+Test the expression by searching for a user or providing values and selecting **Test expression**. The output of the expression test appears in the **View expression output** box.

+* Extension attributes aren't available for selection in the expression builder. However, extension attributes can be used in the attribute mapping expression.

+[Reference for writing expressions for attribute mappings](functions-for-customizing-application-data.md)

+Please refer to the [SAP SuccessFactors integration reference](./sap-successfactors-integration-reference.md#retrieving-more-attributes) to extend the schema for additional attributes.

+To further secure the connectivity between Azure AD provisioning service and SuccessFactors, add the Azure AD IP ranges in the SuccessFactors IP allowlist:

+For every user in SuccessFactors, Azure AD provisioning service retrieves the following entities. Each entity is expanded using the OData API *$expand* query parameter as outlined in the *Retrieval rule* column. Some entities are expanded by default, while some entities are expanded only if a specific attribute is present in the mapping.

+| 1 | `PerPerson` | `*root node*` | Always |

+| 2 | `PerPersonal` | `personalInfoNav` | Always |

+| 3 | `PerPhone` | `phoneNav` | Always |

+| 4 | `PerEmail` | `emailNav` | Always |

+| 5 | `EmpEmployment` | `employmentNav` | Always |

+| 6 | `User` | `employmentNav/userNav` | Always |

+| 7 | `EmpJob` | `employmentNav/jobInfoNav` | Always |

+| 8 | `EmpEmploymentTermination` | `activeEmploymentsCount` | Always |

+| 9 | `User's manager` | `employmentNav/userNav/manager/empInfo` | Always |

+| 10 | `FOCompany` | `employmentNav/jobInfoNav/companyNav` | Only if `company` or `companyId` attribute is mapped |

+| 11 | `FODepartment` | `employmentNav/jobInfoNav/departmentNav` | Only if `department` or `departmentId` attribute is mapped |

+| 12 | `FOBusinessUnit` | `employmentNav/jobInfoNav/businessUnitNav` | Only if `businessUnit` or `businessUnitId` attribute is mapped |

+| 13 | `FOCostCenter` | `employmentNav/jobInfoNav/costCenterNav` | Only if `costCenter` or `costCenterId` attribute is mapped |

+| 14 | `FODivision` | `employmentNav/jobInfoNav/divisionNav` | Only if `division` or `divisionId` attribute is mapped |

+| 15 | `FOJobCode` | `employmentNav/jobInfoNav/jobCodeNav` | Only if `jobCode` or `jobCodeId` attribute is mapped |

+| 16 | `FOPayGrade` | `employmentNav/jobInfoNav/payGradeNav` | Only if `payGrade` attribute is mapped |

+| 17 | `FOLocation` | `employmentNav/jobInfoNav/locationNav` | Only if `location` attribute is mapped |

+| 18 | `FOCorporateAddressDEFLT` | `employmentNav/jobInfoNav/addressNavDEFLT` | If mapping contains one of the following attributes: `officeLocationAddress, officeLocationCity, officeLocationZipCode` |

+| 19 | `FOEventReason` | `employmentNav/jobInfoNav/eventReasonNav` | Only if `eventReason` attribute is mapped |

+| 20 | `EmpGlobalAssignment` | `employmentNav/empGlobalAssignmentNav` | Only if `assignmentType` is mapped |

+| 21 | `EmploymentType Picklist` | `employmentNav/jobInfoNav/employmentTypeNav` | Only if `employmentType` is mapped |

+| 22 | `EmployeeClass Picklist` | `employmentNav/jobInfoNav/employeeClassNav` | Only if `employeeClass` is mapped |

+| 23 | `EmplStatus Picklist` | `employmentNav/jobInfoNav/emplStatusNav` | Only if `emplStatus` is mapped |

+| 24 | `AssignmentType Picklist` | `employmentNav/empGlobalAssignmentNav/assignmentTypeNav` | Only if `assignmentType` is mapped |

+| 25 | `Position` | `employmentNav/jobInfoNav/positionNav` | Only if `positioNav` is mapped |

+| 26 | `Manager User` | `employmentNav/jobInfoNav/managerUserNav` | Only if `managerUserNav` is mapped |

+To validate the data returned by your OData API endpoint for a specific `personIdExternal`, update the `SuccessFactorsAPIEndpoint` in the API query with your API data center server URL and use a tool like [Postman](https://www.postman.com/downloads/) to invoke the query. If the "in" filter does not work, you can try the "eq" filter.

+Here is the OData API request template that Azure AD uses to query SuccessFactors for incremental changes. You can update the variables `SuccessFactorsAPIEndpoint`, `LastExecutionTimestamp` and `CurrentExecutionTime` in the request template use a tool like [Postman](https://www.postman.com/downloads/) to check what data is returned. Alternatively, you can also retrieve the actual request payload from SuccessFactors by [enabling OData API Audit logs](#enabling-odata-api-audit-logs-in-successfactors).

+When Azure AD provisioning service queries SuccessFactors, it retrieves a JSON result set. The JSON result set includes many attributes stored in Employee Central. By default, the provisioning schema is configured to retrieve only a subset of those attributes.

+To retrieve more attributes, follow the steps listed:

+By using JSONPath transformation, you can customize the behavior of the Azure AD provisioning app to retrieve custom attributes and handle scenarios such as rehiring, worker conversion and global assignment.

+* [Retrieving more attributes](#retrieving-more-attributes)

+* [Handling worker conversion and rehiring scenarios](#handling-worker-conversion-and-rehiring-scenarios)

+### Retrieving more attributes

+To add more SuccessFactors attributes to the provisioning schema, use the steps listed:

+1. Use the OData query to retrieve data for a valid test user from Employee Central.

+ * Example 1: Let's say you want to add the attribute `okToRehire`, which is part of `employmentNav` entity, then use the JSONPath `$.employmentNav.results[0].okToRehire`

+Let's say, in your Employee Central instance, *customString35* attribute in *EmpJobInfo* stores the location description. You want to flow this value to Active Directory *physicalDeliveryOfficeName* attribute. To configure attribute-mapping for this scenario, use the steps:

+Use the steps to update your mapping to retrieve these codes.

+ | SuccessFactors to Active Directory User Provisioning | `accountDisabled` | `Switch(\[emplStatus\], "True", "A", "False", "U", "False", "P", "False")` |

+ | SuccessFactors to Azure AD User Provisioning | `accountEnabled` | `Switch(\[emplStatus\], "False", "A", "True", "U", "True", "P", "True")` |

+### Handling worker conversion and rehiring scenarios

+**About worker conversion scenario:** Worker conversion is the process of converting an existing full-time employee to a contractor or a contractor to a full-time employee. In this scenario, Employee Central adds a new *EmpEmployment* entity along with a new *User* entity for the same *Person* entity. The *User* entity nested under the previous *EmpEmployment* entity is set to null.

+**About rehiring scenarios:** In SuccessFactors, there are two options to process rehiring employees:

+To handle both these scenarios so that the new employment data shows up when a conversion or rehire occurs, you can bulk update the provisioning app schema using the steps listed:

+This section describes how you can update the JSONPath settings to definitely retrieve the current active employment record of the user. It also handles worker conversion and rehiring scenarios.

+ | `$.employmentNav.results\[0\].<br>jobInfoNav.results\[0\].emplStatus` | `$.employmentNav..jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P' )\].emplStatusNav.externalCode` | With this find-replace, we are adding the ability to expand emplStatusNav OData object. |

+ | `$.employmentNav.results\[0\].<br>jobInfoNav.results\[0\]` | `$.employmentNav..jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P')\]` | With this find-replace, we instruct the connector to always retrieve attributes associated with the active SuccessFactors EmpJobInfo record. Attributes associated with terminated/inactive records in SuccessFactors will be ignored. |

+ | `$.employmentNav.results\[0\]` | `$.employmentNav..results\[?(@.jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P')\])\]` | With this find-replace, we instruct the connector to always retrieve attributes associated with the active SuccessFactors Employment record. Attributes associated with terminated/inactive records in SuccessFactors will be ignored. |

+ | SuccessFactors to Active Directory User Provisioning | `accountDisabled` | `Switch(\[activeEmploymentsCount\], "False", "0", "True")` | `Switch(\[emplStatus\], "True", "A", "False", "U", "False", "P", "False")` |

+ | SuccessFactors to Azure AD User Provisioning | `accountEnabled` | `Switch(\[activeEmploymentsCount\], "True", "0", "False")` | `Switch(\[emplStatus\], "False", "A", "True", "U", "True", "P", "True")` |

+To fetch attributes belonging to the standard assignment and global assignment user profile, use the steps listed:

+1. You can now either flow both department values to Active Directory attributes or selectively flow a value using expression mapping. Example: the expression sets the value of AD *department* attribute to *globalAssignmentDepartment* if present, else it sets the value to *department* associated with standard assignment.

+To fetch attributes belonging to both jobs, use the steps listed:

+The SuccessFactors connector supports expansion of the position object. To expand and retrieve position object attributes such as job level or position names in a specific language, you can use JSONPath expressions as shown.

+Inbound user provisioning from SAP SuccessFactors to on premises Active Directory and Azure AD now supports advance provisioning of prehires present in the SAP SuccessFactors Onboarding 2.0 module. When the Azure AD provisioning service encounters a new hire profile with a future start date, it queries SAP SuccessFactors to get new hires with one of the following status codes: `active`, `inactive`, `active_external_suite`. The status code `active_external_suite` corresponds to pre-hires present in the SAP SuccessFactors Onboarding 2.0 module. For a description of these status codes, refer to [SAP support note 2736579](https://launchpad.support.sap.com/#/notes/0002736579).

+Usually the *personIdExternal* attribute value in SuccessFactors matches the *userId* attribute value. However, in scenarios such as rehiring and worker conversion, an employee in SuccessFactors may have two employment records, one active and one inactive. In such scenarios, to ensure that write-back updates the active user profile, please update the configuration of the SuccessFactors provisioning apps as described. This configuration ensures that *userId* is always present in the change set visible to the connector and is used in the SuccessFactors API call.

+1. For guidance regarding JSONPath settings, refer to the section [Handling worker conversion and rehiring scenarios](#handling-worker-conversion-and-rehiring-scenarios) to ensure the *userId* value of the active employment record flows into Azure AD.

+1. Update the flowBehavior attribute from "FlowWhenChanged" to "FlowAlways" as shown.

+ >[!TIP]

+ >We recommend that you also enable [system-preferred multifactor authentication (MFA)](concept-system-preferred-multifactor-authentication.md) when you enable Authenticator Lite. With system-preferred MFA enabled, users try to sign-in with Authenticator Lite before they try less secure telephony methods like SMS or voice call.

+>If they don't have any MFA methods registered, users are prompted to download Authenticator when they begin the registration flow. For the most seamless experience, provision users with a [Temporary Access Pass (TAP)](howto-authentication-temporary-access-pass.md) that they can use during Authenticator Lite registration.

+An end user can be enabled for multifactor authentication (MFA) through an on-premises identity provider. The user can still create and utilize a single passwordless phone sign-in credential.

+### Use Microsoft Graph PowerShell

+To get started, [download and install the Microsoft Graph PowerShell module](/powershell/microsoftgraph/overview).

+To quickly install from recent versions of PowerShell that support `Install-Module`, run the following commands. The first line checks to see if the module is already installed:

+Get-Module Microsoft.Graph

+Install-Module Microsoft.Graph

+Select-MgProfile -Name "beta"

+Connect-MgGraph -Scopes "User.ReadWrite.All"

+After the module is installed, use the following steps to configure each field.

+#### Set the authentication data with Microsoft Graph PowerShell

+Connect-MgGraph -Scopes "User.ReadWrite.All"

+Update-MgUser -UserId 'user@domain.com' -otherMails @("emails@domain.com")

+Update-MgUser -UserId 'user@domain.com' -mobilePhone "+1 4251234567"

+Update-MgUser -UserId 'user@domain.com' -businessPhones "+1 4252345678"

+Update-MgUser -UserId 'user@domain.com' -otherMails @("emails@domain.com") -mobilePhone "+1 4251234567" -businessPhones "+1 4252345678"

+#### Read the authentication data with Microsoft Graph PowerShell

+Connect-MgGraph -Scopes "User.Read.All"

+Get-MgUser -UserId 'user@domain.com' | select otherMails

+Get-MgUser -UserId 'user@domain.com' | select mobilePhone

+Get-MgUser -UserId 'user@domain.com' | select businessPhones

+Get-MgUser -UserId 'user@domain.com' | Select businessPhones, mobilePhone, otherMails | Format-Table

+### Use Azure AD PowerShell

+ Our partners help you navigate Permissions Management, letting you in on best

+ Partners guide you through the Entra Permissions Management risk assessment and

+|  | [Mazzy Technologies Identity](https://mazzytechnologies.com/identity%3A-microsoft-entra)

+At least one of the previously listed licenses is sufficient to add and manage the company branding in your tenant.

+This article is the third in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. The following articles in the series provide more information as described.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments.

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+The guidance helps to you achieve a consistent state of user lifecycle management. Lifecycle management includes provisioning, managing, and deprovisioning users across tenants using the available Azure tools that include [Azure AD B2B collaboration](../external-identities/what-is-b2b.md) (B2B) and [cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md).

+Synchronization requirements are unique to your organization's specific needs. As you design a solution to meet your organization's requirements, the following considerations in this article will help you identify your best options.

+- Cross-tenant synchronization

+- Directory object

+- Azure AD Conditional Access

+- Additional access control

+- Office 365

+## Cross-tenant synchronization

+[Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) can address collaboration and access challenges of multi-tenant organizations. The following table shows common synchronization use cases. You can use both cross-tenant synchronization and customer development to satisfy use cases when considerations are relevant to more than one collaboration pattern.

+| Use case | Cross-tenant sync | Custom development |

+| - | - | - |

+| User lifecycle management |  |  |

+| File sharing and app access |  |  |

+| Support sync to/from sovereign clouds | |  |

+| Control sync from resource tenant | |  |

+| Sync Group objects | |  |

+| Sync Manager links | |  |

+| Attribute level Source of Authority | |  |

+| Azure AD write-back to AD | |  |

+## Directory object considerations

+### Inviting an external user with UPN versus SMTP Address

+Azure AD B2B expects that a user's **UserPrincipalName** (UPN) is the primary SMTP (Email) address for sending invitations. When the user's UPN is the same as their primary SMTP address, B2B works as expected. However, if the UPN is different than the external user's primary SMTP address, it may fail to resolve when a user accepts an invitation, which may be a challenge if you don't know the user's real UPN. You need to discover and use the UPN when sending invitations for B2B.

+The [Microsoft Exchange Online](#microsoft-exchange-online) section of this article explains how to change the default primary SMTP on external users. This technique is useful if you want all email and notifications for an external to flow to the real primary SMTP address as opposed to the UPN. It may be a requirement if the UPN isn't route-able for mail flow.

+### Converting an external user's UserType

+When you use the console to manually create an invitation for an external user account, it creates the user object with a guest user type. Using other techniques to create invitations enable you to set the user type to something other than an external guest account. For example, when using the API, you can configure whether the account is an external member account or an external guest account.

+- Some of the [limits on guest functionality can be removed](../external-identities/user-properties.md#guest-user-permissions).

+- You can [convert guest accounts to member user type.](../external-identities/user-properties.md#can-azure-ad-b2b-users-be-added-as-members-instead-of-guests)

+If you convert from an external guest user to an external member user account, there might be issues with how Exchange Online handles B2B accounts. You can't mail-enable accounts that you invited as external member users. To mail-enable an external member account, use the following best approach.

+- Invite the cross-org users as external guest user accounts.

+- Show the accounts in the GAL.

+- Set the UserType to Member.

+When you use this approach, the accounts show up as MailUser objects in Exchange Online and across Office 365. Also, note there's a timing challenge. Make sure the user is visible in the GAL by checking both Azure AD user ShowInAddressList property aligns with the Exchange Online PowerShell HiddenFromAddressListsEnabled property (that are reverse of each other). The [Microsoft Exchange Online](#microsoft-exchange-online) section of this article provides more information on changing visibility.

+It's possible to convert a member user to a guest user, which is useful for internal users that you want to restrict to guest-level permissions. Internal guest users are users that aren't employees of your organization but for whom you manage their users and credentials. It may allow you to avoid licensing the internal guest user.

+### Issues with using mail contact objects instead of external users or members

+You can represent users from another tenant using a traditional GAL synchronization. If you perform a GAL synchronization rather than using Azure AD B2B collaboration, it creates a mail contact object.

+- A mail contact object and a mail-enabled external member or guest user can't coexist in the same tenant with the same email address at the same time.

+- If a mail contact object exists for the same mail address as the invited external user, it creates the external user but isn't mail-enabled.

+- If the mail-enabled external user exists with the same mail, an attempt to create a mail contact object throws an exception at creation time.

+> [!NOTE]

+> Using mail contacts requires Active Directory Directory Services (AD DS) or Exchange Online PowerShell. Microsoft Graph doesn't provide an API call for managing contacts.

+The following table displays the results of mail contact objects and external user states.

+| Existing state | Provisioning scenario | Effective result |

+| - | - | - |

+| None | Invite B2B Member | Non-mail-enabled member user. See important note above. |

+| None | Invite B2B Guest | Mail-enable external user. |

+| Mail contact object exists | Invite B2B Member | Error. Conflict of Proxy Addresses. |

+| Mail contact object exists | Invite B2B Guest | Mail-contact and Non-Mail enabled external user. See important note above. |

+| Mail-enabled external guest user | Create mail contact object | Error |

+| Mail-enabled external member user exists | Create mail-contact | Error |

+Microsoft recommends using Azure AD B2B collaboration (instead of traditional GAL synchronization) to create:

+- External users that you enable to show in the GAL.

+- External member users that show in the GAL by default but aren't mail-enabled.

+You can choose to use the mail contact object to show users in the GAL. This approach integrates a GAL without providing other permissions because mail contacts aren't security principals.

+Follow this recommended approach to achieve the goal:

+- Invite guest users.

+- Unhide them from the GAL.

+- Disable them by [blocking them from sign-in](/powershell/module/azuread/set-azureaduser).

+A mail contact object can't convert to a user object. Therefore, properties associated with a mail contact object can't transfer (such as group memberships and other resource access). Using a mail contact object to represent a user comes with the following challenges.

+- **Office 365 Groups.** Office 365 Groups support policies governing the types of users allowed to be members of groups and interact with content associated with groups. For example, a group may not allow guest users to join. These policies can't govern mail contact objects.

+- **Azure AD Self-service group management (SSGM).** Mail contact objects aren't eligible to be members in groups using the SSGM feature. You may need more tools to manage groups with recipients represented as contacts instead of user objects.

+- **Azure AD Identity Governance, Access Reviews.** You can use the access reviews feature to review and attest to membership of Office 365 group. Access reviews are based on user objects. Members represented by mail contact objects are out of scope for access reviews.

+- **Azure AD Identity Governance, Entitlement Management (EM).** When you use EM to enable self-service access requests for external users in the company's EM portal, it creates a user object the time of request. It doesn't support mail contact objects.

+## Azure AD conditional access considerations

+The state of the user, device, or network in the user's home tenant doesn't convey to the resource tenant. Therefore, an external user might not satisfy conditional access (CA) policies that use the following controls.

+Where allowed, you can override this behavior with [Cross-Tenant Access Settings (CTAS)](../external-identities/cross-tenant-access-overview.md) that honor MFA and device compliance from the home tenant.

+- **Require multi-factor authentication.** Without CTAS configured, an external user must register/respond to MFA in the resource tenant (even if MFA was satisfied in the home tenant), which results in multiple MFA challenges. If they need to reset their MFA proofs, they might not be aware of the multiple MFA proof registrations across tenants. The lack of awareness might require the user to contact an administrator in the home tenant, resource tenant, or both.

+- **Require device to be marked as compliant.** Without CTAS configured, device identity isn't registered in the resource tenant, so the external user can't access resources that require this control.

+- **Require Hybrid Azure AD Joined device.** Without CTAS configured, device identity isn't registered in the resource tenant (or on-premises Active Directory connected to resource tenant), so the external user can't access resources that require this control.

+- **Require approved client app or Require app protection policy.** Without CTAS configured, external users can't apply the resource tenant Intune Mobile App Management (MAM) policy because it also requires device registration. Resource tenant Conditional Access (CA) policy, using this control, doesn't allow home tenant MAM protection to satisfy the policy. Exclude external users from every MAM-based CA policy.

+Additionally, while you can use the following CA conditions, be aware of the possible ramifications.

+- **Sign-in risk and user risk.** User behavior in their home tenant determines, in part, the sign-in risk and user risk. The home tenant stores the data and risk score. If resource tenant policies block an external user, a resource tenant admin might not be able to enable access. [Identity Protection and B2B users](../identity-protection/concept-identity-protection-b2b.md) explains how Identity Protection detects compromised credentials for Azure AD users.

+- **Locations.** The named location definitions in the resource tenant determine the scope of the policy. The scope of the policy doesn't evaluate trusted locations managed in the home tenant. If your organization wants to share trusted locations across tenants, define the locations in each tenant where you define the resources and conditional access policies.

+## Other access control considerations

+The following are considerations for configuring access control.

+- Define [access control policies](../external-identities/authentication-conditional-access.md) to control access to resources.

+- Design CA policies with external users in mind.

+- Create policies specifically for external users.

+- If your organization is using the [**all users** dynamic group](../external-identities/use-dynamic-groups.md) condition in your existing CA policy, this policy affects external users because they are in scope of **all users**.

+- Create dedicated CA policies for external accounts.

+### Require user assignment

+If an application has the **User assignment required?** property set to **No**, external users can access the application. Application admins must understand access control impacts, especially if the application contains sensitive information. [Restrict your Azure AD app to a set of users in an Azure AD tenant](../develop/howto-restrict-your-app-to-a-set-of-users.md) explains how registered applications in an Azure Active Directory (Azure AD) tenant are, by default, available to all users of the tenant who successfully authenticate.

+### Terms and conditions

+[Azure AD terms of use](../conditional-access/terms-of-use.md) provides a simple method that organizations can use to present information to end users. You can use terms of use to require external users to approve terms of use before accessing your resources.

+### Licensing considerations for guest users with Azure AD Premium features

+Azure AD External Identities pricing is based on monthly active users (MAU). The number of active users is the count of unique users with authentication activity within a calendar month. [Billing model for Azure AD External Identities](../external-identities/external-identities-pricing.md) describes how pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month.

+The following information addresses Office 365 in the context of this paper's scenarios. Detailed information is available at [Microsoft 365 inter-tenant collaboration 365 inter-tenant collaboration](/office365/enterprise/office-365-inter-tenant-collaboration) describes options that include using a central location for files and conversations, sharing calendars, using IM, audio/video calls for communication, and securing access to resources and applications.

+Exchange online limits certain functionality for external users. You can lessen the limits by creating external member users instead of external guest users. Support for external users has the following limitations.

+- You can assign an Exchange Online license to an external user. However, you can't issue to them a token for Exchange Online. The results are that they can't access the resource.

+ - External users can't use shared or delegated Exchange Online mailboxes in the resource tenant.

+ - You can assign an external user to a shared mailbox but they can't access it.

+- You need to unhide external users to include them in the GAL. By default, they're hidden.

+ - Hidden external users are created at invite time. The creation is independent of whether the user has redeemed their invitation. So, if all external users are unhidden, the list includes user objects of external users who haven't redeemed an invitation. Based on your scenario, you may or may not want the objects listed.

+ - External users may be unhidden using [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell-v2). You can execute the [Set-MailUser](/powershell/module/exchange/set-mailuser) PowerShell cmdlet to set the **HiddenFromAddressListsEnabled** property to a value of **\$false**.

+

+For example:

+```Set-MailUser [ExternalUserUPN] -HiddenFromAddressListsEnabled:\$false\```

+Where **ExternalUserUPN** is the calculated **UserPrincipalName.**

+For example:

+```Set-MailUser externaluser1_contoso.com#EXT#@fabricam.onmicrosoft.com\ -HiddenFromAddressListsEnabled:\$false```

+- External users may be unhidden using [Azure AD PowerShell](/powershell/module/azuread). You can execute the [Set-AzureADUser](/powershell/module/azuread/set-azureaduser) PowerShell cmdlet to set the **ShowInAddressList** property to a value of **\$true.**

+

+For example:

+```Set-AzureADUser -ObjectId [ExternalUserUPN] -ShowInAddressList:\$true\```

+Where **ExternalUserUPN** is the calculated **UserPrincipalName.**

+For example:

+```Set-AzureADUser -ObjectId externaluser1_contoso.com#EXT#@fabricam.onmicrosoft.com\ -ShowInAddressList:\$true```

+- There's a timing delay when you update attributes and must perform additional automation afterwards, which is a result of the backend sync that occurs between Azure AD and Exchange Online. Make sure the user is visible in the GAL by checking that the Azure AD user property **ShowInAddressList** aligns with the Exchange Online PowerShell property **HiddenFromAddressListsEnabled** (that are reverse of each other) before continuing operations.

