Azure resources.-3. [Set the SQL Active Directory admin.](../azure-sql/database/authentication-aad-configure.md?tabs=azure-powershell#provision-azure-ad-admin-sql-database) +3. [Set the SQL Active Directory admin.](/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#provision-azure-ad-admin-sql-database) 4. Re-create [Azure AD users and groups](sql/sql-authentication.md?tabs=provisioned#non-administrator-users) based on their equivalent users and groups in the new Azure AD tenant for the dedicated and serverless SQL pools. 5. Assign Azure RBAC to Azure AD users, groups to Synapse Analytics workspace. This step should be first step after recovering the workspace. Without this step, launching Synapse Studio will throw 403 messages, due to Azure AD users not having permissions on the workspace: ```JSON |
| synapse-analytics | Migrate To Synapse Analytics Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/migration-guides/migrate-to-synapse-analytics-guide.md | The following sections provide an overview of what's involved with migrating an ## Overview -Before you begin your migration, you should verify that Azure Synapse Analytics is the best solution for your workload. Azure Synapse Analytics is a distributed system designed to perform analytics on large data. Migrating to Azure Synapse Analytics requires some design changes that aren't difficult to understand but that might take some time to implement. If your business requires an enterprise-class data warehouse, the benefits are worth the effort. However, if you don't need the power of Azure Synapse Analytics, it's more cost-effective to use [SQL Server](/sql/sql-server/) or [Azure SQL Database](../../azure-sql/index.yml). +Before you begin your migration, you should verify that Azure Synapse Analytics is the best solution for your workload. Azure Synapse Analytics is a distributed system designed to perform analytics on large data. Migrating to Azure Synapse Analytics requires some design changes that aren't difficult to understand but that might take some time to implement. If your business requires an enterprise-class data warehouse, the benefits are worth the effort. However, if you don't need the power of Azure Synapse Analytics, it's more cost-effective to use [SQL Server](/sql/sql-server/) or [Azure SQL Database](/azure/azure-sql/index). Consider using Azure Synapse Analytics when you: |
| synapse-analytics | Browse Partners | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/partner/browse-partners.md | When you chose a partner application, Azure Synapse Studio provisions a sandbox | -- | - | | A [dedicated SQL pool](../overview-what-is.md) named **Partner_[PartnerName]_pool** | DW100c performance level. | | A [SQL login](/sql/relational-databases/security/authentication-access/principals-database-engine#sa-login) named **Partner_[PartnerName]_login** | Created on your `master` database. The password for this SQL login is specified by you at the creation of your trial.|-| A [database user](../../azure-sql/database/logins-create-manage.md) | A new database user, mapped to the new SQL login. This user is added to the db_owner role for the newly created database. | +| A [database user](/azure/azure-sql/database/logins-create-manage) | A new database user, mapped to the new SQL login. This user is added to the db_owner role for the newly created database. | In all cases, **[PartnerName]** is the name of the third-party ISV who offers the trial. |
| synapse-analytics | Quickstart Copy Activity Load Sql Pool | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/quickstart-copy-activity-load-sql-pool.md | In this quickstart, you learn how to *load data from Azure SQL Database into Azu * Azure subscription: If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. * Azure Synapse workspace: Create a Synapse workspace using the Azure portal following the instructions in [Quickstart: Create a Synapse workspace](quickstart-create-workspace.md).-* Azure SQL Database: This tutorial copies data from the Adventure Works LT sample dataset in Azure SQL Database. You can create this sample database in SQL Database by following the instructions in [Create a sample database in Azure SQL Database](../azure-sql/database/single-database-create-quickstart.md). Or you can use other data stores by following similar steps. +* Azure SQL Database: This tutorial copies data from the Adventure Works LT sample dataset in Azure SQL Database. You can create this sample database in SQL Database by following the instructions in [Create a sample database in Azure SQL Database](/azure/azure-sql/database/single-database-create-quickstart). Or you can use other data stores by following similar steps. * Azure storage account: Azure Storage is used as the *staging* area in the copy operation. If you don't have an Azure storage account, see the instructions in [Create a storage account](../storage/common/storage-account-create.md). * Azure Synapse Analytics: You use a dedicated SQL pool as a sink data store. If you don't have an Azure Synapse Analytics instance, see [Create a dedicated SQL pool](quickstart-create-sql-pool-portal.md) for steps to create one. |
| synapse-analytics | Connectivity Settings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/security/connectivity-settings.md | Selecting the **Disable** option will not apply any firewall rules that you may 5. Select **Save** to save the change. A notification will confirm that the network setting was successfully saved. ## Connection policy-The connection policy for Synapse SQL in Azure Synapse Analytics is set to *Default*. You cannot change this in Azure Synapse Analytics. You can learn more about how that affects connections to Synapse SQL in Azure Synapse Analytics [here](../../azure-sql/database/connectivity-architecture.md#connection-policy). +The connection policy for Synapse SQL in Azure Synapse Analytics is set to *Default*. You cannot change this in Azure Synapse Analytics. You can learn more about how that affects connections to Synapse SQL in Azure Synapse Analytics [here](/azure/azure-sql/database/connectivity-architecture#connection-policy). ## Minimal TLS version The serverless SQL endpoint and development endpoint only accept TLS 1.2 and above. |
| synapse-analytics | How To Set Up Access Control | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/security/how-to-set-up-access-control.md | As a final step to secure your workspace, you should secure network access, usin - With and without a [managed virtual network](./synapse-workspace-managed-vnet.md), you can connect to your workspace from public networks. For more information, see [Connectivity Settings](connectivity-settings.md). - Access from public networks can be controlled by enabling the [public network access feature](connectivity-settings.md#public-network-access) or the [workspace firewall](./synapse-workspace-ip-firewall.md).-- Alternatively, you can connect to your workspace using a [managed private endpoint](synapse-workspace-managed-private-endpoints.md) and [private Link](../../azure-sql/database/private-endpoint-overview.md). Azure Synapse workspaces without the [Azure Synapse Analytics Managed Virtual Network](synapse-workspace-managed-vnet.md) do not have the ability to connect via managed private endpoints.+- Alternatively, you can connect to your workspace using a [managed private endpoint](synapse-workspace-managed-private-endpoints.md) and [private Link](/azure/azure-sql/database/private-endpoint-overview). Azure Synapse workspaces without the [Azure Synapse Analytics Managed Virtual Network](synapse-workspace-managed-vnet.md) do not have the ability to connect via managed private endpoints. ## STEP 10: Completion |
| synapse-analytics | Synapse Workspace Ip Firewall | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/security/synapse-workspace-ip-firewall.md | Also, you need to allow outgoing communication on UDP port 53 for Synapse Studio ## Manage the Azure Synapse workspace firewall -For more information on managing the firewall, see [the Azure SQL documentation to manage server-level firewalls](../../azure-sql/database/firewall-configure.md#create-and-manage-ip-firewall-rules). Azure Synapse only supports server-level IP firewall rules. It doesn't support database-level IP firewall rules. +For more information on managing the firewall, see [the Azure SQL documentation to manage server-level firewalls](/azure/azure-sql/database/firewall-configure#create-and-manage-ip-firewall-rules). Azure Synapse only supports server-level IP firewall rules. It doesn't support database-level IP firewall rules. For more information on the methods to manage the firewall programmatically, see: - [API](/rest/api/synapse/ip-firewall-rules) |
| synapse-analytics | Connect Monitor Azure Synapse Spark Application Level Metrics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/spark/connect-monitor-azure-synapse-spark-application-level-metrics.md | To use the Azure Synapse Prometheus connector in your on-premises Prometheus ser #### 2.1 Create a service principal: -```bash +```azurecli az ad sp create-for-rbac --name <service_principal_name> --role Contributor --scopes /subscriptions/<subscription_id> ``` |
| synapse-analytics | Use Prometheus Grafana To Monitor Apache Spark Application Level Metrics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/spark/use-prometheus-grafana-to-monitor-apache-spark-application-level-metrics.md | Or use the [Azure Cloud Shell](https://shell.azure.com/), which already includes ## Log in to Azure -```bash +```azurecli az login az account set --subscription "<subscription_id>" ``` Note: This step can be skipped if you already have an AKS cluster. ## Create a service principal and grant permission to Synapse workspace -```bash +```azurecli az ad sp create-for-rbac --name <service_principal_name> --role Contributor --scopes /subscriptions/<subscription_id> ``` helm delete <release_name> -n <namespace> Delete the AKS cluster. -```bash +```azurecli az aks delete --name <kubernetes_cluster_name> --resource-group <kubernetes_cluster_rg> ``` |
| synapse-analytics | Create Data Warehouse Azure Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/create-data-warehouse-azure-cli.md | Use these commands to sign on to Azure and set up a resource group. az group create --name myResourceGroup --location WestEurope ``` -1. Create a [logical SQL server](../../azure-sql/database/logical-servers.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) by using the [az sql server create](/cli/azure/sql/server#az-sql-server-create) command: +1. Create a [logical SQL server](/azure/azure-sql/database/logical-servers?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) by using the [az sql server create](/cli/azure/sql/server#az-sql-server-create) command: ```azurecli az sql server create --resource-group myResourceGroup --name mysqlserver \ Use these commands to sign on to Azure and set up a resource group. ## Configure a server-level firewall rule -Create a [server-level firewall rule](../../azure-sql/database/firewall-configure.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). A server-level firewall rule allows an external application, such as SQL Server Management Studio or the SQLCMD utility, to connect to a SQL pool through the SQL pool service firewall. +Create a [server-level firewall rule](/azure/azure-sql/database/firewall-configure?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). A server-level firewall rule allows an external application, such as SQL Server Management Studio or the SQLCMD utility, to connect to a SQL pool through the SQL pool service firewall. Run the [az sql server firewall-rule create](/cli/azure/sql/server/firewall-rule#az-sql-server-firewall-rule-create) command to create a firewall rule: |
| synapse-analytics | Create Data Warehouse Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/create-data-warehouse-portal.md | Sign in to the [Azure portal](https://portal.azure.com/). ## Create a SQL pool -Data warehouses are created using dedicated SQL pool (formerly SQL DW) in Azure Synapse Analytics. A dedicated SQL pool (formerly SQL DW) is created with a defined set of [compute resources](memory-concurrency-limits.md). The database is created within an [Azure resource group](../../azure-resource-manager/management/overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and in a [logical SQL server](../../azure-sql/database/logical-servers.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). +Data warehouses are created using dedicated SQL pool (formerly SQL DW) in Azure Synapse Analytics. A dedicated SQL pool (formerly SQL DW) is created with a defined set of [compute resources](memory-concurrency-limits.md). The database is created within an [Azure resource group](../../azure-resource-manager/management/overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and in a [logical SQL server](/azure/azure-sql/database/logical-servers?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). Follow these steps to create a dedicated SQL pool (formerly SQL DW) that contains the **AdventureWorksDW** sample data. Follow these steps to create a dedicated SQL pool (formerly SQL DW) that contain ## Create a server-level firewall rule -The Azure Synapse service creates a firewall at the server-level. This firewall prevents external applications and tools from connecting to the server or any databases on the server. To enable connectivity, you can add firewall rules that enable connectivity for specific IP addresses. Follow these steps to create a [server-level firewall rule](../../azure-sql/database/firewall-configure.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) for your client's IP address. +The Azure Synapse service creates a firewall at the server-level. This firewall prevents external applications and tools from connecting to the server or any databases on the server. To enable connectivity, you can add firewall rules that enable connectivity for specific IP addresses. Follow these steps to create a [server-level firewall rule](/azure/azure-sql/database/firewall-configure?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) for your client's IP address. > [!NOTE] > Azure Synapse communicates over port 1433. If you are trying to connect from within a corporate network, outbound traffic over port 1433 might not be allowed by your network's firewall. If so, you cannot connect to your server unless your IT department opens port 1433. |
| synapse-analytics | Create Data Warehouse Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/create-data-warehouse-powershell.md | New-AzResourceGroup -Name $resourcegroupname -Location $location ## Create a server -Create a [logical SQL server](../../azure-sql/database/logical-servers.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) using the [New-AzSqlServer](/powershell/module/az.sql/new-azsqlserver?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) command. A server contains a group of databases managed as a group. The following example creates a randomly named server in your resource group with an admin user named `ServerAdmin` and a password of `ChangeYourAdminPassword1`. Replace these pre-defined values as desired. +Create a [logical SQL server](/azure/azure-sql/database/logical-servers?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) using the [New-AzSqlServer](/powershell/module/az.sql/new-azsqlserver?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) command. A server contains a group of databases managed as a group. The following example creates a randomly named server in your resource group with an admin user named `ServerAdmin` and a password of `ChangeYourAdminPassword1`. Replace these pre-defined values as desired. ```powershell New-AzSqlServer -ResourceGroupName $resourcegroupname ` New-AzSqlServer -ResourceGroupName $resourcegroupname ` ## Configure a server-level firewall rule -Create an [server-level firewall rule](../../azure-sql/database/firewall-configure.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) using the [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) command. A server-level firewall rule allows an external application, such as SQL Server Management Studio or the SQLCMD utility to connect to a dedicated SQL pool (formerly SQL DW) through the dedicated SQL pool service firewall. +Create an [server-level firewall rule](/azure/azure-sql/database/firewall-configure?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) using the [New-AzSqlServerFirewallRule](/powershell/module/az.sql/new-azsqlserverfirewallrule?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) command. A server-level firewall rule allows an external application, such as SQL Server Management Studio or the SQLCMD utility to connect to a dedicated SQL pool (formerly SQL DW) through the dedicated SQL pool service firewall. In the following example, the firewall is only opened for other Azure resources. To enable external connectivity, change the IP address to an appropriate address for your environment. To open all IP addresses, use 0.0.0.0 as the starting IP address and 255.255.255.255 as the ending address. |
| synapse-analytics | Quickstart Bulk Load Copy Tsql Examples | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/quickstart-bulk-load-copy-tsql-examples.md | Managed Identity authentication is required when your storage account is attache  -1. Configure Azure AD authentication. Refer to [Configure and manage Azure AD authentication with Azure SQL](../../azure-sql/database/authentication-aad-configure.md?tabs=azure-powershell). +1. Configure Azure AD authentication. Refer to [Configure and manage Azure AD authentication with Azure SQL](/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell). 1. Connect to your SQL pool using Active Directory where you can now run the COPY statement without specifying any credentials: |
| synapse-analytics | Release Notes 10 0 10106 0 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/release-notes-10-0-10106-0.md | For tooling improvements, make sure you have the correct version installed speci |**PREDICT (Preview)**|You can now score machine learning models within your data warehouse avoiding the need for large and complex data movement. The T-SQL PREDICT function relies on open model framework and takes data and machine learning model as input to generate predictions. |**SSDT CI/CD (GA)**|Today we are excited to announce the General Availability of the most requested feature for SQL Analytics ΓÇô SQL Server Data Tools (SSDT) Database projects. This release includes support for SSDT with Visual Studio 2019 along with native platform integration with Azure DevOps providing built-in continuous integration and deployment (CI/CD) capabilities for enterprise level deployments. | |**Materialized View (GA)**|A Materialized View persists the data returned from the view definition query and automatically gets updated as data changes in the underlying tables. It improves the performance of complex queries (typically queries with joins and aggregations) while offering simple maintenance operations. For more information, see [Performance tuning with materialized views](performance-tuning-materialized-views.md). Install [SQL Server Management Studio 18.4 or later](/sql/ssms/download-sql-server-management-studio-ssms?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) for scripting Materialized Views.|-|**Dynamic Data Masking (GA)**|Dynamic Data Masking (DDM) prevents unauthorized access to your sensitive data in your data warehouse by obfuscating it on-the-fly in the query results, based on the masking rules you define.ΓÇ»For more information, see [SQL Database dynamic data masking](../../azure-sql/database/dynamic-data-masking-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| +|**Dynamic Data Masking (GA)**|Dynamic Data Masking (DDM) prevents unauthorized access to your sensitive data in your data warehouse by obfuscating it on-the-fly in the query results, based on the masking rules you define.ΓÇ»For more information, see [SQL Database dynamic data masking](/azure/azure-sql/database/dynamic-data-masking-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| |**Read Committed Snapshot Isolation (GA)**|You can use ALTER DATABASE to enable or disable snapshot isolation for a user database. To avoid impact to your current workload, you may want to set this option during database maintenance window or wait until there is no other active connection to the database. For more information, see [Alter database set options](/sql/t-sql/statements/alter-database-transact-sql-set-options?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true).| |**Ordered Clustered Columnstore Index (GA)**|Columnstore is a key enabler for storing and efficiently querying large amounts of data. Ordered clustered columnstore indexes further optimize query execution by enabling efficient segment elimination.ΓÇ»ΓÇ» For more information, see [Performance tuning with ordered clustered columnstore index](performance-tuning-ordered-cci.md).| |**Result Set Caching (GA)**|When result set caching is enabled, query results are automatically cached in the user database for repetitive use. This allows subsequent query executions to get results directly from the persisted cache so recomputation is not needed. Result set caching improves query performance and reduces compute resource usage. In addition, queries using cached results set do not use any concurrency slots and thus do not count against existing concurrency limits. For security, users can only access the cached results if they have the same data access permissions as the users creating the cached results. For more information, see [Performance tuning with result set caching](performance-tuning-result-set-caching.md). Applies to version 10.0.10783.0 or higher.| For tooling improvements, make sure you have the correct version installed speci | Service improvements | Details | | | |-|**Azure Private Link (Preview)**|With [Azure Private Link](https://azure.microsoft.com/blog/announcing-azure-private-link/), you can create a private endpoint in your Virtual Network (VNet) and map it to your dedicated SQL pool. These resources are then accessible over a private IP address in your VNet, enabling connectivity from on-premises through Azure ExpressRoute private peering and/or VPN gateway. Overall, this simplifies the network configuration by not requiring you to open it up to public IP addresses. This also enables protection against data exfiltration risks. For more details, see [overview](../../private-link/private-link-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and [SQL Analytics documentation](../../azure-sql/database/private-endpoint-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| -|**Data Discovery & Classification (GA)**|[Data discovery and classification](../../azure-sql/database/data-discovery-and-classification-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) feature is now Generally Available. This feature provides advanced capabilities for **discovering, classifying, labeling & protecting** sensitive data in your databases.| +|**Azure Private Link (Preview)**|With [Azure Private Link](https://azure.microsoft.com/blog/announcing-azure-private-link/), you can create a private endpoint in your Virtual Network (VNet) and map it to your dedicated SQL pool. These resources are then accessible over a private IP address in your VNet, enabling connectivity from on-premises through Azure ExpressRoute private peering and/or VPN gateway. Overall, this simplifies the network configuration by not requiring you to open it up to public IP addresses. This also enables protection against data exfiltration risks. For more details, see [overview](../../private-link/private-link-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and [SQL Analytics documentation](/azure/azure-sql/database/private-endpoint-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| +|**Data Discovery & Classification (GA)**|[Data discovery and classification](/azure/azure-sql/database/data-discovery-and-classification-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) feature is now Generally Available. This feature provides advanced capabilities for **discovering, classifying, labeling & protecting** sensitive data in your databases.| |**Azure Advisor one-click Integration**|SQL Analytics in Azure Synapse now directly integrates with Azure Advisor recommendations in the overview blade along with providing a one-click experience. You can now discover recommendations in the overview blade instead of navigating to the Azure advisor blade. Find out more about recommendations [here](sql-data-warehouse-concept-recommendations.md).| |**Read Committed Snapshot Isolation (Preview)**|You can use ALTER DATABASE to enable or disable snapshot isolation for a user database. To avoid impact to your current workload, you may want to set this option during database maintenance window or wait until there is no other active connection to the database. For more information, see [Alter database set options](/sql/t-sql/statements/alter-database-transact-sql-set-options?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true).| |**EXECUTE AS (Transact-SQL)**| [EXECUTE AS](/sql/t-sql/statements/execute-as-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) T-SQL support is now available enabling customers to set the execution context of a session to the specified user.| For tooling improvements, make sure you have the correct version installed speci | Service improvements | Details | | | |-|**Dynamic data masking (Preview)**|Dynamic Data Masking (DDM) prevents unauthorized access to your sensitive data in your data warehouse by obfuscating it on-the-fly in the query results, based on the masking rules you define.ΓÇ»For more information, see [SQL Database dynamic data masking](../../azure-sql/database/dynamic-data-masking-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| +|**Dynamic data masking (Preview)**|Dynamic Data Masking (DDM) prevents unauthorized access to your sensitive data in your data warehouse by obfuscating it on-the-fly in the query results, based on the masking rules you define.ΓÇ»For more information, see [SQL Database dynamic data masking](/azure/azure-sql/database/dynamic-data-masking-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| |**Workload importance now Generally Available**|Workload Management Classification and Importance provide the ability to influence the run order of queries. For more information on workload importance, see the [Classification](sql-data-warehouse-workload-classification.md) and [Importance](sql-data-warehouse-workload-importance.md) overview articles in the documentation. Check out the [CREATE WORKLOAD CLASSIFIER](/sql/t-sql/statements/create-workload-classifier-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) doc as well.<br/><br/>See workload importance in action in the below videos:<br/> -[Workload Management concepts](https://www.youtube.com/embed/QcCRBAhoXpM)<br/> -[Workload Management scenarios](https://www.youtube.com/embed/_2rLMljOjw8)| |**Additional T-SQL support**|The T-SQL language surface area for Synapse SQL has been extended to include support for: </br> - [TRIM](/sql/t-sql/functions/trim-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)| |**JSON functions**|Business analysts can now use familiar T-SQL language to query and manipulate documents that are formatted as JSON data using the following new JSON functions:</br> - [ISJSON](/sql/t-sql/functions/isjson-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)</br> - [JSON_VALUE](/sql/t-sql/functions/json-value-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)</br> - [JSON_QUERY](/sql/t-sql/functions/json-query-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)</br> - [JSON_MODIFY](/sql/t-sql/functions/json-modify-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)</br> - [OPENJSON](/sql/t-sql/functions/openjson-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true)| For tooling improvements, make sure you have the correct version installed speci | Service improvements | Details | | | |-|**Data Discovery & Classification**|Data Discovery & Classification is now available in public preview for Synapse SQL. It's critical to protect sensitive data and the privacy of your customers. As your business and customer data assets grow, it becomes unmanageable to discover, classify, and protect your data. The data discovery and classification feature that we're introducing natively with Synapse SQL helps make protecting your data more manageable. The overall benefits of this capability are:<br/>• Meeting data privacy standards and regulatory compliance requirements.