+- You can only set updates to Exchange-specific properties (such as the **PrimarySmtpAddress**, **ExternalEmailAddress**, **EmailAddresses**, and **MailTip**) using [Exchange Online PowerShell](/powershell/exchange/exchange-online-powershell-v2). The Exchange Online Admin Center doesn't allow you to modify the attributes using the GUI.

+As shown above, you can use the [Set-MailUser](/powershell/module/exchange/set-mailuser) PowerShell cmdlet for mail-specific properties. There are user properties that you can modify with the [Set-User](/powershell/module/exchange/set-user) PowerShell cmdlet. You can modify most properties with the Azure AD Graph APIs.

+One of the most useful features of **Set-MailUser** is the ability to manipulate the **EmailAddresses** property. This multi-valued attribute may contain multiple proxy addresses for the external user (such as SMTP, X500, SIP). By default, an external user has the primary SMTP address stamped correlating to the **UserPrincipalName** (UPN). If you want to change the primary SMTP and/or add SMTP addresses, you can set this property. You can't use the Exchange Admin Center; you must use Exchange Online PowerShell. [Add or remove email addresses for a mailbox in Exchange Online](/exchange/recipients-in-exchange-online/manage-user-mailboxes/add-or-remove-email-addresses) shows different ways to modify a multivalued property such as **EmailAddresses.**

+### Microsoft SharePoint Online

+SharePoint Online has its own service-specific permissions depending on whether the user (internal or external) is of type member or guest in the Azure Active Directory tenant. [Office 365 external sharing and Azure Active Directory B2B collaboration](../external-identities/o365-external-user.md) describes how you can enable integration with SharePoint and OneDrive to share files, folders, list items, document libraries, and sites with people outside your organization, while using Azure B2B for authentication and management.

+After you enable external sharing in SharePoint Online, the ability to search for guest users in the SharePoint Online people picker is **OFF** by default. This setting prohibits guest users from being discoverable when they're hidden from the Exchange Online GAL. You can enable guest users to become visible in two ways (not mutually exclusive):

+- You can enable the ability to search for guest users in these ways:

+ - Modify the **ShowPeoplePickerSuggestionsForGuestUsers** setting at the tenant and site collection level.

+ - Set the feature using the [Set-SPOTenant](/powershell/module/sharepoint-online/Set-SPOTenant) and [Set-SPOSite](/powershell/module/sharepoint-online/set-sposite) [SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online) cmdlets.

+- Guest users that are visible in the Exchange Online GAL are also visible in the SharePoint Online people picker. The accounts are visible regardless of the setting for **ShowPeoplePickerSuggestionsForGuestUsers**.

+### Microsoft Teams

+Microsoft Teams has features to limit access and based on user type. Changes to user type can affect content access and features available. Microsoft Teams will require users to change their context using the tenant switching mechanism of their Teams client when working in Teams outside their home tenant.

+The tenant switching mechanism for Microsoft Teams might require users to manually switch the context of their Teams client when working in Teams outside their home tenant.

+You can enable Teams users from another entire external domain to find, call, chat, and set up meetings with your users with Teams Federation. [Manage external meetings and chat with people and organizations using Microsoft identities](/microsoftteams/manage-external-access) describes how you can allow users in your organization to chat and meet with people outside the organization who are using Microsoft as an identity provider.

+### Licensing considerations for guest users in Teams

+When you use Azure B2B with Office 365 workloads, key considerations include instances in which guest users (internal or external) don't have the same experience as member users.

+- **Microsoft Groups.** [Adding guests to Office 365 Groups](https://support.office.com/article/adding-guests-to-office-365-groups-bfc7a840-868f-4fd6-a390-f347bf51aff6) describes how guest access in Microsoft 365 Groups lets you and your team collaborate with people from outside your organization by granting them access to group conversations, files, calendar invitations, and the group notebook.

+- **Microsoft Teams.** [Team owner, member, and guest capabilities in Teams](https://support.office.com/article/team-owner-member-and-guest-capabilities-in-teams-d03fdf5b-1a6e-48e4-8e07-b13e1350ec7b) describes the guest account experience in Microsoft Teams. You can enable a full fidelity experience in Teams by using external member users. Office 365 recently clarified its licensing policy for multi-tenant organizations. Users licensed in their home tenant may access resources in another tenant within the same legal entity. You can grant access using the external members setting with no extra licensing fees. The setting applies for SharePoint, OneDrive for Business, Teams, and Groups.

+- **Identity Governance features.** Entitlement Management and access reviews may require other licenses for external users.

+- **Other products.** Products such as Dynamics CRM may require licensing in every tenant in which a user is represented.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments.

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+This article is the fourth in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. The following articles in the series provide more information as described.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series.

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+The guidance helps to you achieve a consistent state of user lifecycle management. Lifecycle management includes provisioning, managing, and deprovisioning users across tenants using the available Azure tools that include [Azure AD B2B collaboration](../external-identities/what-is-b2b.md) (B2B) and [cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md).

+Microsoft recommends a single tenant wherever possible. If single tenancy doesn't work for your scenario, reference the following solutions that Microsoft customers have successfully implemented for these challenges:

+- Automatic user lifecycle management and resource allocation across tenants

+- Sharing on-premises apps across tenants

+## Automatic user lifecycle management and resource allocation across tenants

+A customer acquires a competitor with whom they previously had close business relationships. The organizations want to maintain their corporate identities.

+### Current state

+Currently, the organizations are synchronizing each other's users as mail contact objects so that they show in each other's directories. Each resource tenant has enabled mail contact objects for all users in the other tenant. Across tenants, no access to applications is possible.

+### Goals

+The customer has the following goals.

+- Every user appears in each organization's GAL.

+ - User account lifecycle changes in the home tenant automatically reflected in the resource tenant GAL.

+ - Attribute changes in home tenants (such as department, name, SMTP address) automatically reflected in resource tenant GAL and the home GAL.

+- Users can access applications and resources in the resource tenant.

+- Users can self-serve access requests to resources.

+### Solution architecture

+The organizations use a point-to-point architecture with a synchronization engine such as Microsoft Identity Manager (MIM). The following diagram illustrates an example of point-to-point architecture for this solution.

+ Diagram Title: Point-to-point architecture solution. On the left, a box labeled Company A contains internal users and external users. On the right, a box labeled Company B contains internal users and external users. Between Company A and Company B, sync engine interactions go from Company A to Company B and from Company B to Company A.

+Each tenant admin performs the following steps to create the user objects.

+1. Ensure that their user database is up to date.

+ 1. Address existing contact objects.

+ 1. Create external member user objects for the other tenant's internal member users.

+ 1. Synchronize user object attributes.

+ 1. Resources to be shared.

+ 1. Expiration and access review policies.

+A customer with multiple peer organizations needs to share on-premises applications from one of the tenants.

+Peer organizations are synchronizing external users in a mesh topology, enabling resource allocation to cloud applications across tenants. The customer offers following functionality.

+- Share applications in Azure AD.

+- Automated user lifecycle management in resource tenant on home tenant (reflecting add, modify, and delete).

+The following diagram illustrates this scenario, where only internal users in Company A access Company A's on-premises apps.

+ Diagram Title: Mesh topology. On the top left, a box labeled Company A contains internal users and external users. On the top right, a box labeled Company B contains internal users and external users. On the bottom left, a box labeled Company C contains internal users and external users. On the bottom right, a box labeled Company D contains internal users and external users. Between Company A and Company B and between Company C and Company D, sync engine interactions go between the companies on the left and the companies on the right.

+Along with the current functionality, they want to offer the following.

+- Provide access to Company A's on-premises resources for the external users.

+- Apps with SAML authentication.

+- Apps with Integrated Windows Authentication and Kerberos.

+Company A provides SSO to on-premises apps for its own internal users using Azure Application Proxy as illustrated in the following diagram.

+ Diagram Title: Azure Application Proxy architecture solution. On the top left, a box labeled https: //sales.constoso.com contains a globe icon to represent a webiste. Below it, a group of icons represent the User and are connected by an arrow from the User to the website. On the top right, a cloud shape labeled Azure Active Directory contains an icon labeled Application Proxy Service. An arrow connects the website to the cloud shape. On the bottom right, a box labeled DMZ has the subtitle On-premises. An arrow connects the cloud shape to the DMZ box, splitting in two to point to icons labeled Connector. Below the Connector icon on the left, an arrow points down and splits in two to point to icons labeled App 1 and App 2. Below the Connector icon on the right, an arrow points down to an icon labeled App 3.

+Admins in tenant A perform the following steps to enable their external users to access the same on-premises applications.

+1. [Configure access to other applications](../external-identities/hybrid-cloud-to-on-premises.md#access-to-iwa-and-kcd-apps).

+1. Create on-premises users through [MIM](../external-identities/hybrid-cloud-to-on-premises.md#create-b2b-guest-user-objects-through-mim) or [PowerShell](https://www.microsoft.com/download/details.aspx?id=51495).

+The following articles provide additional information about B2B collaboration.

+- [Grant B2B users in Azure AD access to your on-premises resources](../external-identities/hybrid-cloud-to-on-premises.md) describes how you can provide B2B users access to on-premises apps.

+- [Azure Active Directory B2B collaboration for hybrid organizations](../external-identities/hybrid-organizations.md) describes how you can give your external partners access to apps and resources in your organization.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments.

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+# Multi-tenant user management introduction

+This article is the first in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. The following articles in the series provide more information as described.

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+The guidance helps to you achieve a consistent state of user lifecycle management. Lifecycle management includes provisioning, managing, and deprovisioning users across tenants using the available Azure tools that include [Azure AD B2B collaboration](../external-identities/what-is-b2b.md) (B2B) and [cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md).

+Provisioning users into a single Azure Active Directory (Azure AD) tenant provides a unified view of resources and a single set of policies and controls. This approach enables consistent user lifecycle management.

+Microsoft recommends a single tenant when possible. Having multiple tenants can result in unique cross-tenant collaboration and management requirements. When consolidation to a single Azure AD tenant isn't possible, multi-tenant organizations may span two or more Azure AD tenants for reasons that include the following.

+- Mergers

+- Acquisitions

+- Divestitures

+- Collaboration across public, sovereign, and regional clouds

+- Political or organizational structures that prohibit consolidation to a single Azure AD tenant

+## Azure AD B2B collaboration

+Azure AD B2B collaboration (B2B) enables you to securely share your company's applications and services with external users. When users can come from any organization, B2B helps you maintain control over access to your IT environment and data.

+You can use B2B collaboration to provide external access for your organization's users to access multiple tenants that you manage. Traditionally, B2B external user access can authorize access to users that your own organization doesn't manage. However, external user access can manage access across multiple tenants that your organization manages.

+An area of confusion with Azure AD B2B collaboration surrounds the [properties of a B2B guest user](../external-identities/user-properties.md). The difference between internal versus external user accounts and member versus guest user types contributes to confusion. Initially, all internal users are member users with **UserType** attribute set to *Member* (member users). An internal user has an account in your Azure AD that is authoritative and authenticates to the tenant where the user resides. A member user is a licensed user with default [member-level permissions](../fundamentals/users-default-permissions.md) in the tenant. Treat member users as employees of your organization.

+You can invite an internal user of one tenant into another tenant as an external user. An external user signs in with an external Azure AD account, social identity, or other external identity provider. External users authenticate outside the tenant to which you invite the external user. At the B2B first release, all external users were of **UserType** *Guest* (guest users). Guest users have [restricted permissions](../fundamentals/users-default-permissions.md) in the tenant. For example, guest users can't enumerate the list of all users nor groups in the tenant directory.

+For the **UserType** property on users, B2B supports flipping the bit from internal to external, and vice versa, which contributes to the confusion.

+You can change an internal user from member user to guest user. For example, you can have an unlicensed internal guest user with guest-level permissions in the tenant, which is useful when you provide a user account and credentials to a person that isn't an employee of your organization.

+You can change an external user from guest user to member user, giving member-level permissions to the external user. Making this change is useful when you manage multiple tenants for your organization and need to give member-level permissions to a user across all tenants. This need may occur regardless of whether the user is internal or external in any given tenant. Member users may require more [licenses](../external-identities/external-identities-pricing.md).

+Most documentation for B2B refers to an external user as a guest user. It conflates the **UserType** property in a way that assumes all guest users are external. When documentation calls out a guest user, it assumes that it's an external guest user. This article specifically and intentionally refers to external versus internal and member user versus guest user.

+## Cross-tenant synchronization

+[Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) enables multi-tenant organizations to provide seamless access and collaboration experiences to end users, leveraging existing B2B external collaboration capabilities. The feature doesn't allow cross-tenant synchronization across Microsoft sovereign clouds (such as Microsoft 365 US Government GCC High, DOD or Office 365 in China). See [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md#cross-tenant-synchronization) for help with automated and custom cross-tenant synchronization scenarios.

+Watch Arvind Harinder talk about the cross-tenant sync capability in Azure AD (embedded below).

+> [!VIDEO https://www.youtube.com/embed/7B-PQwNfGBc]

+The following conceptual and how-to articles provide information about Azure AD B2B collaboration and cross-tenant synchronization.

+### Conceptual articles

+- [B2B best practices](../external-identities/b2b-fundamentals.md) features recommendations for providing the smoothest experience for users and administrators.

+- [B2B and Office 365 external sharing](../external-identities/o365-external-user.md) explains the similarities and differences among sharing resources through B2B, Office 365, and SharePoint/OneDrive.

+- [Properties on an Azure AD B2B collaboration user](../external-identities/user-properties.md) describes the properties and states of the external user object in Azure AD. The description provides details before and after invitation redemption.

+- [B2B user tokens](../external-identities/user-token.md) provides examples of the bearer tokens for B2B for an external user.

+- [Conditional access for B2B](../external-identities/authentication-conditional-access.md) describes how conditional access and MFA work for external users.

+- [Cross-tenant access settings](../external-identities/cross-tenant-access-overview.md) provides granular control over how external Azure AD organizations collaborate with you (inbound access) and how your users collaborate with external Azure AD organizations (outbound access).

+- [Cross-tenant synchronization overview](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) explains how to automate creating, updating, and deleting Azure AD B2B collaboration users across tenants in an organization.

+### How-to articles

+- [Use PowerShell to bulk invite Azure AD B2B collaboration users](../external-identities/bulk-invite-powershell.md) describes how to use PowerShell to send bulk invitations to external users.

+- [Enforce multifactor authentication for B2B guest users](../external-identities/b2b-tutorial-require-mfa.md) explains how you can use conditional access and MFA policies to enforce tenant, app, or individual external user authentication levels.

+- [Email one-time passcode authentication](../external-identities/one-time-passcode.md) describes how the Email one-time passcode feature authenticates external users when they can't authenticate through other means like Azure AD, a Microsoft account (MSA), or Google Federation.

+## Terminology

+The following terms in Microsoft content refer to multi-tenant collaboration in Azure AD.

+- **Resource tenant:** The Azure AD tenant containing the resources that users want to share with others.

+- **Home tenant:** The Azure AD tenant containing users that require access to the resources in the resource tenant.

+- **Internal user:** An internal user has an account that is authoritative and authenticates to the tenant where the user resides.

+- **External user:** An external user has an external Azure AD account, social identity, or other external identity provider to sign in. The external user authenticates somewhere outside the tenant to which you have invited the external user.

+- **Member user:** An internal or external member user is a licensed user with default member-level permissions in the tenant. Treat member users as employees of your organization.

+- **Guest user:** An internal or external guest user has restricted permissions in the tenant. Guest users aren't employees of your organization (such as users for partners). Most B2B documentation refers to B2B Guests, which primarily refers to external guest user accounts.

+- **User lifecycle management:** The process of provisioning, managing, and deprovisioning user access to resources.

+- **Unified GAL:** Each user in each tenant can see users from each organization in their Global Address List (GAL).

+## Deciding how to meet your requirements

+Your organization's unique requirements influence your strategy for managing users across tenants. To create an effective strategy, consider the following requirements.

+- Number of tenants

+- Type of organization

+- Current topologies

+- Specific user synchronization needs

+### Common requirements

+Organizations initially focus on requirements that they want in place for immediate collaboration. Sometimes called *Day One* requirements, they focus on enabling end users to smoothly merge without interrupting their ability to generate value. As you define Day One and administrative requirements, consider including the following requirements and needs.

+### Communications requirements

+- **Unified global address list:** Each user can see all other users in the GAL in their home tenant.

+- **Free/busy information:** Enable users to discover each other's availability. You can do so with [Organization relationships in Exchange Online](/exchange/sharing/organization-relationships/create-an-organization-relationship).

+- **Chat and presence:** Enable users to determine others' presence and initiate instant messaging. Configure through [external access in Microsoft Teams](/microsoftteams/trusted-organizations-external-meetings-chat).

+- **Book resources such as meeting rooms:** Enable users to book conference rooms or other resources across the organization. Cross-tenant conference room booking isn't currently available.

+- **Single email domain:** Enable all users to send and receive mail from a single email domain (for example, `users@contoso.com`). Sending requires an email address rewrite solution.

+### Access requirements

+- **Document access:** Enable users to share documents from SharePoint, OneDrive, and Teams.

+- **Administration:** Allow administrators to manage configuration of subscriptions and services deployed across multiple tenants.

+- **Application access:** Allow end users to access applications across the organization.

+- **Single Sign On:** Enable users to access resources across the organization without the need to enter more credentials.

+Microsoft mechanisms for creating and managing the lifecycle of your external user accounts follow three common patterns. You can use these patterns to help define and implement your requirements. Choose the pattern that best aligns with your scenario and then focus on the pattern details.

+| [End user-initiated](multi-tenant-user-management-scenarios.md#end-user-initiated-scenario) | Resource tenant admins delegate the ability to invite external users to the tenant, an app, or a resource to users within the resource tenant. You can invite users from the home tenant or they can individually sign up. | Unified Global Address List on Day One not required. |

+|[Scripted](multi-tenant-user-management-scenarios.md#scripted-scenario) | Resource tenant administrators deploy a scripted *pull* process to automate discovery and provisioning of external users to support sharing scenarios. | Small number of tenants (such as two). |

+|[Automated](multi-tenant-user-management-scenarios.md#automated-scenario)| Resource tenant admins use an identity provisioning system to automate the provisioning and deprovisioning processes. | You need Unified Global Address List across tenants. |

+- [Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+- [Multi-tenant synchronization from Active Directory](../hybrid/plan-connect-topologies.md) describes various on-premises and Azure Active Directory (Azure AD) topologies that use Azure AD Connect sync as the key integration solution.

+This article is the second in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. The following articles in the series provide more information as described.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+The guidance helps to you achieve a consistent state of user lifecycle management. Lifecycle management includes provisioning, managing, and deprovisioning users across tenants using the available Azure tools that include [Azure AD B2B collaboration](../external-identities/what-is-b2b.md) (B2B) and [cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md).

+This article describes three scenarios for which you can use multi-tenant user management features.

+- End user-initiated

+- Scripted

+- Automated

+## End user-initiated scenario

+In end user-initiated scenarios, resource tenant administrators delegate certain abilities to users in the tenant. Administrators enable end users to invite external users to the tenant, an app, or a resource. You can invite users from the home tenant or they can individually sign up.

+For example, a global professional services firm collaborates with subcontractors on projects. Subcontractors (external users) require access to the firm's applications and documents. Firm admins can delegate to its end users the ability to invite subcontractors or configure self-service for subcontractor resource access.

+### Provisioning accounts

+Here are the most widely used ways to invite end users to access tenant resources.

+- [**Application-based invitations.**](../external-identities/o365-external-user.md) Microsoft applications (such as Teams and SharePoint) can enable external user invitations. Configure B2B invitation settings in both Azure AD B2B and in the relevant applications.

+- [**MyApps.**](../manage-apps/my-apps-deployment-plan.md) Users can invite and assign external users to applications using MyApps. The user account must have [application self-service sign up](../manage-apps/manage-self-service-access.md) approver permissions. Group owners can invite external users to their groups.

+- [**Entitlement management.**](../governance/entitlement-management-overview.md) Enable admins or resource owners to create access packages with resources, allowed external organizations, external user expiration, and access policies. Publish access packages to enable external user self-service sign-up for resource access.

+- [**Azure portal.**](../external-identities/add-users-administrator.md) End users with the [Guest Inviter role](../external-identities/external-collaboration-settings-configure.md) can sign in to the Azure portal and invite external users from the **Users** menu in Azure AD.

+- [**Programmatic (PowerShell, Graph API).**](../external-identities/customize-invitation-api.md) End users with the [Guest Inviter role](../external-identities/external-collaboration-settings-configure.md) can use PowerShell or Graph API to invite external users.

+### Redeeming invitations

+When you provision accounts to access a resource, email invitations go to the invited user's email address.

+When an invited user receives an invitation, they can follow the link contained in the email to the redemption URL. In doing so, the invited user can approve or deny the invitation and, if necessary, create an external user account.

+Invited users can also try to directly access the resource, referred to as just-in-time (JIT) redemption, if either of the following scenarios are true.

+- The invited user already has an Azure AD or Microsoft account, or

+- Admins have enabled [email one-time passcodes](../external-identities/one-time-passcode.md).

+During JIT redemption, the following considerations may apply.

+- If administrators haven't [suppressed consent prompts](../external-identities/cross-tenant-access-settings-b2b-collaboration.md), the user must consent before accessing the resource.

+- PowerShell allows control over whether an email is sent when [using PowerShell](https://microsoft-my.sharepoint.com/powershell/module/azuread/new-azureadmsinvitation?view=azureadps-2.0&preserve-view=true) to invite users.

+- You can allow or block invitations to external users from specific organizations by using an [allowlist or a blocklist](../external-identities/allow-deny-list.md).

+### Enabling one-time passcode authentication

+In scenarios where you allow for ad hoc B2B, enable [email one-time passcode authentication](../external-identities/one-time-passcode.md). This feature authenticates external users when you can't authenticate them through other means, such as:

+- Azure AD.

+- Microsoft account (MSA).

+- Gmail account through Google Federation.

+- Account from a SAML/WS-Fed IDP through Direct Federation.

+With one-time passcode authentication, there's no need to create a Microsoft account. When the external user redeems an invitation or accesses a shared resource, they receive a temporary code at their email address. They then enter the code to continue signing in.

+### Managing accounts

+In the end user-initiated scenario, the resource tenant administrator manages external user accounts in the resource tenant (not updated based on the updated values in the home tenant). The only visible attributes received include the email address and display name.

+You can configure more attributes on external user objects to facilitate different scenarios (such as entitlement scenarios). You can include populating the address book with contact details. For example, consider the following attributes.

+- **HiddenFromAddressListsEnabled** [ShowInAddressList]

+- **FirstName** [GivenName]

+- **LastName** [SurName]

+- **Title**

+- **Department**

+- **TelephoneNumber**

+You might set these attributes to add external users to the global address list (GAL) and to people search (such as SharePoint People Picker). Other scenarios may require different attributes (such as setting entitlements and permissions for Access Packages, Dynamic Group Membership, and SAML Claims).

+By default, the GAL hides invited external users. Set external user attributes to be unhidden to include them in the unified GAL. The Microsoft Exchange Online section of [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) describes how you can lessen limits by creating external member users instead of external guest users.

+### Deprovisioning accounts

+End user-initiated scenarios decentralize access decisions, which can create the challenge of deciding when to remove an external user and their associated access. [Entitlement management](../governance/entitlement-management-overview.md) and [access reviews](../governance/manage-guest-access-with-access-reviews.md) let you review and remove existing external users and their resource access.

+When you invite users outside of entitlement management, you must create a separate process to review and manage their access. For example, if you directly invite an external user through SharePoint Online, it isn't in your entitlement management process.

+## Scripted scenario

+In the scripted scenario, resource tenant administrators deploy a scripted pull process to automate discovery and external user provisioning.

+For example, a company acquires a competitor. Each company has a single Azure AD tenant. They want the following Day One scenarios to work without users having to perform any invitation or redemption steps. All users must be able to:

+- Use single sign-on to all provisioned resources.

+- Find each other and resources in a unified GAL.

+- Determine each other's presence and initiate chat.

+- Access applications based on dynamic group membership.