<br/>• Restricting access to and hardening the security of data warehouses containing highly sensitive data.<br/>• Monitoring and alerting on anomalous access to sensitive data.<br/>• Visualization of sensitive data in a central dashboard on the Azure portal. </br></br>Data Discovery & Classification is available in all Azure regions, It's part of Advanced Data Security including Vulnerability Assessment and Threat Detection. For more information about Data Discovery & Classification, see the [blog post](https://azure.microsoft.com/blog/announcing-public-preview-of-data-discovery-classification-for-microsoft-azure-sql-data-warehouse/) and our online [documentation](../../azure-sql/database/data-discovery-and-classification-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| +|**Data Discovery & Classification**|Data Discovery & Classification is now available in public preview for Synapse SQL. It's critical to protect sensitive data and the privacy of your customers. As your business and customer data assets grow, it becomes unmanageable to discover, classify, and protect your data. The data discovery and classification feature that we're introducing natively with Synapse SQL helps make protecting your data more manageable. The overall benefits of this capability are:<br/>• Meeting data privacy standards and regulatory compliance requirements.<br/>• Restricting access to and hardening the security of data warehouses containing highly sensitive data.<br/>• Monitoring and alerting on anomalous access to sensitive data.<br/>• Visualization of sensitive data in a central dashboard on the Azure portal. </br></br>Data Discovery & Classification is available in all Azure regions, It's part of Advanced Data Security including Vulnerability Assessment and Threat Detection. For more information about Data Discovery & Classification, see the [blog post](https://azure.microsoft.com/blog/announcing-public-preview-of-data-discovery-classification-for-microsoft-azure-sql-data-warehouse/) and our online [documentation](/azure/azure-sql/database/data-discovery-and-classification-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| |**GROUP BY ROLLUP**|ROLLUP is now a supported GROUP BY option. GROUP BY ROLLUP creates a group for each combination of column expressions. GROUP BY also "rolls up" the results into subtotals and grand totals. The GROUP BY function processes from right to left, decreasing the number of column expressions over which it creates groups and aggregation(s). The column order affects the ROLLUP output and can affect the number of rows in the result set.<br/><br/>For more information on GROUP BY ROLLUP, see [GROUP BY (Transact-SQL)](/sql/t-sql/queries/select-group-by-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) |**Improved accuracy for DWU used and CPU portal metrics**|Synapse SQL significantly enhances metric accuracy in the Azure portal. This release includes a fix to the CPU and DWU Used metric definition to properly reflect your workload across all compute nodes. Before this fix, metric values were being underreported. Expect to see an increase in the DWU used and CPU metrics in the Azure portal. | |**Row Level Security**|We introduced Row-level Security capability back in Nov 2017. We've now extended this support to external tables as well. Additionally, we've added support for calling non-deterministic functions in the inline table-valued functions (inline TVFs) required for defining a security filter predicate. This addition allows you to specify IS_ROLEMEMBER(), USER_NAME() etc. in the security filter predicate. For more information, please see the examples in the [Row-level Security documentation](/sql/relational-databases/security/row-level-security?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| For tooling improvements, make sure you have the correct version installed speci | Service improvements | Details | | | |-|**Virtual Network Service Endpoints Generally Available**|This release includes general availability of Virtual Network (VNet) Service Endpoints for SQL Analytics in Azure Synapse in all Azure regions. VNet Service Endpoints enable you to isolate connectivity to your server from a given subnet or set of subnets within your virtual network. The traffic to Azure Synapse from your VNet will always stay within the Azure backbone network. This direct route will be preferred over any specific routes that take Internet traffic through virtual appliances or on-premises. No additional billing is charged for virtual network access through service endpoints. Current pricing model for [Azure Synapse](https://azure.microsoft.com/pricing/details/sql-data-warehouse/gen2/) applies as is.<br/><br/>With this release, we also enabled PolyBase connectivity to [Azure Data Lake Storage Gen2](../../storage/blobs/data-lake-storage-introduction.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) (ADLS) via [Azure Blob File System](../../storage/blobs/data-lake-storage-abfs-driver.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) (ABFS) driver. Azure Data Lake Storage Gen2 brings all the qualities that are required for the complete lifecycle of analytics data to Azure Storage. Features of the two existing Azure storage services, Azure Blob Storage and Azure Data Lake Storage Gen1 are converged. Features from [Azure Data Lake Storage Gen1](../../data-lake-store/index.yml?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json), such as file system semantics, file-level security, and scale are combined with low-cost, tiered storage, and high availability/disaster recovery capabilities from [Azure Blob Storage](../../storage/blobs/storage-blobs-introduction.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).<br/><br/>Using Polybase you can also import data into SQL Analytics in Azure Synapse from Azure Storage secured to VNet. Similarly, exporting data from Azure Synapse to Azure Storage secured to VNet is also supported via Polybase.<br/><br/>For more information on VNet Service Endpoints in Azure Synapse, refer to the [blog post](https://azure.microsoft.com/blog/general-availability-of-vnet-service-endpoints-for-azure-sql-data-warehouse/) or the [documentation](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| +|**Virtual Network Service Endpoints Generally Available**|This release includes general availability of Virtual Network (VNet) Service Endpoints for SQL Analytics in Azure Synapse in all Azure regions. VNet Service Endpoints enable you to isolate connectivity to your server from a given subnet or set of subnets within your virtual network. The traffic to Azure Synapse from your VNet will always stay within the Azure backbone network. This direct route will be preferred over any specific routes that take Internet traffic through virtual appliances or on-premises. No additional billing is charged for virtual network access through service endpoints. Current pricing model for [Azure Synapse](https://azure.microsoft.com/pricing/details/sql-data-warehouse/gen2/) applies as is.<br/><br/>With this release, we also enabled PolyBase connectivity to [Azure Data Lake Storage Gen2](../../storage/blobs/data-lake-storage-introduction.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) (ADLS) via [Azure Blob File System](../../storage/blobs/data-lake-storage-abfs-driver.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) (ABFS) driver. Azure Data Lake Storage Gen2 brings all the qualities that are required for the complete lifecycle of analytics data to Azure Storage. Features of the two existing Azure storage services, Azure Blob Storage and Azure Data Lake Storage Gen1 are converged. Features from [Azure Data Lake Storage Gen1](../../data-lake-store/index.yml?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json), such as file system semantics, file-level security, and scale are combined with low-cost, tiered storage, and high availability/disaster recovery capabilities from [Azure Blob Storage](../../storage/blobs/storage-blobs-introduction.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).<br/><br/>Using Polybase you can also import data into SQL Analytics in Azure Synapse from Azure Storage secured to VNet. Similarly, exporting data from Azure Synapse to Azure Storage secured to VNet is also supported via Polybase.<br/><br/>For more information on VNet Service Endpoints in Azure Synapse, refer to the [blog post](https://azure.microsoft.com/blog/general-availability-of-vnet-service-endpoints-for-azure-sql-data-warehouse/) or the [documentation](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json).| |**Automatic Performance Monitoring (Preview)**|[Query Store](/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) is now available in Preview in SQL Analytics in Azure Synapse. Query Store is designed to help you with query performance troubleshooting by tracking queries, query plans, runtime statistics, and query history to help you monitor the activity and performance of your data warehouse. Query Store is a set of internal stores and Dynamic Management Views (DMVs) that allow you to:<br/><br/>• Identify and tune top resource consuming queries<br/>• Identify and improve unplanned workloads<br/>• Evaluate query performance and impact to the plan by changes in statistics, indexes, or system size (DWU setting)<br/>• See full query text for all queries executed<br/><br/>The Query Store contains three actual stores:<br/>• A plan store for persisting the execution plan information<br/>• A runtime stats store for persisting the execution statistics information<br/>• A wait stats store for persisting wait stats information.<br/><br/>SQL Analytics in Azure Synapse manages these stores automatically and provides an unlimited number of queries storied over the last seven days at no additional charge. Enabling Query Store is as simple as running an ALTER DATABASE T-SQL statement: <br/>sql -ALTER DATABASE [DatabaseName] SET QUERY_STORE = ON;-For more information on Query Store, see the article, [Monitoring performance by using the Query Store](/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store), and the Query Store DMVs, such as [sys.query_store_query](/sql/relational-databases/system-catalog-views/sys-query-store-query-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true). Here is the [blog post](https://azure.microsoft.com/blog/automatic-performance-monitoring-in-azure-sql-data-warehouse-with-query-store/) announcing the release. For more information on historical query analysis, see [Historical query storage and analysis in Azure Synapse Analytics](../sql/query-history-storage-analysis.md).| |**Lower Compute Tiers for SQL Analytics**|SQL Analytics in Azure Synapse now supports lower compute tiers. Customers can experience Azure Synapse's leading performance, flexibility, and security features starting with 100 cDWU ([data warehouse units](what-is-a-data-warehouse-unit-dwu-cdwu.md)) and scale to 30,000 cDWU in minutes. Starting mid-December 2018, customers can benefit from Gen2 performance and flexibility with lower compute tiers in [regions](gen2-migration-schedule.md#automated-schedule-and-region-availability-table), with the rest of the regions available during 2019.<br/><br/>By dropping the entry point for next-generation data warehousing, Microsoft opens the doors to value-driven customers who want to evaluate all the benefits of a secure, high-performance data warehouse without guessing which trial environment is best for them. Customers may start as low as 100 cDWU, down from the current 500 cDWU entry point. SQL Analytics continues to support pause and resume operations and goes beyond just the flexibility in compute. Gen2 also supports unlimited column-store storage capacity along with 2.5 times more memory per query, up to 128 concurrent queries and [adaptive caching](https://azure.microsoft.com/blog/adaptive-caching-powers-azure-sql-data-warehouse-performance-gains/) features. These features on average bring five times more performance compared to the same data warehouse Unit on Gen1 at the same price. Geo-redundant backups are standard for Gen2 with built-in guaranteed data protection. SQL Analytics in Azure Synapse is ready to scale when you are.| |**Columnstore Background Merge**|By default, Azure SQL Data stores data in columnar format, with micro-partitions called [rowgroups](sql-data-warehouse-memory-optimizations-for-columnstore-compression.md). Sometimes, due to memory constrains at index build or data load time, the rowgroups may be compressed with less than the optimal size of one million rows. Rowgroups may also become fragmented due to deletes. Small or fragmented rowgroups result in higher memory consumption, as well as inefficient query execution. With this release, the columnstore background maintenance task merges small compressed rowgroups to create larger rowgroups to better utilize memory and speed up query execution. |
| synapse-analytics | Sql Data Warehouse Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-authentication.md | Azure Active Directory benefits include: * Eliminates storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory. * Uses contained database users to authenticate identities at the database level. * Supports token-based authentication for applications connecting to SQL pool.-* Supports Multi-Factor authentication through Active Directory Universal Authentication for various tools including [SQL Server Management Studio](../../azure-sql/database/authentication-mfa-ssms-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and [SQL Server Data Tools](/sql/ssdt/azure-active-directory?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true). +* Supports Multi-Factor authentication through Active Directory Universal Authentication for various tools including [SQL Server Management Studio](/azure/azure-sql/database/authentication-mfa-ssms-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) and [SQL Server Data Tools](/sql/ssdt/azure-active-directory?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true). > [!NOTE]-> Azure Active Directory is still relatively new and has some limitations. To ensure that Azure Active Directory is a good fit for your environment, see [Azure AD features and limitations](../../azure-sql/database/authentication-aad-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#azure-ad-features-and-limitations), specifically the Additional considerations. +> Azure Active Directory is still relatively new and has some limitations. To ensure that Azure Active Directory is a good fit for your environment, see [Azure AD features and limitations](/azure/azure-sql/database/authentication-aad-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#azure-ad-features-and-limitations), specifically the Additional considerations. ### Configuration steps Currently Azure Active Directory users are not shown in SSDT Object Explorer. As ### Find the details -* The steps to configure and use Azure Active Directory authentication are nearly identical for Azure SQL Database and Synapse SQL in Azure Synapse. Follow the detailed steps in the topic [Connecting to SQL Database or SQL Pool By Using Azure Active Directory Authentication](../../azure-sql/database/authentication-aad-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). +* The steps to configure and use Azure Active Directory authentication are nearly identical for Azure SQL Database and Synapse SQL in Azure Synapse. Follow the detailed steps in the topic [Connecting to SQL Database or SQL Pool By Using Azure Active Directory Authentication](/azure/azure-sql/database/authentication-aad-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). * Create custom database roles and add users to the roles. Then grant granular permissions to the roles. For more information, see [Getting Started with Database Engine Permissions](/sql/relational-databases/security/authentication-access/getting-started-with-database-engine-permissions?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true). ## Next steps |
| synapse-analytics | Sql Data Warehouse Concept Resource Utilization Query Activity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-concept-resource-utilization-query-activity.md | The following metrics are available in the Azure portal for Synapse SQL. These m | DWU limit | Service level objective of the data warehouse | Avg, Min, Max | | DWU percentage | Maximum between CPU percentage and Data IO percentage | Avg, Min, Max | | DWU used | DWU limit * DWU percentage | Avg, Min, Max |-| Cache hit percentage | (cache hits / cache miss) * 100 where cache hits is the sum of all columnstore segments hits in the local SSD cache and cache miss is the columnstore segments misses in the local SSD cache summed across all nodes | Avg, Min, Max | +| Cache hit percentage | (cache hits / (cache hits + cache miss)) * 100, where cache hits are the sum of all columnstore segments hits in the local SSD cache and cache miss is the columnstore segments misses in the local SSD cache summed across all nodes | Avg, Min, Max | | Cache used percentage | (cache used / cache capacity) * 100 where cache used is the sum of all bytes in the local SSD cache across all nodes and cache capacity is the sum of the storage capacity of the local SSD cache across all nodes | Avg, Min, Max | | Local tempdb percentage | Local tempdb utilization across all compute nodes - values are emitted every five minutes | Avg, Min, Max | Things to consider when viewing metrics and setting alerts: - DWU used represents only a **high-level representation of usage** across the SQL pool and is not meant to be a comprehensive indicator of utilization. To determine whether to scale up or down, consider all factors which can be impacted by DWU such as concurrency, memory, tempdb, and adaptive cache capacity. We recommend [running your workload at different DWU settings](sql-data-warehouse-manage-compute-overview.md#finding-the-right-size-of-data-warehouse-units) to determine what works best to meet your business objectives. - Failed and successful connections are reported for a particular data warehouse - not for the server itself.-- Memory percentage reflects utilization even if the data warehouse is in idle state - it does not reflect active workload memory consumption. Use and track this metric along with others (tempdb, gen2 cache) to make a holistic decision on if scaling for additional cache capacity will increase workload performance to meet your requirements.+- Memory percentage reflects utilization even if the data warehouse is in idle state - it does not reflect active workload memory consumption. Use and track this metric along with others (`tempdb`, gen2 cache) to make a holistic decision on if scaling for additional cache capacity will increase workload performance to meet your requirements. ## Query activity For a programmatic experience when monitoring Synapse SQL via T-SQL, the service provides a set of Dynamic Management Views (DMVs). These views are useful when actively troubleshooting and identifying performance bottlenecks with your workload. -To view the list of DMVs that apply to Synapse SQL, refer to this [documentation](../sql/reference-tsql-system-views.md#dedicated-sql-pool-dynamic-management-views-dmvs). +To view the list of DMVs that apply to Synapse SQL, review [dedicated SQL pool DMVs](../sql/reference-tsql-system-views.md#dedicated-sql-pool-dynamic-management-views-dmvs). ## Metrics and diagnostics logging -Both metrics and logs can be exported to Azure Monitor, specifically the [Azure Monitor logs](../../azure-monitor/logs/log-query-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) component and can be programmatically accessed through [log queries](../../azure-monitor/logs/log-analytics-tutorial.md?bc=%2fazure%2fsynapse-analytics%2fsql-data-warehouse%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fsynapse-analytics%2fsql-data-warehouse%2ftoc.json). The log latency for Synapse SQL is about 10-15 minutes. For more details on the factors impacting latency, visit the following documentation. +Both metrics and logs can be exported to Azure Monitor, specifically the [Azure Monitor logs](../../azure-monitor/logs/log-query-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) component and can be programmatically accessed through [log queries](../../azure-monitor/logs/log-analytics-tutorial.md?bc=%2fazure%2fsynapse-analytics%2fsql-data-warehouse%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fsynapse-analytics%2fsql-data-warehouse%2ftoc.json). The log latency for Synapse SQL is about 10-15 minutes. ## Next steps The following How-to guide describes common scenarios and use cases when monitoring and managing your data warehouse: -- [Monitor your data warehouse workload with DMVs](sql-data-warehouse-manage-monitor.md)+- [Monitor your data warehouse workload with DMVs](sql-data-warehouse-manage-monitor.md) +- [Use Azure Monitor with your Azure Synapse Analytics workspace](../monitoring/how-to-monitor-using-azure-monitor.md) |
| synapse-analytics | Sql Data Warehouse Overview Manage Security | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-manage-security.md | This article will walk you through the basics of securing your dedicated SQL poo Connection Security refers to how you restrict and secure connections to your database using firewall rules and connection encryption. -Firewall rules are used by both the [logical SQL server](../../azure-sql/database/logical-servers.md) and its databases to reject connection attempts from IP addresses that haven't been explicitly approved. To allow connections from your application or client machine's public IP address, you must first create a server-level firewall rule using the Azure portal, REST API, or PowerShell. +Firewall rules are used by both the [logical SQL server](/azure/azure-sql/database/logical-servers) and its databases to reject connection attempts from IP addresses that haven't been explicitly approved. To allow connections from your application or client machine's public IP address, you must first create a server-level firewall rule using the Azure portal, REST API, or PowerShell. As a best practice, you should restrict the IP address ranges allowed through your server-level firewall as much as possible. To access your dedicated SQL pool (formerly SQL DW) from your local computer, ensure the firewall on your network and local computer allows outgoing communication on TCP port 1433. -Dedicated SQL pool (formerly SQL DW) uses server-level IP firewall rules. It doesn't support database-level IP firewall rules. For more information, see see [Azure SQL Database firewall rules](../../azure-sql/database/firewall-configure.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) +Dedicated SQL pool (formerly SQL DW) uses server-level IP firewall rules. It doesn't support database-level IP firewall rules. For more information, see see [Azure SQL Database firewall rules](/azure/azure-sql/database/firewall-configure?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json) Connections to your dedicated SQL pool (formerly SQL DW) are encrypted by default. Modifying connection settings to disable encryption are ignored. CREATE USER ApplicationUser FOR LOGIN ApplicationLogin; To give a user permission to perform additional operations such as creating logins or creating new databases, assign the user to the `Loginmanager` and `dbmanager` roles in the master database. -For more information on these additional roles and authenticating to a SQL Database, see [Managing databases and logins in Azure SQL Database](../../azure-sql/database/logins-create-manage.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). For more information on connecting using Azure Active Directory, see [Connecting by using Azure Active Directory Authentication](sql-data-warehouse-authentication.md). +For more information on these additional roles and authenticating to a SQL Database, see [Managing databases and logins in Azure SQL Database](/azure/azure-sql/database/logins-create-manage?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json). For more information on connecting using Azure Active Directory, see [Connecting by using Azure Active Directory Authentication](sql-data-warehouse-authentication.md). ## Authorization |
| synapse-analytics | Sql Data Warehouse Restore Active Paused Dw | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-restore-active-paused-dw.md | In this article, you learn how to restore an existing dedicated SQL pool (former [!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)] -**Verify your DTU capacity.** Each pool is hosted by a [logical SQL server](../../azure-sql/database/logical-servers.md) (for example, myserver.database.windows.net) which has a default DTU quota. Verify the server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). +**Verify your DTU capacity.** Each pool is hosted by a [logical SQL server](/azure/azure-sql/database/logical-servers) (for example, myserver.database.windows.net) which has a default DTU quota. Verify the server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). ## Before you begin To restore an existing dedicated SQL pool (formerly SQL DW) from a restore point 7. Verify that the restored dedicated SQL pool (formerly SQL DW) is online. -8. After the restore has completed, you can configure your recovered dedicated SQL pool (formerly SQL DW) by following [configure your database after recovery](../../azure-sql/database/disaster-recovery-guidance.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). +8. After the restore has completed, you can configure your recovered dedicated SQL pool (formerly SQL DW) by following [configure your database after recovery](/azure/azure-sql/database/disaster-recovery-guidance?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). ```powershell |
| synapse-analytics | Sql Data Warehouse Restore Deleted Dw | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-restore-deleted-dw.md | In this article, you learn to restore a dedicated SQL pool (formerly SQL DW) usi [!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)] -**Verify your DTU capacity.** Each dedicated SQL pool (formerly SQL DW) is hosted by a [logical SQL server](../../azure-sql/database/logical-servers.md) (for example, myserver.database.windows.net) which has a default DTU quota. Verify that the server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). +**Verify your DTU capacity.** Each dedicated SQL pool (formerly SQL DW) is hosted by a [logical SQL server](/azure/azure-sql/database/logical-servers) (for example, myserver.database.windows.net) which has a default DTU quota. Verify that the server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). ## Restore a deleted data warehouse through PowerShell To restore a deleted dedicated SQL pool (formerly SQL DW), use the [Restore-AzSq 1. To restore the deleted dedicated SQL pool (formerly SQL DW) to a different server, make sure to specify the other server name. This server can also be in a different resource group and region. 1. To restore to a different subscription, use the [Move](../../azure-resource-manager/management/move-resource-group-and-subscription.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#use-the-portal) button to move the server to another subscription. 7. Verify that the restored data warehouse is online.-8. After the restore has completed, you can configure your recovered data warehouse by following [configure your database after recovery](../../azure-sql/database/disaster-recovery-guidance.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). +8. After the restore has completed, you can configure your recovered data warehouse by following [configure your database after recovery](/azure/azure-sql/database/disaster-recovery-guidance?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). ```powershell $SubscriptionName="<YourSubscriptionName>" |
| synapse-analytics | Sql Data Warehouse Restore From Geo Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-restore-from-geo-backup.md | In this article, you learn to restore your dedicated SQL pool (formerly SQL DW) [!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)] -**Verify your DTU capacity.** Each dedicated SQL pool (formerly SQL DW) is hosted by a [logical SQL server](../../azure-sql/database/logical-servers.md) (for example, myserver.database.windows.net) which has a default DTU quota. Verify that the SQL server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). +**Verify your DTU capacity.** Each dedicated SQL pool (formerly SQL DW) is hosted by a [logical SQL server](/azure/azure-sql/database/logical-servers) (for example, myserver.database.windows.net) which has a default DTU quota. Verify that the SQL server has enough remaining DTU quota for the database being restored. To learn how to calculate DTU needed or to request more DTU, see [Request a DTU quota change](sql-data-warehouse-get-started-create-support-ticket.md). ## Restore from an Azure geographical region through PowerShell |
| synapse-analytics | Sql Data Warehouse Troubleshoot Connectivity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/sql-data-warehouse-troubleshoot-connectivity.md | Otherwise, check with your IT administrator to verify that this maintenance isn' ## Check your firewall settings -The dedicated SQL pool (formerly SQL DW) database communicates over port 1433.  If you're trying to connect from within a corporate network, outbound traffic over port 1433 might not be allowed by your network's firewall. In that case, you can't connect to your [logical server](../../azure-sql/database/logical-servers.md) unless your IT department opens port 1433. Additional information on firewall configurations can be found [here](../../azure-sql/database/firewall-configure.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#create-and-manage-ip-firewall-rules). +The dedicated SQL pool (formerly SQL DW) database communicates over port 1433.  If you're trying to connect from within a corporate network, outbound traffic over port 1433 might not be allowed by your network's firewall. In that case, you can't connect to your [logical server](/azure/azure-sql/database/logical-servers) unless your IT department opens port 1433. Additional information on firewall configurations can be found [here](/azure/azure-sql/database/firewall-configure?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#create-and-manage-ip-firewall-rules). ## Check your VNet/Service Endpoint settings -If you're receiving Errors 40914 and 40615, see [error description and resolution here](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#errors-40914-and-40615). +If you're receiving Errors 40914 and 40615, see [error description and resolution here](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#errors-40914-and-40615). ## Check for the latest drivers Check to see if you're experiencing heavy load on the server with a high number ## Common error messages -Errors 40914 and 40615, see the [error description and resolution here](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#errors-40914-and-40615). +Errors 40914 and 40615, see the [error description and resolution here](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#errors-40914-and-40615). ## Still having connectivity issues? |
| synapse-analytics | Upgrade To Latest Generation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/upgrade-to-latest-generation.md | $GeoRestoredDatabase.status ``` > [!NOTE]-> To configure your database after the restore has completed, see [Configure your database after recovery](../../azure-sql/database/disaster-recovery-guidance.md?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). +> To configure your database after the restore has completed, see [Configure your database after recovery](/azure/azure-sql/database/disaster-recovery-guidance?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json#configure-your-database-after-recovery). The recovered database will be TDE-enabled if the source database is TDE-enabled. |
| synapse-analytics | What Is A Data Warehouse Unit Dwu Cdwu | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql-data-warehouse/what-is-a-data-warehouse-unit-dwu-cdwu.md | Both DWUs and cDWUs support scaling compute up or down, and pausing compute when ## Capacity limits -Each SQL server (for example, myserver.database.windows.net) has a [Database Transaction Unit (DTU)](../../azure-sql/database/service-tiers-dtu.md?bc=%2fazure%2fsynapse-analytics%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fsynapse-analytics%2ftoc.json) quota that allows a specific number of data warehouse units. For more information, see the [workload management capacity limits](sql-data-warehouse-service-capacity-limits.md#workload-management). +Each SQL server (for example, myserver.database.windows.net) has a [Database Transaction Unit (DTU)](/azure/azure-sql/database/service-tiers-dtu?bc=%2fazure%2fsynapse-analytics%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fsynapse-analytics%2ftoc.json) quota that allows a specific number of data warehouse units. For more information, see the [workload management capacity limits](sql-data-warehouse-service-capacity-limits.md#workload-management). ## How many data warehouse units do I need |
| synapse-analytics | On Demand Workspace Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql/on-demand-workspace-overview.md | Serverless SQL pool offers mechanisms to secure access to your data. ### Azure Active Directory integration and multi-factor authentication -Serverless SQL pool enables you to centrally manage identities of database user and other Microsoft services with [Azure Active Directory integration](../../azure-sql/database/authentication-aad-configure.md). This capability simplifies permission management and enhances security. Azure Active Directory (Azure AD) supports [multi-factor authentication](../../azure-sql/database/authentication-mfa-ssms-configure.md) (MFA) to increase data and application security while supporting a single sign-on process. +Serverless SQL pool enables you to centrally manage identities of database user and other Microsoft services with [Azure Active Directory integration](/azure/azure-sql/database/authentication-aad-configure). This capability simplifies permission management and enhances security. Azure Active Directory (Azure AD) supports [multi-factor authentication](/azure/azure-sql/database/authentication-mfa-ssms-configure) (MFA) to increase data and application security while supporting a single sign-on process. #### Authentication |
| synapse-analytics | Overview Features | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql/overview-features.md | Synapse SQL pools enable you to use built-in security features to secure your da | **Storage Azure Active Directory (Azure AD) passthrough authentication** | Yes | Yes, [Azure AD passthrough authentication](develop-storage-files-storage-access-control.md?tabs=user-identity#supported-storage-authorization-types) is applicable to Azure AD logins. The identity of the Azure AD user is passed to the storage if a credential is not specified. Azure AD passthrough authentication is not available for the SQL users. | | **Storage shared access signature (SAS) token authentication** | No | Yes, using [DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true) with [shared access signature token](develop-storage-files-storage-access-control.md?tabs=shared-access-signature#database-scoped-credential) in [EXTERNAL DATA SOURCE](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) or instance-level [CREDENTIAL](/sql/t-sql/statements/create-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true) with [shared access signature](develop-storage-files-storage-access-control.md?tabs=shared-access-signature#server-scoped-credential). | | **Storage Access Key authentication** | Yes, using [DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true) in [EXTERNAL DATA SOURCE](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) | No, [use SAS token](develop-storage-files-storage-access-control.md?tabs=shared-access-signature#database-scoped-credential) instead of storage access key. |-| **Storage [Managed Identity](../../data-factory/data-factory-service-identity.md?context=/azure/synapse-analytics/context/context&tabs=synapse-analytics) authentication** | Yes, using [Managed Service Identity Credential](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?preserve-view=true&toc=%2fazure%2fsynapse-analytics%2ftoc.json&view=azure-sqldw-latest&preserve-view=true) | Yes, The query can access the storage using the workspace [Managed Identity](develop-storage-files-storage-access-control.md?tabs=managed-identity#database-scoped-credential) credential. | +| **Storage [Managed Identity](../../data-factory/data-factory-service-identity.md?context=/azure/synapse-analytics/context/context&tabs=synapse-analytics) authentication** | Yes, using [Managed Service Identity Credential](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?preserve-view=true&toc=%2fazure%2fsynapse-analytics%2ftoc.json&view=azure-sqldw-latest&preserve-view=true) | Yes, The query can access the storage using the workspace [Managed Identity](develop-storage-files-storage-access-control.md?tabs=managed-identity#database-scoped-credential) credential. | | **Storage Application identity/Service principal (SPN) authentication** | [Yes](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, you can create a [credential](develop-storage-files-storage-access-control.md?tabs=service-principal#database-scoped-credential) with a [service principal application ID](develop-storage-files-storage-access-control.md?tabs=service-principal#supported-storage-authorization-types) that will be used to authenticate on the storage. | | **Server roles** | No | Yes, sysadmin, public, and other server-roles are supported. | | **SERVER SCOPED CREDENTIAL** | No | Yes, the [server scoped credentials](develop-storage-files-storage-access-control.md?tabs=user-identity#server-scoped-credential) are used by the `OPENROWSET` function that do not uses explicit data source. | Synapse SQL pools enable you to use built-in security features to secure your da | **Row-level security** | [Yes](/sql/relational-databases/security/row-level-security?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) | No, there is no built-in support for the row-level security. Use custom views as a [workaround](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/how-to-implement-row-level-security-in-serverless-sql-pools/ba-p/2354759). | | **Data masking** | [Yes](../guidance/security-white-paper-access-control.md#dynamic-data-masking) | No, built-in data masking is not supported in the serverless SQL pools. Use wrapper SQL views that explicitly mask some columns as a workaround. | | **Built-in/system security & identity functions** | Some Transact-SQL security functions and operators: `CURRENT_USER`, `HAS_DBACCESS`, `IS_MEMBER`, `IS_ROLEMEMBER`, `SESSION_USER`, `SUSER_NAME`, `SUSER_SNAME`, `SYSTEM_USER`, `USER`, `USER_NAME`, `EXECUTE AS`, `OPEN/CLOSE MASTER KEY` | Some Transact-SQL security functions and operators are supported: `CURRENT_USER`, `HAS_DBACCESS`, `HAS_PERMS_BY_NAME`, `IS_MEMBER`, `IS_ROLEMEMBER`, `IS_SRVROLEMEMBER`, `SESSION_USER`, `SESSION_CONTEXT`, `SUSER_NAME`, `SUSER_SNAME`, `SYSTEM_USER`, `USER`, `USER_NAME`, `EXECUTE AS`, and `REVERT`. Security functions cannot be used to query external data (store the result in variable that can be used in the query). |-| **Transparent Data Encryption (TDE)** | [Yes](../../azure-sql/database/transparent-data-encryption-tde-overview.md) | No, Transparent Data Encryption is not supported. | -| **Data Discovery & Classification** | [Yes](../../azure-sql/database/data-discovery-and-classification-overview.md) | No, Data Discovery & Classification is not supported. | -| **Vulnerability Assessment** | [Yes](../../azure-sql/database/sql-vulnerability-assessment.md) | No, Vulnerability Assessment is not available. | -| **Advanced Threat Protection** | [Yes](../../azure-sql/database/threat-detection-overview.md) | No, Advanced Threat Protection is not supported. | -| **Auditing** | [Yes](../../azure-sql/database/auditing-overview.md) | Yes, [auditing is supported](../../azure-sql/database/auditing-overview.md) in serverless SQL pools. | +| **Transparent Data Encryption (TDE)** | [Yes](/azure/azure-sql/database/transparent-data-encryption-tde-overview) | No, Transparent Data Encryption is not supported. | +| **Data Discovery & Classification** | [Yes](/azure/azure-sql/database/data-discovery-and-classification-overview) | No, Data Discovery & Classification is not supported. | +| **Vulnerability Assessment** | [Yes](/azure/azure-sql/database/sql-vulnerability-assessment) | No, Vulnerability Assessment is not available. | +| **Advanced Threat Protection** | [Yes](/azure/azure-sql/database/threat-detection-overview) | No, Advanced Threat Protection is not supported. | +| **Auditing** | [Yes](/azure/azure-sql/database/auditing-overview) | Yes, [auditing is supported](/azure/azure-sql/database/auditing-overview) in serverless SQL pools. | | **[Firewall rules](../security/synapse-workspace-ip-firewall.md)**| Yes | Yes, the firewall rules can be set on the serverless SQL endpoint. | | **[Private endpoint](../security/synapse-workspace-managed-private-endpoints.md)**| Yes | Yes, the private endpoint can be set on the serverless SQL pool. | |
| synapse-analytics | Resource Consumption Models | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql/resource-consumption-models.md | As you increase data warehouse units, you're linearly increasing computing resou #### Capacity limits -Each SQL server (for example, myserver.database.windows.net) has a [Database Transaction Unit (DTU)](../../azure-sql/database/service-tiers-dtu.md) quota that allows a specific number of data warehouse units. For more information, see the [workload management capacity limits](../sql-data-warehouse/sql-data-warehouse-service-capacity-limits.md?context=/azure/synapse-analytics/context/context#workload-management). +Each SQL server (for example, myserver.database.windows.net) has a [Database Transaction Unit (DTU)](/azure/azure-sql/database/service-tiers-dtu) quota that allows a specific number of data warehouse units. For more information, see the [workload management capacity limits](../sql-data-warehouse/sql-data-warehouse-service-capacity-limits.md?context=/azure/synapse-analytics/context/context#workload-management). ### Assess the number of data warehouse units you need |
| traffic-manager | Traffic Manager Load Balancing Azure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/traffic-manager/traffic-manager-load-balancing-azure.md | In this scenario, Traffic Manager is connected to application gateways (as confi In this scenario, Load Balancer distributes connections from the web tier to the databases within a high-availability cluster. -If your high-availability database cluster is using SQL Server AlwaysOn, refer to [Configure one or more Always On Availability Group Listeners](../azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure.md) for step-by-step instructions. +If your high-availability database cluster is using SQL Server AlwaysOn, refer to [Configure one or more Always On Availability Group Listeners](/azure/azure-sql/virtual-machines/windows/availability-group-listener-powershell-configure) for step-by-step instructions. For more information about configuring an internal load balancer, see [Create an Internal load balancer in the Azure portal](../load-balancer/quickstart-load-balancer-standard-internal-portal.md). |
| virtual-desktop | Azure Stack Hci | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/azure-stack-hci.md | You can find the image you're looking for by using the **Search** function in Az If you're looking for Windows 10 multi-session, you can run a search with this criteria: -```azure +```azurecli az vm image list --all --publisher "microsoftwindowsdesktop" --offer "windows-10" --sku "21h1-evd-g2" ``` This command should return the following URN: -```azure +```output MicrosoftWindowsDesktop:Windows-10:21h1-evd-g2:latest ``` If you're looking for Windows Server 2019 datacenter, you can run the following criteria in your Azure CLI: -```azure +```azurecli az vm image list --all --publisher "microsoftwindowsserver" --offer "WindowsServer" --sku "2019-Datacenter-gen2" ``` This command should return the following URN: -```azure +```output MicrosoftWindowsServer:windowsserver-gen2preview:2019-datacenter-gen2:latest ``` To create an Azure managed disk: 1. Run the following commands in an Azure command-line prompt to set the parameters of your managed disk. Make sure to replace the items in brackets with the values relevant to your scenario. -```azure +```console $urn = <URN of the Marketplace image> #Example: ΓÇ£MicrosoftWindowsServer:WindowsServer:2019-Datacenter:LatestΓÇ¥ $diskName = <disk name> #Name for new disk to be created $diskRG = <resource group> #Resource group that contains the new disk $diskRG = <resource group> #Resource group that contains the new disk 2. Run these commands to create the disk and generate a Serial Attached SCSI (SAS) access URL. -```azure +```azurecli az disk create -g $diskRG -n $diskName --image-reference $urn $sas = az disk grant-access --duration-in-seconds 36000 --access-level Read --name $diskName --resource-group $diskRG $diskAccessSAS = ($sas | ConvertFrom-Json)[0].accessSas To export the VHD: >[!NOTE] >If you're running azcopy, you may need to skip the md5check by running this command: >-> ```azure +> ```azurecli > azcopy copy ΓÇ£$sas" "destination_path_on_cluster" --check-md5 NoCheck > ``` When you're done with your VHD, you'll need to free up space by deleting the man To delete the managed disk you created, run these commands: -```azure +```azurecli az disk revoke-access --name $diskName --resource-group $diskRG az disk delete --name $diskName --resource-group $diskRG --yes ``` |
| virtual-desktop | Teams On Avd | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/teams-on-avd.md | Title: Microsoft Teams on Azure Virtual Desktop - Azure description: How to use Microsoft Teams on Azure Virtual Desktop. Previously updated : 02/14/2022 Last updated : 04/25/2022 ->- Windows Desktop and client on Windows 10/11 machines. Windows Desktop client version 1.2.1026.0 or later. +>- Windows Desktop client for Windows 10 or 11 machines, version 1.2.1026.0 or later. >- macOS Remote Desktop client, version 10.7.7 or later (preview) > [!IMPORTANT] Before you can use Microsoft Teams on Azure Virtual Desktop, you'll need to do t - [Prepare your network](/microsoftteams/prepare-network/) for Microsoft Teams. - Install the [Remote Desktop client](./user-documentation/connect-windows-7-10.md) on a Windows 10 or Windows 10 IoT Enterprise device that meets the Microsoft Teams [hardware requirements for Teams](/microsoftteams/hardware-requirements-for-the-teams-app#hardware-requirements-for-teams-on-a-windows-pc/).-- Connect to a Windows 10/11 Multi-session or Windows 10/11 Enterprise virtual machine (VM).+- Connect to a Windows 10 or 11 Multi-session or Windows 10 or 11 Enterprise virtual machine (VM). ## Install the Teams desktop app -This section will show you how to install the Teams desktop app on your Windows 10/11 Multi-session or Windows 10/11 Enterprise VM image. To learn more, check out [Install or update the Teams desktop app on VDI](/microsoftteams/teams-for-vdi#install-or-update-the-teams-desktop-app-on-vdi). +This section will show you how to install the Teams desktop app on your Windows 10 or 11 Multi-session or Windows 10 or 11 Enterprise VM image. To learn more, check out [Install or update the Teams desktop app on VDI](/microsoftteams/teams-for-vdi#install-or-update-the-teams-desktop-app-on-vdi). ### Prepare your image for Teams Using Teams in a virtualized environment is different from using Teams in a non- ### Calls and meetings -- The Teams desktop client in Azure Virtual Desktop environments doesn't support creating live events, but you can join live events. For now, we recommend you create live events from the [Teams web client](https://teams.microsoft.com) in your remote session instead.+- The Teams desktop client in Azure Virtual Desktop environments doesn't support creating live events, but you can join live events. For now, we recommend you create live events from the [Teams web client](https://teams.microsoft.com) in your remote session instead. When watching a live event in the browser, [enable multimedia redirection (MMR) for Teams live events](multimedia-redirection.md#how-to-use-mmr-for-teams-live-events) for smoother playback. - Calls or meetings don't currently support application sharing. Desktop sessions support desktop sharing. - Give control and take control aren't currently supported. - Teams on Azure Virtual Desktop only supports one incoming video input at a time. This means that whenever someone tries to share their screen, their screen will appear instead of the meeting leader's screen. |
| virtual-machine-scale-sets | Vmss Support Help | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machine-scale-sets/vmss-support-help.md | If you can't find an answer to your problem using search, submit a new question |-|-| | [Azure virtual machine scale sets](overview.md) | [azure-virtual-machine-scale-set](/answers/topics/azure-virtual-machines-scale-set.html) | | [Azure Virtual Machines](../virtual-machines/linux/overview.md) | [azure-virtual-machines](/answers/topics/azure-virtual-machines.html) | -| [Azure SQL Virtual Machines](../azure-sql/virtual-machines/index.yml) | [azure-sql-virtual-machines](/answers/topics/azure-sql-virtual-machines.html)| +| [Azure SQL Virtual Machines](/azure/azure-sql/virtual-machines/index) | [azure-sql-virtual-machines](/answers/topics/azure-sql-virtual-machines.html)| | [Azure Virtual Machine backup](../virtual-machines/backup-recovery.md) | [azure-virtual-machine-backup](/answers/questions/36892/azure-virtual-machine-backups.html) | | [Azure Virtual Machine extension](../virtual-machines/extensions/overview.md) | [azure-virtual-machine-extension](/answers/topics/azure-virtual-machines-extension.html)| | [Azure Virtual Machine Images](../virtual-machines/shared-image-galleries.md) | [azure-virtual-machine-images](/answers/topics/azure-virtual-machines-images.html) | |
| virtual-machines | Backup And Disaster Recovery For Azure Iaas Disks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/backup-and-disaster-recovery-for-azure-iaas-disks.md | Creation of the snapshots alone might not be sufficient for disaster recovery. Y ### SQL Server -SQL Server running in a VM has its own built-in capabilities to back up your SQL Server database to Azure Blob storage or a file share. For more information, see [Back up and restore for SQL Server in Azure virtual machines](../azure-sql/virtual-machines/windows/azure-storage-sql-server-backup-restore-use.md). In addition to back up and restore, [SQL Server AlwaysOn availability groups](../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md) can maintain secondary replicas of databases. This ability greatly reduces the disaster recovery time. +SQL Server running in a VM has its own built-in capabilities to back up your SQL Server database to Azure Blob storage or a file share. For more information, see [Back up and restore for SQL Server in Azure virtual machines](/azure/azure-sql/virtual-machines/windows/azure-storage-sql-server-backup-restore-use). In addition to back up and restore, [SQL Server AlwaysOn availability groups](/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview) can maintain secondary replicas of databases. This ability greatly reduces the disaster recovery time. ## Next steps |
| virtual-machines | Custom Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/custom-data.md | To use custom data, you must Base64-encode the contents before passing the data In the CLI, you can pass your custom data as a file, as the following example shows. The file will be converted to Base64. -```bash +```azurecli az vm create \ --resource-group myResourceGroup \ --name centos74 \ |
| virtual-machines | Disks Enable Ultra Ssd | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/disks-enable-ultra-ssd.md | Update-AzDisk -ResourceGroupName $resourceGroup -DiskName $diskName -DiskUpdate ## Next steps - [Use Azure ultra disks on Azure Kubernetes Service (preview)](../aks/use-ultra-disks.md).-- [Migrate log disk to an ultra disk](../azure-sql/virtual-machines/windows/storage-migrate-to-ultradisk.md).+- [Migrate log disk to an ultra disk](/azure/azure-sql/virtual-machines/windows/storage-migrate-to-ultradisk). |
| virtual-machines | Disks Find Unattached Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/disks-find-unattached-portal.md | description: How to find unattached Azure managed and unmanaged (VHDs/page blobs Previously updated : 06/29/2021 Last updated : 04/25/2022 If you have unattached managed disks and no longer need the data on them, the fo On the **Disks** blade, you are presented with a list of all your disks. -1. Select the disk you'd like to delete, this opens the disk's blade. -1. On the disk's blade, confirm the disk state is unattached, then select **Delete**. +1. Select the disk you'd like to delete, this brings you to the individual disk's blade. +1. On the individual disk's blade, confirm the disk state is unattached, then select **Delete**. :::image type="content" source="media/disks-find-unattached-portal/delete-managed-disk-unattached.png" alt-text="Screenshot of an individual managed disks blade. This blade will show unattached in the disk state if it is unattached. You can delete this disk if you do not need to preserve its data any longer"::: If you have unmanaged disks that aren't attached to a VM, no longer need the dat :::image type="content" source="media/disks-find-unattached-portal/unmanaged-disk-unattached-attached-to.png" alt-text="Screenshot of the unmanaged disks blade. Disks in this blade that have - in the attached to column are unattached."::: -1. Select the unattached disk you'd like to delete, this brings up the disk's blade. +1. Select the unattached disk you'd like to delete, this brings up the individual disk's blade. -1. On the disk's blade, you can confirm it is unattached, since **Attached to** will still be **-**. +1. On that individual disk's blade, you can confirm it is unattached, since **Attached to** will still be **-**. :::image type="content" source="media/disks-find-unattached-portal/unmanaged-disk-unattached-select-blade.png" alt-text="Screenshot of an individual unmanaged disk blade. It will have - as the attached to value if it is unattached. If you no longer need this disks data, you can delete it."::: |