+In this scenario, each organization's tenant is the home tenant for its existing employees while being the resource tenant for the other organization's employees.

+### Provisioning accounts

+With [Delta Query](/graph/delta-query-overview), tenant admins can deploy a scripted pull process to automate discovery and identity provisioning to support resource access. This process checks the home tenant for new users. It uses the B2B Graph APIs to provision new users as external users in the resource tenant as illustrated in the following multi-tenant topology diagram.

+ Diagram Title: Multi-tenant topology diagram. On the left, a box labeled Company A contains internal users and external users. On the right, a box labeled Company B contains internal users and external users. Between Company A and Company B, an interaction goes from Company A to Company B with the label, Script to pull A users to B. Another interaction goes from Company B to Company A with the label, Script to pull B users to A.

+- Tenant administrators prearrange credentials and consent to allow each tenant to read.

+- Tenant administrators automate enumeration and pulling scoped users to the resource tenant.

+- Use Microsoft Graph API with consented permissions to read and provision users with the invitation API.

+- Initial provisioning can read source attributes and apply them to the target user object.

+### Managing accounts

+The resource organization may augment profile data to support sharing scenarios by updating the user's metadata attributes in the resource tenant. However, if ongoing synchronization is necessary, then a synchronized solution might be a better option.

+### Deprovisioning accounts

+[Delta Query](/graph/delta-query-overview) can signal when an external user needs to be deprovisioned. [Entitlement management](../governance/entitlement-management-overview.md) and [access reviews](../governance/manage-guest-access-with-access-reviews.md) can provide a way to review and remove existing external users and their access to resources.

+If you invite users outside of entitlement management, create a separate process to review and manage external user access. For example, if you invite the external user directly through SharePoint Online, it isn't in your entitlement management process.

+## Automated scenario

+Synchronized sharing across tenants is the most complex of the patterns described in this article. This pattern enables more automated management and deprovisioning options than end user-initiated or scripted.

+In automated scenarios, resource tenant admins use an identity provisioning system to automate provisioning and deprovisioning processes. In scenarios within Microsoft's Commercial Cloud instance, we have [cross-tenant synchronization](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/seamless-application-access-and-lifecycle-management-for-multi/ba-p/3728752). In scenarios that span Microsoft Sovereign Cloud instances, you need other approaches because cross-tenant synchronization doesn't yet support cross-cloud.

+For example, within a Microsoft Commercial Cloud instance, a multi-national conglomeration has multiple subsidiaries with the following requirements.

+- Each has their own Azure AD tenant and need to work together.

+- In addition to synchronizing new users among tenants, automatically synchronize attribute updates and automate deprovisioning.

+- If an employee is no longer at a subsidiary, remove their account from all other tenants during the next synchronization.

+In an expanded, cross-cloud scenario, a Defense Industrial Base (DIB) contractor has a defense-based and commercial-based subsidiary. These have competing regulation requirements:

+- The US defense business resides in a US Sovereign Cloud tenant such as Microsoft 365 US Government GCC High and Azure Government.

+- The commercial business resides in a separate Azure AD tenant in Commercial such as an Azure AD environment running on the global Azure cloud.

+To act like a single company deployed into a cross-cloud architecture, all users synchronize to both tenants. This approach enables unified GAL availability across both tenants and may ensure that users automatically synchronized to both tenants include entitlements and restrictions to applications and content. Example requirements include:

+- US employees may have ubiquitous access to both tenants.

+- Non-US employees show in the unified GAL of both tenants but don't have access to protected content in the GCC High tenant.

+This scenario requires automatic synchronization and identity management to configure users in both tenants while associating them with the proper entitlement and data protection policies.

+[Cross-cloud B2B](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/collaborate-securely-across-organizational-boundaries-and/ba-p/3094109) requires you to configure [Cross-Tenant Access Settings](../external-identities/cross-cloud-settings.md) for each organization with which you want to collaborate in the remote cloud instance.

+### Provisioning accounts

+This section describes three techniques for automating account provisioning in the automated scenario.

+#### Technique 1: Use the [built-in cross-tenant synchronization capability in Azure AD](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/seamless-application-access-and-lifecycle-management-for-multi/ba-p/3728752)

+This approach only works when all tenants that you need to synchronize are in the same cloud instance (such as Commercial to Commercial).

+#### Technique 2: Provision accounts with Microsoft Identity Manager

+Use an external Identity and Access Management (IAM) solution such as [Microsoft Identity Manager](https://microsoft.sharepoint-df.com/microsoft-identity-manager/microsoft-identity-manager-2016) (MIM) as a synchronization engine.

+This advanced deployment uses MIM as a synchronization engine. MIM calls the [Microsoft Graph API](https://developer.microsoft.com/graph) and [Exchange Online PowerShell](/powershell/exchange/exchange-online/exchange-online-powershell?view=exchange-ps&preserve-view=true). Alternative implementations can include the cloud-hosted [Active Directory Synchronization Service](/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) (ADSS) managed service offering from [Microsoft Industry Solutions](https://www.microsoft.com/industrysolutions). There are non-Microsoft offerings that you can create from scratch with other IAM offerings (such as SailPoint, Omada, and OKTA).

+You perform a cloud-to-cloud synchronization of identity (users, contacts, and groups) from one tenant to another as illustrated in the following diagram.

+ Diagram Title: Cloud-to-cloud identity synchronization. On the left, a box labeled Company A contains internal users and external users. On the right, a box labeled Company B contains internal users and external users. Between Company A and Company B, sync engine interactions go from Company A to Company B and from Company B to Company A.

+Considerations that are outside the scope of this article include integration of on-premises applications.

+#### Technique 3: Provision accounts with Azure AD Connect

+This technique only applies for complex organizations that manage all identity in traditional Windows Server-based Active Directory Domain Services (AD DS). The approach uses Azure AD Connect as the synchronization engine as illustrated in the following diagram.

+ Diagram Title: Provision accounts with Azure AD Connect. The diagram shows four main components. A box on the left represents the Customer. A cloud shape on the right represents B2B Conversion. At the top center, a box containing a cloud shape represents Microsoft Commercial Cloud. At the bottom center, a box containing a cloud shape represents Microsoft US Government Sovereign Cloud. Inside the Customer box, a Windows Server Active Directory icon connects to two boxes, each with an Azure AD Connect label. The connections are dashed red lines with arrows at both ends and a refresh icon. Inside the Microsoft Commercial Cloud shape is another cloud shape that represents Microsoft Azure Commercial. Inside is another cloud shape that represents Azure Active Directory. To the right of the Microsoft Azure Commercial cloud shape is a box that represents Office 365 with a label, Public Multi-Tenant. A solid red line with arrows at both ends connects the Office 365 box with the Microsoft Azure Commercial cloud shape and a label, Hybrid Workloads. Two dashed lines connect from the Office 365 box to the Azure Active Directory cloud shape. One has an arrow on the end that connects to Azure Active Directory. The other has arrows on both ends. A dashed line with arrows on both ends connects the Azure Active Directory cloud shape to the top Customer Azure AD Connect box. A dashed line with arrows on both ends connects the Microsoft Commercial Cloud shape to the B2B Conversion cloud shape. Inside the Microsoft US Government Sovereign Cloud box is another cloud shape that represents Microsoft Azure Government. Inside is another cloud shape that represents Azure Active Directory. To the right of the Microsoft Azure Commercial cloud shape is a box that represents Office 365 with a label, US Gov GCC-High L4. A solid red line with arrows at both ends connects the Office 365 box with the Microsoft Azure Government cloud shape and a label, Hybrid Workloads. Two dashed lines connect from the Office 365 box to the Azure Active Directory cloud shape. One has an arrow on the end that connects to Azure Active Directory. The other has arrows on both ends. A dashed line with arrows on both ends connects the Azure Active Directory cloud shape to the bottom Customer Azure AD Connect box. A dashed line with arrows on both ends connects the Microsoft Commercial Cloud shape to the B2B Conversion cloud shape.

+Unlike the MIM technique, all identity sources (users, contacts, and groups) come from traditional Windows Server-based Active Directory Domain Services (AD DS). The AD DS directory is typically an on-premises deployment for a complex organization that manages identity for multiple tenants. Cloud-only identity isn't in scope for this technique. All identity must be in AD DS to include them in scope for synchronization.

+Conceptually, this technique synchronizes a user into a home tenant as an internal member user (default behavior). Alternatively, it may synchronize a user into a resource tenant as an external user (customized behavior).

+Microsoft supports this dual sync user technique with careful considerations to what modifications occur in the Azure AD Connect configuration. For example, if you make modifications to the wizard-driven setup configuration, you need to document the changes if you must rebuild the configuration during a support incident.

+Out of the box, Azure AD Connect can't synchronize an external user. You must augment it with an external process (such as a PowerShell script) to convert the users from internal to external accounts.

+Benefits of this technique include Azure AD Connect synchronizing identity with attributes stored in AD DS. Synchronization may include address book attributes, manager attributes, group memberships, and other hybrid identity attributes into all tenants within scope. It deprovisions identity in alignment with AD DS. It doesn't require a more complex IAM solution to manage the cloud identity for this specific task.

+There's a one-to-one relationship of Azure AD Connect per tenant. Each tenant has its own configuration of Azure AD Connect that you can individually alter to support member and/or external user account synchronization.

+### Choosing the right topology

+Most customers use one of the following topologies in automated scenarios.

+- A mesh topology enables sharing of all resources in all tenants. You create users from other tenants in each resource tenant as external users.

+- A single resource tenant topology uses a single tenant (the resource tenant), in which users from other tenants are external users.

+Reference the following table as a decision tree while you design your solution. Following the table, diagrams illustrate both topologies to help you determine which is right for your organization.

+#### Comparison of mesh versus single resource tenant topologies

+| Consideration | Mesh topology | Single resource tenant |

+| Each company has separate Azure AD tenant with users and resources | Yes | Yes |

+| **Resource location and collaboration** | | |

+| Shared apps and other resources remain in their current home tenant | Yes | No. You can share only apps and other resources in the resource tenant. You can't share apps and other resources remaining in other tenants. |

+| All viewable in individual company's GALs (Unified GAL) | Yes| No |

+| **Resource access and administration** | | |

+| You can share ALL applications connected to Azure AD among all companies. | Yes | No. Only applications in the resource tenant are shared. You can't share applications remaining in other tenants. |

+| Global resource administration | Continue at tenant level. | Consolidated in the resource tenant. |

+| Licensing: Office 365 SharePoint Online, unified GAL, Teams access all support guests; however, other Exchange Online scenarios don't. | Continues at tenant level. | Continues at tenant level. |

+| Licensing: [Azure AD (premium)](../external-identities/external-identities-pricing.md) | First 50 K Monthly Active Users are free (per tenant). | First 50 K Monthly Active Users are free. |

+| Licensing: SaaS apps | Remain in individual tenants, may require licenses per user per tenant. | All shared resources reside in the single resource tenant. You can investigate consolidating licenses to the single tenant if appropriate. |

+The following diagram illustrates mesh topology.

+ Diagram Title: Mesh topology. On the top left, a box labeled Company A contains internal users and external users. On the top right, a box labeled Company B contains internal users and external users. On the bottom left, a box labeled Company C contains internal users and external users. On the bottom right, a box labeled Company D contains internal users and external users. Between Company A and Company B and between Company C and Company D, sync engine interactions go between the companies on the left and the companies on the right.

+In a mesh topology, every user in each home tenant synchronizes to each of the other tenants, which become resource tenants.

+- You can share any resource within a tenant with external users.

+- Each organization can see all users in the conglomerate. In the above diagram, there are four unified GALs, each of which contains the home users and the external users from the other three tenants.

+[Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides information on provisioning, managing, and deprovisioning users in this scenario.

+#### Mesh topology for cross-cloud

+You can use the mesh topology in as few as two tenants, such as in the scenario for a DIB defense contractor straddling a cross-sovereign cloud solution. As with the mesh topology, each user in each home tenant synchronizes to the other tenant, which becomes a resource tenant. In the [Technique 3 section](#technique-3-provision-accounts-with-azure-ad-connect) diagram, the public Commercial tenant internal user synchronizes to the US sovereign GCC High tenant as an external user account. At the same time, the GCC High internal user synchronizes to Commercial as an external user account.

+The diagram also illustrates data storage locations. Data categorization and compliance is outside the scope of this article, but you can include entitlements and restrictions to applications and content. Content may include locations where an internal user's user-owned data resides (such as data stored in an Exchange Online mailbox or OneDrive for Business). The content may be in their home tenant and not in the resource tenant. Shared data may reside in either tenant. You can restrict access to the content through access control and conditional access policies.

+The following diagram illustrates single resource tenant topology.

+ Diagram Title: Single resource tenant topology. At the top, a box that represents Company A contains three boxes. On the left, a box represents all shared resources. In the middle, a box represents internal users. On the right, a box represents external users. Below the Company A box is a box that represents the sync engine. Three arrows connect the sync engine to Company A. Below the sync engine box, at the bottom of the diagram, are three boxes that represent Company B, Company C, and Company D. An arrow connects each of them to the sync engine box. Inside each of the bottom company boxes is a label, Microsoft Graph API Exchange online PowerShell, and icons that represent internal users.

+In a single resource tenant topology, users and their attributes synchronize to the resource tenant (Company A in the above diagram).

+- All resources shared among the member organizations must reside in the single resource tenant. If multiple subsidiaries have subscriptions to the same SaaS apps, there's an opportunity to consolidate those subscriptions.

+- Only the GAL in the resource tenant displays users from all companies.

+### Managing accounts

+This solution detects and syncs attribute changes from source tenant users to resource tenant external users. You can use these attributes to make authorization decisions (such as when you're using dynamic groups).

+### Deprovisioning accounts

+Automation detects object deletion in the source environment and deletes the associated external user object in the target environment.

+[Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides additional information on provisioning, managing, and deprovisioning users in this scenario.

+- [Multi-tenant user management introduction](multi-tenant-user-management-introduction.md) is the first in the series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments.

+- [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.

+- [Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.

+Inactive accounts are user accounts that aren't required anymore by members of your organization to gain access to your resources. One key identifier for inactive accounts is that they haven't been used *for a while* to sign in to your environment. Because inactive accounts are tied to the sign-in activity, you can use the timestamp of the last time an account attempted to sign in to detect inactive accounts.

+The last sign-in provides potential insights into a user's continued need for access to resources. It can help with determining if group membership or app access is still needed or could be removed. For external user management, you can understand if an external user is still active within the tenant or should be cleaned up.

+You can detect inactive accounts by evaluating the `lastSignInDateTime` property exposed by the `signInActivity` resource type of the **Microsoft Graph API**. The `lastSignInDateTime` property shows the last time a user attempted to make an interactive sign-in attempt in Azure AD. Using this property, you can implement a solution for the following scenarios:

+- Each interactive sign-in attempt results in an update of the underlying data store. Typically, sign-ins show up in the related sign-in report within 6 hours.

+- To generate a `lastSignInDateTime` timestamp, you an attempted sign-in. The value of the `lastSignInDateTime` property may be blank if:

+ - The last attempted sign-in of a user took place before April 2020.

+ - The affected user account was never used for a sign-in attempt.

+* [A IDEO tenant](https://www.saasworthy.com/product/shape-space/pricing)

+ Title: Improve reliability of your business-critical applications using Azure Advisor.

+description: Use Azure Advisor to evaluate the reliability posture of your business-critical applications, assess risks and plan improvements.

+# Improve the reliability of your business-critical applications using Azure Advisor

+Azure Advisor helps you assess and improve the reliability of your business-critical applications.

+## Reliability recommendations

+You can get reliability recommendations on the **Reliability** tab on the Advisor dashboard.

+1. Sign in to the [**Azure portal**](https://portal.azure.com).

+1. Search for and select [**Advisor**](https://aka.ms/azureadvisordashboard) from any page.

+1. On the **Advisor** dashboard, select the **Reliability** tab.

+## Reliability workbook

+You can evaluate the reliability of posture of your applications, assess risks and plan improvements using the new Reliability workbook template, which is available in Azure Advisor.

+1. Sign in to the [**Azure portal**](https://portal.azure.com).

+1. Search for and select [**Advisor**](https://aka.ms/azureadvisordashboard) from any page.

+1. Select **Workbooks** item in the left menu.

+1. Open **Reliability** workbook template.

+## Next steps

+For more information about Advisor recommendations, see:

+* [Reliability recommendations](advisor-reference-reliability-recommendations.md)

+* [Introduction to Advisor](advisor-overview.md)

+* [Get started with Advisor](advisor-get-started.md)

+ Title: Azure Kubernetes Service (AKS) Diagnose and Solve Problems Overview

+# Azure Kubernetes Service Diagnose and Solve Problems overview

+Troubleshooting Azure Kubernetes Service (AKS) cluster issues plays an important role in maintaining your cluster, especially if your cluster is running mission-critical workloads. AKS Diagnose and Solve Problems is an intelligent, self-diagnostic experience that:

+* Helps you identify and resolve problems in your cluster.

+* Requires no extra configuration or billing cost.

+

+## Open AKS Diagnose and Solve Problems

+To access AKS Diagnose and Solve Problems:

+1. Navigate to your Kubernetes cluster in the [Azure portal](https://portal.azure.com).

+2. Click on **Diagnose and solve problems** in the left navigation, which opens AKS Diagnose and Solve Problems.

+3. Choose a category that best describes the issue of your cluster by:

+ * Referring the keywords in each tile description on the homepage.

+ * Typing a keyword that best describes your issue in the search bar.

+

+To initiate the tool and retrieve the results in a seamless manner, click on the tile to troubleshoot. The left navigation pane has an _Overview_ option which runs all the diagnostics in that particular category. The issues that are found with the cluster will be displayed on the right panel. To obtain a comprehensive understanding of the issue, click on View details for each tile, which will provide a detailed description of:

+* Issue summary

+* Error details

+Based on the outcome, you may follow the detailed instructions or peruse the documentation links to effectively resolve the issue at hand.

+**Example scenario 1**: I observed that my application is getting disconnected or experiencing intermittent connection issues. In response, I click **Connectivity Issues** tile to investigate the potential causes.

+

+I received a diagnostic alert indicating that the disconnection may be related to my *Cluster DNS*. To gather more information, I clicked on *View details*.

+

+Based on the diagnostic result, it appears that the issue may be related to known DNS issues or VNET configuration. Thankfully, I can use the documentation links provided to address the issue and resolve the problem.

+

+Furthermore, if the recommended documentation based on the diagnostic results does not resolve the issue, you can return to the previous step in Diagnostics and refer to additional documentation.

+

+## Use AKS Diagnose and Solve Problems for Best Practices

+Deploying applications on AKS requires adherence to best practices to guarantee optimal performance, availability, and security. To this end, the AKS Diagnose and Solve Problems **Best Practices** tile provides an array of best practices that can assist in managing various aspects such as VM resource provisioning, cluster upgrades, scaling operations, subnet configuration, and other essential aspects of a cluster's configuration. Leveraging the AKS Diagnose and Solve Problems can be vital in ensuring that your cluster adheres to best practices and that any potential issues are identified and resolved in a timely and effective manner. By incorporating AKS Diagnose and Solve Problems into your operational practices, you can be confident in the reliability and security of your application in production.

+**Example Scenario 2**: My cluster seems to be in good health. All nodes are ready, and my application runs without any issues. However, I am curious about the best practices I can follow to prevent potential problems. So, I click on the **Best Practices** tile. After reviewing the recommendations, I discovered that even though my cluster appears healthy at the moment, there are still some things I can do to avoid latency, throttling or VM uptime issues in the future.

+

+

+A persistent volume represents a piece of storage that has been provisioned for use with Kubernetes pods. A persistent volume can be used by one or many pods, and can be dynamically or statically provisioned. If multiple pods need concurrent access to the same storage volume, you can use Azure Files to connect using the [Server Message Block (SMB) protocol][smb-overview]. This article shows you how to dynamically create an Azure file share for use by multiple pods in an Azure Kubernetes Service (AKS) cluster.

+For Azure Files CSI driver parameters, see [CSI driver parameters][CSI driver parameters].

+## Azure Files CSI driver new features

+In addition to the original in-tree driver features, Azure Files CSI driver supports the following new features:

+A storage class is used to define how an Azure file share is created. A storage account is automatically created in the [node resource group][node-resource-group] for use with the storage class to hold the Azure files share. Choose one of the following [Azure storage redundancy SKUs][storage-skus] for *skuName*:

+When you use storage CSI drivers on AKS, there are two more built-in `StorageClasses` that uses the Azure Files CSI storage drivers. The other CSI storage classes are created with the cluster alongside the in-tree default storage classes.

+- `azurefile-csi`: Uses Azure Standard Storage to create an Azure file share.

+- `azurefile-csi-premium`: Uses Azure Premium Storage to create an Azure file share.

+The reclaim policy on both storage classes ensures that the underlying Azure files share is deleted when the respective PV is deleted. The storage classes also configure the file shares to be expandable, you just need to edit the [persistent volume claim][persistent-volume-claim-overview] (PVC) with the new size.

+To use these storage classes, create a PVC and respective pod that references and uses them. A PVC is used to automatically provision storage based on a storage class. A PVC can use one of the pre-created storage classes or a user-defined storage class to create an Azure files share for the desired SKU and size. When you create a pod definition, the PVC is specified to request the desired storage.

+The Azure Files CSI driver supports creating [snapshots of persistent volumes](https://kubernetes-csi.github.io/docs/snapshot-restore-feature.html) and the underlying file shares.

+The Azure Files CSI driver also supports Windows nodes and containers. To use Windows containers, follow the [Windows containers quickstart](./learn/quick-windows-container-deploy-cli.md) to add a Windows node pool.

+ * `tenantID`, `clientID`, and `clientSecret` from an [App Registration][azure-ad-app-registration] in Azure Active Directory (AD) with sufficient permissions for the Azure NetApp Files service. The App Registration includes the `Owner` or `Contributor` role that's predefined by Azure.

+ The output of the command resembles the following example:

+Traditional volumes are created as Kubernetes resources backed by Azure Storage. You can manually create data volumes to be assigned to pods directly, or have Kubernetes automatically create them. Data volumes can use: [Azure Disk][disks-types], [Azure Files][storage-files-planning], [Azure NetApp Files][azure-netapp-files-service-levels], or [Azure Blobs][storage-account-overview].

+> Depending on the VM SKU that's being used, the Azure Disk CSI driver might have a per-node volume limit. For some powerful VMs (for example, 16 cores), the limit is 64 volumes per node. To identify the limit per VM SKU, review the **Max data disks** column for each VM SKU offered. For a list of VM SKUs offered and their corresponding detailed capacity limits, see [General purpose virtual machine sizes][general-purpose-machine-sizes].

+To help determine best fit for your workload between Azure Files and Azure NetApp Files, review the information provided in the article [Azure Files and Azure NetApp Files comparison][azure-files-azure-netapp-comparison].

+### Azure Disk

+Use [Azure Disk][azure-disk-csi] to create a Kubernetes *DataDisk* resource. Disks types include:

+Because Azure Disk are mounted as *ReadWriteOnce*, they're only available to a single node. For storage volumes that can be accessed by pods on multiple nodes simultaneously, use Azure Files.

+You can use [Azure Disk](azure-csi-disk-storage-provision.md) or [Azure Files](azure-csi-files-storage-provision.md) to provide the PersistentVolume. As noted in the [Volumes](#volumes) section, the choice of Disks or Files is often determined by the need for concurrent access to the data or the performance tier.

+A PersistentVolume can be *statically* created by a cluster administrator, or *dynamically* created by the Kubernetes API server. If a pod is scheduled and requests currently unavailable storage, Kubernetes can create the underlying Azure Disk or File storage and attach it to the pod. Dynamic provisioning uses a *StorageClass* to identify what type of Azure storage needs to be created.

+| `azurefile-csi` | Uses Azure Standard storage to create an Azure file share. The reclaim policy ensures that the underlying Azure file share is deleted when the persistent volume that used it is deleted. |

+| `azurefile-csi-premium` | Uses Azure Premium storage to create an Azure file share. The reclaim policy ensures that the underlying Azure file share is deleted when the persistent volume that used it is deleted.|

+- [Enable Container Storage Interface (CSI) drivers for Azure Disk, Azure Files, and Azure Blob storage on Azure Kubernetes Service][csi-storage-drivers]

+- [Use Azure Disk CSI driver in Azure Kubernetes Service][azure-disk-csi]

+[azure-files-azure-netapp-comparison]: ../storage/files/storage-files-netapp-comparison.md

+> Alias minor version requires Azure CLI version 2.37 or above as well as API version 20220401 or above. Use `az upgrade` to install the latest version of the CLI.