| virtual-machines | Disks Shared | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/disks-shared.md | Azure shared disks are supported on Windows Server 2008 and newer. Most Windows- Some popular applications running on WSFC include: -- [Create an FCI with Azure shared disks (SQL Server on Azure VMs)](../azure-sql/virtual-machines/windows/failover-cluster-instance-azure-shared-disks-manually-configure.md)- - [Migrate your failover cluster instance to SQL Server on Azure VMs with shared disks](../azure-sql/migration-guides/virtual-machines/sql-server-failover-cluster-instance-to-sql-on-azure-vm.md) +- [Create an FCI with Azure shared disks (SQL Server on Azure VMs)](/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-azure-shared-disks-manually-configure) + - [Migrate your failover cluster instance to SQL Server on Azure VMs with shared disks](/azure/azure-sql/migration-guides/virtual-machines/sql-server-failover-cluster-instance-to-sql-on-azure-vm) - Scale-out File Server (SoFS) [template](https://aka.ms/azure-shared-disk-sofs-template) - SAP ASCS/SCS [template](https://aka.ms/azure-shared-disk-sapacs-template) - File Server for General Use (IW workload) |
| virtual-machines | Linux Vm Connect | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux-vm-connect.md | + + Title: Connect to a Linux VM +description: Learn how to connect to a Linux VM in Azure. +++++ Last updated : 04/18/2022++++# Connect to a Linux VM ++In Azure there are multiple ways to connect to a Linux virtual machine. The most common practice for connecting to a Linux VM is using the Secure Shell Protocol (SSH). This is done via any standard SSH aware client commonly found in Linux; on Windows you can use [Windows Sub System for Linux](/windows/wsl/about) or any local terminal. You can also use [Azure Cloud Shell](../cloud-shell/overview.md) from any browser. ++This document describes how to connect, via SSH, to a VM that has a public IP. If you need to connect to a VM without a public IP see [Azure Bastion Service](../bastion/bastion-overview.md) ++## Prerequisites ++- You need an SSH key pair. If you don't already have one Azure will create a key pair during the deployment process. If you need help with creating one manually, see [Create and use an SSH public-private key pair for Linux VMs in Azure](./linux/mac-create-ssh-keys.md). ++- In order to connect to a Linux Virtual Machine you need the appropriate port open: normally this will be port 22. The following instructions assume port 22 but the process is the same for other port numbers. You can validate an appropriate port is open for SSH using the troubleshooter or by checking manually in your VM settings. To check if port 22 is open: ++ 1. On the page for the VM, select **Networking** from the left menu. + 1. On the **Networking** page, check to see if there is a rule which allows TCP on port 22 from the IP address of the computer you are using to connect to the VM. If the rule exists, you can move to the next section. + 1. If there isn't a rule, add one by selecting **Add inbound port rule**. + 1. From the **Service** dropdown select **SSH**. + + :::image type="content" source="media/linux-vm-connect/create-rule.png" alt-text="Screenshot showing where to choose S S H."::: ++ 1. Edit **Priority** and **Source** if necessary + 1. For **Name**, type *SSH*. + 1. When you are done, select **Add**. + 1. You should now have an SSH rule in the table of inbound port rules. ++- Your VM must have a public IP address. To check if your VM has a public IP address, select **Overview** from the left menu and look at the **Networking** section. If you see an IP address next to **Public IP address**, then your VM has a public IP + + If your VM does not have a public IP Address, it will look like this: ++ :::image type="content" source="media/linux-vm-connect/no-public-ip.png" alt-text="Screenshot of how the networking section looks when you do not have a public I P."::: ++ + To learn more about adding a public IP address to an existing VM, see [Associate a public IP address to a virtual machine](../virtual-network/ip-services/associate-public-ip-address-vm.md) ++- Verify your VM is running. On the Overview tab, in the **Essentials** section, verify the status of the VM is **Running**. To start the VM, select **Start** at the top of the page. + +## Connect to the VM ++Once the above prerequisites are met, you are ready to connect to your VM. Open your SSH client of choice. +++- If you are using Linux or macOS this is most commonly terminal or shell. +- For a Windows machine this might be [WSL](/windows/wsl/about), or any local terminal like [PowerShell](/powershell/scripting/overview). If you do not have an SSH client you can [install WSL](/windows/wsl/install), or consider using [Azure Cloud Shell](../cloud-shell/overview.md). ++> [!NOTE] +> The following examples assume the SSH key is in the key.pem format. If you used CLI or Azure PowerShell to download your keys, they may be in the id_rsa format. ++## [WSL, macOS, or native Linux client](#tab/Linux) ++### SSH with a new key pair +1. Ensure your public and private keys are in the correct directory. This is usually the ~/.ssh directory. ++ If you generated keys manually or generated them with the CLI, then the keys are probably already there. However, if you downloaded them in pem format from the Azure portal, you may need to move them to the right location. This can be done with the following syntax: `mv PRIVATE_KEY_SOURCE PRIVATE_KEY_DESTINATION` + + For example, if the key is in the `Downloads` folder, and `myKey.pem` is the name of your SSH key, type: + ```bash + mv /Downloads/myKey.pem ~/.ssh + ``` +2. Ensure you have read-only access to the private Key by running + ```bash + chmod 400 ~/.ssh/myKey.pem + ``` +3. Run the SSH command with the following syntax: `ssh -i PATH_TO_PRIVATE_KEY USERNAME@EXTERNAL_IP` + + For example, if your `azureuser` is the username you created and `20.51.230.13` is the public IP address of your VM, type: + ```bash + ssh -i ~/.ssh/myKey.pem azureuser@20.51.230.13 + ``` +4. Validate the returned fingerprint. ++ If you have never connected to this VM before you will be asked to verify the hosts fingerprint. It is tempting to simply accept the fingerprint presented, however, this exposes you to a potential person in the middle attack. You should always validate the hosts fingerprint. You only need to do this on the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command: + + ```bash + ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' + ``` +5. Success! You should now be connected to your VM. If you are unable to connect, see [Troubleshoot SSH connections](/troubleshoot/azure/virtual-machines/troubleshoot-ssh-connection). ++### SSH With existing public key +1. Run the following command in your SSH client. In this example, *20.51.230.13* is the public IP Address of your VM and *azureuser* is the username you created when you created the VM. + ```bash + ssh azureuser@20.51.230.13 + ``` +2. Validate the returned fingerprint. + + If you have never connected to this VM before you will be asked to verify the hosts fingerprint. It is tempting to simply accept the fingerprint presented, however, this exposes you to a possible person in the middle attack. You should always validate the hosts fingerprint. You only need to do this on the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command: + + ```bash + ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' + ``` ++3. Success! You should now be connected to your VM. If you are unable to connect, see our troubleshooting guide [Troubleshoot SSH connections](/troubleshoot/azure/virtual-machines/troubleshoot-ssh-connection). ++### Password authentication + +> [!WARNING] +> This type of authentication method is not as secure and is not recommended. ++1. Run the following command in your SSH client. In this example, *20.51.230.13* is the public IP Address of your VM and *azureuser* is the username you created when you created the VM. ++ ```bash + ssh azureuser@20.51.230.13 + ``` ++ If you forgot your password or username see [Reset Access to an Azure VM](./extensions/vmaccess.md) ++2. Validate the returned fingerprint. ++ If you have never connected to this VM before you will be asked to verify the hosts fingerprint. It is tempting to simply accept the fingerprint presented, however, this exposes you to a possible person in the middle attack. You should always validate the hosts fingerprint. You only need to do this on the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command: + ```bash + ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' + ``` ++3. Success! You should now be connected to your VM. If you are unable to connect using the correct method above, see [Troubleshoot SSH connections](/troubleshoot/azure/virtual-machines/troubleshoot-ssh-connection). +++## [Windows 10 Command Line (cmd.exe, PowerShell etc.)](#tab/Windows) ++### SSH with a new key pair +1. Locate your private SSH Key +2. Run the SSH command with the following syntax: `ssh -i PATH_TO_PRIVATE_KEY USERNAME@EXTERNAL_IP` ++ For example, if your `azureuser` is the username you created and `20.51.230.13` is the public IP address of your VM, type: + ```bash + ssh -i .\Downloads\myKey.pem azureuser@20.51.230.13 + ``` +3. Validate the returned fingerprint. ++ If you have never connected to this VM before you will be asked to verify the hosts fingerprint. It is tempting to simply accept the fingerprint presented, however, this exposes you to a possible person in the middle attack. You should always validate the hosts fingerprint. You only need to do this on the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command: + + ```bash + ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' + ``` +4. Success! You should now be connected to your VM. If you are unable to connect, see [Troubleshoot SSH connections](/troubleshoot/azure/virtual-machines/troubleshoot-ssh-connection). ++### Password authentication + +> [!WARNING] +> This type of authentication method is not as secure and is not our recommended way to connect. ++1. Run the following command in your SSH client, where `20.51.230.13` is the public IP Address of your VM and `azureuser` is the username you created when you created the VM. ++ ```bash + ssh azureuser@20.51.230.13 + ``` ++ If you forgot your password or username see [Reset Access to an Azure VM](./extensions/vmaccess.md) ++2. Validate the returned fingerprint. + + If you have never connected to this VM before you will be asked to verify the hosts fingerprint. It is tempting to simply accept the fingerprint presented, however, this exposes you to a potential person in the middle attack. You should always validate the hosts fingerprint. You only need to do this on the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command: + + ```bash + ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}' + ``` ++3. Success! You should now be connected to your VM. If you are unable to connect using the methods above, see [Troubleshoot SSH connections](/troubleshoot/azure/virtual-machines/troubleshoot-ssh-connection). ++++## Next steps ++Learn how to transfer files to an existing Linux VM, see [Use SCP to move files to and from a Linux VM](./linux/copy-files-to-linux-vm-using-scp.md). + |
| virtual-machines | Cli Ps Findimage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/cli-ps-findimage.md | If you have an existing VHD from a VM that was created using a paid Azure Market If you still have the original VM, or another VM created using the same marketplace image, you can get the plan name, publisher, and product information from it using [az vm get-instance-view](/cli/azure/vm#az-vm-get-instance-view). This example gets a VM named *myVM* in the *myResourceGroup* resource group and then displays the purchase plan information. -```azurepowershell-interactive +```azurecli-interactive az vm get-instance-view -g myResourceGroup -n myVM --query plan ``` |
| virtual-machines | How To Resize Encrypted Lvm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/how-to-resize-encrypted-lvm.md | The traditional way to resize LVs is to extend an LV when the VG has space avail 1. Verify the current size of the file system that you want to increase: - ``` bash + ```bash df -h /mountpoint ``` The traditional way to resize LVs is to extend an LV when the VG has space avail 2. Verify that the VG has enough space to increase the LV: - ``` bash + ```bash vgs ``` The traditional way to resize LVs is to extend an LV when the VG has space avail You can also use `vgdisplay`: - ``` bash + ```bash vgdisplay vgname ``` The traditional way to resize LVs is to extend an LV when the VG has space avail 3. Identify which LV needs to be resized: - ``` bash + ```bash lsblk ``` The traditional way to resize LVs is to extend an LV when the VG has space avail 4. Check the LV size: - ``` bash + ```bash lvdisplay lvname ``` The traditional way to resize LVs is to extend an LV when the VG has space avail 5. Increase the LV size by using `-r` to resize the file system online: - ``` bash + ```bash lvextend -r -L +2G /dev/vgname/lvname ``` The traditional way to resize LVs is to extend an LV when the VG has space avail 6. Verify the new sizes for the LV and the file system: - ``` bash + ```bash df -h /mountpoint ``` The traditional way to resize LVs is to extend an LV when the VG has space avail You can check the LV information again to confirm the changes at the level of the LV: -``` bash +```bash lvdisplay lvname ``` When you need to add a new disk to increase the VG size, extend your traditional 1. Verify the current size of the file system that you want to increase: - ``` bash + ```bash df -h /mountpoint ``` When you need to add a new disk to increase the VG size, extend your traditional 2. Verify the current PV configuration: - ``` bash + ```bash pvs ``` When you need to add a new disk to increase the VG size, extend your traditional 3. Check the current VG information: - ``` bash + ```bash vgs ``` When you need to add a new disk to increase the VG size, extend your traditional 4. Check the current disk list. Identify data disks by checking the devices in */dev/disk/azure/scsi1/*. - ``` bash + ```bash ls -l /dev/disk/azure/scsi1/ ``` When you need to add a new disk to increase the VG size, extend your traditional 5. Check the output of `lsblk`: - ``` bash + ```bash lsbk ``` When you need to add a new disk to increase the VG size, extend your traditional 7. Check the disk list, and notice the new disk. - ``` bash + ```bash ls -l /dev/disk/azure/scsi1/ ```  - ``` bash + ```bash lsbk ``` When you need to add a new disk to increase the VG size, extend your traditional 8. Create a new PV on top of the new data disk: - ``` bash + ```bash pvcreate /dev/newdisk ``` When you need to add a new disk to increase the VG size, extend your traditional 9. Verify that the PV was added to the PV list: - ``` bash + ```bash pvs ``` When you need to add a new disk to increase the VG size, extend your traditional 10. Extend the VG by adding the new PV to it: - ``` bash + ```bash vgextend vgname /dev/newdisk ``` When you need to add a new disk to increase the VG size, extend your traditional 11. Check the new VG size: - ``` bash + ```bash vgs ``` When you need to add a new disk to increase the VG size, extend your traditional 12. Use `lsblk` to identify the LV that needs to be resized: - ``` bash + ```bash lsblk ``` When you need to add a new disk to increase the VG size, extend your traditional 13. Extend the LV size by using `-r` to increase the file system online: - ``` bash + ```bash lvextend -r -L +2G /dev/vgname/lvname ``` When you need to add a new disk to increase the VG size, extend your traditional 14. Verify the new sizes of the LV and file system: - ``` bash + ```bash df -h /mountpoint ``` When you need to add a new disk to increase the VG size, extend your traditional 17. Set the encryption extension again. This time you'll stamp the encryption settings on the new data disk at the platform level. Here's a CLI example: - ``` bash + ```azurecli az vm encryption enable -g ${RGNAME} --name ${VMNAME} --disk-encryption-keyvault "<your-unique-keyvault-name>" ``` Follow these steps to finish cleaning up: 1. Unmount the LV: - ``` bash + ```bash umount /mountpoint ``` 1. Close the encrypted layer of the volume: - ``` bash + ```bash cryptsetup luksClose /dev/vgname/lvname ``` 1. Delete the LV: - ``` bash + ```bash lvremove /dev/vgname/lvname ``` Im some scenarios, your limitations might require you to resize an existing disk 1. Identify your encrypted disks: - ``` bash + ```bash ls -l /dev/disk/azure/scsi1/ ```  - ``` bash + ```bash lsblk -fs ``` Im some scenarios, your limitations might require you to resize an existing disk 2. Check the PV information: - ``` bash + ```bash pvs ``` Im some scenarios, your limitations might require you to resize an existing disk 3. Check the VG information: - ``` bash + ```bash vgs vgdisplay -v vgname ``` Im some scenarios, your limitations might require you to resize an existing disk 4. Check the disk sizes. You can use `fdisk` or `lsblk` to list the drive sizes. - ``` bash + ```bash for disk in `ls -l /dev/disk/azure/scsi1/* | awk -F/ '{print $NF}'` ; do echo "fdisk -l /dev/${disk} | grep ^Disk "; done | bash lsblk -o "NAME,SIZE" Im some scenarios, your limitations might require you to resize an existing disk Here we identified which PVs are associated with which LVs by using `lsblk -fs`. You can identify the associations by running `lvdisplay`. - ``` bash + ```bash lvdisplay --maps VG/LV lvdisplay --maps datavg/datalv1 ``` Im some scenarios, your limitations might require you to resize an existing disk 5. Check the current file system utilization: - ``` bash + ```bash df -h /datalvm* ``` Im some scenarios, your limitations might require you to resize an existing disk 7. Start the VM and check the new sizes by using `fdisk`. - ``` bash + ```bash for disk in `ls -l /dev/disk/azure/scsi1/* | awk -F/ '{print $NF}'` ; do echo "fdisk -l /dev/${disk} | grep ^Disk "; done | bash lsblk -o "NAME,SIZE" Im some scenarios, your limitations might require you to resize an existing disk 8. Check the current PV size: - ``` bash + ```bash pvdisplay /dev/resizeddisk ``` Im some scenarios, your limitations might require you to resize an existing disk 9. Resize the PV: - ``` bash + ```bash pvresize /dev/resizeddisk ``` Im some scenarios, your limitations might require you to resize an existing disk 10. Check the PV size: - ``` bash + ```bash pvdisplay /dev/resizeddisk ``` Im some scenarios, your limitations might require you to resize an existing disk 11. Check the VG information. - ``` bash + ```bash vgdisplay vgname ``` Im some scenarios, your limitations might require you to resize an existing disk 12. Resize the LV: - ``` bash + ```bash lvresize -r -L +5G vgname/lvname lvresize -r -l +100%FREE /dev/datavg/datalv01 ``` Im some scenarios, your limitations might require you to resize an existing disk 13. Check the size of the file system: - ``` bash + ```bash df -h /datalvm2 ``` You can use this method to add space to an existing LV. Or you can create new VG 1. Verify the current size of your VG: - ``` bash + ```bash vgdisplay vgname ``` You can use this method to add space to an existing LV. Or you can create new VG 2. Verify the size of the file system and LV that you want to expand: - ``` bash + ```bash lvdisplay /dev/vgname/lvname ```  - ``` bash + ```bash df -h mountpoint ``` You can use this method to add space to an existing LV. Or you can create new VG Before you add the new disk, check the disks: - ``` bash + ```bash fdisk -l | egrep ^"Disk /" ``` You can use this method to add space to an existing LV. Or you can create new VG Here's another way to check the disks before you add the new disk: - ``` bash + ```bash lsblk ``` You can use this method to add space to an existing LV. Or you can create new VG 4. Check the disks to make sure the new disk has been added: - ``` bash + ```bash fdisk -l | egrep ^"Disk /" ```  - ``` bash + ```bash lsblk ``` You can use this method to add space to an existing LV. Or you can create new VG 5. Create a file system on top of the recently added disk. Match the disk to the linked devices on `/dev/disk/azure/scsi1/`. - ``` bash + ```bash ls -la /dev/disk/azure/scsi1/ ```  - ``` bash + ```bash mkfs.ext4 /dev/disk/azure/scsi1/${disk} ``` You can use this method to add space to an existing LV. Or you can create new VG 6. Create a temporary mount point for the new added disk: - ``` bash + ```bash newmount=/data4 mkdir ${newmount} ``` 7. Add the recently created file system to `/etc/fstab`. - ``` bash + ```bash blkid /dev/disk/azure/scsi1/lun4| awk -F\" '{print "UUID="$2" '${newmount}' "$4" defaults,nofail 0 0"}' >> /etc/fstab ``` 8. Mount the newly created file system: - ``` bash + ```bash mount -a ``` 9. Verify that the new file system is mounted: - ``` bash + ```bash df -h ```  - ``` bash + ```bash lsblk ``` You can use this method to add space to an existing LV. Or you can create new VG Here's an example: - ``` bash + ```azurecli az vm encryption enable \ --resource-group ${RGNAME} \ --name ${VMNAME} \ You can use this method to add space to an existing LV. Or you can create new VG When the encryption finishes, you see a crypt layer on the newly added disk: - ``` bash + ```bash lsblk ``` You can use this method to add space to an existing LV. Or you can create new VG 11. Unmount the encrypted layer of the new disk: - ``` bash + ```bash umount ${newmount} ``` 12. Check the current PV information: - ``` bash + ```bash pvs ``` You can use this method to add space to an existing LV. Or you can create new VG 13. Create a PV on top of the encrypted layer of the disk. Take the device name from the previous `lsblk` command. Add a `/dev/` mapper in front of the device name to create the PV: - ``` bash + ```bash pvcreate /dev/mapper/mapperdevicename ``` You can use this method to add space to an existing LV. Or you can create new VG 14. Verify that the new PV was added to the LVM configuration: - ``` bash + ```bash pvs ``` You can use this method to add space to an existing LV. Or you can create new VG 15. Add the new PV to the VG that you need to increase. - ``` bash + ```bash vgextend vgname /dev/mapper/nameofhenewpv ``` You can use this method to add space to an existing LV. Or you can create new VG 16. Verify the new size and free space of the VG: - ``` bash + ```bash vgdisplay vgname ``` You can use this method to add space to an existing LV. Or you can create new VG 17. Increase the size of the LV and the file system. Use the `-r` option on `lvextend`. In this example, we're adding the total available space in the VG to the given LV. - ``` bash + ```bash lvextend -r -l +100%FREE /dev/vgname/lvname ``` Follow the next steps to verify your changes. 1. Verify the size of the LV: - ``` bash + ```bash lvdisplay /dev/vgname/lvname ``` Follow the next steps to verify your changes. 1. Verify the new size of the file system: - ``` bash + ```bash df -h mountpoint ``` Follow the next steps to verify your changes. 1. Verify that the LVM layer is on top of the encrypted layer: - ``` bash + ```bash lsblk ``` Follow the next steps to verify your changes. You might want to use `lsblk -fs`. In this command, `-fs` reverses the sort order so that the mount points are shown once. The disks are shown multiple times. - ``` bash + ```bash lsblk -fs ``` Follow the next steps to verify your changes. 1. Identify your encrypted disks: - ``` bash + ```bash lsblk ```  - ``` bash + ```bash lsblk -s ``` Follow the next steps to verify your changes. 2. Check your PV information: - ``` bash + ```bash pvs ``` Follow the next steps to verify your changes. 3. Check your VG information: - ``` bash + ```bash vgs ``` Follow the next steps to verify your changes. 4. Check your LV information: - ``` bash + ```bash lvs ``` Follow the next steps to verify your changes. 5. Check the file system utilization: - ``` bash + ```bash df -h /mountpoint(s) ``` Follow the next steps to verify your changes. 6. Check the sizes of your disks: - ``` bash + ```bash fdisk fdisk -l | egrep ^"Disk /" lsblk Follow the next steps to verify your changes. 8. Check your disks sizes: - ``` bash + ```bash fdisk fdisk -l | egrep ^"Disk /" lsblk Follow the next steps to verify your changes. 9. Check the current PV size. Remember that on LVM-on-crypt, the PV is the `/dev/mapper/` device, not the `/dev/sd*` device. - ``` bash + ```bash pvdisplay /dev/mapper/devicemappername ``` Follow the next steps to verify your changes. 10. Resize the PV: - ``` bash + ```bash pvresize /dev/mapper/devicemappername ``` Follow the next steps to verify your changes. 11. Check the new PV size: - ``` bash + ```bash pvdisplay /dev/mapper/devicemappername ``` Follow the next steps to verify your changes. 12. Resize the encrypted layer on the PV: - ``` bash + ```bash cryptsetup resize /dev/mapper/devicemappername ``` Follow the next steps to verify your changes. 13. Check your VG information: - ``` bash + ```bash vgdisplay vgname ``` Follow the next steps to verify your changes. 14. Check the LV information: - ``` bash + ```bash lvdisplay vgname/lvname ``` Follow the next steps to verify your changes. 15. Check the file system utilization: - ``` bash + ```bash df -h /mountpoint ``` Follow the next steps to verify your changes. 16. Resize the LV: - ``` bash + ```bash lvresize -r -L +2G /dev/vgname/lvname ``` Follow the next steps to verify your changes. 17. Check the LV information: - ``` bash + ```bash lvdisplay vgname/lvname ``` Follow the next steps to verify your changes. 18. Check the file system utilization: - ``` bash + ```bash df -h /mountpoint ``` |
| virtual-machines | Image Builder Devops Task | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/image-builder-devops-task.md | There are two Azure VM Image Builder (AIB) DevOps Tasks: New-AzStorageAccount -ResourceGroupName $strResourceGroup -Name $storageAccName -Location $location -SkuName Standard_LRS ``` - ```bash + ```azurecli # Az CLI location=westus scriptStorageAcc=aibstordot$(date +'%s') |
| virtual-machines | Image Builder Json | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/image-builder-json.md | You can distribute an image to both of the target types in the same configuratio Because you can have more than one target to distribute to, Image Builder maintains a state for every distribution target that can be accessed by querying the `runOutputName`. The `runOutputName` is an object you can query post distribution for information about that distribution. For example, you can query the location of the VHD, or regions where the image version was replicated to, or SIG Image version created. This is a property of every distribution target. The `runOutputName` must be unique to each distribution target. Here is an example, this is querying an Azure Compute Gallery distribution: -```bash +```azurecli subscriptionID=<subcriptionID> imageResourceGroup=<resourceGroup of image template> runOutputName=<runOutputName> Invoke-AzResourceAction -ResourceName $imageTemplateName -ResourceGroupName $ima ``` -```bash +```azurecli az resource invoke-action \ --resource-group $imageResourceGroup \ --resource-type Microsoft.VirtualMachineImages/imageTemplates \ Examples of `cancel` commands: Invoke-AzResourceAction -ResourceName $imageTemplateName -ResourceGroupName $imageResourceGroup -ResourceType Microsoft.VirtualMachineImages/imageTemplates -ApiVersion "2021-10-01" -Action Cancel -Force ``` -```bash +```azurecli az resource invoke-action \ --resource-group $imageResourceGroup \ --resource-type Microsoft.VirtualMachineImages/imageTemplates \ |
| virtual-machines | Image Builder Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/image-builder-troubleshoot.md | Deployment failed. Correlation ID: XXXXXX-XXXX-XXXXXX-XXXX-XXXXXX. Failed in dis Image Builder timed out waiting for the image to be added and replicated to the Azure Compute Gallery. If the image is being injected into the SIG, it can be assumed the image build was successful. However, the overall process failed, because the image builder was waiting on Azure Compute Gallery to complete the replication. Even though the build has failed, the replication continues. You can get the properties of the image version by checking the distribution *runOutput*. -```bash +```azurecli $runOutputName=<distributionRunOutput> az resource show \ --ids "/subscriptions/$subscriptionID/resourcegroups/$imageResourceGroup/providers/Microsoft.VirtualMachineImages/imageTemplates/$imageTemplateName/runOutputs/$runOutputName" \ |
| virtual-machines | Image Builder Vnet | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/image-builder-vnet.md | az group create -n $imageResourceGroup -l $location If you do not have an existing VNET\Subnet\NSG, use the following script to create one. -```bash +```azurecli # Create a resource group sed -i -e "s/<vnetRgName>/$vnetRgName/g" aibRoleNetworking.json Image Builder will use the [user-identity](../../active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vm.md#user-assigned-managed-identity) provided to inject the image into the Azure Compute Gallery (formerly known as Shared Image Gallery). In this example, you will create an Azure role definition that has the granular actions to perform distributing the image to the SIG. The role definition will then be assigned to the user-identity. -```bash +```azurecli # create user assigned identity for image builder idenityName=aibBuiUserId$(date +'%s') az identity create -g $imageResourceGroup -n $idenityName sed -i -e "s/Azure Image Builder Service Networking Role/$netRoleDefName/g" aibR Instead of granting Image Builder lower granularity and increased privilege, you can create two roles. One gives the builder permissions to create an image, the other allows it to connect the build VM and load balancer to your VNET. -```bash +```azurecli # create role definitions az role definition create --role-definition ./aibRoleImageCreation.json az role definition create --role-definition ./aibRoleNetworking.json |
| virtual-machines | No Agent | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/linux/no-agent.md | This demo will show how you can take an existing Marketplace image (in this case ### Create the resource group and base VM: -```bash +```azurecli $ az group create --location eastus --name demo1 ``` Create the base VM: -```bash +```azurecli $ az vm create \ --resource-group demo1 \ --name demo1 \ Now the VM is ready to be generalized and have an image created from it. Back on your development machine, run the following to prepare for image creation from the base VM: -```bash +```azurecli $ az vm deallocate --resource-group demo1 --name demo1 $ az vm generalize --resource-group demo1 --name demo1 ``` And create the image from this VM: -```bash +```azurecli $ az image create \ --resource-group demo1 \ --source demo1 \ $ az image create \ Now we are ready to create a new VM (or multiple VMs) from the image: -```bash +```azurecli $ IMAGE_ID=$(az image show -g demo1 -n demo1img --query id -o tsv) $ az vm create \ --resource-group demo12 \ |
| virtual-machines | Page Blobs Backup And Disaster Recovery | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/page-blobs-backup-and-disaster-recovery.md | For VMs with multiple disks, you must copy all the snapshots that are part of th ### SQL Server -SQL Server running in a VM has its own built-in capabilities to back up your SQL Server database to Azure Blob storage or a file share. If the storage account is geo-redundant storage or read-access geo-redundant storage, you can access those backups in the storage accountΓÇÖs secondary datacenter in the event of a disaster, with the same restrictions as previously discussed. For more information, see [Back up and restore for SQL Server in Azure virtual machines](../azure-sql/virtual-machines/windows/azure-storage-sql-server-backup-restore-use.md). In addition to back up and restore, [SQL Server AlwaysOn availability groups](../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md) can maintain secondary replicas of databases. This ability greatly reduces the disaster recovery time. +SQL Server running in a VM has its own built-in capabilities to back up your SQL Server database to Azure Blob storage or a file share. If the storage account is geo-redundant storage or read-access geo-redundant storage, you can access those backups in the storage accountΓÇÖs secondary datacenter in the event of a disaster, with the same restrictions as previously discussed. For more information, see [Back up and restore for SQL Server in Azure virtual machines](/azure/azure-sql/virtual-machines/windows/azure-storage-sql-server-backup-restore-use). In addition to back up and restore, [SQL Server AlwaysOn availability groups](/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview) can maintain secondary replicas of databases. This ability greatly reduces the disaster recovery time. ## Other considerations |
| virtual-machines | Premium Storage Performance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/premium-storage-performance.md | An important configuration in disk striping is the stripe size. The stripe size For example, if an IO request generated by your application is bigger than the disk stripe size, the storage system writes it across stripe unit boundaries on more than one disk. When it is time to access that data, it will have to seek across more than one stripe units to complete the request. The cumulative effect of such behavior can lead to substantial performance degradation. On the other hand, if the IO request size is smaller than stripe size, and if it is random in nature, the IO requests may add up on the same disk causing a bottleneck and ultimately degrading the IO performance. -Depending on the type of workload your application is running, choose an appropriate stripe size. For random small IO requests, use a smaller stripe size. Whereas for large sequential IO requests use a larger stripe size. Find out the stripe size recommendations for the application you will be running on Premium Storage. For SQL Server, configure stripe size of 64 KB for OLTP workloads and 256 KB for data warehousing workloads. See [Performance best practices for SQL Server on Azure VMs](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) to learn more. +Depending on the type of workload your application is running, choose an appropriate stripe size. For random small IO requests, use a smaller stripe size. Whereas for large sequential IO requests use a larger stripe size. Find out the stripe size recommendations for the application you will be running on Premium Storage. For SQL Server, configure stripe size of 64 KB for OLTP workloads and 256 KB for data warehousing workloads. See [Performance best practices for SQL Server on Azure VMs](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) to learn more. > [!NOTE] > You can stripe together a maximum of 32 premium storage disks on a DS series VM and 64 premium storage disks on a GS series VM. Learn more about the available disk types: For SQL Server users, read articles on Performance Best Practices for SQL Server: -* [Performance Best Practices for SQL Server in Azure Virtual Machines](../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md) +* [Performance Best Practices for SQL Server in Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist) * [Azure Premium Storage provides highest performance for SQL Server in Azure VM](https://cloudblogs.microsoft.com/sqlserver/2015/04/23/azure-premium-storage-provides-highest-performance-for-sql-server-in-azure-vm/) |
| virtual-machines | Vm Support Help | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/vm-support-help.md | If you can't find an answer to your problem using search, submit a new question | Area | Tag | |-|-| | [Azure Virtual Machines](./linux/overview.md) | [azure-virtual-machines](/answers/topics/azure-virtual-machines.html) | -| [Azure SQL Virtual Machines](../azure-sql/virtual-machines/index.yml) | [azure-sql-virtual-machines](/answers/topics/azure-sql-virtual-machines.html)| +| [Azure SQL Virtual Machines](/azure/azure-sql/virtual-machines/index) | [azure-sql-virtual-machines](/answers/topics/azure-sql-virtual-machines.html)| | [Azure Virtual Machine backup](backup-recovery.md) | [azure-virtual-machine-backup](/answers/questions/36892/azure-virtual-machine-backups.html) | | [Azure Virtual Machine extension](./extensions/overview.md) | [azure-virtual-machine-extension](/answers/topics/azure-virtual-machines-extension.html)| | [Azure Virtual Machine Images](shared-image-galleries.md) | [azure-virtual-machine-images](/answers/topics/azure-virtual-machines-images.html) | |
| virtual-machines | Connect Logon | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/windows/connect-logon.md | You'll use the **Connect** button in the Azure portal to start a Remote Desktop To connect to a Windows VM from a Mac, you will need to install an RDP client for Mac such as [Microsoft Remote Desktop](https://aka.ms/rdmac). +## Prerequisites +- In order to connect to a Windows Virtual Machine via RDP you need port 3389 open. You can validate an appropriate port is open for RDP using the troubleshooter or by checking manually in your VM settings. To check if port 3389 is open: ++ 1. On the page for the VM, select **Networking** from the left menu. + 1. On the **Networking** page, check to see if there is a rule which allows TCP on port 3389 from the IP address of the computer you are using to connect to the VM. If the rule exists, you can move to the next section. + 1. If there isn't a rule, add one by selecting **Add Inbound port rule**. + 1. From the **Service** dropdown select **RDP**. + 1. Edit **Priority** and **Source** if necessary + 1. For **Name**, type *Port_3389* + 1. When finished, select **Add** + 1. You should now have an RDP rule in the table of inbound port rules. ++- Your VM must have a public IP address. To check if your VM has a public IP address, select **Overview** from the left menu and look at the **Networking** section. If you see an IP address next to **Public IP address**, then your VM has a public IP. To learn more about adding a public IP address to an existing VM, see [Associate a public IP address to a virtual machine](../../virtual-network/ip-services/associate-public-ip-address-vm.md) ++- Verify your VM is running. On the Overview tab, in the essentials section, verify the status of the VM is Running. To start the VM, select **Start** at the top of the page. ## Connect to the virtual machine 1. Go to the [Azure portal](https://portal.azure.com/) to connect to a VM. Search for and select **Virtual machines**. 2. Select the virtual machine from the list. Get-AzRemoteDesktopFile -ResourceGroupName "RgName" -Name "VmName" -LocalPath "C ``` ## Next steps-If you have difficulty connecting, see [Troubleshoot Remote Desktop connections](/troubleshoot/azure/virtual-machines/troubleshoot-rdp-connection?toc=%2fazure%2fvirtual-machines%2fwindows%2ftoc.json). +If you have difficulty connecting, see [Troubleshoot Remote Desktop connections](/troubleshoot/azure/virtual-machines/troubleshoot-rdp-connection?toc=%2fazure%2fvirtual-machines%2fwindows%2ftoc.json). |
| virtual-machines | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/mainframe-rehosting/overview.md | Learn how to [move mainframe compute to Azure](./concepts/mainframe-compute-azur Azure offers commitment-based service-level agreements (SLAs). Multiple-nines availability is the default, and SLAs can be optimized with local or geo-based replication of services. The full [Azure SLA](https://azure.microsoft.com/support/legal/sla/virtual-machines/) explains the guaranteed availability of Azure as a whole. -With Azure IaaS such as a VM, specific system functions provide failover supportΓÇöfor example, failover clustering instances and availability sets. When you use Azure platform as a service (PaaS) resources, the platform handles failover automatically. Examples include [Azure SQL Database](../../../azure-sql/database/sql-database-paas-overview.md) and [Azure Cosmos DB](../../../cosmos-db/introduction.md). +With Azure IaaS such as a VM, specific system functions provide failover supportΓÇöfor example, failover clustering instances and availability sets. When you use Azure platform as a service (PaaS) resources, the platform handles failover automatically. Examples include [Azure SQL Database](/azure/azure-sql/database/sql-database-paas-overview) and [Azure Cosmos DB](../../../cosmos-db/introduction.md). ### Scalability |
| virtual-machines | Oracle Database Quick Create | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/oracle/oracle-database-quick-create.md | After you create the VM, Azure CLI displays information similar to the following ``` ## Create and attach a new disk for Oracle datafiles and FRA -```bash +```azurecli az vm disk attach --name oradata01 --new --resource-group rg-oracle --size-gb 64 --sku StandardSSD_LRS --vm-name vmoracle19c ``` az vm disk attach --name oradata01 --new --resource-group rg-oracle --size-gb 64 In this task you must configure some external endpoints for the database listener to use by setting up the Azure Network Security Group that protects the VM. 1. To open the endpoint that you use to access the Oracle database remotely, create a Network Security Group rule as follows:- ```bash + ```azurecli az network nsg rule create ^ --resource-group rg-oracle ^ --nsg-name vmoracle19cNSG ^ In this task you must configure some external endpoints for the database listene --destination-port-range 1521 ``` 2. To open the endpoint that you use to access Oracle remotely, create a Network Security Group rule with az network nsg rule create as follows:- ```bash + ```azurecli az network nsg rule create ^ --resource-group rg-oracle ^ --nsg-name vmoracle19cNSG ^ In this task you must configure some external endpoints for the database listene ``` 3. If needed, obtain the public IP address of your VM again with az network public-ip show as follows: - ```bash + ```azurecli az network public-ip show ^ --resource-group rg-oracle ^ --name vmoracle19cPublicIP ^ |
| virtual-machines | Automation Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/automation-tutorial.md | The sample SAP Library configuration file `MGMT-NOEU-SAP_LIBRARY.tfvars` is in t - If you have authentication issues directly after running the script `prepare_region.sh`, run: - ```bash + ```azurecli az logout az login For this example configuration, the resource group is `MGMT-NOEU-DEP00-INFRASTRU > [!NOTE] > The use of single quotes when setting `sap_user_password` is important. The use of special characters in the password can otherwise cause unpredictable results! - ```bash + ```azurecli sap_user_password='<sap-password>' az keyvault secret set --name "S-Password" --vault-name "${key_vault}" --value "${sap_user_password}"; |
| virtual-machines | Businessobjects Deployment Guide Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/businessobjects-deployment-guide-linux.md | For more information, see [Manage the availability of Linux virtual machines](.. ### High availability for a CMS database -If you're using Azure Database for MySQL for your CMS and audit databases, you have a locally redundant, high availability framework by default. You just need to select the region, and service inherent high availability, redundancy, and resiliency capabilities, without needing to configure any additional components. If the deployment strategy for the SAP BOBI platform is across availability zones, then you need to make sure you achieve zone redundancy for your CMS and audit databases. For more information, see [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md) and [High availability for Azure SQL Database](../../../azure-sql/database/high-availability-sla.md). +If you're using Azure Database for MySQL for your CMS and audit databases, you have a locally redundant, high availability framework by default. You just need to select the region, and service inherent high availability, redundancy, and resiliency capabilities, without needing to configure any additional components. If the deployment strategy for the SAP BOBI platform is across availability zones, then you need to make sure you achieve zone redundancy for your CMS and audit databases. For more information, see [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md) and [High availability for Azure SQL Database](/azure/azure-sql/database/high-availability-sla). For other deployments for the CMS database, see the high availability information in the [DBMS deployment guides for SAP Workload](dbms_guide_general.md). |
| virtual-machines | Businessobjects Deployment Guide Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/businessobjects-deployment-guide-windows.md | SAP BOBI application servers require database client/drivers to access the CMS o 1. Select **With SQL Server authentication using a login ID and password entered by user** to verify authenticity to Azure SQL Server. Enter the user credential that was created at the time of the SQL Database server creation. For example, enter **boadmin**. Select **Next**. 1. Change the **default database** to **bocms**, and keep everything else as default. Select **Next**. 1. Select the **Use strong encryption for data** checkbox, and keep everything else as default. Select **Finish**.-1. The data source to the CMS database has been created. Now you can select **Test Data Source** to validate the connection to the CMS database from the BI application. It should complete successfully. If it fails, [troubleshoot](../../../azure-sql/database/troubleshoot-common-errors-issues.md) the connectivity issue. +1. The data source to the CMS database has been created. Now you can select **Test Data Source** to validate the connection to the CMS database from the BI application. It should complete successfully. If it fails, [troubleshoot](/azure/azure-sql/database/troubleshoot-common-errors-issues) the connectivity issue. >[!Note] >SQL Database communicates over port 1433. Outbound traffic over port 1433 should be allowed from your SAP BOBI application servers. For an SAP BOBI platform running on Windows VMs, the CMS and audit database can * **SQL Database** uses SQL Server technology to create [full backups](/sql/relational-databases/backup-restore/full-database-backups-sql-server?preserve-view=true&view=sql-server-ver15) every week, [differential backups](/sql/relational-databases/backup-restore/differential-backups-sql-server?preserve-view=true&view=sql-server-ver15) every 12 to 24 hours, and [transaction log](/sql/relational-databases/backup-restore/transaction-log-backups-sql-server?preserve-view=true&view=sql-server-ver15) backups every 5 to 10 minutes. The frequency of transaction log backups is based on the compute size and the amount of database activity. - Users can choose an option to configure backup storage redundancy between LRS, ZRS, or GRS blobs. Storage redundancy mechanisms store multiple copies of your data to protect it from planned and unplanned events, which includes transient hardware failure, network or power outages, or massive natural disasters. By default, SQL Database stores backup in [GRS blobs](../../../storage/common/storage-redundancy.md) that are replicated to a [paired region](../../../availability-zones/cross-region-replication-azure.md). It can be changed based on the business requirement to either LRS or ZRS blobs. For more up-to-date information on SQL Database backup scheduling, retention, and storage consumption, see [Automated backups: Azure SQL Database and Azure SQL Managed Instance](../../../azure-sql/database/automated-backups-overview.md). + Users can choose an option to configure backup storage redundancy between LRS, ZRS, or GRS blobs. Storage redundancy mechanisms store multiple copies of your data to protect it from planned and unplanned events, which includes transient hardware failure, network or power outages, or massive natural disasters. By default, SQL Database stores backup in [GRS blobs](../../../storage/common/storage-redundancy.md) that are replicated to a [paired region](../../../availability-zones/cross-region-replication-azure.md). It can be changed based on the business requirement to either LRS or ZRS blobs. For more up-to-date information on SQL Database backup scheduling, retention, and storage consumption, see [Automated backups: Azure SQL Database and Azure SQL Managed Instance](/azure/azure-sql/database/automated-backups-overview). * **Azure Database for MySQL** automatically creates server backups and stores in user-configured LRS or GRS. Azure Database for MySQL takes backups of the data files and the transaction log. Depending on the supported maximum storage size, it either takes full and differential backups (4-TB max storage servers) or snapshot backups (up to 16-TB max storage servers). These backups allow you to restore a server at any point in time within your configured backup retention period. The default backup retention period is 7 days, which you can [optionally configure](../../../mysql/howto-restore-server-portal.md#set-backup-configuration) up to 35 days. All backups are encrypted by using AES 256-bit encryption. These backup files aren't user exposed and can't be exported. These backups can only be used for restore operations in Azure Database for MySQL. You can use [mysqldump](../../../mysql/concepts-migrate-dump-restore.md) to copy a database. For more information, see [Backup and restore in Azure Database for MySQL](../../../mysql/concepts-backup.md). Currently, not all Azure regions offer availability zones, so you need to adopt ### High availability for the CMS database -If you're using an Azure database as a solution for your CMS and audit database, a locally redundant high-availability framework is provided by default. Select the region and service inherent high-availability, redundancy, and resiliency capabilities without requiring you to configure any more components. If the deployment strategy for an SAP BOBI platform is across an availability zone, make sure you achieve zone redundancy for your CMS and audit database. For more information on high availability for supported database offerings in Azure, see [High availability for Azure SQL Database](../../../azure-sql/database/high-availability-sla.md) and [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md). +If you're using an Azure database as a solution for your CMS and audit database, a locally redundant high-availability framework is provided by default. Select the region and service inherent high-availability, redundancy, and resiliency capabilities without requiring you to configure any more components. If the deployment strategy for an SAP BOBI platform is across an availability zone, make sure you achieve zone redundancy for your CMS and audit database. For more information on high availability for supported database offerings in Azure, see [High availability for Azure SQL Database](/azure/azure-sql/database/high-availability-sla) and [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md). For other database management system (DBMS) deployment for a CMS database, see [DBMS deployment guides for SAP workload](dbms_guide_general.md) for insight on a different DBMS deployment and its approach to achieving high availability. The CMS and audit database in the DR region must be a copy of the databases runn #### Azure SQL Database -For a [SQL Database](../../../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md) DR strategy, two options are available to copy the database to the secondary region. Both recovery options offer different levels of RTO and RPO. For more information on the RTO and RPO for each recovery option, see [Recover a database to an existing server](../../../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md#recover-a-database-to-the-existing-server). +For a [SQL Database](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview) DR strategy, two options are available to copy the database to the secondary region. Both recovery options offer different levels of RTO and RPO. For more information on the RTO and RPO for each recovery option, see [Recover a database to an existing server](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview#recover-a-database-to-the-existing-server). -Option 1: [Geo-redundant database backup restore](../../../azure-sql/database/recovery-using-backups.md#geo-restore) +Option 1: [Geo-redundant database backup restore](/azure/azure-sql/database/recovery-using-backups#geo-restore) By default, SQL Database stores data in [GRS blobs](../../../storage/common/storage-redundancy.md) that are replicated to a [paired region](../../../availability-zones/cross-region-replication-azure.md). For a SQL database, the backup storage redundancy can be configured at the time of CMS and audit database creation, or it can be updated for an existing database. The changes made to an existing database apply to future backups only. You can restore a database on any SQL database in any Azure region from the most recent geo-replicated backups. Geo-restore uses a geo-replicated backup as its source. There's a delay between when a backup is taken and when it's geo-replicated to an Azure blob in a different region. As a result, the restored database can be up to one hour behind the original database. >[!Important]- >Geo-restore is available for SQL databases configured with geo-redundant [backup storage](../../../azure-sql/database/automated-backups-overview.md#backup-storage-redundancy). + >Geo-restore is available for SQL databases configured with geo-redundant [backup storage](/azure/azure-sql/database/automated-backups-overview#backup-storage-redundancy). -Option 2: [Geo-replication](../../../azure-sql/database/active-geo-replication-overview.md) or an [autofailover group](../../../azure-sql/database/auto-failover-group-overview.md) +Option 2: [Geo-replication](/azure/azure-sql/database/active-geo-replication-overview) or an [autofailover group](/azure/azure-sql/database/auto-failover-group-overview) - Geo-replication is a SQL Database feature that allows you to create readable secondary databases of individual databases on a server in the same or different region. If geo-replication is enabled for the CMS and audit database, the application can initiate failover to a secondary database in a different Azure region. Geo-replication is enabled for individual databases, but to enable transparent and coordinated failover of multiple databases (CMS and audit) for an SAP BOBI application, it's advisable to use an autofailover group. It provides the group semantics on top of active geo-replication, which means the entire SQL server (all databases) is replicated to another region instead of individual databases. Check the capabilities table that [compares geo-replication with failover groups](../../../azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview.md#compare-geo-replication-with-failover-groups). + Geo-replication is a SQL Database feature that allows you to create readable secondary databases of individual databases on a server in the same or different region. If geo-replication is enabled for the CMS and audit database, the application can initiate failover to a secondary database in a different Azure region. Geo-replication is enabled for individual databases, but to enable transparent and coordinated failover of multiple databases (CMS and audit) for an SAP BOBI application, it's advisable to use an autofailover group. It provides the group semantics on top of active geo-replication, which means the entire SQL server (all databases) is replicated to another region instead of individual databases. Check the capabilities table that [compares geo-replication with failover groups](/azure/azure-sql/database/business-continuity-high-availability-disaster-recover-hadr-overview#compare-geo-replication-with-failover-groups). Autofailover groups provide read/write and read-only listener endpoints that remain unchanged during failover. The read/write endpoint can be maintained as a listener in the ODBC connection entry for the CMS and audit database. So whether you use manual or automatic failover activation, failover switches all secondary databases in the group to primary. After the database failover is completed, the DNS record is automatically updated to redirect the endpoints to the new region. The application is automatically connected to the CMS database as the read/write endpoint is maintained as a listener in the ODBC connection. Option 2: [Geo-replication](../../../azure-sql/database/active-geo-replication-o  - This option provides a lower RTO and RPO than option 1. For more information about this option, see [Use autofailover groups to enable transparent and coordinated failover of multiple databases](../../../azure-sql/database/auto-failover-group-overview.md). + This option provides a lower RTO and RPO than option 1. For more information about this option, see [Use autofailover groups to enable transparent and coordinated failover of multiple databases](/azure/azure-sql/database/auto-failover-group-overview). #### Azure Database for MySQL |