+ Title: Use a managed identity in Azure Kubernetes Service (AKS)

+description: Learn how to use a system-assigned or user-assigned managed identity in Azure Kubernetes Service (AKS).

+# Use a managed identity in Azure Kubernetes Service (AKS)

+Azure Kubernetes Service (AKS) clusters require an identity to access Azure resources like load balancers and managed disks. This identity can be a *managed identity* or *service principal*. A system-assigned managed identity is automatically created when you create an AKS cluster. This identity is managed by the Azure platform and doesn't require you to provision or rotate any secrets. For more information about managed identities in Azure AD, see [Managed identities for Azure resources][managed-identity-resources-overview].

+AKS doesn't automatically create a [service principal](kubernetes-service-principal.md), so you have to create one. Clusters that use a service principal eventually expire, and the service principal must be renewed to keep the cluster working. Managing service principals adds complexity, so it's easier to use managed identities instead. The same permission requirements apply for both service principals and managed identities. Managed identities use certificate-based authentication. Each managed identity's credentials have an expiration of *90 days* and are rolled after *45 days*. AKS uses both system-assigned and user-assigned managed identity types, and these identities are immutable.

+> [!NOTE]

+> If you're considering implementing [Azure AD pod-managed identity][aad-pod-identity] on your AKS cluster, we recommend you first review the [Azure AD workload identity overview][workload-identity-overview]. This authentication method replaces Azure AD pod-managed identity (preview) and is the recommended method.

+## Before you begin

+Make sure you have Azure CLI version 2.23.0 or later installed. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].

+* Tenants moving or migrating a managed identity-enabled cluster isn't supported.

+* If the cluster has Azure AD pod-managed identity (`aad-pod-identity`) enabled, Node-Managed Identity (NMI) pods modify the iptables of the nodes to intercept calls to the Azure Instance Metadata (IMDS) endpoint. This configuration means any request made to the Metadata endpoint is intercepted by NMI, even if the pod doesn't use `aad-pod-identity`. AzurePodIdentityException CRD can be configured to inform `aad-pod-identity` of any requests to the Metadata endpoint originating from a pod that matches labels defined in CRD should be proxied without any processing in NMI. The system pods with `kubernetes.azure.com/managedby: aks` label in *kube-system* namespace should be excluded in `aad-pod-identity` by configuring the AzurePodIdentityException CRD.

+ * For more information, see [Disable aad-pod-identity for a specific pod or application](https://azure.github.io/aad-pod-identity/docs/configure/application_exception).

+ * To configure an exception, install the [mic-exception YAML](https://github.com/Azure/aad-pod-identity/blob/master/deploy/infra/mic-exception.yaml).

+* AKS doesn't support the use of a system-assigned managed identity if using a custom private DNS zone.

+| Control plane | AKS Cluster Name | Used by AKS control plane components to manage cluster resources including ingress load balancers and AKS-managed public IPs, Cluster Autoscaler, Azure Disk & File CSI drivers. | Contributor role for Node resource group | Supported

+| Kubelet | AKS Cluster Name-agentpool | Authentication with Azure Container Registry (ACR). | N/A (for kubernetes v1.15+) | Supported

+| Add-on | AzureNPM | No identity required. | N/A | No

+| Add-on | AzureCNI network monitoring | No identity required. | N/A | No

+| Add-on | azure-policy (gatekeeper) | No identity required. | N/A | No

+| Add-on | azure-policy | No identity required. | N/A | No

+| Add-on | Calico | No identity required. | N/A | No

+| Add-on | Dashboard | No identity required. | N/A | No

+| Add-on | HTTPApplicationRouting | Manages required network resources. | Reader role for node resource group, contributor role for DNS zone | No

+| Add-on | Ingress application gateway | Manages required network resources. | Contributor role for node resource group | No

+| Add-on | omsagent | Used to send AKS metrics to Azure Monitor. | Monitoring Metrics Publisher role | No

+| Add-on | Virtual-Node (ACIConnector) | Manages required network resources for Azure Container Instances (ACI). | Contributor role for node resource group | No

+| OSS project | aad-pod-identity | Enables applications to access cloud resources securely with Microsoft Azure Active Directory (Azure AD). | N/A | Steps to grant permission at [Azure AD Pod Identity Role Assignment configuration](https://azure.github.io/aad-pod-identity/docs/getting-started/role-assignment/).

+## Enable managed identities on a new AKS cluster

+> AKS creates a system-assigned kubelet identity in the node resource group if you don't [specify your own kubelet managed identity][Use a pre-created kubelet managed identity].

+1. Create an Azure resource group using the [`az group create`][az-group-create] command.

+ ```azurecli-interactive

+ az group create --name myResourceGroup --location westus2

+ ```

+2. Create an AKS cluster using the [`az aks create`][az-aks-create] command.

+ ```azurecli-interactive

+ az aks create -g myResourceGroup -n myManagedCluster --enable-managed-identity

+ ```

+3. Get credentials to access the cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.

+ ```azurecli-interactive

+ az aks get-credentials --resource-group myResourceGroup --name myManagedCluster

+ ```

+## Enable managed identities on an existing AKS cluster

+* Update an existing AKS cluster currently using a service principal to work with a system-assigned managed identity using the [`az aks update`][az-aks-update] command.

+ ```azurecli-interactive

+ az aks update -g myResourceGroup -n myManagedCluster --enable-managed-identity

+ ```

+After updating your cluster, the control plane and pods use the managed identity. kubelet continues using a service principal until you upgrade your agentpool. You can use the `az aks nodepool upgrade --node-image-only` command on your nodes to update to a managed identity. A node pool upgrade causes downtime for your AKS cluster as the nodes in the node pools are cordoned/drained and reimaged.

+> * Keep the following information in mind when updating your cluster:

+> * An update only works if there's a VHD update to consume. If you're running the latest VHD, you need to wait until the next VHD is available in order to perform the update.

+> * The Azure CLI ensures your addon's permission is correctly set after migrating. If you're not using the Azure CLI to perform the migrating operation, you need to handle the addon identity's permission by yourself. For an example using an Azure Resource Manager (ARM) template, see [Assign Azure roles using ARM templates](../role-based-access-control/role-assignments-template.md).

+>

+> * If your cluster was using `--attach-acr` to pull from images from Azure Container Registry, you need to run the `az aks update --attach-acr <ACR resource ID>` command after updating your cluster to let the newly-created kubelet used for managed identity get the permission to pull from ACR. Otherwise, you won't be able to pull from ACR after the update.

+When you create and use your own VNet, attached Azure disk, static IP address, route table, or user-assigned kubelet identity where the resources are outside of the worker node resource group, the Azure CLI adds the role assignment automatically. If you're using an ARM template or another method, you need to use the Principal ID of the cluster managed identity to perform a role assignment.

+If you're not using the Azure CLI, but you're using your own VNet, attached Azure disk, static IP address, route table, or user-assigned kubelet identity that's outside of the worker node resource group, we recommend using [user-assigned control plane identity][Bring your own control plane managed identity]. For system-assigned control plane identity, we can't get the identity ID before creating cluster, which delays the role assignment from taking effect.

+### Get the principal ID of control plane identity

+* Get the existing identity's principal ID using the [`az identity show`][az-identity-show] command.

+ ```azurecli-interactive

+ az identity show --ids <identity-resource-id>

+ ```

+ Your output should resemble the following example output:

+ ```output

+ {

+ "clientId": "<client-id>",

+ "id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity",

+ "location": "eastus",

+ "name": "myIdentity",

+ "principalId": "<principal-id>",

+ "resourceGroup": "myResourceGroup",

+ "tags": {},

+ "tenantId": "<tenant-id>",

+ "type": "Microsoft.ManagedIdentity/userAssignedIdentities"

+ }

+ ```

+For a VNet, attached Azure disk, static IP address, or route table outside the default worker node resource group, you need to assign the `Contributor` role on the custom resource group.

+* Assign the `Contributor` role on the custom resource group using the [`az role assignment create`][az-role-assignment-create] command.

+ ```azurecli-interactive

+ az role assignment create --assignee <control-plane-identity-principal-id> --role "Contributor" --scope "<custom-resource-group-resource-id>"

+ ```

+For a user-assigned kubelet identity outside the default worker node resource group, you need to assign the `Managed Identity Operator` role on the kubelet identity.

+* Assign the `Managed Identity Operator` role on the kubelet identity using the [`az role assignment create`][az-role-assignment-create] command.

+ ```azurecli-interactive

+ az role assignment create --assignee <kubelet-identity-principal-id> --role "Managed Identity Operator" --scope "<kubelet-identity-resource-id>"

+ ```

+> It may take up to 60 minutes for the permissions granted to your cluster's managed identity to populate.

+A custom control plane managed identity enables access to the existing identity prior to cluster creation. This feature enables scenarios such as using a custom VNet or outboundType of UDR with a pre-created managed identity.

+>

+> USDOD Central, USDOD East, and USGov Iowa regions in Azure US Government cloud aren't supported.

+>

+> AKS creates a system-assigned kubelet identity in the node resource group if you don't [specify your own kubelet managed identity][Use a pre-created kubelet managed identity].

+* If you don't have a managed identity, create one using the [`az identity create`][az-identity-create] command.

+ ```azurecli-interactive

+ az identity create --name myIdentity --resource-group myResourceGroup

+ ```

+ Your output should resemble the following example output:

+ ```output

+ {

+ "clientId": "<client-id>",

+ "clientSecretUrl": "<clientSecretUrl>",

+ "id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity",

+ "location": "westus2",

+ "name": "myIdentity",

+ "principalId": "<principal-id>",

+ "resourceGroup": "myResourceGroup",

+ "tags": {},

+ "tenantId": "<tenant-id>",

+ "type": "Microsoft.ManagedIdentity/userAssignedIdentities"

+ }

+ ```

+* Before creating the cluster, [add the role assignment for control plane identity][add role assignment for control plane identity] using the [`az aks create`][az-aks-create] command.

+ ```azurecli-interactive

+ az aks create \

+ --resource-group myResourceGroup \

+ --name myManagedCluster \

+ --network-plugin azure \

+ --vnet-subnet-id <subnet-id> \

+ --docker-bridge-address 172.17.0.1/16 \

+ --dns-service-ip 10.2.0.10 \

+ --service-cidr 10.2.0.0/24 \

+ --enable-managed-identity \

+ --assign-identity <identity-resource-id>

+ ```

+A kubelet identity enables access to the existing identity prior to cluster creation. This feature enables scenarios such as connection to ACR with a pre-created managed identity.

+Make sure you have Azure CLI version 2.26.0 or later installed. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].

+### Pre-created kubelet identity limitations

+* The China East and China North regions in Azure China 21Vianet aren't supported.

+#### Control plane managed identity

+* If you don't have a control plane managed identity, create one using the [`az identity create`][az-identity-create].

+ ```azurecli-interactive

+ az identity create --name myIdentity --resource-group myResourceGroup

+ ```

+ Your output should resemble the following example output:

+ ```output

+ {

+ "clientId": "<client-id>",

+ "clientSecretUrl": "<clientSecretUrl>",

+ "id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity",

+ "location": "westus2",

+ "name": "myIdentity",

+ "principalId": "<principal-id>",

+ "resourceGroup": "myResourceGroup",

+ "tags": {},

+ "tenantId": "<tenant-id>",

+ "type": "Microsoft.ManagedIdentity/userAssignedIdentities"

+ ```

+#### kubelet managed identity

+* If you don't have a kubelet managed identity, create one using the [`az identity create`][az-identity-create] command.

+ ```azurecli-interactive

+ az identity create --name myKubeletIdentity --resource-group myResourceGroup

+ ```

+ Your output should resemble the following example output:

+ ```output

+ {

+ "clientSecretUrl": "<clientSecretUrl>",

+ "id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity",

+ "location": "westus2",

+ "name": "myKubeletIdentity",

+ "principalId": "<principal-id>",

+ "resourceGroup": "myResourceGroup",

+ "tags": {},

+ "tenantId": "<tenant-id>",

+ "type": "Microsoft.ManagedIdentity/userAssignedIdentities"

+ ```

+### Create a cluster using user-assigned kubelet identity

+Now you can create your AKS cluster with your existing identities. Make sure to provide the control plane identity resource ID via `assign-identity` and the kubelet managed identity via `assign-kubelet-identity`.

+* Create an AKS cluster with your existing identities using the [`az aks create`][az-aks-create] command.

+ ```azurecli-interactive

+ az aks create \

+ --resource-group myResourceGroup \

+ --name myManagedCluster \

+ --network-plugin azure \

+ --vnet-subnet-id <subnet-id> \

+ --docker-bridge-address 172.17.0.1/16 \

+ --dns-service-ip 10.2.0.10 \

+ --service-cidr 10.2.0.0/24 \

+ --enable-managed-identity \

+ --assign-identity <identity-resource-id> \

+ --assign-kubelet-identity <kubelet-identity-resource-id>

+ ```

+ A successful AKS cluster creation using your own kubelet managed identity should resemble the following example output:

+ ```output

+ "identity": {

+ "principalId": null,

+ "tenantId": null,

+ "type": "UserAssigned",

+ "userAssignedIdentities": {

+ "/subscriptions/<subscriptionid>/resourcegroups/resourcegroups/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity": {

+ "clientId": "<client-id>",

+ "principalId": "<principal-id>"

+ }

+ }

+ },

+ "identityProfile": {

+ "kubeletidentity": {

+ "clientId": "<client-id>",

+ "objectId": "<object-id>",

+ "resourceId": "/subscriptions/<subscriptionid>/resourcegroups/resourcegroups/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity"

+ }

+ },

+ ```

+### Update an existing cluster using kubelet identity

+> Updating kubelet managed identity upgrades node pools, which causes downtime for your AKS cluster as the nodes in the node pools will be cordoned/drained and reimaged.

+> If your cluster was using `--attach-acr` to pull from images from Azure Container Registry, you need to run the `az aks update --attach-acr <ACR Resource ID>` command after updating your cluster to let the newly-created kubelet used for managed identity get the permission to pull from ACR. Otherwise, you won't be able to pull from ACR after the upgrade.

+#### Make sure your CLI version is updated

+1. Check your CLI version using the [`az version`][az-version] command.

+ ```azurecli-interactive

+ az version

+ ```

+2. Upgrade your CLI version using the [`az upgrade`][az-upgrade] command.

+ ```azurecli-interactive

+ az upgrade

+ ```

+1. Confirm your AKS cluster is using the user-assigned control plane identity using the [`az aks show`][az-aks-show] command.

+ ```azurecli-interactive

+ az aks show -g <RGName> -n <ClusterName> --query "servicePrincipalProfile"

+ ```

+ If your cluster is using a managed identity, the output shows `clientId` with a value of **msi**. A cluster using a service principal shows an object ID. For example:

+ ```output

+ {

+ "clientId": "msi"

+ }

+ ```

+2. After confirming your cluster is using a managed identity, find the control plane identity's resource ID using the [`az aks show`][az-aks-show] command.

+ ```azurecli-interactive

+ az aks show -g <RGName> -n <ClusterName> --query "identity"

+ ```

+ For a user-assigned control plane identity, your output should look similar to the following example output:

+ ```output

+ {

+ "principalId": null,

+ "tenantId": null,

+ "type": "UserAssigned",

+ "userAssignedIdentities": <identity-resource-id>

+ "clientId": "<client-id>",

+ "principalId": "<principal-id>"

+ },

+ ```

+#### Update your cluster with kubelet identity

+1. If you don't have a kubelet managed identity, create one using the [`az identity create`][az-identity-create] command.

+ ```azurecli-interactive

+ az identity create --name myKubeletIdentity --resource-group myResourceGroup

+ ```

+ Your output should resemble the following example output:

+ ```output

+ {

+ "clientSecretUrl": "<clientSecretUrl>",

+ "id": "/subscriptions/<subscriptionid>/resourcegroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity",

+ "location": "westus2",

+ "name": "myKubeletIdentity",

+ "principalId": "<principal-id>",

+ "resourceGroup": "myResourceGroup",

+ "tags": {},

+ "tenantId": "<tenant-id>",

+ "type": "Microsoft.ManagedIdentity/userAssignedIdentities"

+ ```

+2. Update your cluster with your existing identities using the [`az aks update`][az-aks-update] command. Make sure you provide the control plane identity resource ID for `assign-identity` and the kubelet managed identity for `assign-kubelet-identity`.

+ ```azurecli-interactive

+ az aks update \

+ --resource-group myResourceGroup \

+ --name myManagedCluster \

+ --enable-managed-identity \

+ --assign-identity <identity-resource-id> \

+ --assign-kubelet-identity <kubelet-identity-resource-id>

+ ```

+ Your output for a successful cluster update using your own kubelet managed identity should resemble the following example output:

+ ```output

+ "identity": {

+ "principalId": null,

+ "tenantId": null,

+ "type": "UserAssigned",

+ "userAssignedIdentities": {

+ "/subscriptions/<subscriptionid>/resourcegroups/resourcegroups/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity": {

+ "clientId": "<client-id>",

+ "principalId": "<principal-id>"

+ }

+ }

+ },

+ "identityProfile": {

+ "kubeletidentity": {

+ "clientId": "<client-id>",

+ "objectId": "<object-id>",

+ "resourceId": "/subscriptions/<subscriptionid>/resourcegroups/resourcegroups/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myKubeletIdentity"

+ }

+ },

+ ```

+Use [Azure Resource Manager templates][aks-arm-template] to create a managed identity-enabled cluster.

+[az-identity-show]: /cli/azure/identity#az_identity_show

+[az-group-create]: /cli/azure/group#az_group_create

+[az-aks-create]: /cli/azure/aks#az_aks_create

+[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials

+[az-aks-update]: /cli/azure/aks#az_aks_update

+[az-aks-show]: /cli/azure/aks#az_aks_show

+[az-role-assignment-create]: /cli/azure/role/assignment#az_role_assignment_create

+[az-version]: /cli/azure/reference-index#az_version

+[az-upgrade]: /cli/azure/reference-index#az_upgrade

+ Title: Enable Premium SSD v2 Disk support on Azure Kubernetes Service (AKS)

+description: Learn how to enable and configure Premium SSD v2 Disks in an Azure Kubernetes Service (AKS) cluster.

+# Use Azure Premium SSD v2 disks on Azure Kubernetes Service

+[Azure Premium SSD v2 disks][azure-premium-v2-disk-overview] offer IO-intense enterprise workloads, a consistent submillisecond disk latency, and high IOPS and throughput. The performance (capacity, throughput, and IOPS) of Premium SSD v2 disks can be independently configured at any time, making it easier for more scenarios to be cost efficient while meeting performance needs.

+This article describes how to configure a new or existing AKS cluster to use Azure Premium SSD v2 disks.

+## Before you begin

+Before creating or upgrading an AKS cluster that is able to use Azure Premium SSD v2 disks, you need to create an AKS cluster in the same region and availability zone that supports Premium Storage and attach the disks following the steps below.

+For an existing AKS cluster, you can enable Premium SSD v2 disks by adding a new node pool to your cluster, and then attach the disks following the steps below.

+> [!IMPORTANT]

+> Azure Premium SSD v2 disks require node pools deployed in regions that support these disks. For a list of supported regions, see [Premium SSD v2 disk supported regions][premium-v2-regions].

+### Limitations

+- Azure Premium SSD v2 disks have certain limitations that you need to be aware of. For a complete list, see [Premium SSD v2 limitations][premium-v2-limitations].

+## Use Premium SSD v2 disks dynamically with a storage class

+To use Premium SSD v2 disks in a deployment or stateful set, you can use a [storage class for dynamic provisioning][azure-disk-volume].

+### Create the storage class

+A storage class is used to define how a unit of storage is dynamically created with a persistent volume. For more information on Kubernetes storage classes, see [Kubernetes Storage Classes][kubernetes-storage-classes].

+In this example, you create a storage class that references Premium SSD v2 disks. Create a file named `azure-pv2-disk-sc.yaml`, and copy in the following manifest.

+```yaml

+apiVersion: storage.k8s.io/v1

+kind: StorageClass

+metadata:

+ name: premium2-disk-sc

+parameters:

+ cachingMode: None

+ skuName: PremiumV2_LRS

+ DiskIOPSReadWrite: "4000"

+ DiskMBpsReadWrite: "1000"

+provisioner: disk.csi.azure.com

+reclaimPolicy: Delete

+volumeBindingMode: Immediate

+allowVolumeExpansion: true

+```

+Create the storage class with the [kubectl apply][kubectl-apply] command and specify your *azure-pv2-disk-sc.yaml* file:

+```bash

+kubectl apply -f azure-pv2-disk-sc.yaml

+```

+The output from the command resembles the following example:

+```console

+storageclass.storage.k8s.io/premium2-disk-sc created

+```

+## Create a persistent volume claim

+A persistent volume claim (PVC) is used to automatically provision storage based on a storage class. In this case, a PVC can use the previously created storage class to create an ultra disk.

+Create a file named `azure-pv2-disk-pvc.yaml`, and copy in the following manifest. The claim requests a disk named `premium2-disk` that is *1000 GB* in size with *ReadWriteOnce* access. The *premium2-disk-sc* storage class is specified as the storage class.

+```yaml

+apiVersion: v1

+kind: PersistentVolumeClaim

+metadata:

+ name: premium2-disk

+spec:

+ accessModes:

+ - ReadWriteOnce

+ storageClassName: premium2-disk-sc

+ resources:

+ requests:

+ storage: 1000Gi

+```

+Create the persistent volume claim with the [kubectl apply][kubectl-apply] command and specify your *azure-pv2-disk-pvc.yaml* file:

+```bash

+kubectl apply -f azure-pv2-disk-pvc.yaml

+```

+The output from the command resembles the following example:

+```console

+persistentvolumeclaim/premium2-disk created

+```

+## Use the persistent volume

+Once the persistent volume claim has been created and the disk successfully provisioned, a pod can be created with access to the disk. The following manifest creates a basic NGINX pod that uses the persistent volume claim named *premium2-disk* to mount the Azure disk at the path `/mnt/azure`.

+Create a file named `nginx-premium2.yaml`, and copy in the following manifest.

+```yaml

+kind: Pod

+apiVersion: v1

+metadata:

+ name: nginx-premium2

+spec:

+ containers:

+ - name: nginx-premium2

+ image: mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine

+ resources:

+ requests:

+ cpu: 100m

+ memory: 128Mi

+ limits:

+ cpu: 250m

+ memory: 256Mi

+ volumeMounts:

+ - mountPath: "/mnt/azure"

+ name: volume

+ volumes:

+ - name: volume

+ persistentVolumeClaim:

+ claimName: premium2-disk

+```

+Create the pod with the [kubectl apply][kubectl-apply] command, as shown in the following example:

+```bash

+kubectl apply -f nginx-premium2.yaml

+```

+The output from the command resembles the following example:

+```bash

+pod/nginx-premium2 created

+```

+You now have a running pod with your Azure disk mounted in the `/mnt/azure` directory. This configuration can be seen when inspecting your pod via `kubectl describe pod nginx-premium2`, as shown in the following condensed example:

+```bash

+kubectl describe pod nginx-premium2

+[...]

+Volumes:

+ volume:

+ Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)

+ ClaimName: premium2-disk

+ ReadOnly: false

+ kube-api-access-sh59b:

+ Type: Projected (a volume that contains injected data from multiple sources)

+ TokenExpirationSeconds: 3607

+ ConfigMapName: kube-root-ca.crt

+ ConfigMapOptional: <nil>

+ DownwardAPI: true

+QoS Class: Burstable

+Node-Selectors: <none>

+Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists

+ node.kubernetes.io/not-ready:NoExecute op=Exists for 300s

+ node.kubernetes.io/unreachable:NoExecute op=Exists for 300s

+Events:

+ Type Reason Age From Message

+ - - - -

+ Normal Scheduled 7m58s default-scheduler Successfully assigned default/nginx-premium2 to aks-agentpool-12254644-vmss000006

+ Normal SuccessfulAttachVolume 7m46s attachdetach-controller AttachVolume.Attach succeeded for volume "pvc-ff39fb64-1189-4c52-9a24-e065b855b886"

+ Normal Pulling 7m39s kubelet Pulling image "mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine"

+ Normal Pulled 7m38s kubelet Successfully pulled image "mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine" in 1.192915667s

+ Normal Created 7m38s kubelet Created container nginx-premium2

+ Normal Started 7m38s kubelet Started container nginx-premium2

+[...]

+```

+## Set IOPS and throughput limits

+Input/Output Operations Per Second (IOPS) and throughput limits for Azure Premium v2 SSD disk is currently not supported through AKS. To adjust performance, you can use the Azure CLI command [az disk update][az-disk-update] and including the `--disk-iops-read-write` and `--disk-mbps-read-write` parameters.

+The following example updates the disk IOPS read/write to **5000** and Mbps to **200**. For `--resource-group`, the value must be the second resource group automatically created to store the AKS worker nodes with the naming convention *MC_resourcegroupname_clustername_location*. For more information, see [Why are two resource groups created with AKS?][aks-two-resource-groups].

+The value for the `--name` parameter is the name of the volume created using the StorageClass, and it starts with `pvc-`. To identify the disk name, you can run `kubectl get pvc` or navigate to the secondary resource group in the portal to find it. See [manage resources from the Azure portal][manage-resources-azure-portal] to learn more.

+```azurecli

+az disk update --subscription subscriptionName --resource-group myResourceGroup --name diskName --disk-iops-read-write=5000 --disk-mbps-read-write=200

+```

+## Next steps

+- For more about Premium SSD v2 disks, see [Using Azure Premium SSD v2 disks](../virtual-machines/disks-deploy-premium-v2.md).

+- For more about storage best practices, see [Best practices for storage and backups in Azure Kubernetes Service (AKS)][operator-best-practices-storage].

+<!-- LINKS - external -->

+[kubectl-apply]: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#apply

+[kubernetes-storage-classes]: https://kubernetes.io/docs/concepts/storage/storage-classes/

+<!-- LINKS - internal -->

+[azure-premium-v2-disk-overview]: ../virtual-machines/disks-types.md#premium-ssd-v2

+[premium-v2-regions]: ../virtual-machines/disks-types.md#regional-availability

+[premium-v2-limitations]: ../virtual-machines/disks-types.md#premium-ssd-v2-limitations

+[azure-disk-volume]: azure-disk-csi.md

+[use-tags]: use-tags.md

+[operator-best-practices-storage]: operator-best-practices-storage.md

+[az-disk-update]: /cli/azure/disk#az-disk-update

+[manage-resources-azure-portal]: ../azure-resource-manager/management/manage-resources-portal.md#open-resources

+[aks-two-resource-groups]: faq.md#why-are-two-resource-groups-created-with-aks

+[Azure ultra disks][ultra-disk-overview] offer high throughput, high IOPS, and consistent low latency disk storage for your stateful applications. One major benefit of ultra disks is the ability to dynamically change the performance of the SSD along with your workloads without the need to restart your agent nodes. Ultra disks are suited for data-intensive workloads.

+This article describes how to configure a new or existing AKS cluster to use Azure ultra disks.

+## Before you begin

+This feature can only be set at cluster creation or when creating a node pool.

+- Azure ultra disks require node pools deployed in availability zones and regions that support these disks, and are only supported by specific VM series. Review the corresponding table under the [Ultra disk limitations][ultra-disk-limitations] section for more information.

+- Ultra disks can't be used with some features and functionality, such as availability sets or Azure Disk Encryption. Review the [Ultra disk limitations][ultra-disk-limitations] for the latest information.

+Create an AKS cluster that is able to leverage Azure ultra Disks by using the following CLI commands. Use the `--enable-ultra-ssd` parameter to set the `EnableUltraSSD` feature.

+```azurecli-interactive

+az aks create -g MyResourceGroup -n myAKSCluster -l westus2 --node-vm-size Standard_D2s_v3 --zones 1 2 --node-count 2 --enable-ultra-ssd

+```

+If you want to create a cluster without ultra disk support, you can do so by omitting the `--enable-ultra-ssd` parameter.

+You can enable ultra disks on an existing cluster by adding a new node pool to your cluster that support ultra disks. Configure a new node pool to use ultra disks by using the `--enable-ultra-ssd` parameter with the [`az aks nodepool add`][az-aks-nodepool-add] command.

+If you want to create new node pools without support for ultra disks, you can do so by excluding the `--enable-ultra-ssd` parameter.

+A storage class is used to define how a unit of storage is dynamically created with a persistent volume. For more information on Kubernetes storage classes, see [Kubernetes storage classes][kubernetes-storage-classes]. In this example, we'll create a storage class that references ultra disks.

+ ```bash

+ ```bash

+ ```bash

+[ultra-disk-overview]: ../virtual-machines/disks-types.md#ultra-disks

+[ultra-disk-limitations]: ../virtual-machines/disks-types.md#ultra-disk-limitations

+Back up and restore are supported in **Basic**, **Standard**, **Premium**, and **Isolated** tiers. For **Basic** tier, only the production slot can be backed up and restored. For more information about scaling your App Service plan to use a higher tier, see [Scale up an app in Azure](manage-scale-up.md).

+## Automatic vs. custom backups

+ To back up the linked databases, select **Next: Advanced** > **Include database**, and select the databases to backup.

+You cannot stop automatic backup. The automatic backup is stored on the platform and has no effect on the underlying app instance or its storage.

+## Upstream SSL certificate does not match

+### Cause

+The TLS certificate installed in the backend server(s), does not match the hostname received in the Host request header.

+In scenarios where End-to-end TLS is enabled, a configuration that is achieved by editing the appropiate "Backend HTTP Settings", and changing there the configuration of the "Backend protocol" setting to HTTPS, it is mandatory to ensure that the CNAME of the TLS certificate installed in the backend servers matches the hostname coming to the backend in the HTTP host header request.

+As a reminder, the effect of enabling on the "Backend HTTP Settings" the option of protocol HTTPS rather than HTTP, will be that the second part of the communication that happens between the instances of the Application Gateway and the backend servers will be encrypted with TLS.

+Due to the fact that by default Application Gateway sends the same HTTP host header to the backend as it receives from the client, you will need to ensure that the TLS certificate installed on the backend server, is issued with a CNAME that matches the host name received by that backend server in the HTTP host header.

+Remember that, unless specified otherwise, this hostname would be the same as the one received from the client.

+For example:

+Imagine that you have an Application Gateway to serve the https requests for domain www.contoso.com

+You could have the domain contoso.com delegated to an Azure DNS Public Zone, and a A DNS record in that zone pointing www.contoso.com to the public IP of the specific Application Gateway that is going to serve the requests.

+On that Application Gateway you should have a listener for the host www.contoso.com with a rule that has the "Backed HTTP Setting" forced to use protocol HTTPS (ensuring End-to-end TLS). That same rule could have configured a backend pool with two VMs running IIS as Web servers.

+As we know enabling HTTPS in the "Backed HTTP Setting" of the rule will make the second part of the communication that happens between the Application Gateway instances and the servers in the backend to use TLS.

+If the backend servers do not have a TLS certificate issued for the CNAME www.contoso.com or *.contoso.com, the request will fail with **Server Error: 502 - Web server received an invalid response while acting as a gateway or proxy server** because the upstream SSL certificate (the certificate installed in the backend servers) will not match the hostname in the host header, and hence the TLS negotiation will fail.

+www.contoso.com --> APP GW front end IP --> Listener with a rule that configures "Backend HTTP Settings" to use protocol HTTP --> Backend Pool --> Web server (needs to have a TLS certificate installed for www.contoso.com)

+## Solution

+it is required that the CNAME of the TLS certificate installed in the backend server, matches the host name configured in the HTTP backend settings, otherwise the second part of the End-to-end communication that happens between the instances of the Application Gateway and the backend, will fail with "Upstream SSL certificate does not match", and will throw back a **Server Error: 502 - Web server received an invalid response while acting as a gateway or proxy server**

+* **Granularity**: The interval between consecutive data points in your time series data. Currently Metrics Advisor supports: Yearly, Monthly, Weekly, Daily, Hourly, per minute, and Custom. The lowest interval the customization option supports is 60 seconds.

+In the following example, the [Get-AzVM](/powershell/module/az.compute/get-azvm) cmdlet has three parameter sets. The example uses one set called **ListLocationVirtualMachinesParamSet**, with a single optional parameter, to return the location for the virtual machines to be listed. The example also uses the **GetVirtualMachineInResourceGroupParamSet** parameter set for specifying the virtual machine to return. This set has two mandatory parameters and one optional parameter.

+1. ```bash

+1. ```bash

+```bash

+ sudo cat /opt/microsoft/omsconfig/modules/nxOMSAutomationWorker/VERSION

+```

+- Red Hat, CentOS, Oracle:

+```bash

+ sudo yum install -y python2

+```

+- Ubuntu, Debian:

+

+```bash

+ sudo apt-get udpate

+ sudo apt-get install -y python2

+```

+- SUSE:

+

+```bash

+ sudo zypper install -y python2

+```

+- Red Hat, CentOS, Oracle:

+```bash

+ sudo yum install -y python3

+```

+- Ubuntu, Debian:

+```bash

+ sudo apt-get update

+ sudo apt-get install -y python3

+```

+- SUSE:

+

+```bash

+ sudo zypper install -y python3

+```

+ ```

+ ```bash

+You can use Azure CLI to create a new Hybrid Worker group, create a new Azure VM, add it to an existing Hybrid Worker Group and install the Hybrid Worker extension. Learn more aboutΓÇ»[Azure CLI](/cli/azure/what-is-azure-cli).

+- To create, delete, and manage extension-based Hybrid Runbook Worker groups, see [az automation hrwg | Microsoft Docs](/cli/azure/automation/hrwg?view=azure-cli-latest&preserve-view=true)

+- To create, delete, and manage extension-based Hybrid Runbook Worker, see [az automation hrwg hrw | Microsoft Docs](/cli/azure/automation/hrwg/hrw?view=azure-cli-latest&preserve-view=true)

+After creating new Hybrid Runbook Worker, you must install the extension on the Hybrid Worker using [az vm extension set](/cli/azure/vm/extension?view=azure-cli-latest#az-vm-extension-set&preserve-view=true).

+1. ```bash

+1. ```bash

+rpm -e <package name>

+- If you want to add the configuration back and recompile, see [Compile DSC configurations in Azure Automation State Configuration](../automation-dsc-compile.md).

+### Scenario: Job failed to start as the Hybrid Worker was not available when the scheduled job started

+#### Issue

+Job fails to start on a Hybrid Worker and you see the following error:

+*Failed to start, as hybrid worker was not available when scheduled job started, the hybrid worker was last active at mm/dd/yyyy*.

+#### Cause

+This error can occur due to the following reasons:

+- The machines doesn't exist anymore.

+- The machine is turned off and is unreachable.

+- The machine has a network connectivity issue.

+- The Hybrid Runbook Worker extension has been uninstalled from the machine.

+#### Resolution

+- Ensure that the machine exists, and Hybrid Runbook Worker extension is installed on it. The Hybrid Worker should be healthy and should give a heartbeat. Troubleshoot any network issues by checking the Microsoft-SMA event logs on the Workers in the Hybrid Runbook Worker Group that tried to run this job.

+- You can also monitor [HybridWorkerPing](../../azure-monitor/essentials/metrics-supported.md#microsoftautomationautomationaccounts) metric that provides the number of pings from a Hybrid Worker and can help to check ping-related issues.

+### Scenario: Job was suspended as it exceeded the job limit for a Hybrid Worker

+#### Issue

+Job gets suspended with the following error message:

+*Job was suspended as it exceeded the job limit for a Hybrid Worker. Add more Hybrid Workers to the Hybrid Worker group to overcome this issue.*

+#### Cause

+Jobs might get suspended due to any of the following reasons:

+- Each active Hybrid Worker in the group will poll for jobs every 30 seconds to see if any jobs are available. The Worker picks jobs on a first-come, first-serve basis. Depending on when a job was pushed, whichever Hybrid Worker within the Hybrid Worker Group pings the Automation service first picks up the job. A single hybrid worker can generally pick up four jobs per ping (that is, every 30 seconds). If your rate of pushing jobs is higher than four per 30 seconds and no other Worker picks up the job, the job might get suspended.

+- Hybrid Worker might not be polling as expected every 30 seconds. This could happen if the Worker is not healthy or there are network issues.

+#### Resolution

+- If the job limit for a Hybrid Worker exceeds four jobs per 30 seconds, you can add more Hybrid Workers to the Hybrid Worker group for high availability and load balancing. You can also schedule jobs so they do not exceed the limit of four jobs per 30 seconds. The processing time of the jobs queue depends on the Hybrid worker hardware profile and load. Ensure that the Hybrid Worker is healthy and gives a heartbeat.

+- Troubleshoot any network issues by checking the Microsoft-SMA event logs on the Workers in the Hybrid Runbook Worker Group that tried to run this job.

+- You can also monitor the [HybridWorkerPing](../../azure-monitor/essentials/metrics-supported.md#microsoftautomationautomationaccounts) metric that provides the number of pings from a Hybrid Worker and can help to check ping-related issues.

+### Scenario: Job failed to start as the Hybrid Worker was not available when the scheduled job started

+#### Issue

+Job fails to start on a Hybrid Worker and you see the following error:

+*Failed to start, as hybrid worker was not available when scheduled job started, the hybrid worker was last active at mm/dd/yyyy*.

+#### Cause

+This error can occur due to the following reasons:

+- The machines doesn't exist anymore.

+- The machine is turned off and is unreachable.

+- The machine has a network connectivity issue.

+- The Hybrid Runbook Worker extension has been uninstalled from the machine.

+#### Resolution

+- Ensure that the machine exists, and Hybrid Runbook Worker extension is installed on it. The Hybrid Worker should be healthy and should give a heartbeat. Troubleshoot any network issues by checking the Microsoft-SMA event logs on the Workers in the Hybrid Runbook Worker Group that tried to run this job.

+- You can also monitor [HybridWorkerPing](../../azure-monitor/essentials/metrics-supported.md#microsoftautomationautomationaccounts) metric that provides the number of pings from a Hybrid Worker and can help to check ping-related issues.

+### Scenario: Job was suspended as it exceeded the job limit for a Hybrid Worker

+#### Issue

+Job gets suspended with the following error message:

+*Job was suspended as it exceeded the job limit for a Hybrid Worker. Add more Hybrid Workers to the Hybrid Worker group to overcome this issue.*

+#### Cause

+Jobs might get suspended due to any of the following reasons:

+- Each active Hybrid Worker in the group will poll for jobs every 30 seconds to see if any jobs are available. The Worker picks jobs on a first-come, first-serve basis. Depending on when a job was pushed, whichever Hybrid Worker within the Hybrid Worker Group pings the Automation service first picks up the job. A single hybrid worker can generally pick up four jobs per ping (that is, every 30 seconds). If your rate of pushing jobs is higher than four per 30 seconds and no other Worker picks up the job, the job might get suspended.

+- Hybrid Worker might not be polling as expected every 30 seconds. This could happen if the Worker is not healthy or there are network issues.

+#### Resolution

+- If the job limit for a Hybrid Worker exceeds four jobs per 30 seconds, you can add more Hybrid Workers to the Hybrid Worker group for high availability and load balancing. You can also schedule jobs so they do not exceed the limit of four jobs per 30 seconds. The processing time of the jobs queue depends on the Hybrid worker hardware profile and load. Ensure that the Hybrid Worker is healthy and gives a heartbeat.

+- Troubleshoot any network issues by checking the Microsoft-SMA event logs on the Workers in the Hybrid Runbook Worker Group that tried to run this job.

+- You can also monitor the [HybridWorkerPing](../../azure-monitor/essentials/metrics-supported.md#microsoftautomationautomationaccounts) metric that provides the number of pings from a Hybrid Worker and can help to check ping-related issues.

+```output

+ ```bash

+```bash

+```bash

+```bash

+```bash

+```bash

+```bash

+```output

+```bash

+```bash

+```bash

+```bash

+## Console applications

+In this section, you will create a console application and load data from your App Configuration store.

+### Connect to App Configuration

+### Run the application

+ #### [Windows command prompt](#tab/windowscommandprompt)

+ #### [PowerShell](#tab/powershell)

+ #### [macOS](#tab/unix)

+ #### [Linux](#tab/linux)

+ #### [Windows command prompt](#tab/windowscommandprompt)

+ #### [PowerShell](#tab/powershell)

+ #### [macOS](#tab/unix)

+ #### [Linux](#tab/linux)

+## Web applications

+The App Configuration provider loads data into a `Mapping` object, accessible as a dictionary, which can be used in combination with the existing configuration of various Python frameworks. This section shows how to use the App Configuration provider in popular web frameworks like Flask and Django.

+### [Flask](#tab/flask)

+You can use Azure App Configuration in your existing Flask web apps by updating its in-built configuration. You can do this by passing your App Configuration provider object to the `update` function of your Flask app instance in `app.py`:

+```python

+azure_app_config = load(connection_string=os.environ.get("AZURE_APPCONFIG_CONNECTION_STRING"))

+# NOTE: This will override all existing configuration settings with the same key name.

+app.config.update(azure_app_config)

+# Access a configuration setting directly from within Flask configuration

+message = app.config.get("message")

+```

+### [Django](#tab/django)

+You can use Azure App Configuration in your existing Django web apps by adding the following lines of code into your `settings.py` file

+```python

+CONFIG = load(connection_string=os.environ.get("AZURE_APPCONFIG_CONNECTION_STRING"))

+```

+To access individual configuration settings in the Django views, you can reference them from the provider object created in Django settings. For example, in `views.py`:

+```python

+# Import Django settings

+from django.conf import settings

+# Access a configuration setting from Django settings instance.

+MESSAGE = settings.CONFIG.get("message")

+```

+Full code samples on how to use Azure App Configuration in Python web applications can be found in the [Azure App Configuration](https://github.com/Azure/AppConfiguration/tree/main/examples/Python) GitHub repo.

+- [ReadWriteMany (RWX) capable storage class](../../aks/concepts-storage.md#azure-disk) is required for backups, for both General Purpose and Business Critical service tiers. Specifying a non-ReadWriteMany storage class will cause the SQL Managed Instance to be stuck in "Pending" status during deployment.

+> Currently, Azure Arc-enabled Kubernetes cluster extensions aren't supported on ARM64-based clusters, except for [Flux (GitOps)](conceptual-gitops-flux2.md). To [install and use other cluster extensions](extensions.md), the cluster must have at least one node of operating system and architecture type `linux/amd64`.

+The most recent version of the Flux v2 extension (`microsoft.flux`) and the two previous versions (N-2) are supported. We generally recommend that you use the [most recent version](extensions-release.md#flux-gitops) of the extension.

+Starting with [`microsoft.flux` version 1.7.0](extensions-release.md#170-march-2023), ARM64-based clusters are supported.

+* An existing Azure Arc-enabled Kubernetes connected cluster, with at least one node of operating system and architecture type `linux/amd64`. If deploying [Flux (GitOps)](extensions-release.md#flux-gitops), you can use an ARM64-based cluster without a `linux/amd64` node.

+> Currently, Azure Arc-enabled Kubernetes [cluster extensions](conceptual-extensions.md) aren't supported on ARM64-based clusters, except for [Flux (GitOps)](conceptual-gitops-flux2.md). To [install and use other cluster extensions](extensions.md), the cluster must have at least one node of operating system and architecture type `linux/amd64`.

+* An Azure Arc-enabled Kubernetes connected cluster that's up and running. Starting with [`microsoft.flux` version 1.7.0](extensions-release.md#170-march-2023), ARM64-based clusters are supported.

+* An Azure Arc-enabled Kubernetes connected cluster that's up and running. Starting with [`microsoft.flux` version 1.7.0](extensions-release.md#170-march-2023), ARM64-based clusters are supported.

+ az storage account create --name <STORAGE_NAME> --location <REGION> --resource-group AzureFunctionsQuickstart-rg --sku Standard_LRS

+ az functionapp create --resource-group AzureFunctionsQuickstart-rg --consumption-plan-location westeurope --runtime python --runtime-version 3.9 --functions-version 4 --name <APP_NAME> --os-type linux --storage-account <STORAGE_NAME>

+[Search API]: /rest/api/maps/search

+ You can send Windows event and Syslog data sources to Azure Monitor Logs only. You can send performance counters to both Azure Monitor Metrics and Azure Monitor Logs. At this time, hybrid compute (Arc for Server) resources **do not** support the Azure Monitor Metrics (Preview) destination.

+In this example we have copied the `applicationinsights-agent-3.4.12.jar` and `applicationinsights.json` files from an `agent` folder (you can choose any folder of your machine). These two files have to be in the same folder in the Docker container.

+ Title: Migrate from System Center Operations Manager (SCOM) to Azure Monitor

+description: Guidance for existing users of System Center Operations Manager (SCOM) to transition monitoring of workloads to Azure Monitor as part of a transition to the cloud.

+# Migrate from System Center Operations Manager (SCOM) to Azure Monitor

+This article provides guidance for customers who currently use [System Center Operations Manager (SCOM)](/system-center/scom/welcome) and are planning a transition to cloud based monitoring with [Azure Monitor](overview.md) as they migrate business applications and other resources into Azure.

+There's no standard process for migrating from SCOM, and you may rely on SCOM management packs for an extended time as opposed to performing a quick migration. This article describes the different options available and decision criteria you can use to determine the best strategy for your particular environment.

+## Hybrid cloud monitoring

+Most customers use a [hybrid cloud monitoring](/azure/cloud-adoption-framework/manage/monitor/cloud-models-monitor-overview#hybrid-cloud-monitoring) strategy that allows you to make a gradual transition to the cloud. This approach allows you to maintain your existing business processes as you become more familiar with the new platform. Only move away from SCOM functionality as you can replace it with Azure Monitor. Multiple monitoring tools add complexity, but it allows you to take advantage of Azure Monitor's ability to monitor next generation cloud workloads while retaining SCOM's ability to monitor server software and workloads.

+Your environment prior to moving any components into Azure is based on virtual and physical machines located on-premises or with a managed service provider. It relies on SCOM to monitor business applications, server software, and other infrastructure components in your environment such as physical servers and networks. You use standard management packs for server software such as IIS, SQL Server, and various vendor software, and you tune those management packs for your specific requirements. You create custom management packs for your business applications and components that can't be monitored with existing management packs, and you also configure SCOM to support your business processes.

+As you move services into the cloud, Azure Monitor starts collecting [platform metrics](essentials/data-platform-metrics.md) and the [activity log](essentials/activity-log.md) for each of your resources. You create [diagnostic settings](essentials/diagnostic-settings.md) to collect [resource logs](essentials/resource-logs.md) so you can interactively analyze all available telemetry using [log queries](logs/log-query-overview.md) and [insights](insights/insights-overview.md).

+During this period of transition, you have two independent monitoring tools. You use insights and workbooks to analyze your cloud telemetry in the Azure portal while still using the Operations console to analyze your data collected by SCOM. Since each system has its own alerting, you need to create action groups in Azure Monitor equivalent to your notification groups in SCOM.

+The following table describes the different features and strategies that are available for a hybrid monitoring environment using SCOM and Azure Monitor.

+| Method | Description |

+|:|:|

+| Dual-homed agents | SCOM uses the Microsoft Management Agent (MMA) which is the same as [Log Analytics agent](agents/log-analytics-agent.md) used by Azure Monitor. You can configure this agent to have a single machine connect to both SCOM and Azure Monitor simultaneously. This configuration does require that your Azure VMs have a connection to your on-premises management servers.<br><br>The [Log Analytics agent](agents/log-analytics-agent.md) has been replaced with the [Azure Monitor agent](agents/agents-overview.md), which provides significant advantages including simpler management and better control over data collection. The two agents can coexist on the same machine allowing you to connect to both Azure Monitor and SCOM. This configuration is a better option than dual-homing the legacy agent because of the significant [advantages of the Azure Monitor agent](agents/agents-overview.md#benefits). |

+| Connected management group | [Connect your SCOM management group to Azure Monitor](agents/om-agents.md) to forward data collected from your SCOM agents to Azure Monitor. This is similar to using dual-homed agents, but doesn't require each agent to be configured to connect to Azure Monitor. This strategy requires the legacy agent, so you can't specify monitoring with data collection rules. You also can't use VM insights unless you connect each VM directly to Azure Monitor. |

+| SCOM Managed instance (preview) | [SCOM managed instance (preview)](vm/scom-managed-instance-overview.md) is a full implementation of SCOM in Azure allowing you to continue running the same management packs that you run in your on-premises SCOM environment. There's no current integration between the data and alerts from SCOM and Azure Monitor, and you continue to use the same Operations console for analyzing your health and alerts.<br><br>SCOM MI is similar to maintaining your existing SCOM environment and dual-homing agents, although you can consolidate your monitoring configuration in Azure and retire your on-premises components such as database and management servers. Agents from Azure VMs can connect to the SCOM managed instance in Azure rather than connecting to management servers in your own data center. |

+| Azure management pack | The [Azure management pack](https://www.microsoft.com/download/details.aspx?id=50013) allows Operations Manager to discover Azure resources and monitor their health based on a particular set of monitoring scenarios. This management pack does require you to perform extra configuration for each resource in Azure. It may be helpful though to provide some visibility of your Azure resources in the Operations Console until you evolve your business processes to focus on Azure Monitor. |

+## Monitor business applications

+You typically require custom management packs to monitor your business applications with SCOM, using agents installed on each virtual machine. Application Insights in Azure Monitor monitors web-based applications whether they're in Azure, other clouds, or on-premises. It can be used for all of your applications whether or not they've been migrated to Azure.