| virtual-machines | Businessobjects Deployment Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/businessobjects-deployment-guide.md | The BI Platform needs database for CMS and Auditing Data store, which can be ins - [Azure SQL Database](https://azure.microsoft.com/services/sql-database/) (Supported database only for SAP BOBI Platform on Windows) - It's a fully managed SQL Server database engine, based on the latest stable Enterprise Edition of SQL Server. Azure SQL database handles most of the database management functions such as upgrading, patching, and monitoring without user involvement. With Azure SQL Database, you can create a highly available and high-performance data storage layer for the applications and solutions in Azure. For more details, check [Azure SQL Database](../../../azure-sql/azure-sql-iaas-vs-paas-what-is-overview.md) documentation. + It's a fully managed SQL Server database engine, based on the latest stable Enterprise Edition of SQL Server. Azure SQL database handles most of the database management functions such as upgrading, patching, and monitoring without user involvement. With Azure SQL Database, you can create a highly available and high-performance data storage layer for the applications and solutions in Azure. For more details, check [Azure SQL Database](/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview) documentation. - [Azure Database for MySQL](https://azure.microsoft.com/services/mysql/) (Follow same compatibility guidelines as mentioned for MySQL AB in SAP PAM) Azure SQL Database offers the following three purchasing models: It lets you choose the number of vCores, amount of memory, and the amount and speed of storage. The vCore-based purchasing model also allows you to use [Azure Hybrid Benefit for SQL Server](https://azure.microsoft.com/pricing/hybrid-benefit/) to gain cost savings. This model is suited for customer who value flexibility, control, and transparency. - There are three [Service Tier Options](../../../azure-sql/database/service-tiers-vcore.md#service-tiers) being offered in vCore model that include - General Purpose, Business Critical, and Hyperscale. The service tier defines the storage architecture, space, I/O limits, and business continuity options related to availability and disaster recovery. Following is high-level details on each service tier option - + There are three [Service Tier Options](/azure/azure-sql/database/service-tiers-vcore#service-tiers) being offered in vCore model that include - General Purpose, Business Critical, and Hyperscale. The service tier defines the storage architecture, space, I/O limits, and business continuity options related to availability and disaster recovery. Following is high-level details on each service tier option - - 1. **General Purpose** service tier is best suited for Business workloads. It offers budget-oriented, balanced, and scalable compute and storage options. For more information, refer [Resource options and limits](../../../azure-sql/database/resource-limits-vcore-single-databases.md#general-purposeprovisioned-computegen5). - 2. **Business Critical** service tier offers business applications the highest resilience to failures by using several isolated replicas, and provides the highest I/O performance per database replica. For more information, refer [Resource options and limits](../../../azure-sql/database/resource-limits-vcore-single-databases.md#business-criticalprovisioned-computegen5). - 3. **Hyperscale** service tier is best for business workloads with highly scalable storage and read-scale requirements. It offers higher resilience to failures by allowing configuration of more than one isolated database replica. For more information, refer [Resource options and limits](../../../azure-sql/database/resource-limits-vcore-single-databases.md#hyperscaleprovisioned-computegen5). + 1. **General Purpose** service tier is best suited for Business workloads. It offers budget-oriented, balanced, and scalable compute and storage options. For more information, refer [Resource options and limits](/azure/azure-sql/database/resource-limits-vcore-single-databases#general-purposeprovisioned-computegen5). + 2. **Business Critical** service tier offers business applications the highest resilience to failures by using several isolated replicas, and provides the highest I/O performance per database replica. For more information, refer [Resource options and limits](/azure/azure-sql/database/resource-limits-vcore-single-databases#business-criticalprovisioned-computegen5). + 3. **Hyperscale** service tier is best for business workloads with highly scalable storage and read-scale requirements. It offers higher resilience to failures by allowing configuration of more than one isolated database replica. For more information, refer [Resource options and limits](/azure/azure-sql/database/resource-limits-vcore-single-databases#hyperscaleprovisioned-computegen5). - DTU-based The DTU-based purchasing model offers a blend of compute, memory, and I/O resources in three service tiers, to support light and heavy database workloads. Compute sizes within each tier provide a different mix of these resources, to which you can add additional storage resources. It's best suited for customers who want simple, pre-configure resource options. - [Service Tiers](../../../azure-sql/database/service-tiers-dtu.md#compare-service-tiers) in the DTU-based purchasing model is differentiated by a range of compute sizes with a fixed amount of included storage, fixed retention period of backups, and fixed price. + [Service Tiers](/azure/azure-sql/database/service-tiers-dtu#compare-service-tiers) in the DTU-based purchasing model is differentiated by a range of compute sizes with a fixed amount of included storage, fixed retention period of backups, and fixed price. - Serverless - The serverless model automatically scales compute based on workload demand, and bills for the amount of compute used per second. The serverless compute tier automatically pauses databases during inactive periods when only storage is billed, and automatically resumes databases when activity returns. For more information, refer [Resource options and limits](../../../azure-sql/database/resource-limits-vcore-single-databases.md#general-purposeserverless-computegen5). + The serverless model automatically scales compute based on workload demand, and bills for the amount of compute used per second. The serverless compute tier automatically pauses databases during inactive periods when only storage is billed, and automatically resumes databases when activity returns. For more information, refer [Resource options and limits](/azure/azure-sql/database/resource-limits-vcore-single-databases#general-purposeserverless-computegen5). It's more suitable for intermittent, unpredictable usage with low average compute utilization over time. So this model can be used for non-production SAP BOBI deployment. Availability Zones are physically separate locations within an Azure region. Eac To achieve high availability on each tier for SAP BI Platform, you can distribute VMs across Availability Zone by implementing high availability framework, which can provide the best SLA in Azure. For Virtual Machine SLA in Azure, check the latest version of [Virtual Machine SLAs](https://azure.microsoft.com/support/legal/sla/virtual-machines/). -For data tier, Azure Database as a Service (DBaaS) service provides high availability framework by default. You just need to select the region and service inherent high availability, redundancy, and resiliency capabilities to mitigate database downtime from planned and unplanned outages, without requiring you to configure any additional components. For more details on the SLA for supported DBaaS offering on Azure, check [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md) and [High availability for Azure SQL Database](../../../azure-sql/database/high-availability-sla.md). +For data tier, Azure Database as a Service (DBaaS) service provides high availability framework by default. You just need to select the region and service inherent high availability, redundancy, and resiliency capabilities to mitigate database downtime from planned and unplanned outages, without requiring you to configure any additional components. For more details on the SLA for supported DBaaS offering on Azure, check [High availability in Azure Database for MySQL](../../../mysql/concepts-high-availability.md) and [High availability for Azure SQL Database](/azure/azure-sql/database/high-availability-sla). ### Availability sets Azure Storage has different Storage types available for customers and details fo SAP BOBI is a reporting and analytics BI platform that doesnΓÇÖt hold any business data. So the system is connected to other database servers from where it fetches all the data and provide insight to users. Azure provides a network infrastructure, which allows the mapping of all scenarios that can be realized with SAP BI Platform like connecting to on-premise system, systems in different virtual network and others. For more information check [Microsoft Azure Networking for SAP Workload](https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/virtual-machines/workloads/sap/planning-guide.md#microsoft-azure-networking). -For Database-as-a-Service offering, any newly created database (Azure SQL Database or Azure Database for MySQL) has a firewall that blocks all external connections. To allow access to the DBaaS service from BI Platform virtual machines, you need to specify one or more server-level firewall rules to enable access to your DBaaS server. For more information, see [Firewall rules](../../../mysql/concepts-firewall-rules.md) for Azure Database for MySQL and [Network Access Controls](../../../azure-sql/database/network-access-controls-overview.md) section for Azure SQL database. +For Database-as-a-Service offering, any newly created database (Azure SQL Database or Azure Database for MySQL) has a firewall that blocks all external connections. To allow access to the DBaaS service from BI Platform virtual machines, you need to specify one or more server-level firewall rules to enable access to your DBaaS server. For more information, see [Firewall rules](../../../mysql/concepts-firewall-rules.md) for Azure Database for MySQL and [Network Access Controls](/azure/azure-sql/database/network-access-controls-overview) section for Azure SQL database. ## Next steps |
| virtual-machines | Dbms_Guide_General | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/dbms_guide_general.md | If there's a failover of the database node, there's no need for the SAP applicat Azure offers two different [load balancer SKUs](../../../load-balancer/load-balancer-overview.md): a basic SKU and a standard SKU. Based on the advantages in setup and functionality, you should use the Standard SKU of the Azure load balancer. One of the large advantages of the Standard version of the load balancer is that the data traffic is not routed through the load balancer itself. -An example how you can configure an internal load balancer can be found in the article [Tutorial: Configure a SQL Server availability group on Azure Virtual Machines manually](../../../azure-sql/virtual-machines/windows/availability-group-manually-configure-tutorial-single-subnet.md#create-an-azure-load-balancer) +An example how you can configure an internal load balancer can be found in the article [Tutorial: Configure a SQL Server availability group on Azure Virtual Machines manually](/azure/azure-sql/virtual-machines/windows/availability-group-manually-configure-tutorial-single-subnet#create-an-azure-load-balancer) > [!NOTE] > There are differences in behavior of the basic and standard SKU related to the access of public IP addresses. The way how to work around the restrictions of the Standard SKU to access public IP addresses is described in the document [Public endpoint connectivity for Virtual Machines using Azure Standard Load Balancer in SAP high-availability scenarios](./high-availability-guide-standard-load-balancer-outbound-connections.md) |
| virtual-machines | Dbms_Guide_Maxdb | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/dbms_guide_maxdb.md | -[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:../../../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md -[virtual-machines-sql-server-infrastructure-services]:../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md -[virtual-machines-sql-server-performance-best-practices]:../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices.md +[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview +[virtual-machines-sql-server-infrastructure-services]:/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview +[virtual-machines-sql-server-performance-best-practices]:/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices [virtual-machines-upload-image-windows-resource-manager]:../../virtual-machines-windows-upload-image.md [virtual-machines-windows-tutorial]:../../virtual-machines-windows-hero-tutorial.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/resources/templates/sql-server-2014-alwayson-existing-vnet-and-ad/ |
| virtual-machines | Dbms_Guide_Oracle | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/dbms_guide_oracle.md | -[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:../../../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md -[virtual-machines-sql-server-infrastructure-services]:../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md -[virtual-machines-sql-server-performance-best-practices]:../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices.md +[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview +[virtual-machines-sql-server-infrastructure-services]:/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview +[virtual-machines-sql-server-performance-best-practices]:/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices [virtual-machines-upload-image-windows-resource-manager]:../../virtual-machines-windows-upload-image.md [virtual-machines-windows-tutorial]:../../virtual-machines-windows-hero-tutorial.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/resources/templates/sql-server-2014-alwayson-existing-vnet-and-ad/ |
| virtual-machines | Dbms_Guide_Sqlserver | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/dbms_guide_sqlserver.md | -[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:../../../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md -[virtual-machines-sql-server-infrastructure-services]:../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md -[virtual-machines-sql-server-performance-best-practices]:../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices.md +[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview +[virtual-machines-sql-server-infrastructure-services]:/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview +[virtual-machines-sql-server-performance-best-practices]:/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices [virtual-machines-upload-image-windows-resource-manager]:../../virtual-machines-windows-upload-image.md [virtual-machines-windows-tutorial]:../../virtual-machines-windows-hero-tutorial.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/eresources/templates/sql-server-2014-alwayson-existing-vnet-and-ad/ This document covers several different areas to consider when deploying SQL Serv In general, you should consider using the most recent SQL Server releases to run SAP workload in Azure IaaS. The latest SQL Server releases offer better integration into some of the Azure services and functionality. Or have changes that optimize operations in an Azure IaaS infrastructure. -It's recommended to review the article [What is SQL Server on Azure Virtual Machines (Windows)](../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md) before continuing. +It's recommended to review the article [What is SQL Server on Azure Virtual Machines (Windows)](/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview) before continuing. In the following sections, pieces of parts of the documentation under the link above are aggregated and mentioned. Specifics around SAP are mentioned as well and some concepts are described in more detail. However, it's highly recommended to work through the documentation above first before reading the SQL Server-specific documentation. There's some SQL Server in IaaS specific information you should know before continuing: * **SQL Version Support**: For SAP customers, SQL Server 2008 R2 and higher is supported on Microsoft Azure Virtual Machine. Earlier editions aren't supported. Review this general [Support Statement](https://support.microsoft.com/kb/956893) for more details. In general, SQL Server 2008 is supported by Microsoft as well. However due to significant functionality for SAP, which was introduced with SQL Server 2008 R2, SQL Server 2008 R2 is the minimum release for SAP. In general, you should consider using the most recent SQL Server releases to run SAP workload in Azure IaaS. The latest SQL Server releases offer better integration into some of the Azure services and functionality. Or have changes that optimize operations in an Azure IaaS infrastructure. Therefore, the paper is restricted to SQL Server 2016 and SQL Server 2017.-* **SQL Performance**: Microsoft Azure hosted Virtual Machines perform well in comparison to other public cloud virtualization offerings, but individual results may vary. Check out the article [Performance best practices for SQL Server in Azure Virtual Machines](../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md). +* **SQL Performance**: Microsoft Azure hosted Virtual Machines perform well in comparison to other public cloud virtualization offerings, but individual results may vary. Check out the article [Performance best practices for SQL Server in Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist). * **Using Images from Azure Marketplace**: The fastest way to deploy a new Microsoft Azure VM is to use an image from the Azure Marketplace. There are images in the Azure Marketplace, which contain the most recent SQL Server releases. The images where SQL Server already is installed can't be immediately used for SAP NetWeaver applications. The reason is the default SQL Server collation is installed within those images and not the collation required by SAP NetWeaver systems. In order to use such images, check the steps documented in chapter [Using a SQL Server image out of the Microsoft Azure Marketplace][dbms-guide-5.6]. * **SQL Server multi-instance support within a single Azure VM**: This deployment method is supported. However, be aware of resource limitations, especially around network and storage bandwidth of the VM type that you're using. Detailed information is available in article [Sizes for virtual machines in Azure](../../sizes.md). These quota limitations might prevent you to implement the same multi-instance architecture as you can implement on-premise. As of the configuration and interference of sharing the resources available within a single VM, the same considerations as on-premise need to be taken into account. * **Multiple SAP databases in one single SQL Server instance in a single VM**: As above, configurations like these are supported. Considerations of multiple SAP databases sharing the shared resources of a single SQL Server instance are the same as for on-premise deployments. Additional keep other limits like number of disks that can be attached to a specific VM type in mind. Or network and storage quota limits of specific VM types as detailed [Sizes for virtual machines in Azure](../../sizes.md). A VM configuration, which runs SQL Server with an SAP database and where tempdb The diagram above displays a simple case. As eluded to in the article [Considerations for Azure Virtual Machines DBMS deployment for SAP workload](dbms_guide_general.md), Azure storage type, number, and size of disks is dependent from different factors. But in general we recommend: - Using one large volume, which contains the SQL Server data files. Reason behind this configuration is that in real life there are numerous SAP databases with different sized database files with different I/O workload.-- Use the D:\drive for tempdb as long as performance is good enough. If the overall workload is limited in performance by tempdb being located on the D:\ drive you might need to consider to move tempdb to separate Azure premium storage or Ultra disk disks as recommended in [this article](../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist.md).+- Use the D:\drive for tempdb as long as performance is good enough. If the overall workload is limited in performance by tempdb being located on the D:\ drive you might need to consider to move tempdb to separate Azure premium storage or Ultra disk disks as recommended in [this article](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist). SQL Server proportional fill mechanism distributes reads and writes to all datafiles evenly provided all SQL Server data files are the same size and have the same frees pace. SAP on SQL Server will deliver the best performance when reads and writes are distributed evenly across all available datafiles. If a database has too few datafiles or datafiles with extremely different sizes the best method to correct this is an R3load export and import. An R3load export and import involves downtime and should only be done if there's an obvious performance problem that needs to be resolved. If the datafiles are only moderately different sizes, increase all datafiles to the same size and SQL Server will rebalance data over time. SQL Server will automatically grow datafiles evenly if traceflag 1117 is set or if SQL Server 2016 or higher is used. Experiences gained in the meantime with SQL Server Buffer Pool Extension with SA ## Backup/Recovery considerations for SQL Server When deploying SQL Server into Azure, your backup methodology must be reviewed. Even if the system isn't a production system, the SAP database hosted by SQL Server must be backed up periodically. Since Azure Storage keeps three images, a backup is now less important in respect to compensating a storage crash. The priority reason for maintaining a proper backup and recovery plan is more that you can compensate for logical/manual errors by providing point in time recovery capabilities. The goal is to either use backups to restore the database back to a certain point in time or to use the backups in Azure to seed another system by copying the existing database. -In order to look at different SQL Server backup possibilities in Azure read the article [Backup and Restore for SQL Server in Azure Virtual Machines](../../../azure-sql/virtual-machines/windows/backup-restore.md). The article covers several different possibilities. +In order to look at different SQL Server backup possibilities in Azure read the article [Backup and Restore for SQL Server in Azure Virtual Machines](/azure/azure-sql/virtual-machines/windows/backup-restore). The article covers several different possibilities. ### Manual backups You have several possibilities to perform 'manual' backups by: You have several possibilities to perform 'manual' backups by: The first method is well known and applied in many cases in the on-premises world as well. Nevertheless, it leaves you with the task to solve the longer term backup location. Since you don't want to keep your backups for 30 or more days in the locally attached Azure Storage, you have the need to either use Azure Backup Services or another third-party backup/recovery tool that includes access and retention management for your backups. Or you build out a large file server in Azure using Windows storage spaces. -The second method is described closer in the article [SQL Server Backup to URL](../../../azure-sql/virtual-machines/windows/backup-restore.md). Different releases of SQL Server have some variations in this functionality. Therefore, you should check out the documentation for your particular SQL Server release check. Important to note that this article lists numerous restrictions. You either have the possibility to perform the backup against: +The second method is described closer in the article [SQL Server Backup to URL](/azure/azure-sql/virtual-machines/windows/backup-restore). Different releases of SQL Server have some variations in this functionality. Therefore, you should check out the documentation for your particular SQL Server release check. Important to note that this article lists numerous restrictions. You either have the possibility to perform the backup against: - One single Azure page blob, which then limits the backup size to 1000 GB. This restriction also limits the throughput you can achieve. - Multiple (up to 64) Azure block blobs, which enable a theoretical backup size of 12 TB. However, tests with customer databases revealed that the maximum backup size can be smaller than its theoretical limit. In this case, you're responsible for managing retention of backups and access o the backups as well. ### Automated Backup for SQL Server-Automated Backup provides an automatic backup service for SQL Server Standard and Enterprise editions running in a Windows VM in Azure. This service is provided by the [SQL Server IaaS Agent Extension](../../../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md), which is automatically installed on SQL Server Windows virtual machine images in the Azure portal. If you deploy your own OS images with SQL Server installed, you need to install the VM extensions separately. The steps necessary are documented in this [article](../../../azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management.md). +Automated Backup provides an automatic backup service for SQL Server Standard and Enterprise editions running in a Windows VM in Azure. This service is provided by the [SQL Server IaaS Agent Extension](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management), which is automatically installed on SQL Server Windows virtual machine images in the Azure portal. If you deploy your own OS images with SQL Server installed, you need to install the VM extensions separately. The steps necessary are documented in this [article](/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management). More details about the capabilities of this method can be found in these articles: -- SQL Server 2014: [Automated Backup for SQL Server 2014 Virtual Machines (Resource Manager)](../../../azure-sql/virtual-machines/windows/automated-backup-sql-2014.md)-- SQL Server 2016/2017: [Automated Backup v2 for Azure Virtual Machines (Resource Manager)](../../../azure-sql/virtual-machines/windows/automated-backup.md)+- SQL Server 2014: [Automated Backup for SQL Server 2014 Virtual Machines (Resource Manager)](/azure/azure-sql/virtual-machines/windows/automated-backup-sql-2014) +- SQL Server 2016/2017: [Automated Backup v2 for Azure Virtual Machines (Resource Manager)](/azure/azure-sql/virtual-machines/windows/automated-backup) Looking into the documentation, you can see that the functionality with the more recent SQL Server releases improved. Some more details on SQL Server automated backups are released in the article [SQL Server Managed Backup to Microsoft Azure](/sql/relational-databases/backup-restore/sql-server-managed-backup-to-microsoft-azure). The theoretical backup size limit is 12 TB. The automated backups can be a good method for backup sizes of up to 12 TB. Since multiple blobs are written to in parallel, you can expect a throughput of larger than 100 MB/sec. Some considerations using an Availability Group Listener are: Detailed documentation on deploying Always On with SQL Server in Azure VMs lists like: -- [Introducing SQL Server Always On availability groups on Azure virtual machines](../../../azure-sql/virtual-machines/windows/availability-group-overview.md).-- [Configure an Always On availability group on Azure virtual machines in different regions](../../../azure-sql/virtual-machines/windows/availability-group-manually-configure-multiple-regions.md).-- [Configure a load balancer for an Always On availability group in Azure](../../../azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.md).+- [Introducing SQL Server Always On availability groups on Azure virtual machines](/azure/azure-sql/virtual-machines/windows/availability-group-overview). +- [Configure an Always On availability group on Azure virtual machines in different regions](/azure/azure-sql/virtual-machines/windows/availability-group-manually-configure-multiple-regions). +- [Configure a load balancer for an Always On availability group in Azure](/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure). >[!NOTE] > If you're configuring the Azure load balancer for the virtual IP address of the Availability Group listener, make sure to enable **Floating IP**. Configuring this option will reduce the network round trip latency between the SAP application layer and the DBMS layer. Also make sure to select **HA ports**. >[!NOTE]->Reading [Introducing SQL Server Always On availability groups on Azure virtual machines](../../../azure-sql/virtual-machines/windows/availability-group-overview.md), you're going to read about SQL Server's [Direct Network Name (DNN) listener](../../../azure-sql/virtual-machines/windows/availability-group-distributed-network-name-dnn-listener-configure.md). This new functionality got introduced with SQL Server 2019 CU8. This new functionality makes the usage of an Azure load balancer handling the virtual IP address of the Availability Group Listener obsolete. +>Reading [Introducing SQL Server Always On availability groups on Azure virtual machines](/azure/azure-sql/virtual-machines/windows/availability-group-overview), you're going to read about SQL Server's [Direct Network Name (DNN) listener](/azure/azure-sql/virtual-machines/windows/availability-group-distributed-network-name-dnn-listener-configure). This new functionality got introduced with SQL Server 2019 CU8. This new functionality makes the usage of an Azure load balancer handling the virtual IP address of the Availability Group Listener obsolete. SQL Server Always On is the most common used high availability and disaster recovery functionality used in Azure for SAP workload deployments. Most customers use Always On for high availability within a single Azure Region. If the deployment is restricted to two nodes only, you have two choices for connectivity: - Using the Availability Group Listener. With the Availability Group Listener, you're required to deploy an Azure load balancer. -- Using SQL Server 2016 SP3, SQL Server 2017 CU 25, or SQL Server 2019 CU8 or more recent SQL Server releases on Windows Server 2016 or later you can use the [Direct Network Name (DNN) listener](../../../azure-sql/virtual-machines/windows/availability-group-distributed-network-name-dnn-listener-configure.md) instead. DNN is eliminating the requirement to us an Azure load balancer.+- Using SQL Server 2016 SP3, SQL Server 2017 CU 25, or SQL Server 2019 CU8 or more recent SQL Server releases on Windows Server 2016 or later you can use the [Direct Network Name (DNN) listener](/azure/azure-sql/virtual-machines/windows/availability-group-distributed-network-name-dnn-listener-configure) instead. DNN is eliminating the requirement to us an Azure load balancer. - Using the connectivity parameters of SQL Server Database Mirroring. In this case, you need to configure the connectivity of the SAP applications in a way where both node names are named. Exact details of such an SAP side configuration is documented in SAP Note [#965908](https://launchpad.support.sap.com/#/notes/965908). By using this option, you would have no need to configure an Availability Group listener. And with that no Azure load balancer for the SQL Server high availability. But recall, this option only works if you restrict your Availability Group to span two instances. Quite a few customers are using the SQL Server Always On functionality for disaster recovery functionality between Azure regions. Several customers also use the ability to perform backups from a secondary replica. |
| virtual-machines | Deployment Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/deployment-guide.md | -[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:../../../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md -[virtual-machines-sql-server-infrastructure-services]:../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md -[virtual-machines-sql-server-performance-best-practices]:../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices.md +[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview +[virtual-machines-sql-server-infrastructure-services]:/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview +[virtual-machines-sql-server-performance-best-practices]:/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices [virtual-machines-upload-image-windows-resource-manager]:../../windows/upload-image.md [virtual-machines-windows-tutorial]:../../windows/quick-create-portal.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/documentation/templates/sql-server-2014-alwayson-dsc/ |
| virtual-machines | High Availability Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/high-availability-guide.md | -[virtual-machines-windows-portal-sql-alwayson-int-listener]:../../../azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.md +[virtual-machines-windows-portal-sql-alwayson-int-listener]:/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure [virtual-machines-upload-image-windows-resource-manager]:../../virtual-machines-windows-upload-image.md [virtual-machines-windows-tutorial]:../../virtual-machines-windows-hero-tutorial.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/documentation/templates/sql-server-2014-alwayson-dsc/ |
| virtual-machines | High Availability Multi Sid | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/high-availability-multi-sid.md | -[virtual-machines-windows-portal-sql-alwayson-int-listener]:../../../azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.md -[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:../../../azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md -[virtual-machines-sql-server-infrastructure-services]:../../../azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md -[virtual-machines-sql-server-performance-best-practices]:../../../azure-sql/virtual-machines/windows/performance-guidelines-best-practices.md +[virtual-machines-windows-portal-sql-alwayson-int-listener]:/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure +[virtual-machines-sql-server-high-availability-and-disaster-recovery-solutions]:/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview +[virtual-machines-sql-server-infrastructure-services]:/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview +[virtual-machines-sql-server-performance-best-practices]:/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices [virtual-machines-upload-image-windows-resource-manager]:../../virtual-machines-windows-upload-image.md [virtual-machines-windows-tutorial]:../../virtual-machines-windows-hero-tutorial.md [virtual-machines-workload-template-sql-alwayson]:https://azure.microsoft.com/documentation/templates/sql-server-2014-alwayson-dsc/ |
| virtual-machines | Sap High Availability Architecture Scenarios | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/sap-high-availability-architecture-scenarios.md | -[virtual-machines-windows-portal-sql-alwayson-int-listener]:../../../azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.md +[virtual-machines-windows-portal-sql-alwayson-int-listener]:/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure [sap-ha-bc-virtual-env-hyperv-vmware-white-paper]:https://scn.sap.com/docs/DOC-44415 [sap-ha-partner-information]:https://scn.sap.com/docs/DOC-8541 |
| virtual-machines | Sap Planning Supported Configurations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/sap-planning-supported-configurations.md | For Azure VMs, the following high availability configurations are supported on D - [Deploy a SAP HANA scale-out system with standby node on Azure VMs by using Azure NetApp Files on SUSE Linux Enterprise Server}](./sap-hana-scale-out-standby-netapp-files-suse.md) - [Deploy a SAP HANA scale-out system with standby node on Azure VMs by using Azure NetApp Files on Red Hat Enterprise Linux](./sap-hana-scale-out-standby-netapp-files-rhel.md) - SQL Server Failover cluster based on Windows Scale-Out File Services. Though recommendation for production systems is to use SQL Server Always On instead of clustering. SQL Server Always On provides better availability using separate storage. Details are described in this article: - - [Configure a SQL Server failover cluster instance on Azure virtual machines](../../../azure-sql/virtual-machines/windows/failover-cluster-instance-storage-spaces-direct-manually-configure.md) + - [Configure a SQL Server failover cluster instance on Azure virtual machines](/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-storage-spaces-direct-manually-configure) - SQL Server Always On is supported with the Windows operating system for SQL Server on Azure. This is the default recommendation for production SQL Server instances on Azure. Details are described in these articles:- - [Introducing SQL Server Always On availability groups on Azure virtual machines](../../../azure-sql/virtual-machines/windows/availability-group-overview.md). - - [Configure an Always On availability group on Azure virtual machines in different regions](../../../azure-sql/virtual-machines/windows/availability-group-manually-configure-multiple-regions.md). - - [Configure a load balancer for an Always On availability group in Azure](../../../azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.md). + - [Introducing SQL Server Always On availability groups on Azure virtual machines](/azure/azure-sql/virtual-machines/windows/availability-group-overview). + - [Configure an Always On availability group on Azure virtual machines in different regions](/azure/azure-sql/virtual-machines/windows/availability-group-manually-configure-multiple-regions). + - [Configure a load balancer for an Always On availability group in Azure](/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure). - Oracle Data Guard for Windows and Oracle Linux. Details for Oracle Linux can be found in this article: - [Implement Oracle Data Guard on an Azure Linux virtual machine](../oracle/configure-oracle-dataguard.md) - IBM Db2 HADR on SUSE and RHEL Detailed documentation for SUSE and RHEL using Pacemaker is provided here: |
| virtual-network | Create Vm Accelerated Networking Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/create-vm-accelerated-networking-cli.md | Though this article provides steps to create a virtual machine with accelerated You can also enable or disable accelerated networking through the portal after VM creation by navigating to the network interface and clicking the button at the top of the **Overview** blade. >[!NOTE]+> The Accelerated Networking setting in the portal reflects the user-selected state. AccelNet allows choosing ΓÇ£DisabledΓÇ¥ even if the VM size requires AccelNet. For those AccelNet-required VM sizes, AccelNet will be enabled at runtime regardless of the user setting seen in the portal. +> > Only supported operating systems can be enabled through the portal. If you're using a custom image, and your image supports Accelerated Networking, create your VM using CLI or PowerShell. After the VM is created, you can confirm that Accelerated Networking is enabled by following the [confirmation instructions](#confirm-that-accelerated-networking-is-enabled). A VM with Accelerated Networking enabled can't be resized to a VM instance that ## Next steps * Learn [how Accelerated Networking works](./accelerated-networking-how-it-works.md) * Learn how to [create a VM with Accelerated Networking in PowerShell](../virtual-network/create-vm-accelerated-networking-powershell.md)-* Improve latency with an [Azure proximity placement group](../virtual-machines/co-location.md) +* Improve latency with an [Azure proximity placement group](../virtual-machines/co-location.md) |
| virtual-network | Create Vm Dual Stack Ipv6 Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/ip-services/create-vm-dual-stack-ipv6-cli.md | Use [az network public-ip show](/cli/azure/network/public-ip#az-network-public-i --output tsv ``` -```bash +```azurecli user@Azure:~$ az network public-ip show \ > --resource-group myResourceGroup \ > --name myPublicIP-IPv4 \ user@Azure:~$ az network public-ip show \ --output tsv ``` -```bash +```azurecli user@Azure:~$ az network public-ip show \ > --resource-group myResourceGroup \ > --name myPublicIP-IPv6 \ |
| virtual-network | Network Security Groups Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/network-security-groups-overview.md | A network security group contains zero, or as many rules as desired, within Azur ||| |Name|A unique name within the network security group.| |Priority | A number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.|-|Source or destination| Any, or an individual IP address, classless inter-domain routing (CIDR) block (10.0.0.0/24, for example), service tag, or application security group. If you specify an address for an Azure resource, specify the private IP address assigned to the resource. Network security groups are processed after Azure translates a public IP address to a private IP address for inbound traffic, and before Azure translates a private IP address to a public IP address for outbound traffic. . Specifying a range, a service tag, or application security group, enables you to create fewer security rules. The ability to specify multiple individual IP addresses and ranges (you cannot specify multiple service tags or application groups) in a rule is referred to as [augmented security rules](#augmented-security-rules). Augmented security rules can only be created in network security groups created through the Resource Manager deployment model. You cannot specify multiple IP addresses and IP address ranges in network security groups created through the classic deployment model.| +|Source or destination| Any, or an individual IP address, classless inter-domain routing (CIDR) block (10.0.0.0/24, for example), service tag, or application security group. If you specify an address for an Azure resource, specify the private IP address assigned to the resource. Network security groups are processed after Azure translates a public IP address to a private IP address for inbound traffic, and before Azure translates a private IP address to a public IP address for outbound traffic. Specifying a range, a service tag, or application security group, enables you to create fewer security rules. The ability to specify multiple individual IP addresses and ranges (you cannot specify multiple service tags or application groups) in a rule is referred to as [augmented security rules](#augmented-security-rules). Augmented security rules can only be created in network security groups created through the Resource Manager deployment model. You cannot specify multiple IP addresses and IP address ranges in network security groups created through the classic deployment model.| |Protocol | TCP, UDP, ICMP, ESP, AH, or Any.| |Direction| Whether the rule applies to inbound, or outbound traffic.| |Port range |You can specify an individual or range of ports. For example, you could specify 80 or 10000-10005. Specifying ranges enables you to create fewer security rules. Augmented security rules can only be created in network security groups created through the Resource Manager deployment model. You cannot specify multiple ports or port ranges in the same security rule in network security groups created through the classic deployment model. | |
| virtual-network | Virtual Network For Azure Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/virtual-network-for-azure-services.md | Deploying services within a virtual network provides the following capabilities: |-|-|-| | Compute | Virtual machines: [Linux](/previous-versions/azure/virtual-machines/linux/infrastructure-example?toc=%2fazure%2fvirtual-network%2ftoc.json) or [Windows](/previous-versions/azure/virtual-machines/windows/infrastructure-example?toc=%2fazure%2fvirtual-network%2ftoc.json) <br/>[Virtual machine scale sets](../virtual-machine-scale-sets/virtual-machine-scale-sets-mvss-existing-vnet.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Cloud Service](/previous-versions/azure/reference/jj156091(v=azure.100)): Virtual network (classic) only<br/> [Azure Batch](../batch/nodes-and-pools.md?toc=%2fazure%2fvirtual-network%2ftoc.json#virtual-network-vnet-and-firewall-configuration)| No <br/> No <br/> No <br/> No<sup>2</sup> | Network | [Application Gateway - WAF](../application-gateway/application-gateway-ilb-arm.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[VPN Gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Azure Firewall](../firewall/overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json) <br/> [Azure Bastion](../bastion/bastion-overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Network Virtual Appliances](/windows-server/networking/sdn/manage/use-network-virtual-appliances-on-a-vn)| Yes <br/> Yes <br/> Yes <br/> Yes <br/> No-|Data|[RedisCache](../azure-cache-for-redis/cache-how-to-premium-vnet.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Azure SQL Managed Instance](../azure-sql/managed-instance/connectivity-architecture-overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json)| Yes <br/> Yes <br/> +|Data|[RedisCache](../azure-cache-for-redis/cache-how-to-premium-vnet.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Azure SQL Managed Instance](/azure/azure-sql/managed-instance/connectivity-architecture-overview?toc=%2fazure%2fvirtual-network%2ftoc.json)| Yes <br/> Yes <br/> |Analytics | [Azure HDInsight](../hdinsight/hdinsight-plan-virtual-network-deployment.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Azure Databricks](/azure/databricks/scenarios/what-is-azure-databricks?toc=%2fazure%2fvirtual-network%2ftoc.json) |No<sup>2</sup> <br/> No<sup>2</sup> <br/> | Identity | [Azure Active Directory Domain Services](../active-directory-domain-services/tutorial-create-instance.md?toc=%2fazure%2fvirtual-network%2ftoc.json) |No <br/> | Containers | [Azure Kubernetes Service (AKS)](../aks/concepts-network.md?toc=%2fazure%2fvirtual-network%2ftoc.json)<br/>[Azure Container Instance (ACI)](https://www.aka.ms/acivnet)<br/>[Azure Container Service Engine](https://github.com/Azure/acs-engine) with Azure Virtual Network CNI [plug-in](https://github.com/Azure/acs-engine/tree/master/examples/vnet)<br/>[Azure Functions](../azure-functions/functions-networking-options.md#virtual-network-integration) |No<sup>2</sup><br/> Yes <br/> No <br/> Yes |
| virtual-network | Virtual Network Service Endpoints Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/virtual-network-service-endpoints-overview.md | Service endpoints are available for the following Azure services and regions. Th **Generally available** - **[Azure Storage](../storage/common/storage-network-security.md?toc=%2fazure%2fvirtual-network%2ftoc.json#grant-access-from-a-virtual-network)** (*Microsoft.Storage*): Generally available in all Azure regions.-- **[Azure SQL Database](../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in all Azure regions.-- **[Azure Synapse Analytics](../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in all Azure regions for dedicated SQL pools (formerly SQL DW).+- **[Azure SQL Database](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in all Azure regions. +- **[Azure Synapse Analytics](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in all Azure regions for dedicated SQL pools (formerly SQL DW). - **[Azure Database for PostgreSQL server](../postgresql/howto-manage-vnet-using-portal.md?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in Azure regions where database service is available. - **[Azure Database for MySQL server](../mysql/howto-manage-vnet-using-portal.md?toc=%2fazure%2fvirtual-network%2ftoc.json)** (*Microsoft.Sql*): Generally available in Azure regions where database service is available. - **[Azure Database for MariaDB](../mariadb/concepts-data-access-security-vnet.md)** (*Microsoft.Sql*): Generally available in Azure regions where database service is available. For FAQs, see [Virtual Network Service Endpoint FAQs](./virtual-networks-faq.md# - [Configure virtual network service endpoints](tutorial-restrict-network-access-to-resources.md) - [Secure an Azure Storage account to a virtual network](../storage/common/storage-network-security.md?toc=%2fazure%2fvirtual-network%2ftoc.json)-- [Secure an Azure SQL Database to a virtual network](../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=%2fazure%2fvirtual-network%2ftoc.json)-- [Secure an Azure Synapse Analytics to a virtual network](../azure-sql/database/vnet-service-endpoint-rule-overview.md?toc=%2fazure%2fsql-data-warehouse%2ftoc.json)+- [Secure an Azure SQL Database to a virtual network](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=%2fazure%2fvirtual-network%2ftoc.json) +- [Secure an Azure Synapse Analytics to a virtual network](/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=%2fazure%2fsql-data-warehouse%2ftoc.json) - [Compare Private Endpoints and Service Endpoints](./vnet-integration-for-azure-services.md#compare-private-endpoints-and-service-endpoints) - [Virtual Network Service Endpoint Policies](./virtual-network-service-endpoint-policies-overview.md) - [Azure Resource Manager template](https://azure.microsoft.com/resources/templates/vnet-2subnets-service-endpoints-storage-integration) |
| vpn-gateway | Vpn Gateway Connect Different Deployment Models Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/vpn-gateway/vpn-gateway-connect-different-deployment-models-portal.md | Title: 'Connect classic virtual networks to Azure Resource Manager VNets: Portal' -description: Learn how to to connect classic VNets to Resource Manager VNets using the portal. -+description: Learn how to connect classic VNets to Resource Manager VNets using the portal. - Previously updated : 02/10/2021 Last updated : 04/25/2022 -> [!div class="op_single_selector"] -> * [Portal](vpn-gateway-connect-different-deployment-models-portal.md) -> * [PowerShell](vpn-gateway-connect-different-deployment-models-powershell.md) -> -> +This article is intended for customers who already have a VNet that was created using the classic (legacy) deployment model and want to connect the classic VNet to anther VNet that was created using the latest deployment model. If you don't already have a legacy VNet, use the [Create a VNet-to-VNet connection](vpn-gateway-howto-vnet-vnet-resource-manager-portal.md) article instead. ++## Architecture ++Connecting a classic VNet to a Resource Manager VNet is similar to connecting a VNet to an on-premises site location. Both connectivity types use a VPN gateway to provide a secure tunnel using IPsec/IKE. You can create a connection between VNets that are in different subscriptions and in different regions. You can also connect VNets that already have connections to on-premises networks, as long as the gateway is dynamic or route-based. For more information about VNet-to-VNet connections, see the [VNet-to-VNet FAQ](vpn-gateway-vpn-faq.md). ++For this configuration, you create a VPN gateway connection over an IPsec/IKE VPN tunnel between the virtual networks. Make sure that none of your VNet ranges overlap with each other, or with any of the local networks that they connect to. ++The following table shows an example of how the example VNets and local sites are defined: ++| Virtual Network | Address Space | Region | Connects to local network site | +|: |: |: |: | +| ClassicVNet |(10.1.0.0/16) |West US | RMVNetSite (192.168.0.0/16) | +| RMVNet | (192.168.0.0/16) |East US |ClassicVNetSite (10.1.0.0/16) | ++## <a name="before"></a>Prerequisites -Connecting a classic VNet to a Resource Manager VNet is similar to connecting a VNet to an on-premises site location. Both connectivity types use a VPN gateway to provide a secure tunnel using IPsec/IKE. You can create a connection between VNets that are in different subscriptions and in different regions. You can also connect VNets that already have connections to on-premises networks, as long as the gateway that they have been configured with is dynamic or route-based. For more information about VNet-to-VNet connections, see the [VNet-to-VNet FAQ](#faq) at the end of this article. +These steps assume that both VNets have already been created. If you're using this article as an exercise and don't have VNets, there are links in the steps to help you create them. -If you do not already have a virtual network gateway and do not want to create one, you may want to instead consider connecting your VNets using VNet Peering. VNet peering does not use a VPN gateway. For more information, see [VNet peering](../virtual-network/virtual-network-peering-overview.md). +* Verify that the address ranges for the VNets don't overlap with each other, or overlap with any of the ranges for other connections that the gateways may be connected to. +* In this article, we use both the Azure portal and PowerShell. PowerShell is required to create the connection from the classic VNet to the Resource Manager VNet. Install the latest PowerShell cmdlets for **both** Resource Manager and Service Management. -### <a name="before"></a>Before you begin + While it's possible to perform a few of the PowerShell commands using the Azure Cloud Shell environment, you need to install both versions of the cmdlets to create the connections properly. + * [Service Management (classic) PowerShell cmdlets](/powershell/azure/servicemanagement/install-azure-ps?). When you install the Service Management cmdlets, you may need to modify the [Execution policy](/powershell/module/microsoft.powershell.core/about/about_execution_policies?) in order to install the classic version of the Azure module. + * [AZ PowerShell cmdlets for Resource Manager](/powershell/azure/install-az-ps?) -* These steps assume that both VNets have already been created. If you are using this article as an exercise and don't have VNets, there are links in the steps to help you create them. -* Verify that the address ranges for the VNets do not overlap with each other, or overlap with any of the ranges for other connections that the gateways may be connected to. -* Install the latest PowerShell cmdlets for both Resource Manager and Service Management (classic). In this