+If your monitoring of a business application is limited to functionality provided by the [.NET app performance template](/system-center/scom/net-application-performance-monitoring-template) in SCOM, then you can most likely migrate to Application Insights with no loss of functionality. In fact, Application Insights includes a significant number of other features including the following:

+- Automatically discover and monitor application components.

+- Collect detailed application usage and performance data such as response time, failure rates, and request rates.

+- Collect browser data such as page views and load performance.

+- Detect exceptions and drill into stack trace and related requests.

+- Perform advanced analysis using features such as [distributed tracing](app/distributed-tracing-telemetry-correlation.md) and [smart detection](alerts/proactive-diagnostics.md).

+- Use [metrics explorer](essentials/metrics-getting-started.md) to interactively analyze performance data.

+- Use [log queries](logs/log-query-overview.md) to interactively analyze collected telemetry together with data collected for Azure services and VM insights.

+There are certain scenarios though where you may need to continue using SCOM in addition to Application Insights until you're able to achieve required functionality. Examples where you may need to continue with SCOM include the following:

+- [Availability tests](/previous-versions/azure/azure-monitor/app/monitor-web-app-availability), which allow you to monitor and alert on the availability and responsiveness of your applications require incoming requests from the IP addresses of web test agents. If your policy doesn't allow such access, you may need to keep using [Web Application Availability Monitors](/system-center/scom/web-application-availability-monitoring-template) in SCOM.

+- In SCOM you can set any polling interval for availability tests, with many customers checking every 60-120 seconds. Application Insights has a minimum polling interval of five minutes, which may be too long for some customers.

+- A significant amount of monitoring in SCOM is performed by collecting events generated by applications and by running scripts on the local agent. These aren't standard options in Application Insights, so you could require custom work to achieve your business requirements. This might include custom alert rules using event data stored in a Log Analytics workspace and scripts launched in a virtual machines guest using [hybrid runbook worker](../automation/automation-hybrid-runbook-worker.md).

+- Depending on the language that your application is written in, you may be limited in the [instrumentation you can use with Application Insights](app/app-insights-overview.md#supported-languages).

+Following the basic strategy in the other sections of this guide, continue to use SCOM for your business applications, but take advantage of additional features provided by Application Insights. As you're able to replace critical functionality with Azure Monitor, you can start to retire your custom management packs.

+## Monitor virtual machines

+Monitoring the software on your virtual machines in a hybrid environment will often use a combination of Azure Monitor and SCOM, depending on the requirements of the workloads running on your VMs. As soon as a virtual machine is created in Azure, [platform metrics](essentials/data-platform-metrics.md) and [activity logs](essentials/activity-log.md) for the VM host automatically start being collected. [Enable recommended alerts](vm/tutorial-monitor-vm-alert-recommended.md) to notify you of common errors for the VM host such as server down and high CPU utilization.

+Enable [VM insights](vm/vminsights-overview.md) to install the Azure Monitor agent and begin collecting common performance data from the client operating system. This may overlap with some data that you're already collecting in SCOM, but it will allow you to start viewing trends over time and monitor your Azure VMs with other cloud resources. You may also choose to enable the [map feature](vm/vminsights-maps.md) which will give you insight into the processes running on your virtual machines and their dependencies on other services.

+Continue to use management packs for functionality that can't be provided by other features in Azure Monitor. This includes management packs for critical server software like IIS, SQL Server, or Exchange. You may also have custom management packs developed for on-premises infrastructure that can't be reached with Azure Monitor. Also continue to use SCOM if it's tightly integrated into your operational processes until you can transition to modernizing your service operations where Azure Monitor and other Azure services can augment or replace.

+> If you enable VM Insights with the Log Analytics agent instead of the Azure Monitor agent, then no additional agent needs to be installed on the VM. Azure Monitor agent is recommended though because of its significant improvements in monitoring the VM in the cloud. The complexity from maintaining multiple agents is offset by the ability to define monitoring in data collection rules which allow you to configure different data collection for different sets of VMs, similar to your strategy for designing management packs.

+### Migrate management pack logic for VM workloads

+There are no migration tools to convert SCOM management packs to Azure Monitor because their logic is fundamentally different than Azure Monitor data collection. Migrating management pack logic will typically focus on analyzing the data collected by SCOM and identifying those monitoring scenarios that can be replicated by Azure Monitor. As you customize Azure Monitor to meet your requirements for different applications and components, then you can start to retire different management packs and legacy agents in SCOM.

+Management packs in SCOM contain rules and monitors that combine collection of data and the resulting alert into a single end-to-end workflow. Data already collected by SCOM is rarely used for alerting. Azure Monitor separates data collection and alerts into separate processes. Alert rules access data from Azure Monitor Logs and Azure Monitor Metrics that has already been collected from agents. Also, rules and monitors are typically narrowly focused on specific data such as a particular event or performance counter. Data collection rules in Azure Monitor are typically more broad collecting multiple sets of events and performance counters in a single DCR.

+See the following content for guidance on creating data collection and alerting for common monitoring scenarios:

+- Data that you need to collect to support alerting, analysis, and visualization. See [Monitor virtual machines with Azure Monitor: Data collection](vm/monitor-virtual-machine-data-collection.md)

+- Alerts rules that analyze the collected data to proactively notify of you of issues. See [Monitor virtual machines with Azure Monitor: Alerts](vm/monitor-virtual-machine-alerts.md)

+Instead of attempting to replicate the entire functionality of a management pack, analyze the critical monitoring that each provides. Decide whether you can replicate those monitoring requirements by using alternate methods. In many cases, you can configure data collection and alert rules in Azure Monitor that replicate enough functionality that you can retire a particular management pack. Management packs can often include hundreds and even thousands of rules and monitors.

+One strategy is to focus on those monitors and rules that triggered alerts in your environment. Refer to [existing reports available in Operations Manager](/system-center/scom/manage-reports-installed-during-setup), such as **Alerts** and **Most Common Alerts**, which can help you identify alerts over time. You can also run the following query on the Operations Database to evaluate the most common recent alerts.

+```sql

+select AlertName, COUNT(AlertName) as 'Total Alerts' from

+Alert.vAlertResolutionState ars

+inner join Alert.vAlertDetail adt on ars.AlertGuid = adt.AlertGuid

+inner join Alert.vAlert alt on ars.AlertGuid = alt.AlertGuid

+group by AlertName

+order by 'Total Alerts' DESC

+```

+Evaluate the output to identify specific alerts for migration. Ignore any alerts that were tuned out or are known to be problematic. Review your management packs to identify any critical alerts of interest that never fired.

+### Synthetic transactions

+Management packs often make use of synthetic transactions that connect to an application or service running on a machine to simulate a user connection or actual user traffic. If the application is available, you can assume that the machine is running properly. [Application Insights availability tests](app/availability-overview.md) in Azure Monitor provides this functionality. It only works for applications that are accessible from the internet. For internal applications, you must open a firewall to allow access from specific Microsoft URLs performing the test. Or you can continue to use your existing management pack.

+ - If the AKS Cluster is using Service Principal, you must upgrade to [Managed Identity](../../aks/use-managed-identity.md#enable-managed-identities-on-an-existing-aks-cluster)

+## Multi-line logging in Container Insights

+Azure Monitor - Container insights now supports multiline logging. With this feature enabled, previously split container logs are stitched together and sent as single entries to the ContainerLogV2 table. Customers are able see container log lines upto to 64 KB (up from the existing 16 KB limit). If the stitched log line is larger than 64 KB, it gets truncated due to Log Analytics limits.

+Additionally, the feature also adds support for .NET and Go stack traces, which appear as single entries instead of being split into multiple entries in ContainerLogV2 table.

+### Pre-requisites

+Customers must enable *ContainerLogV2* for multi-line logging to work. Go here to [enable ContainerLogV2](/containers/container-insights-logging-v2#enable-the-containerlogv2-schema) in Container Insights.

+### How to enable - This is currently a preview feature

+Multi-line logging can be enabled by setting *enable_multiline_logs* flag to ΓÇ£trueΓÇ¥ in [the config map](https://github.com/microsoft/Docker-Provider/blob/ci_prod/kubernetes/container-azm-ms-agentconfig.yaml#L49)

+### Next steps for Multi-line logging

+* Read more about the [ContainerLogV2 schema](https://aka.ms/ContainerLogv2)

+uid: azure_monitor_logs_api_overview

+### [1.4.4](https://www.nuget.org/packages/Microsoft.ApplicationInsights.SnapshotCollector/1.4.4)

+A point release to address user-reported bugs.

+#### Bug fixes

+- Fix [Exception during native component extraction when using a single file application.](https://github.com/microsoft/ApplicationInsights-SnapshotCollector/issues/21)

+#### Changes

+- Lowered PDB scan failure messages from Error to Warning.

+- Update msdia140.dll.

+- Avoid making a service connection if the debugger is disabled via site extension settings.

+- Fix [Hide the IMDS dependency from dependency tracker.](https://github.com/microsoft/ApplicationInsights-SnapshotCollector/issues/17)

+| Connectivity to [Private Endpoints](../private-link/private-endpoint-overview.md) | Yes* | No |

+| Connectivity to [Service Endpoints](../virtual-network/virtual-network-service-endpoints-overview.md) | Yes | No |

+\* Applying Azure network security groups on the private link subnet to Azure Key Vault isn't supported for Azure NetApp Files customer-managed keys. Network security groups don't affect connectivity to Private Link unless Private endpoint network policy is enabled on the subnet. It's recommended to keep this option disabled.

+# Configure Virtual WAN for Azure NetApp Files

+```bash

+ ./readahead.sh show <mount-point>

+```

+```bash

+./readahead.sh set <mount-point> [read-ahead-kb]

+```

+ ```config

+ SUBSYSTEM=="bdi", ACTION=="add", PROGRAM="<absolute_path>/awk -v bdi=$kernel 'BEGIN{ret=1} {if ($4 == bdi) {ret=0}} END{exit ret}' /proc/fs/nfsfs/volumes", ATTR{read_ahead_kb}="15380"

+ ```

+ ```bash

+ sudo udevadm control --reload

+ ```

+## April 2023

+* [Azure Virtual WAN](configure-virtual-wan.md) is now generally available in [all regions](azure-netapp-files-network-topologies.md#supported-regions) that support standard network features

+> If the linked or nested template targets a different resource group, that deployment uses incremental mode. For more information, see [Deployment Scope](./deploy-to-resource-group.md#deployment-scopes).

+Azure Video Indexer is now integrated with Azure Resource Health enabling you to see the health and availability of each of your Azure Video Indexer resource. If needed, Azure Resource Health helps with diagnosing and solving problems. You can also set alerts to be notified whenever your resources are affected. For more information, see [Azure Resource Health overview](../service-health/resource-health-overview.md).

+## Create custom AVS storage policy

+You'll run the `New-AVSStoragePolicy` cmdlet to create or overwrite an existing policy.

+This function creates a new or overwrites an existing vSphere Storage Policy. Non vSAN-Based, vSAN Only, VMEncryption Only, Tag Only based and/or any combination of these policy types are supported.

+> [!NOTE]

+> You cannot modify existing AVS default storage policies.

+> Certain options enabled in storage policies will produce warnings to associated risks.

+1. Select **Run command** > **Packages** > **New-AVSStoragePolicy**.

+1. Provide the required values or change the default values, and then select **Run**.

+ | **Field** | **Value** |

+ | | |

+ | **Overwrite** | Overwrite existing Storage Policy. <ul><li>Default is $false. <li>Passing overwrite true provided will overwrite an existing policy exactly as defined. <li>Those values not passed will be removed or set to default values. </ul></li>|

+ | **NotTags** | Match to datastores that do NOT have these tags. <ul><li>Tags are case sensitive. <li>Comma seperate multiple tags. <li> Example: Tag1,Tag 2,Tag_3 | <ul><li>

+ | **Tags** | Match to datastores that do have these tags. <ul><li> Tags are case sensitive. <li>Comma seperate multiple tags. <li>Example: Tag1,Tag 2,Tag_3 </ul></li>|

+ | **vSANForceProvisioning** | Default is $false. <ul><li> Force provisioning for the policy. <li> Valid values are $true or $false <li>**WARNING** - vSAN Force Provisioned Objects are not covered under Microsoft SLA. Data LOSS and vSAN instability may occur. <li>Recommended value is $false.</ul></li> |

+ | **vSANChecksumDisabled** | Default is $false. <ul><li> Enable or disable checksum for the policy. <li>Valid values are $true or $false. <li> **WARNING** - Disabling checksum may lead to data LOSS and/or corruption. <li> Recommended value is $false.</ul></li> |

+ | **vSANCacheReservation** | Default is 0. <ul><li>Valid values are 0..100. <li>Percentage of cache reservation for the policy.</ul></li> |

+ | **vSANIOLimit** | Default is unset. <ul><li>Valid values are 0..2147483647. <li>IOPS limit for the policy.</ul></li> |

+ | **vSANDiskStripesPerObject** | Default is 1. Valid values are 1..12. <ul><li>The number of HDDs across which each replica of a storage object is striped. <li>A value higher than 1 may result in better performance (for e.g. when flash read cache misses need to get serviced from HDD), but also results in higher use of system resources.</ul></li> |

+ | **vSANObjectSpaceReservation** | Default is 0. Valid values are 0..100. <ul><li>Object Reservation. <li>0=Thin Provision <li>100=Thick Provision</ul></li> |

+ | **VMEncryption** | Default is None. <ul><li> Valid values are None, PreIO, PostIO. <li>PreIO allows VAIO filtering solutions to capture data prior to VM encryption. <li>PostIO allows VAIO filtering solutions to capture data after VM encryption.</ul></li> |

+ | **vSANFailuresToTolerate** | Default is "R1FTT1". <ul><li> Valid values are "None", "R1FTT1", "R1FTT2", "R1FTT3", "R5FTT1", "R6FTT2", "R1FTT3" <li> None = No Data Redundancy<li> R1FTT1 = 1 failure - RAID-1 (Mirroring)<li> R1FTT2 = 2 failures - RAID-1 (Mirroring)<li> R1FTT3 = 3 failures - RAID-1 (Mirroring)<li> R5FTT1 = 1 failure - RAID-5 (Erasure Coding), <li> R6FTT2 = 2 failures - RAID-6 (Erasure Coding) <li> No Data Redundancy options are not covered under Microsoft SLA. </li></ul>|

+ | **vSANSiteDisasterTolerance** | Default is "None". <ul><li> Valid Values are "None", "Dual", "Preferred", "Secondary", "NoneStretch" <li> None = No Site Redundancy (Recommended Option for Non-Stretch Clusters, NOT recommended for Stretch Clusters) <li> Dual = Dual Site Redundancy (Recommended Option for Stretch Clusters) <li> Preferred = No site redundancy - keep data on Preferred (stretched cluster) <li> Secondary = No site redundancy - Keep data on Secondary Site (stretched cluster) <li>NoneStretch = No site redundancy - Not Recommended (https://kb.vmware.com/s/article/88358)<li> Only valid for stretch clusters.</li></ul> |

+ | **Description** | Description of Storage Policy you are creating, free form text. |

+ | **Name** | Name of the storage policy to set. For example, **RAID-FTT-1**. |

+ | **Retain up to** | Retention period of the cmdlet output. The default value is 60. |

+ | **Specify name for execution** | Alphanumeric name, for example, **New-AVSStoragePolicy-Exec1**. |

+ | **Timeout** | The period after which a cmdlet exits if taking too long to finish. |

+1. Check **Notifications** to see the progress.

+## Remove AVS Storage Policy

+You'll run the `Remove-AVSStoragePolicy` cmdlet to specify default storage policy for a cluster,

+1. Select **Run command** > **Packages** > **Remove-AVSStoragePolicy**.

+1. Provide the required values or change the default values, and then select **Run**.

+ | **Field** | **Value** |

+ | | |

+ | **Name** | Name of Storage Policy. Wildcards are not supported and will be stripped. |

+ | **Retain up to** | Retention period of the cmdlet output. The default value is 60. |

+ | **Specify name for execution** | Alphanumeric name, for example, **Remove-AVSStoragePolicy-Exec1**. |

+ | **Timeout** | The period after which a cmdlet exits if taking too long to finish. |

+1. Check **Notifications** to see the progress.

+As MON is an enterprise capability of the NE feature, make sure you've [enabled the VMware HCX Enterprise](/azure/azure-vmware/install-vmware-hcx#hcx-license-edition) through the Azure portal.

+- Backup Extension uses the AKS clusterΓÇÖs Managed System Identity to perform backup operations. So, ASK backup doesn't support AKS clusters using Service Principal. You can [update your AKS cluster to use Managed System Identity](../aks/use-managed-identity.md#enable-managed-identities-on-an-existing-aks-cluster).

+- The Backup Extension uses the AKS cluster's Managed System Identity to perform backup operations. So, AKS clusters using *Service Principal* aren't supported by ASK backup. You can [update your AKS cluster to use Managed System Identity](../aks/use-managed-identity.md#enable-managed-identities-on-an-existing-aks-cluster).

+ az k8s-extension create --name azure-aks-backup --extension-type microsoft.dataprotection.kubernetes --scope cluster --cluster-type managedClusters --cluster-name <aksclustername> --resource-group <aksclusterrg> --release-train stable --configuration-settings blobContainer=<containername> storageAccount=<storageaccountname> storageAccountResourceGroup=<storageaccountrg> storageAccountSubscriptionId=<subscriptionid>

+ -g $myResourceGroup \ 

+ --cluster-name $myAKSCluster 

+ –n <randomRoleBindingName> \ 

+ --source-resource-id <vaultID> \ 

+ --roles Microsoft.DataProtection/backupVaults/backup-operator

+ - `C:\Program Files\Microsoft Azure Backup Server\DPM\MARS\Microsoft Azure Recovery Services Agent\bin\cbengine.exe` as a process.

+ - `C:\Program Files\Microsoft Azure Backup Server\DPM\MARS\Microsoft Azure Recovery Services Agent` as a folder.

+ - Scratch location (if you're not using the standard location).

+ |`*.privatelink.<geo>.backup.windowsazure.com` |Backup |

+ |`*.blob.core.windows.net` |Blob |

+ |`*.queue.core.windows.net` |Queue |

+ |`*.storage.azure.net` |Blob |

+| Azure Storage | `*.blob.core.windows.net` <br><br> `*.queue.core.windows.net` <br><br> `*.blob.storage.azure.net` <br><br> `*.storage.azure.net` |

+| Azure Storage | `*.blob.core.windows.net` <br><br> `*.queue.core.windows.net` <br><br> `*.blob.storage.azure.net` <br><br> `*.storage.azure.net` |

+* This configuration isn't available for the **Basic** SKU. To use this feature, [Upgrade the SKU](upgrade-sku.md) to the Standard SKU tier.

+When connecting to a Linux virtual machine using SSH, you can use both username/password and SSH keys for authentication. The SSH private key must be in a format that begins with `"--BEGIN RSA PRIVATE KEY--"` and ends with `"--END RSA PRIVATE KEY--"`.

+Make sure that you have set up an Azure Bastion host for the virtual network in which the VM resides. For more information, see [Create an Azure Bastion host](./tutorial-create-host-portal.md). Once the Bastion service is provisioned and deployed in your virtual network, you can use it to connect to any VM in this virtual network.

+The connection settings and features that are available depend on the Bastion SKU you're using.

+* To see the available features and settings per SKU tier, see the [SKUs and features](bastion-overview.md#sku) section of the Bastion overview article.

+* To check the SKU tier of your Bastion deployment and upgrade if necessary, see [Upgrade a Bastion SKU](upgrade-sku.md).

+* Reader role on the virtual machine.

+* Reader role on the NIC with private IP of the virtual machine.

+* Reader role on the Azure Bastion resource.

+* Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).

+* Inbound port: Custom value (you'll then need to specify this custom port when you connect to the VM via Azure Bastion). This setting requires the **Standard** SKU tier.

+1. In the [Azure portal](https://portal.azure.com), go to the virtual machine to which you want to connect. On the **Overview** page for the virtual machine, select **Connect**, then select **Bastion** from the dropdown to open the Bastion page.

+ :::image type="content" source="./media/bastion-connect-vm-ssh-linux/bastion.png" alt-text="Screenshot shows the Overview page for a virtual machine." lightbox="./media/bastion-connect-vm-ssh-linux/bastion.png":::

+1. On the **Bastion** page, the settings that you can configure depend on the Bastion [SKU](bastion-overview.md#sku) tier that your bastion host has been configured to use.

+ * If you're using the **Standard** SKU, **Connection Settings** values (ports and protocols) are visible and can be configured.

+ :::image type="content" source="./media/bastion-connect-vm-ssh-linux/bastion-connect-full.png" alt-text="Screenshot shows connection settings for the Standard SKU." lightbox="./media/bastion-connect-vm-ssh-linux/bastion-connect-full.png":::

+ * If you're using the **Basic** SKU, you can't configure **Connection Settings** values. Instead, your connection uses the following default settings: SSH and port 22.

+ :::image type="content" source="./media/bastion-connect-vm-ssh-linux/basic.png" alt-text="Screenshot shows connection settings for the Basic SKU." lightbox="./media/bastion-connect-vm-ssh-linux/basic.png":::

+ * To view and select an available **Authentication Type**, use the dropdown.

+ :::image type="content" source="./media/bastion-connect-vm-ssh-linux/authentication-type.png" alt-text="Screenshot shows authentication type settings." lightbox="./media/bastion-connect-vm-ssh-linux/authentication-type.png":::

+1. Use the following sections in this article to configure authentication settings and connect to your VM.

+ * [Username and password](#password-authentication)

+ * [Password - Azure Key Vault](#password-authenticationazure-key-vault)

+ * [SSH private key from local file](#ssh-private-key-authenticationlocal-file)

+ * [SSH private key - Azure Key Vault](#ssh-private-key-authenticationazure-key-vault)

+## Password authentication

+Use the following steps to authenticate using username and password.

+1. To authenticate using a username and password, configure the following settings.

+ * **Connection Settings** (Standard SKU only)

+ * **Protocol**: Select SSH.

+ * **Port**: Specify the port number.

+ * **Authentication type**: Select **Password** from the dropdown.

+ * **Username**: Enter the username.

+ * **Password**: Enter the **Password**.

+## Password authentication - Azure Key Vault

+1. To authenticate using a password from Azure Key Vault, configure the following settings.

+ * **Connection Settings** (Standard SKU only)

+ * **Protocol**: Select SSH.

+ * **Port**: Specify the port number.

+## SSH private key authentication - local file

+Use the following steps to authenticate using an SSH private key from a local file.

+1. To authenticate using a private key from a local file, configure the following settings.

+ * **Connection Settings** (Standard SKU only)

+ * **Protocol**: Select SSH.

+ * **Port**: Specify the port number.

+ * **Authentication type**: Select **SSH Private Key from Local File** from the dropdown.

+ * **Username**: Enter the username.

+ * **Local File**: Select the local file.

+ * **SSH Passphrase**: Enter the SSH passphrase if necessary.

+1. To work with the VM in a new browser tab, select **Open in new browser tab**.

+1. Click **Connect** to connect to the VM.

+## SSH private key authentication - Azure Key Vault

+1. To authenticate using a private key stored in Azure Key Vault, configure the following settings. For the Basic SKU, connection settings can't be configured and will instead use the default connection settings: SSH and port 22.

+ * **Connection Settings** (Standard SKU only)

+ * **Protocol**: Select SSH.

+ * **Port**: Specify the port number.

+ :::image type="content" source="./media/bastion-connect-vm-ssh-windows/connect.png" alt-text="Screenshot shows the overview for a virtual machine in Azure portal with Connect selected." lightbox="./media/bastion-connect-vm-ssh-windows/connect.png":::

+* Shareable Links isn't currently supported for peered VNETs across tenants.

+```bash

+```bash

+ Title: 'Tutorial: Run a Batch job through Azure Data Factory'

+description: Learn how to use Batch Explorer, Azure Storage Explorer, and a Python script to run a Batch workload through an Azure Data Factory pipeline.