article, we use both the Azure portal and PowerShell. PowerShell is required to create the connection from the classic VNet to the Resource Manager VNet. For more information, see [How to install and configure Azure PowerShell](/powershell/azure/). + For more information, see [How to install and configure Azure PowerShell](/powershell/azure/). ### <a name="values"></a>Example settings You can use these values to create a test environment, or refer to them to bette **Classic VNet** VNet name = ClassicVNet <br>-Address space = 10.0.0.0/24 <br> -Subnet name = Subnet-1 <br> -Subnet address range = 10.0.0.0/27 <br> +Address space = 10.1.0.0/16 <br> +Subnet name = Subnet1 <br> +Subnet address range = 10.1.0.0/24 <br> Subscription = the subscription you want to use <br> Resource Group = ClassicRG <br> Location = West US <br>-GatewaySubnet = 10.0.0.32/28 <br> -Local site = RMVNetLocal <br> +GatewaySubnet Address range = 10.1.255.0/27 <br> +Local site name = RMVNetSite <br> +Gateway Size = Standard **Resource Manager VNet** VNet name = RMVNet <br> Address space = 192.168.0.0/16 <br>-Resource Group = RG1 <br> +Resource Group = RMRG <br> Location = East US <br>-Subnet name = Subnet-1 <br> +Subnet name = Subnet1 <br> Address range = 192.168.1.0/24 <br>-GatewaySubnet = 192.168.0.0/26 <br> +GatewaySubnet = 192.168.255.0/27 <br> Virtual network gateway name = RMGateway <br> Gateway type = VPN <br> VPN type = Route-based <br> SKU = VpnGw1 <br> Location = East US <br>-Virtual network = RMVNet <br> (associate the VPN gateway to this VNet) -First IP configuration = rmgwpip <br> (gateway public IP address) -Local network gateway = ClassicVNetLocal <br> -Connection name = RMtoClassic +Virtual network = RMVNet(associate the VPN gateway to this VNet) <br> +First IP configuration = rmgwpip (gateway public IP address) <br> +Local network gateway = ClassicVNetSite <br> +Connection name = RM-Classic -### <a name="connectoverview"></a>Connection overview +## <a name="classicvnet"></a>Configure the classic VNet -For this configuration, you create a VPN gateway connection over an IPsec/IKE VPN tunnel between the virtual networks. Make sure that none of your VNet ranges overlap with each other, or with any of the local networks that they connect to. +In this section, you create the classic VNet, the local network (local site), and the virtual network gateway. Screenshots are provided as examples. Be sure to replace the values with your own, or use the [Example](#values) values. -The following table shows an example of how the example VNets and local sites are defined: +If you already have a VNet with a VPN gateway, verify that the gateway is Dynamic. If it's Static, you must first delete the VPN gateway before you proceed to [Configure the site and gateway](#classicgw). -| Virtual Network | Address Space | Region | Connects to local network site | -|: |: |: |: | -| ClassicVNet |(10.0.0.0/24) |West US | RMVNetLocal (192.168.0.0/16) | -| RMVNet | (192.168.0.0/16) |East US |ClassicVNetLocal (10.0.0.0/24) | +### 1. <a name="classicvnet"></a>Create a classic VNet -## <a name="classicvnet"></a>Section 1 - Configure the classic VNet settings +If you don't have a classic VNet and are using these steps as an exercise, you can create a VNet using the example values. Follow the steps below, making sure to use the navigation method in the steps to create your virtual network. -In this section, you create the classic VNet, the local network (local site), and the virtual network gateway. Screenshots are provided as examples. Be sure to replace the values with your own, or use the [Example](#values) values. +**Example values** -### 1. <a name="classicvnet"></a>Create a classic VNet +* Project details + * Resource Group = ClassicRG +* Instance details + * Name = ClassicVNet + * Address space = 10.1.0.0/16 + * Subnet name = Subnet1 + * Subnet address range = 10.1.0.0/24 + * Location = West US -If you don't have a classic VNet and are running these steps as an exercise, you can create a VNet by using [this article](/previous-versions/azure/virtual-network/virtual-networks-create-vnet-classic-pportal) and the [Example](#values) settings values from above. +1. Open the [Azure portal](https://portal.azure.com) and sign in with your Azure account. + > [!Important] + > To see the option to create a classic VNet, you have to navigate to the page using the following steps. -If you already have a VNet with a VPN gateway, verify that the gateway is Dynamic. If it's Static, you must first delete the VPN gateway before you proceed to [Configure the local site](#local). +1. Click **+ Create a resource** at the top of the page to open the page showing **Search service and marketplace**. +1. In the **Search services and marketplace** field, type 'Virtual Network'. +1. Locate **Virtual Network** from the returned list and click it to open the **Virtual network** page. +1. On the **Virtual network** page, in the text under the 'Create' button, click **(change to Classic)** to toggle to the Deploy with Classic wording. If you accidentally don't do this, you'll wind up with a Resource Manager VNet instead. +1. Click **Create** to open the **Create a virtual network (classic)** page. +1. Fill in the values, then click **Review + Create** and **Create** to create your classic VNet. -1. Open the [Azure portal](https://portal.azure.com) and sign in with your Azure account. -2. Click **+ Create a resource** to open the 'New' page. -3. In the 'Search the marketplace' field, type 'Virtual Network'. If you instead, select Networking -> Virtual Network, you will not get the option to create a classic VNet. -4. Locate 'Virtual Network' from the returned list and click it to open the Virtual Network page. -5. On the virtual network page, select 'Classic' to create a classic VNet. If you take the default here, you will wind up with a Resource Manager VNet instead. +### 2. <a name="classicgw"></a>Configure classic site and virtual network gateway -### 2. <a name="local"></a>Configure the local site +1. Go to your classic VNet. +1. In the left menu list, click **Gateway**, then click the banner to open the page to configure a gateway. +1. On the **Configure a VPN connection and gateway** page **Connection** tab, fill in the values, using the exercise [Example values](#values) if necessary. + * Connection type = Site-to-site + * Local site name = RMVNetSite + * VPN gateway IP address = use a placeholder value if you don't know the Public IP address of the Resource Manager VPN gateway or you haven't yet created one. You can update this setting later. + * Local site client addresses = The address range for the RM VNet. For example, 192.168.0.0/16. +1. At the bottom of the page, click **Next: Gateway** to advance to the Gateway tab. +1. On the **Gateway** tab, configure the settings: -1. Navigate to **All resources** and locate the **ClassicVNet** in the list. -2. Click **Gateway** in the **Settings** section of the menu, and then click on the banner to create a gateway. -  -3. On the **New VPN Connection** page, for **Connection type**, select **Site-to-site**. -4. For **Local site**, click **Configure required settings**. This opens the **Local site** page. -5. On the **Local site** page, create a name to refer to the Resource Manager VNet. For example, 'RMVNetLocal'. -6. If the VPN gateway for the Resource Manager VNet already has a Public IP address, use the value for the **VPN gateway IP address** field. If you are doing these steps as an exercise, or don't yet have a virtual network gateway for your Resource Manager VNet, you can make up a placeholder IP address. Make sure that the placeholder IP address uses a valid format. Later, you replace the placeholder IP address with the Public IP address of the Resource Manager virtual network gateway. -7. For **Client Address Space**, use the [values](#connectoverview) for the virtual network IP address spaces for the Resource Manager VNet. This setting is used to specify the address spaces to route to the Resource Manager virtual network. In the example, we use 192.168.0.0/16, the address range for the RMVNet. -8. Click **OK** to save the values and return to the **New VPN Connection** page. + * Size = Standard + * Routing Type = Dynamic + * Address range for the GatewaySubnet = 10.1.255.0/27 +1. Click **Review + create** to validate the settings. +1. Click **Create** to create the gateway. The gateway can take up to 45 minutes to create. While the gateway configures, you can continue with the next steps. -### <a name="classicgw"></a>3. Create the virtual network gateway +## <a name="rmvnet"></a>Configure the Resource Manager VNet -1. On the **New VPN Connection** page, select the **Create gateway immediately** checkbox. -2. Click **Optional gateway configuration** to open the **Gateway configuration** page. +In this section, you create the RM virtual network and the RM VPN gateway. If you already have a Resource Manager virtual network and VPN gateway, verify that the gateway is route-based. -  -3. Click **Subnet - Configure required settings** to open the **Add subnet** page. The **Name** is already configured with the required value: **GatewaySubnet**. -4. The **Address range** refers to the range for the gateway subnet. Although you can create a gateway subnet with a /29 address range (3 addresses), we recommend creating a gateway subnet that contains more IP addresses. This will accommodate future configurations that may require more available IP addresses. If possible, use /27 or /28. If you are using these steps as an exercise, you can refer to the [Example values](#values). For this example, we use '10.0.0.32/28'. Click **OK** to create the gateway subnet. -5. On the **Gateway configuration** page, **Size** refers to the gateway SKU. Select the gateway SKU for your VPN gateway. -6. Verify the **Routing Type** is **Dynamic**, then click **OK** to return to the **New VPN Connection** page. -7. On the **New VPN Connection** page, click **OK** to begin creating your VPN gateway. Creating a VPN gateway can take up to 45 minutes to complete. +### 1. Create an RM virtual network -### <a name="ip"></a>4. Copy the virtual network gateway Public IP address +Create a Resource Manager VNet. -After the virtual network gateway has been created, you can view the gateway IP address. +For steps, see [Create a virtual network](../virtual-network/quick-create-portal.md). -1. Navigate to your classic VNet, and click **Overview**. -2. Click **VPN connections** to open the VPN connections page. On the VPN connections page, you can view the Public IP address. This is the Public IP address assigned to your virtual network gateway. Make a note of the IP address. You use it in later steps when you work with your Resource Manager local network gateway configuration settings. -3. You can view the status of your gateway connections. Notice the local network site you created is listed as 'Connecting'. The status will change after you have created your connections. You can close this page when you are finished viewing the status. +**Example values:** ++* Project details + * Resource Group = RMRG +* Instance details + * VNet name = RMVNet + * Region = East US +* IP Addresses + * Address space = 192.168.0.0/16 + * Subnet name = Subnet1 + * Address range = 192.168.1.0/24 -## <a name="rmvnet"></a>Section 2 - Configure the Resource Manager VNet settings +### <a name="creategw"></a>2. Create an RM virtual network gateway -In this section, you create the virtual network gateway and the local network gateway for your Resource Manager VNet. Screenshots are provided as examples. Be sure to replace the values with your own, or use the [Example](#values) values. +Next, create the virtual network gateway (VPN gateway) object for your VNet. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. -### 1. Create a virtual network +For steps, see [Create a VPN gateway](tutorial-site-to-site-portal.md#VNetGateway) **Example values:** -* VNet name = RMVNet <br> -* Address space = 192.168.0.0/16 <br> -* Resource Group = RG1 <br> -* Location = East US <br> -* Subnet name = Subnet-1 <br> -* Address range = 192.168.1.0/24 <br> +* Instance details + * Name = RMGateway + * Region = East US + * Gateway type = VPN + * VPN type = Route-based + * SKU = VpnGw2 + * Generation = Generation2 + * Virtual network = RMVNet + * GatewaySubnet address range = 192.168.255.0/27 + * Public IP Address Type = Basic +* Public IP address + * Public IP address = Create new + * Public IP address name = RMGWpip -If you don't have a Resource Manager VNet and are running these steps as an exercise, create a virtual network with the steps in [Create a virtual network](../virtual-network/quick-create-portal.md), using the example values. +### <a name="createlng"></a>3. Create an RM local network gateway -### <a name="creategw"></a>2. Create a virtual network gateway +In this step, you create the local network gateway. The local network gateway is an object that specifies the address range and the Public IP address endpoint associated with your classic VNet and its virtual network gateway. -In this step, you create the virtual network gateway for your VNet. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. +For steps, see [Create a local network gateway](tutorial-site-to-site-portal.md#LocalNetworkGateway). +**Example values** -**Example values:** +* Project details + * Resource Group = RMRG + * Region = East US +* Name = ClassicVNetSite +* Endpoint = IP address +* IP address = the Gateway Public IP address of the Classic VNet. If necessary, you can use a placeholder IP address, and then go back and modify later. +* Address space = 10.1.0.0/16 (address space of the Classic VNet) ++## <a name="modifylng"></a>Modify site and local network gateway settings ++After both gateways have completed deployment, you can proceed with the next steps. The next steps require the public IP address that is assigned to each gateway. ++### <a name="modify-classic"></a>Modify classic VNet local site settings -* Virtual network gateway name = RMGateway <br> -* Gateway type = VPN <br> -* VPN type = Route-based <br> -* SKU = VpnGw1 <br> -* Location = East US <br> -* Virtual network = RMVNet <br> -* GatewaySubnet = 192.168.0.0/26 <br> -* First IP configuration = rmgwpip <br> +In this section, you modify the local network site for the classic VNet by updating the public IP address field with the address of the Resource Manager virtual network gateway. +1. For these steps, you need to obtain the public IP address for the **Resource Manager virtual network gateway**. You can find the gateway IP address by going to the RM virtual network gateway **Overview** page. Copy the IP address. +1. Next, go to the **classic VNet**. +1. On the left menu, click **Site-to-site connections** to open the Site-to-site connections page. +1. Under **Name**, click the name of the RM site you created. For example, RMVNetSite. This opens the **Properties** page for your local site. +1. On the Properties page, click **Edit local site**. +1. Change the **VPN gateway IP address** to the Public IP address that is assigned to the RMVNet gateway (the gateway to which you want to connect). +1. Click **OK** to save the settings. +### <a name="modify-rm"></a>Modify RM VNet local network gateway settings -### <a name="createlng"></a>3. Create a local network gateway +In this section, you modify the local network gateway settings for the Resource Manager local network gateway object by updating the public IP address field with the address of the classic virtual network gateway. -**Example values:** Local network gateway = ClassicVNetLocal +1. For these steps, you need to obtain the public IP address for the **classic virtual network gateway**. You can find the gateway IP address by going to the classic virtual network **Overview** page. +1. In **All resources**, locate the local network gateway. In our example, the local network gateway is **ClassicVNetSite**. +1. In the left menu, click **Configuration** and update the IP address. Close the page. -| Virtual Network | Address Space | Region | Connects to local network site |Gateway Public IP address| -|: |: |: |: |: | -| ClassicVNet |(10.0.0.0/24) |West US | RMVNetLocal (192.168.0.0/16) |The Public IP address that is assigned to the ClassicVNet gateway| -| RMVNet | (192.168.0.0/16) |East US |ClassicVNetLocal (10.0.0.0/24) |The Public IP address that is assigned to the RMVNet gateway.| +For steps, see [Modify local network gateway settings](vpn-gateway-modify-local-network-gateway-portal.md). -The local network gateway specifies the address range and the Public IP address associated with your classic VNet and its virtual network gateway. If you are doing these steps as an exercise, refer to the Example values. +## <a name="connections"></a>Configure connections +This section helps you connect your classic VNet to your RM VNet. Even though it appears that you can do the classic VNet connection in the portal, it will fail. This section requires PowerShell to be installed locally on your computer, as specified in the [Prerequisites](#before). -## <a name="modifylng"></a>Section 3 - Modify the classic VNet local site settings +### <a name="classic-values"></a>Get classic VNet values -In this section, you replace the placeholder IP address that you used when specifying the local site settings, with the Resource Manager VPN gateway IP address. This section uses the classic (SM) PowerShell cmdlets. +When you create a VNet in the Azure portal, the full values for name and site aren't visible in the portal. For example, a VNet that appears to be named 'ClassicVNet' in the Azure portal may have a much longer name in the network configuration file. The name might look something like: 'Group ClassicRG ClassicVNet'. The local network site may also have a much longer name than what appears in the portal. -1. In the Azure portal, navigate to the classic virtual network. -2. On the page for your virtual network, click **Overview**. -3. In the **VPN connections** section, click the name of your local site in the graphic. +In these steps, you download the network configuration file and to obtain the values used for the next sections. -  -4. On the **Site-to-site VPN connections** page, click the name of the site. +#### 1. Connect to your Azure account -  -5. On the connection page for your local site, click the name of the local site to open the **Local site** page. +Open the PowerShell console with elevated rights and sign in to your Azure account. After logging in, your account settings are downloaded so that they're available to Azure PowerShell. The following cmdlets prompts you for the sign-in credentials for your Azure Account for the [Resource Manager deployment model](../azure-resource-manager/management/deployment-models.md): -  -6. On the **Local site** page, replace the **VPN gateway IP address** with the IP address of the Resource Manager gateway. +1. First, connect to RM. -  -7. Click **OK** to update the IP address. + Connect to use the RM cmdlets. -## <a name="RMtoclassic"></a>Section 4 - Create Resource Manager to classic connection + ```powershell + Connect-AzAccount + ``` -In these steps, you configure the connection from the Resource Manager VNet to the classic VNet using the Azure portal. +1. Get a list of your Azure subscriptions (optional). -1. In **All resources**, locate the local network gateway. In our example, the local network gateway is **ClassicVNetLocal**. -2. Click **Configuration** and verify that the IP address value is the VPN gateway for the classic VNet. Update, if needed, then click **Save**. Close the page. -3. In **All resources**, click the local network gateway. -4. Click **Connections** to open the Connections page. -5. On the **Connections** page, click **+** to add a connection. -6. On the **Add connection** page, name the connection. For example, 'RMtoClassic'. -7. **Site-to-Site** is already selected on this page. -8. Select the virtual network gateway that you want to associate with this site. -9. Create a **shared key**. This key is also used in the connection that you create from the classic VNet to the Resource Manager VNet. You can generate the key or make one up. In our example, we use 'abc123', but you can (and should) use something more complex. -10. Click **OK** to create the connection. + ```powershell + Get-AzSubscription + ``` -## <a name="classictoRM"></a>Section 5 - Create classic to Resource Manager connection +1. If you have more than one subscription, specify the subscription that you want to use. -In these steps, you configure the connection from the classic VNet to the Resource Manager VNet. These steps require PowerShell. You can't create this connection in the portal. Make sure you have downloaded and installed both the classic (SM) and Resource Manager (RM) PowerShell cmdlets. + ```powershell + Select-AzSubscription -SubscriptionName "Name of subscription" + ``` -### 1. Connect to your Azure account +1. Next, you must connect to the classic PowerShell cmdlets. -Open the PowerShell console with elevated rights and log in to your Azure account. After logging in, your account settings are downloaded so that they are available to Azure PowerShell. The following cmdlet prompts you for the login credentials for your Azure Account for the [Resource Manager deployment model](../azure-resource-manager/management/deployment-models.md): + Use the following command to add your Azure account for the classic deployment model: -```powershell -Connect-AzAccount -``` + ```powershell + Add-AzureAccount + ``` -Get a list of your Azure subscriptions. +1. Get a list of your subscriptions (optional). -```powershell -Get-AzSubscription -``` + ```powershell + Get-AzureSubscription + ``` -If you have more than one subscription, specify the subscription that you want to use. +1. If you have more than one subscription, specify the subscription that you want to use. -```powershell -Select-AzSubscription -SubscriptionName "Name of subscription" -``` + ```powershell + Select-AzureSubscription -SubscriptionName "Name of subscription" + ``` -Next, log in to use the classic PowerShell cmdlets (Service Management). Use the following command to add your Azure account for the classic deployment model: +#### 2. View the network configuration file values -```powershell -Add-AzureAccount -``` +1. Create a directory on your computer. For our example, we created a directory called "AzureNet". +1. Export the network configuration file to the directory. In this example, the network configuration file is exported to C:\AzureNet. -Get a list of your subscriptions. This step may be necessary when adding the Service Management cmdlets, depending on your Azure module install. + ```powershell + Get-AzureVNetConfig -ExportToFile C:\AzureNet\NetworkConfig.xml + ``` -```powershell -Get-AzureSubscription -``` +1. Open the file with a text editor and view the name for your classic VNet. Use the names in the network configuration file when running your PowerShell cmdlets. -If you have more than one subscription, specify the subscription that you want to use. + * VNet names are listed as **VirtualNetworkSite name =** + * Site names are listed as **LocalNetworkSite name=** -```powershell -Select-AzureSubscription -SubscriptionName "Name of subscription" -``` +#### 3. Create the connection -### 2. View the network configuration file values +Set the shared key and create the connection from the classic VNet to the Resource Manager VNet. The connections must be created using PowerShell, not the Azure portal. -When you create a VNet in the Azure portal, the full name that Azure uses is not visible in the Azure portal. For example, a VNet that appears to be named 'ClassicVNet' in the Azure portal may have a much longer name in the network configuration file. The name might look something like: 'Group ClassicRG ClassicVNet'. In these steps, you download the network configuration file and view the values. +If you get an error, verify the site and the VNet names are correct. Also, make sure that you've authenticated for both versions of PowerShell or you won't be able to set the shared key. -Create a directory on your computer and then export the network configuration file to the directory. -In this example, the network configuration file is exported to C:\AzureNet. +* In this example, **-VNetName** is the name of the classic VNet as found in your network configuration file. +* The **-LocalNetworkSiteName** is the name you specified for the local site, as found in your network configuration file. Use the entire site name, including any numbers. +* The **-SharedKey** is a value that you generate and specify. For this example, we used *abc123*, but you should generate and use something more complex. The value you specify here must be the same value that you specify when creating your Resource Manager to classic connection. -```powershell -Get-AzureVNetConfig -ExportToFile C:\AzureNet\NetworkConfig.xml -``` +1. Set the key. -Open the file with a text editor and view the name for your classic VNet. Use the names in the network configuration file when running your PowerShell cmdlets. + ```powershell + Set-AzureVNetGatewayKey -VNetName "Group ClassicRG ClassicVNet" ` + -LocalNetworkSiteName "172B916_RMVNetSite" -SharedKey abc123 + ``` -- VNet names are listed as **VirtualNetworkSite name =**-- Site names are listed as **LocalNetworkSite name=**+1. Create the VPN connection by running the following commands. Be sure to modify the commands to reflect your environment. -### 3. Create the connection + Set the variables. -Set the shared key and create the connection from the classic VNet to the Resource Manager VNet. You cannot set the shared key using the portal. Make sure you run these steps while logged in using the classic version of the PowerShell cmdlets. To do so, use **Add-AzureAccount**. Otherwise, you will not be able to set the '-AzureVNetGatewayKey'. + ```powershell + $vnet01gateway = Get-AzLocalNetworkGateway -Name ClassicVNetSite -ResourceGroupName RMRG + $vnet02gateway = Get-AzVirtualNetworkGateway -Name RMGateway -ResourceGroupName RMRG + ``` -- In this example, **-VNetName** is the name of the classic VNet as found in your network configuration file. -- The **-LocalNetworkSiteName** is the name you specified for the local site, as found in your network configuration file.-- The **-SharedKey** is a value that you generate and specify. For this example, we used *abc123*, but you can generate something more complex. The important thing is that the value you specify here must be the same value that you specified when creating your Resource Manager to classic connection.+ Create the connection. Notice that the **-ConnectionType** is IPsec, not Vnet2Vnet. -```powershell -Set-AzureVNetGatewayKey -VNetName "Group ClassicRG ClassicVNet" ` --LocalNetworkSiteName "172B9E16_RMVNetLocal" -SharedKey abc123-``` + ```powershell + New-AzVirtualNetworkGatewayConnection -Name RM-Classic -ResourceGroupName RMRG ` + -Location "East US" -VirtualNetworkGateway1 ` + $vnet02gateway -LocalNetworkGateway2 ` + $vnet01gateway -ConnectionType IPsec -RoutingWeight 10 -SharedKey 'abc123' + ``` -## <a name="verify"></a>Section 6 - Verify your connections +## <a name="verify"></a>Verify your connections You can verify your connections by using the Azure portal or PowerShell. When verifying, you may need to wait a minute or two as the connection is being created. When a connection is successful, the connectivity state changes from 'Connecting' to 'Connected'. -### To verify the connection from your classic VNet to your Resource Manager VNet +### Verify the classic VNet to RM connection -### To verify the connection from your Resource Manager VNet to your classic VNet +### Verify the RM VNet to classic connection -## <a name="faq"></a>VNet-to-VNet FAQ +## Next steps +For more information about VNet-to-VNet connections, see the [VPN Gateway FAQ](vpn-gateway-vpn-faq.md). |