+# Tutorial: Run a Batch job through Data Factory with Batch Explorer, Storage Explorer, and Python

+This tutorial walks you through creating and running an Azure Data Factory pipeline that runs an Azure Batch workload. A Python script runs on the Batch nodes to get comma-separated value (CSV) input from an Azure Blob Storage container, manipulate the data, and write the output to a different storage container. You use Batch Explorer to create a Batch pool and nodes, and Azure Storage Explorer to work with storage containers and files.

+> - Use Batch Explorer to create a Batch pool and nodes.

+> - Use Storage Explorer to create storage containers and upload input files.

+> - Develop a Python script to manipulate input data and produce output.

+> - Create a Data Factory pipeline that runs the Batch workload.

+> - Use Batch Explorer to look at the output log files.

+## Prerequisites

+- An Azure account with an active subscription. If you don't have one, [create a free account](https://azure.microsoft.com/free).

+- A Batch account with a linked Azure Storage account. You can create the accounts by using any of the following methods: [Azure portal](quick-create-portal.md) | [Azure CLI](quick-create-cli.md) | [Bicep](quick-create-bicep.md) | [ARM template](quick-create-template.md) | [Terraform](quick-create-terraform.md).

+- A Data Factory instance. To create the data factory, follow the instructions in [Create a data factory](/azure/data-factory/quickstart-create-data-factory-portal#create-a-data-factory).

+- [Batch Explorer](https://azure.github.io/BatchExplorer) downloaded and installed.

+- [Storage Explorer](https://azure.microsoft.com/products/storage/storage-explorer) downloaded and installed.

+- [Python 3.7 or above](https://www.python.org/downloads), with the [azure-storage-blob](https://pypi.org/project/azure-storage-blob) package installed by using `pip`.

+- The [iris.csv input dataset](https://github.com/Azure-Samples/batch-adf-pipeline-tutorial/blob/master/iris.csv) downloaded from GitHub.

+## Use Batch Explorer to create a Batch pool and nodes

+Use Batch Explorer to create a pool of compute nodes to run your workload.

+1. Sign in to Batch Explorer with your Azure credentials.

+1. Select your Batch account.

+1. Select **Pools** on the left sidebar, and then select the **+** icon to add a pool.

+ [ ](media/run-python-batch-azure-data-factory/batch-explorer-add-pool.png#lightbox)

+1. Complete the **Add a pool to the account** form as follows:

+ - Under **ID**, enter *custom-activity-pool*.

+ - Under **Dedicated nodes**, enter *2*.

+ - For **Select an operating system configuration**, select the **Data science** tab, and then select **Dsvm Win 2019**.

+ - For **Choose a virtual machine size**, select **Standard_F2s_v2**.

+ - For **Start Task**, select **Add a start task**.

+ On the start task screen, under **Command line**, enter `cmd /c "pip install azure-storage-blob pandas"`, and then select **Select**. This command installs the `azure-storage-blob` package on each node as it starts up.

+1. Select **Save and close**.

+## Use Storage Explorer to create blob containers

+Use Storage Explorer to create blob containers to store input and output files, and then upload your input files.

+1. Sign in to Storage Explorer with your Azure credentials.

+1. In the left sidebar, locate and expand the storage account that's linked to your Batch account.

+1. Right-click **Blob Containers**, and select **Create Blob Container**, or select **Create Blob Container** from **Actions** at the bottom of the sidebar.

+1. Enter *input* in the entry field.

+1. Create another blob container named *output*.

+1. Select the **input** container, and then select **Upload** > **Upload files** in the right pane.

+1. On the **Upload files** screen, under **Selected files**, select the ellipsis **...** next to the entry field.

+1. Browse to the location of your downloaded *iris.csv* file, select **Open**, and then select **Upload**.

+[ ](media/run-python-batch-azure-data-factory/storage-explorer.png#lightbox)

+## Develop a Python script

+The following Python script loads the *iris.csv* dataset file from your Storage Explorer **input** container, manipulates the data, and saves the results to the **output** container.

+The script needs to use the connection string for the Azure Storage account that's linked to your Batch account. To get the connection string:

+1. In the [Azure portal](https://portal.azure.com), search for and select the name of the storage account that's linked to your Batch account.

+1. On the page for the storage account, select **Access keys** from the left navigation under **Security + networking**.

+1. Under **key1**, select **Show** next to **Connection string**, and then select the **Copy** icon to copy the connection string.

+Paste the connection string into the following script, replacing the `<storage-account-connection-string>` placeholder. Save the script as a file named *main.py*.

+>[!IMPORTANT]

+>Exposing account keys in the app source isn't recommended for Production usage. You should restrict access to credentials and refer to them in your code by using variables or a configuration file. It's best to store Batch and Storage account keys in Azure Key Vault.

+# Save the subset of the iris dataframe locally in the task node

+ blob.upload_blob(data, overwrite=True)

+Run the script locally to test and validate functionality.

+The script should produce an output file named *iris_setosa.csv* that contains only the data records that have Species = setosa. After you verify that it works correctly, upload the *main.py* script file to your Storage Explorer **input** container.

+## Set up a Data Factory pipeline

+Create and validate a Data Factory pipeline that uses your Python script.

+### Get account information

+The Data Factory pipeline uses your Batch and Storage account names, account key values, and Batch account endpoint. To get this information from the [Azure portal](https://portal.azure.com):

+1. From the Azure Search bar, search for and select your Batch account name.

+1. On your Batch account page, select **Keys** from the left navigation.

+1. On the **Keys** page, copy the following values:

+ - **Batch account**

+ - **Account endpoint**

+ - **Primary access key**

+ - **Storage account name**

+ - **Key1**

+### Create and run the pipeline

+1. If Azure Data Factory Studio isn't already running, select **Launch studio** on your Data Factory page in the Azure portal.

+1. In Data Factory Studio, select the **Author** pencil icon in the left navigation.

+1. Under **Factory Resources**, select the **+** icon, and then select **Pipeline**.

+1. In the **Properties** pane on the right, change the name of the pipeline to *Run Python*.

+ [ ](media/run-python-batch-azure-data-factory/create-pipeline.png#lightbox)

+1. In the **Activities** pane, expand **Batch Service**, and drag the **Custom** activity to the pipeline designer surface.

+1. Below the designer canvas, on the **General** tab, enter *testPipeline* under **Name**.

+ 

+1. Select the **Azure Batch** tab, and then select **New**.

+1. Complete the **New linked service** form as follows:

+ - **Name**: Enter a name for the linked service, such as **AzureBatch1**.

+ - **Access key**: Enter the primary access key you copied from your Batch account.

+ - **Account name**: Enter your Batch account name.

+ - **Batch URL**: Enter the account endpoint you copied from your Batch account, such as `https://batchdotnet.eastus.batch.azure.com`.

+ - **Pool name**: Enter *custom-activity-pool*, the pool you created in Batch Explorer.

+ - **Storage account linked service name**: Select **New**. On the next screen, enter a **Name** for the linked storage service, such as *AzureBlobStorage1*, select your Azure subscription and linked storage account, and then select **Create**.

+1. At the bottom of the Batch **New linked service** screen, select **Test connection**. When the connection is successful, select **Create**.

+ 

+1. Select the **Settings** tab, and enter or select the following settings:

+ - **Command**: Enter `cmd /C python main.py`.

+ - **Resource linked service**: Select the linked storage service you created, such as **AzureBlobStorage1**, and test the connection to make sure it's successful.

+ - **Folder path**: Select the folder icon, and then select the **input** container and select **OK**. The files from this folder download from the container to the pool nodes before the Python script runs.

+ 

+1. Select **Validate** on the pipeline toolbar to validate the pipeline.

+1. Select **Debug** to test the pipeline and ensure it works correctly.

+1. Select **Publish all** to publish the pipeline.

+1. Select **Add trigger**, and then select **Trigger now** to run the pipeline, or **New/Edit** to schedule it.

+ 

+## Use Batch Explorer to view log files

+If running your pipeline produces warnings or errors, you can use Batch Explorer to look at the *stdout.txt* and *stderr.txt* output files for more information.

+1. In Batch Explorer, select **Jobs** from the left sidebar.

+1. Select the **adfv2-custom-activity-pool** job.

+1. Select a task that had a failure exit code.

+1. View the *stdout.txt* and *stderr.txt* files to investigate and diagnose your problem.

+## Clean up resources

+Batch accounts, jobs, and tasks are free, but compute nodes incur charges even when they're not running jobs. It's best to allocate node pools only as needed, and delete the pools when you're done with them. Deleting pools deletes all task output on the nodes, and the nodes themselves.

+Input and output files remain in the storage account and can incur charges. When you no longer need the files, you can delete the files or containers. When you no longer need your Batch account or linked storage account, you can delete them.

+## Next steps

+In this tutorial, you learned how to use a Python script with Batch Explorer, Storage Explorer, and Data Factory to run a Batch workload. For more information about Data Factory, see [What is Azure Data Factory?](/azure/data-factory/introduction)

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+ ```powershell-interactive

+```output

+```powershell-interactive

+ ```output

+ ```output

+ ```powershell-interactive

+ ```powershell-interactive

+Azure OpenAI provides access to many different models, grouped by family and capability. A model family typically associates models by their intended task. The following table describes model families currently available in Azure OpenAI. Not all models are available in all regions currently. Refer to the [model capability table](#model-capabilities) in this article for a full breakdown.

+| ada | N/A | N/A | 2,049 | Oct 2019|

+| babbage | N/A | N/A | 2,049 | Oct 2019 |

+| curie | N/A | N/A | 2,049 | Oct 2019 |

+| davinci | N/A | N/A | 2,049 | Oct 2019|

+| text-davinci-fine-tune-002 | N/A | N/A | | |

+| gpt-35-turbo<sup>1</sup> (ChatGPT) (preview) | East US, South Central US, West Europe | N/A | 4,096 | Sep 2021 |

+<br><sup>1</sup> Currently, only version `0301` of this model is available. This version of the model will be deprecated on 8/1/2023 in favor of newer version of the gpt-35-model. See [ChatGPT model versioning](../how-to/chatgpt.md#model-versioning) for more details.

+Finally, we'll show the top result from document search based on user query against the entire knowledge base. This returns the top result of the "Taxpayer's Right to View Act of 1993". This document has a cosine similarity score of 0.76 between the query and the document:

+| | [Receive inline images](../../../tutorials/chat-interop/meeting-interop-features-inline-image.md) | ✔️** |

+**Microsoft Teams allows users to share images by:

+- Copying & paste into the box at the bottom of the chat - inline images.

+- Drag & drop into the chat area.

+- Upload an image as a file via the "Upload from this device" button.

+Azure Communication Services currently support only option one for copying and pasting the image. Users can achieve it using keyboard shortcuts or the operating system's context menu options for copy and paste.

+- If you're using [Azure Key Vault references](./manage-secrets.md#reference-secret-from-key-vault), you will need to add the `AzureKeyVault` service tag and the *login.microsoft.com* FQDN to the allow list for your firewall.

+[resource-requests]: /rest/api/container-instances/2022-09-01/container-groups/create-or-update#resourcerequests

+[resource-limits]: /rest/api/container-instances/2022-09-01/container-groups/create-or-update#resourcelimits

+[resource-requirements]: /rest/api/container-instances/2022-09-01/container-groups/create-or-update#resourcerequirements

+> Custom DNS settings are not currently available in the Azure portal for container group deployments. They must be provided with YAML file, Resource Manager template, [REST API](/rest/api/container-instances/2022-09-01/container-groups/create-or-update), or an [Azure SDK](https://azure.microsoft.com/downloads/).

+ When you create a container group, enable one or more managed identities by setting a [ContainerGroupIdentity](/rest/api/container-instances/2022-09-01/container-groups/create-or-update#containergroupidentity) property. You can also enable or update managed identities after a container group is running - either action causes the container group to restart. To set the identities on a new or existing container group, use the Azure CLI, a Resource Manager template, a YAML file, or another Azure tool.

+Use the [List Usage](/rest/api/container-instances/2022-09-01/location/list-usage) API to review current quota usage in a region for a subscription.

+Use the [List Usage](/rest/api/container-instances/2022-09-01/location/list-usage) API to review current quota usage in a region for a subscription.

+[list-cached-images]: /rest/api/container-instances/2022-09-01/location/list-cached-images

+- [Use Azure Cosmos DB's REST API](/rest/api/cosmos-db-resource-provider/2022-11-15/service/create#sqldedicatedgatewayservicecreate)

+This article describes how to create, monitor, and manage intra-account container copy jobs using Azure CLI commands.

+* You may use the portal [Cloud Shell](/azure/cloud-shell/quickstart?tabs=powershell) to run container copy commands. Alternately, you may run the commands locally; make sure you have [Azure CLI](/cli/azure/install-azure-cli) downloaded and installed on your machine.

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+```azurecli-interactive

+## Limitations

+### Preview eligibility criteria

+Container copy jobs don't work with accounts having following capabilities enabled. You will need to disable these features before running the container copy jobs.

+- [Disable local auth](https://learn.microsoft.com/azure/cosmos-db/how-to-setup-rbac#use-azure-resource-manager-templates)

+- [Private endpoint / IP Firewall enabled](https://learn.microsoft.com/azure/cosmos-db/how-to-configure-firewall#allow-requests-from-global-azure-datacenters-or-other-sources-within-azure). You will need to provide access to connections within public Azure datacenters to run container copy jobs.

+- [Merge partition](https://learn.microsoft.com/azure/cosmos-db/merge).

+### Account Configurations

+- The time-to-live (TTL) setting is not adjusted in the destination container. As a result, if a document has not expired in the source container, it will start its countdown anew in the destination container.

+ "code": "404",

+* Error - Error while getting resources for job.

+ This error can occur due to internal server issues. To resolve this issue, contact Microsoft support by raising a **New Support Request** from the Azure portal. Set the Problem Type as **'Data Migration'** and Problem subtype as **'Intra-account container copy'**.

+ ```output

+ "code": "500"

+ "message": "Error while getting resources for job, StatusCode: 500, SubStatusCode: 0, OperationId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ActivityId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

+ ```

+

+ Title: Monitor data by using Azure Diagnostic settings

+## Prerequisites

+- An existing Azure Cosmos DB account.

+ - If you have an Azure subscription, [create a new account](nosql/how-to-create-account.md?tabs=azure-portal).

+ - If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.

+ - Alternatively, you can [try Azure Cosmos DB free](try-free.md) before you commit.

+Here, we walk through the process of creating diagnostic settings for your account.

+### [ARM Template](#tab/azure-resource-manager-template)

+Here, use an [Azure Resource Manager (ARM) template](../azure-resource-manager/templates/index.yml) to create a diagnostic setting.

+> [!NOTE]

+> Set the **logAnalyticsDestinationType** property to **Dedicated** to enable resource-specific tables.

+1. Create the following JSON template file to deploy diagnostic settings for your Azure Cosmos DB resource.

+ ```json

+ {

+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",

+ "contentVersion": "1.0.0.0",

+ "parameters": {

+ "settingName": {

+ "type": "string",

+ "metadata": {

+ "description": "The name of the diagnostic setting."

+ }

+ },

+ "dbName": {

+ "type": "string",

+ "metadata": {

+ "description": "The name of the database."

+ }

+ },

+ "workspaceId": {

+ "type": "string",

+ "metadata": {

+ "description": "The resource Id of the workspace."

+ }

+ },

+ "storageAccountId": {

+ "type": "string",

+ "metadata": {

+ "description": "The resource Id of the storage account."

+ }

+ },

+ "eventHubAuthorizationRuleId": {

+ "type": "string",

+ "metadata": {

+ "description": "The resource Id of the event hub authorization rule."

+ }

+ },

+ "eventHubName": {

+ "type": "string",

+ "metadata": {

+ "description": "The name of the event hub."

+ }

+ }

+ },

+ "resources": [

+ {

+ "type": "Microsoft.Insights/diagnosticSettings",

+ "apiVersion": "2021-05-01-preview",

+ "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('dbName'))]",

+ "name": "[parameters('settingName')]",

+ "properties": {

+ "workspaceId": "[parameters('workspaceId')]",

+ "storageAccountId": "[parameters('storageAccountId')]",

+ "eventHubAuthorizationRuleId": "[parameters('eventHubAuthorizationRuleId')]",

+ "eventHubName": "[parameters('eventHubName')]",

+ "logAnalyticsDestinationType": "[parameters('logAnalyticsDestinationType')]",

+ "logs": [

+ {

+ "category": "DataPlaneRequests",

+ "categoryGroup": null,

+ "enabled": true,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "MongoRequests",

+ "categoryGroup": null,

+ "enabled": false,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "QueryRuntimeStatistics",

+ "categoryGroup": null,

+ "enabled": true,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "PartitionKeyStatistics",

+ "categoryGroup": null,

+ "enabled": true,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "PartitionKeyRUConsumption",

+ "categoryGroup": null,

+ "enabled": true,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "ControlPlaneRequests",

+ "categoryGroup": null,

+ "enabled": true,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "CassandraRequests",

+ "categoryGroup": null,

+ "enabled": false,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "GremlinRequests",

+ "categoryGroup": null,

+ "enabled": false,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ },

+ {

+ "category": "TableApiRequests",

+ "categoryGroup": null,

+ "enabled": false,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ }

+ }

+ ],

+ "metrics": [

+ {

+ "timeGrain": null,

+ "enabled": false,

+ "retentionPolicy": {

+ "days": 0,

+ "enabled": false

+ },

+ "category": "Requests"

+ }

+ ]

+ }

+ }

+ ]

+ }

+ ```

+1. Create the following JSON parameter file with settings appropriate for your Azure Cosmos DB resource.

+ ```json

+ {

+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",

+ "contentVersion": "1.0.0.0",

+ "parameters": {

+ "settingName": {

+ "value": "{DIAGNOSTIC_SETTING_NAME}"

+ },

+ "dbName": {

+ "value": "{ACCOUNT_NAME}"

+ },

+ "workspaceId": {

+ "value": "/subscriptions/{SUBSCRIPTION_ID}/resourcegroups/{RESOURCE_GROUP}/providers/microsoft.operationalinsights/workspaces/{WORKSPACE_NAME}"

+ },

+ "storageAccountId": {

+ "value": "/subscriptions/{SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Storage/storageAccounts/{STORAGE_ACCOUNT_NAME}"

+ },

+ "eventHubAuthorizationRuleId": {

+ "value": "/subscriptions/{SUBSCRIPTION_ID}/resourcegroups{RESOURCE_GROUP}/providers/Microsoft.EventHub/namespaces/{EVENTHUB_NAMESPACE}/authorizationrules/{EVENTHUB_POLICY_NAME}"

+ },

+ "eventHubName": {

+ "value": "{EVENTHUB_NAME}"

+ },

+ "logAnalyticsDestinationType": {

+ "value": "Dedicated"

+ }

+ }

+ }

+ ```

+1. Deploy the template using [`az deployment group create`](/cli/azure/deployment/group#az-deployment-group-create).

+ ```azurecli

+ az deployment group create \

+ --resource-group <resource-group-name> \

+ --template-file <path-to-template>.json \

+ --parameters @<parameters-file-name>.json

+ ```

+ :::image type="content" source="media/monitor/full-text-query-features.png" lightbox="media/monitor/full-text-query-features.png" alt-text="Screenshot of the navigation process to the Features page.":::

+ :::image type="content" source="media/monitor/select-enable-full-text.png" alt-text="Screenshot of the full-text feature being enabled.":::

+### [Azure CLI / REST API / ARM template](#tab/azure-cli+rest-api+azure-resource-manager-template)

+> [!div class="nextstepaction"]

+> [Monitoring Azure Cosmos DB data reference](monitor-reference.md#resource-logs)

+1. Navigate to the [azure-samples/cosmos-db-nosql-notebooks](https://github.com/azure-samples/cosmos-db-nosql-notebooks) template repository.

+indices](https://www.postgresql.org/docs/current/gin-intro.html) on

+For any value of `Tmax`, the database or container can store a total of `0.1 * Tmax GB`. After this amount of storage is reached, the maximum RU/s will be automatically increased based on the new storage value, with no impact to your application.

+For example, if you start with a maximum RU/s of 50,000 RU/s (scales between 5000 - 50,000 RU/s), you can store up to 5000 GB of data. If you exceed 500 GB - e.g. storage is now 6000 GB, the new maximum RU/s will be 60,000 RU/s (scales between 6000 - 60,000 RU/s).

+When you use database level throughput with autoscale, you can have the first 25 containers share an autoscale maximum RU/s of 1000 (scales between 100 - 1000 RU/s), as long as you don't exceed 100 GB of storage. See this [documentation](autoscale-faq.yml#can-i-change-the-max-ru-s-on-the-database-or-container--) for more information.

+1. Create a new GitHub repository using the [cosmos-db-nosql-dotnet-sample-web-environment-variables template](https://github.com/azure-samples/cosmos-db-nosql-dotnet-sample-web-environment-variables).

+If you are eligible to pay by invoice (wire transfer), you can switch your subscription to invoice payment (wire transfer) in the Azure portal.

+- Submit one wire transfer payment per invoice.

+| MCA - individual | EA | ΓÇó The transfer isnΓÇÖt supported by Microsoft, so you must move resources yourself. For more information, see [Move resources to a new resource group or subscription](../../azure-resource-manager/management/move-resource-group-and-subscription.md).<br><br> ΓÇó Reservations and savings plans don't automatically transfer and transferring them isn't supported. |

+If you represent a business, you can use the invoice payment method (wire transfer) to pay for your Azure subscription. After you set up the account to pay by invoice, you can't change to another payment option, unless you have a Microsoft Customer Agreement and signed up for Azure through the Azure website.

+Here's a video demonstrating how [centralized Azure Hybrid Benefit works](https://aka.ms/azure/pricing/CM_AHB_SQL/DevVideo).

+>[!VIDEO https://www.youtube.com/embed/ReoLB9N76Lo]

+|Wire transfer | If your account is approved for payment through wire transfer, you can pay the amount due for your invoice with a wire transfer. The instructions for payment are given on the invoice. |

+At the bottom of the invoice, there are instructions for paying your bill. You can pay by wire transfer or online. If you pay online, you can use a credit card or Azure credits, if applicable.

+Instructions for paying your bill are shown at the bottom of the invoice. You can pay by wire transfer within 60 days of your invoice date.

+> [!IMPORTANT]

+> If the zone file that you import contains CNAME entries that point to names in another private zone, Azure DNS resolution of the CNAME will fail unless the other zone is also imported, or the CNAME entries are modified.

+Importing a zone file creates a new zone in Azure DNS if the zone doesn't already exist. If the zone exists, then the record sets in the zone file will be merged with the existing record sets.

+> [!NOTE]

+> The IP addresses 10.0.0.1 and 10.0.0.2 are examples only. Since Azure reserves the first four addresses in a subnet, the .1 and .2 addresses are not normally assigned to a VM.

+ Event Grid operates with all-or-none semantics. It doesn't support partial success of a batch delivery. Subscribers should be careful to only ask for as many events per batch as they can reasonably handle in 30 seconds.

+ from azure.identity.aio import DefaultAzureCredential

+> [!NOTE]

+> It can take several minutes for this to take effect. Consider performing an update on Azure Firewall for the change to take effect immediately.

+A custom domain can only be associated with one Front Door profile at a time. However, you can have different subdomains of an apex domain in the same or a different Front Door profile.

+Read more about [HDInsight 4.0](./apache-hadoop-introduction.md).

+* If you need more help, you can submit a support request from the [Azure portal](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade/). Select **Support** from the menu bar or open the **Help + support** hub. For more detailed information, review [How to create an Azure support request](../../azure-portal/supportability/how-to-create-azure-support-request.md). Access to Subscription Management and billing support is included with your Microsoft Azure subscription, and Technical Support is provided through one of the [Azure Support Plans](https://azure.microsoft.com/support/plans/).

+- If you need more help, you can submit a support request from the [Azure portal](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade/). Select **Support** from the menu bar or open the **Help + support** hub. For more detailed information, review [How to create an Azure support request](../../azure-portal/supportability/how-to-create-azure-support-request.md). Your Microsoft Azure subscription includes access to subscription management and billing support, and technical support is provided through one of the [Azure support plans](https://azure.microsoft.com/support/plans/).

+For example, the samples provided by Microsoft are stored in the `https://hdiconfigactions.blob.core.windows.net/` storage account. This location is a public, read-only container maintained by the HDInsight team.

+While HBase provides row-level transactions, Phoenix integrates with [Tephra](https://tephra.apache.org/) to add cross-row and cross-table transaction support with full [ACID](https://en.wikipedia.org/wiki/ACID) semantics.

+ > We advise customers to use to latest versions of HDInsight [Images](./view-hindsight-cluster-image-version.md) as they bring in the best of open source updates, Azure updates and security fixes. For more information, see [Best practices](./hdinsight-overview-before-you-start.md).

+In this article, you learn how to rotate Azure Storage account access keys for the primary or secondary storage accounts in Azure HDInsight.

+* We're going to use an approach to rotate the primary and secondary access keys of the storage account in a staggered, alternating fashion to ensure HDInsight cluster is accessible throughout the process.

+ Here's an example of how to use primary and secondary storage access keys and set up rotation policies on them:

+ 1. Set up rotation policy for access key2 every N day. As part of this rotation update, HDInsight to use access key1 and then rotate access key2 on storage account.

+ 1. Set up rotation policy for access key1 every N/2 day. As part of this rotation update, HDInsight to use access key2 and then rotate access key1 on storage account.

+ 1. With approach access key1 will be rotated N/2, 3N/2 etc. days and access key2 will be rotated N, 2N, 3N etc. days.

+* To set up periodic rotation of storage account keys, see [Automate the rotation of a secret](../key-vault/secrets/tutorial-rotation-dual.md).

+The preceding script directly updates the access key on the cluster side only and doesn't renew a copy on the HDInsight Resource provider side. Therefore, the script action hosted in the storage account will fail after the access key is rotated.

+* [Add more storage accounts](hdinsight-hadoop-add-storage.md)

+1. Browse to [Research and Innovative Technology Administration, Bureau of Transportation Statistics](https://www.transtats.bts.gov/Homepage.asp).

+Follow the following steps to set up a linked service to the external Hive metastore and underlying catalog storage in Synapse workspace, and configure Spark pool to use the linked external Hive metastore.

+Follow steps to set up a linked service to the external Hive metastore in Synapse workspace.

+3. Provide **Name** of the linked service. Record the name of the linked service, this info is used to configure Spark shortly.

+Some network security rule settings may block access from Spark pool to the external Hive metastore DB. Before you configure the Spark pool, run following code in any Spark pool notebook to test connection to the external Hive metastore DB.

+You can also get your Hive metastore version from the output results. The Hive metastore version is used in the Spark configuration.

+After creating the linked service to the external Hive metastore successfully, you need to set up a few configurations in the Spark to use the external Hive metastore. You can both set up the configuration at Spark pool level, or at Spark session level.

+Here's an example for metastore version 2.1 with linked service named as HiveCatalog21:

+If you donΓÇÖt want to configure your Spark pool, you can also configure the Spark session in notebook using %%configure magic command. Here's the code. Same configuration can also be applied to a Spark batch job.

+If the underlying data of your Hive tables is stored in the workspace primary storage account, you donΓÇÖt need to do extra settings. It works as long as you followed storage setting up instructions during workspace creation.

+- Synapse Studio object explorer continues to show objects in managed Synapse metastore instead of the external HMS, we're improving the experience.

+- Apache Ranger integration isn't supported as of now.

+Py4JJavaError : An error occurred while calling o241.load. : org.apache.hadoop.fs.azure.AzureException: org.apache.hadoop.fs.azure.AzureException: No credentials found for account demohdicatalohdistorage.blob.core.windows.net in the configuration, and its container demohdicatalog-2021-07-15t23-42-51-077z isn't accessible using anonymous credentials. Please check if the container exists first. If it isn't publicly available, you have to provide account credentials.

+Py4JJavaError : An error occurred while calling o305.load. : Operation failed: "This request isn't authorized to perform this operation using this permission.", 403, HEAD

+To avoid changing HMS backend schema/version, following hive configs set by system by default:

+### When sharing the metastore with HDInsight 4.0 Spark clusters, I can't see the tables

+If you want to share the Hive catalog with a spark cluster in HDInsight 4.0, ensure your property `spark.hadoop.metastore.catalog.default` in Synapse spark aligns with the value in HDInsight spark. The default value is `Spark`.

+When you run sqoop import/export command, it fails with the error for some users:

+The ownership on the staging directory /user/yourlongdomainuserna/.staging isn't as expected.

+In the example, `/user/yourlongdomainuserna/.staging` displays the truncated 20 character username for the username `yourlongdomainusername`.

+> Routes without a version are not supported.

+* v2

+## DICOM Conformance Statement

+All versions of the DICOM APIs will always conform to the DICOMwebΓäó Standard specifications, but different versions may expose different APIs. See the specific version of the conformance statement for details:

+* [DICOM Conformance Statement v1](dicom-services-conformance-statement.md)

+* [DICOM Conformance Statement v2](dicom-services-conformance-statement-v2.md)

+* Renaming or removing endpoints.

+* Removing parameters or adding mandatory parameters.

+* Changing status code.

+* Deleting a property in a response, or altering a response type at all, but it's okay to add properties to the response.

+* Changing the type of a property.

+* Behavior when an API changes such as changes in business logic used to do foo, but it now does bar.

+* Addition of properties that are nullable or have a default value.

+* Addition of properties to a response model.

+* Changing the order of properties.

+ Title: DICOM Conformance Statement version 2 for Azure Health Data Services

+description: This document provides details about the DICOM Conformance Statement v2 for Azure Health Data Services.

+# DICOM Conformance Statement v2

+> [!NOTE]

+> API version 2 is in **Preview** and should be used only for testing.

+The Medical Imaging Server for DICOM supports a subset of the DICOMwebΓäó Standard. Support includes:

+* [Studies Service](#studies-service)

+ * [Store (STOW-RS)](#store-stow-rs)

+ * [Retrieve (WADO-RS)](#retrieve-wado-rs)

+ * [Search (QIDO-RS)](#search-qido-rs)

+ * [Delete](#delete)

+* [Worklist Service (UPS Push and Pull SOPs)](#worklist-service-ups-rs)

+ * [Create Workitem](#create-workitem)

+ * [Retrieve Workitem](#retrieve-workitem)

+ * [Update Workitem](#update-workitem)

+ * [Change Workitem State](#change-workitem-state)

+ * [Request Cancellation](#request-cancellation)

+ * [Search Workitems](#search-workitems)

+Additionally, the following nonstandard API(s) are supported:

+* [Change Feed](dicom-change-feed-overview.md)

+* [Extended Query Tags](dicom-extended-query-tags-overview.md)

+The service uses REST API versioning. The version of the REST API must be explicitly specified as part of the base URL, as in the following example:

+`https://<service_url>/v<version>/studies`

+This version of the conformance statement corresponds to the `v2` version of the REST APIs.

+For more information on how to specify the version when making requests, see the [API Versioning Documentation](api-versioning-dicom-service.md).

+You can find example requests for supported transactions in the [Postman collection](https://github.com/microsoft/dicom-server/blob/main/docs/resources/Conformance-as-Postman.postman_collection.json).

+## Preamble Sanitization

+The service ignores the 128-byte File Preamble, and replaces its contents with null characters. This behavior ensures that no files passed through the service are vulnerable to the [malicious preamble vulnerability](https://dicom.nema.org/medical/dicom/current/output/chtml/part10/sect_7.5.html). However, this preamble sanitization also means that [preambles used to encode dual format content](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6489422/) such as TIFF can't be used with the service.

+## Studies Service

+The [Studies Service](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#chapter_10) allows users to store, retrieve, and search for DICOM Studies, Series, and Instances. We've added the nonstandard Delete transaction to enable a full resource lifecycle.

+### Store (STOW-RS)

+This transaction uses the POST method to store representations of studies, series, and instances contained in the request payload.

+| Method | Path | Description |

+| :-- | :-- | :- |

+| POST | ../studies | Store instances. |

+| POST | ../studies/{study} | Store instances for a specific study. |

+Parameter `study` corresponds to the DICOM attribute StudyInstanceUID. If it's specified, any instance that doesn't belong to the provided study is rejected with a `43265` warning code.

+The following `Accept` header(s) for the response are supported:

+* `application/dicom+json`

+The following `Content-Type` header(s) are supported:

+* `multipart/related; type="application/dicom"`

+* `application/dicom`

+> [!NOTE]

+> The Server **will not** coerce or replace attributes that conflict with existing data. All data will be stored as provided.

+#### Store required attributes

+The following DICOM elements are required to be present in every DICOM file attempting to be stored:

+* `StudyInstanceUID`

+* `SeriesInstanceUID`

+* `SOPInstanceUID`

+* `SOPClassUID`

+* `PatientID`

+> [!NOTE]

+> All identifiers must be between 1 and 64 characters long, and only contain alpha numeric characters or the following special characters: `.`, `-`.

+Each file stored must have a unique combination of `StudyInstanceUID`, `SeriesInstanceUID`, and `SopInstanceUID`. The warning code `45070` is returned if a file with the same identifiers already exists.

+Only transfer syntaxes with explicit Value Representations are accepted.

+> [!NOTE]

+> Requests are limited to 2GB. No single DICOM file or combination of files may exceed this limit.

+#### Store changes from v1

+In previous versions, a Store request would fail if any of the [required](#store-required-attributes) or [searchable attributes](#searchable-attributes) failed validation. Beginning with V2, the request fails only if **required attributes** fail validation.

+Failed validation of attributes not required by the API results in the file being stored with a warning. A warning is given about each failing attribute per instance.

+When a sequence contains an attribute that fails validation, or when there are multiple issues with a single attribute, only the first failing attribute reason is noted.

+#### Store response status codes

+| Code | Description |

+| : |:|

+| `200 (OK)` | All the SOP instances in the request have been stored. |

+| `202 (Accepted)` | The origin server stored some of the Instances and others have failed or returned warnings. Additional information regarding this error may be found in the response message body. |

+| `204 (No Content)` | No content was provided in the store transaction request. |

+| `400 (Bad Request)` | The request was badly formatted. For example, the provided study instance identifier didn't conform the expected UID format. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `406 (Not Acceptable)` | The specified `Accept` header isn't supported. |

+| `409 (Conflict)` | None of the instances in the store transaction request have been stored. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+### Store response payload

+The response payload populates a DICOM dataset with the following elements:

+| Tag | Name | Description |

+| :-- | :-- | :- |

+| (0008, 1190) | `RetrieveURL` | The Retrieve URL of the study if the StudyInstanceUID was provided in the store request and at least one instance is successfully stored. |

+| (0008, 1198) | `FailedSOPSequence` | The sequence of instances that failed to store. |

+| (0008, 1199) | `ReferencedSOPSequence` | The sequence of stored instances. |

+Each dataset in the `FailedSOPSequence` has the following elements (if the DICOM file attempting to be stored could be read):

+| Tag | Name | Description |

+|: |: |:--|

+| (0008, 1150) | `ReferencedSOPClassUID` | The SOP class unique identifier of the instance that failed to store. |

+| (0008, 1155) | `ReferencedSOPInstanceUID` | The SOP instance unique identifier of the instance that failed to store. |

+| (0008, 1197) | `FailureReason` | The reason code why this instance failed to store. |

+| (0008, 1196) | `WarningReason` | A `WarningReason` indicates validation issues that were detected but weren't severe enough to fail the store operation. |

+| (0074, 1048) | `FailedAttributesSequence` | The sequence of `ErrorComment` that includes the reason for each failed attribute. |

+Each dataset in the `ReferencedSOPSequence` has the following elements:

+| Tag | Name | Description |

+| :-- | :-- | :- |

+| (0008, 1150) | `ReferencedSOPClassUID` | The SOP class unique identifier of the instance that was stored. |

+| (0008, 1155) | `ReferencedSOPInstanceUID` | The SOP instance unique identifier of the instance that was stored. |

+| (0008, 1190) | `RetrieveURL` | The retrieve URL of this instance on the DICOM server. |

+An example response with `Accept` header `application/dicom+json` without a FailedAttributesSequence in a ReferencedSOPSequence:

+```json

+{

+ "00081190":

+ {

+ "vr":"UR",

+ "Value":["http://localhost/studies/d09e8215-e1e1-4c7a-8496-b4f6641ed232"]

+ },

+ "00081198":

+ {

+ "vr":"SQ",

+ "Value":

+ [{

+ "00081150":

+ {

+ "vr":"UI","Value":["cd70f89a-05bc-4dab-b6b8-1f3d2fcafeec"]

+ },

+ "00081155":

+ {

+ "vr":"UI",

+ "Value":["22c35d16-11ce-43fa-8f86-90ceed6cf4e7"]

+ },

+ "00081197":

+ {

+ "vr":"US",

+ "Value":[43265]

+ }

+ }]

+ },

+ "00081199":

+ {

+ "vr":"SQ",

+ "Value":

+ [{

+ "00081150":

+ {

+ "vr":"UI",

+ "Value":["d246deb5-18c8-4336-a591-aeb6f8596664"]

+ },

+ "00081155":

+ {

+ "vr":"UI",

+ "Value":["4a858cbb-a71f-4c01-b9b5-85f88b031365"]

+ },

+ "00081190":

+ {

+ "vr":"UR",

+ "Value":["http://localhost/studies/d09e8215-e1e1-4c7a-8496-b4f6641ed232/series/8c4915f5-cc54-4e50-aa1f-9b06f6e58485/instances/4a858cbb-a71f-4c01-b9b5-85f88b031365"]

+ }

+ }]

+ }

+}

+```

+An example response with `Accept` header `application/dicom+json` with a FailedAttributesSequence in a ReferencedSOPSequence:

+```json

+{

+ "00081190":

+ {

+ "vr":"UR",

+ "Value":["http://localhost/studies/d09e8215-e1e1-4c7a-8496-b4f6641ed232"]

+ },

+ "00081199":

+ {

+ "vr":"SQ",

+ "Value":

+ [{

+ "00081150":

+ {

+ "vr":"UI",

+ "Value":["d246deb5-18c8-4336-a591-aeb6f8596664"]

+ },

+ "00081155":

+ {

+ "vr":"UI",

+ "Value":["4a858cbb-a71f-4c01-b9b5-85f88b031365"]

+ },

+ "00081190":

+ {

+ "vr":"UR",

+ "Value":["http://localhost/studies/d09e8215-e1e1-4c7a-8496-b4f6641ed232/series/8c4915f5-cc54-4e50-aa1f-9b06f6e58485/instances/4a858cbb-a71f-4c01-b9b5-85f88b031365"]

+ },

+ "00081196": {

+ "vr": "US",

+ "Value": [

+ 1

+ ]

+ },

+ "00741048": {

+ "vr": "SQ",

+ "Value": [

+ {

+ "00000902": {

+ "vr": "LO",

+ "Value": [

+ "DICOM100: (0008,0020) - Content \"NotAValidDate\" does not validate VR DA: one of the date values does not match the pattern YYYYMMDD"

+ ]

+ }

+ },

+ {

+ "00000902": {

+ "vr": "LO",

+ "Value": [

+ "DICOM100: (0008,002a) - Content \"NotAValidDate\" does not validate VR DT: value does not mach pattern YYYY[MM[DD[HH[MM[SS[.F{1-6}]]]]]]"

+ ]

+ }

+ }

+ ]

+ }

+ }]

+ }

+}

+```

+#### Store failure reason codes

+| Code | Description |

+| :- | :- |

+| `272` | The store transaction didn't store the instance because of a general failure in processing the operation. |

+| `43264` | The DICOM instance failed the validation. |

+| `43265` | The provided instance `StudyInstanceUID` didn't match the specified `StudyInstanceUID` in the store request. |

+| `45070` | A DICOM instance with the same `StudyInstanceUID`, `SeriesInstanceUID`, and `SopInstanceUID` has already been stored. If you wish to update the contents, delete this instance first. |

+| `45071` | A DICOM instance is being created by another process, or the previous attempt to create has failed and the cleanup process hasn't had chance to clean up yet. Delete the instance first before attempting to create again. |

+#### Store warning reason codes

+| Code | Description |

+|:|:-|

+| `45063` | A DICOM instance Data Set doesn't match SOP Class. The Studies Store Transaction (Section 10.5) observed that the Data Set didn't match the constraints of the SOP Class during storage of the instance. |

+| `1` | The Studies Store Transaction (Section 10.5) observed that the Data Set has validation warnings. |

+#### Store Error Codes

+| Code | Description |

+| :- | :- |

+| `100` | The provided instance attributes didn't meet the validation criteria. |

+### Retrieve (WADO-RS)

+This Retrieve Transaction offers support for retrieving stored studies, series, instances and frames by reference.

+| Method | Path | Description |

+| :-- | :- | :- |

+| GET | ../studies/{study} | Retrieves all instances within a study. |

+| GET | ../studies/{study}/metadata | Retrieves the metadata for all instances within a study. |

+| GET | ../studies/{study}/series/{series} | Retrieves all instances within a series. |

+| GET | ../studies/{study}/series/{series}/metadata | Retrieves the metadata for all instances within a series. |

+| GET | ../studies/{study}/series/{series}/instances/{instance} | Retrieves a single instance. |

+| GET | ../studies/{study}/series/{series}/instances/{instance}/metadata | Retrieves the metadata for a single instance. |

+| GET | ../studies/{study}/series/{series}/instances/{instance}/frames/{frames} | Retrieves one or many frames from a single instance. To specify more than one frame, a comma separate each frame to return. For example, /studies/1/series/2/instance/3/frames/4,5,6 |

+#### Retrieve instances within study or series

+The following `Accept` header(s) are supported for retrieving instances within a study or a series:

+* `multipart/related; type="application/dicom"; transfer-syntax=*`

+* `multipart/related; type="application/dicom";` (when transfer-syntax isn't specified, 1.2.840.10008.1.2.1 is used as default)

+* `multipart/related; type="application/dicom"; transfer-syntax=1.2.840.10008.1.2.1`

+* `multipart/related; type="application/dicom"; transfer-syntax=1.2.840.10008.1.2.4.90`

+#### Retrieve an Instance

+The following `Accept` header(s) are supported for retrieving a specific instance:

+* `application/dicom; transfer-syntax=*`

+* `multipart/related; type="application/dicom"; transfer-syntax=*`

+* `application/dicom;` (when transfer-syntax isn't specified, `1.2.840.10008.1.2.1` is used as default)

+* `multipart/related; type="application/dicom"` (when transfer-syntax isn't specified, `1.2.840.10008.1.2.1` is used as default)

+* `application/dicom; transfer-syntax=1.2.840.10008.1.2.1`

+* `multipart/related; type="application/dicom"; transfer-syntax=1.2.840.10008.1.2.1`

+* `application/dicom; transfer-syntax=1.2.840.10008.1.2.4.90`

+* `multipart/related; type="application/dicom"; transfer-syntax=1.2.840.10008.1.2.4.90`

+#### Retrieve Frames

+The following `Accept` headers are supported for retrieving frames:

+* `multipart/related; type="application/octet-stream"; transfer-syntax=*`

+* `multipart/related; type="application/octet-stream";` (when transfer-syntax isn't specified, `1.2.840.10008.1.2.1` is used as default)

+* `multipart/related; type="application/octet-stream"; transfer-syntax=1.2.840.10008.1.2.1`

+* `multipart/related; type="image/jp2";` (when transfer-syntax isn't specified, `1.2.840.10008.1.2.4.90` is used as default)

+* `multipart/related; type="image/jp2";transfer-syntax=1.2.840.10008.1.2.4.90`

+* `application/octet-stream; transfer-syntax=*` for single frame retrieval

+#### Retrieve transfer syntax

+When the requested transfer syntax is different from original file, the original file is transcoded to requested transfer syntax. The original file needs to be one of the formats below for transcoding to succeed, otherwise transcoding may fail:

+* 1.2.840.10008.1.2 (Little Endian Implicit)

+* 1.2.840.10008.1.2.1 (Little Endian Explicit)

+* 1.2.840.10008.1.2.2 (Explicit VR Big Endian)

+* 1.2.840.10008.1.2.4.50 (JPEG Baseline Process 1)

+* 1.2.840.10008.1.2.4.57 (JPEG Lossless)

+* 1.2.840.10008.1.2.4.70 (JPEG Lossless Selection Value 1)

+* 1.2.840.10008.1.2.4.90 (JPEG 2000 Lossless Only)

+* 1.2.840.10008.1.2.4.91 (JPEG 2000)

+* 1.2.840.10008.1.2.5 (RLE Lossless)

+An unsupported `transfer-syntax` results in `406 Not Acceptable`.

+### Retrieve metadata (for study, series, or instance)

+The following `Accept` header is supported for retrieving metadata for a study, a series, or an instance:

+* `application/dicom+json`

+Retrieving metadata won't return attributes with the following value representations:

+| VR Name | Description |

+| : | : |

+| OB | Other Byte |

+| OD | Other Double |

+| OF | Other Float |

+| OL | Other Long |

+| OV | Other 64-Bit Very Long |

+| OW | Other Word |

+| UN | Unknown |

+### Retrieve metadata cache validation for (study, series, or instance)

+Cache validation is supported using the `ETag` mechanism. In the response to a metadata request, ETag is returned as one of the headers. This ETag can be cached and added as `If-None-Match` header in the later requests for the same metadata. Two types of responses are possible if the data exists:

+* Data hasn't changed since the last request: `HTTP 304 (Not Modified)` response is sent with no response body.

+* Data has changed since the last request: `HTTP 200 (OK)` response is sent with updated ETag. Required data is returned as part of the body.

+### Retrieve response status codes

+| Code | Description |

+| : | :- |

+| `200 (OK)` | All requested data has been retrieved. |

+| `304 (Not Modified)` | The requested data hasn't been modified since the last request. Content isn't added to the response body in such case. For more information, see the above section **Retrieve Metadata Cache Validation (for Study, Series, or Instance)**. |

+| `400 (Bad Request)` | The request was badly formatted. For example, the provided study instance identifier didn't conform to the expected UID format, or the requested transfer-syntax encoding isn't supported. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The specified DICOM resource couldn't be found. |

+| `406 (Not Acceptable)` | The specified `Accept` header isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+### Search (QIDO-RS)

+Query based on ID for DICOM Objects (QIDO) enables you to search for studies, series, and instances by attributes.

+| Method | Path | Description |

+| :-- | :- | :-- |

+| *Search for Studies* |

+| GET | ../studies?... | Search for studies |

+| *Search for Series* |

+| GET | ../series?... | Search for series |

+| GET |../studies/{study}/series?... | Search for series in a study |

+| *Search for Instances* |

+| GET |../instances?... | Search for instances |

+| GET |../studies/{study}/instances?... | Search for instances in a study |

+| GET |../studies/{study}/series/{series}/instances?... | Search for instances in a series |

+The following `Accept` header(s) are supported for searching:

+* `application/dicom+json`

+### Search changes from v1

+In the v1 API and continued for v2, if an [extended query tag](dicom-extended-query-tags-overview.md) has any errors, because one or more of the existing instances had a tag value that couldn't be indexed, then subsequent search queries containing the extended query tag will return `erroneous-dicom-attributes` as detailed in the [documentation](dicom-extended-query-tags-overview.md#tag-query-status). However, tags (also known as attributes) with validation warnings from STOW-RS are **not** included in this header. If a store request results in validation warnings on [searchable tags](#searchable-attributes), subsequent searches containing these tags won't consider any DICOM SOP instance that produced a warning. This behavior may result in incomplete search results.

+To correct an attribute, delete the stored instance and upload the corrected data.

+### Supported search parameters

+The following parameters for each query are supported:

+| Key | Support Value(s) | Allowed Count | Description |

+| : | :- | : | :- |

+| `{attributeID}=` | `{value}` | 0...N | Search for attribute/ value matching in query. |

+| `includefield=` | `{attributeID}`<br/>`all` | 0...N | The additional attributes to return in the response. Both, public and private tags are supported.<br/>When `all` is provided, refer to [Search Response](#search-response) for more information about which attributes are returned for each query type.<br/>If a mixture of `{attributeID}` and `all` is provided, the server defaults to using `all`. |

+| `limit=` | `{value}` | 0..1 | Integer value to limit the number of values returned in the response.<br/>Value can be between the range 1 >= x <= 200. Defaulted to 100. |

+| `offset=` | `{value}` | 0..1 | Skip `{value}` results.<br/>If an offset is provided larger than the number of search query results, a 204 (no content) response is returned. |

+| `fuzzymatching=` | `true` / `false` | 0..1 | If true fuzzy matching is applied to PatientName attribute. It does a prefix word match of any name part inside PatientName value. For example, if PatientName is "John^Doe", then "joh", "do", "jo do", "Doe" and "John Doe" all match. However "ohn" doesn't match. |

+#### Searchable attributes

+We support searching the following attributes and search types.

+| Attribute Keyword | All Studies | All Series | All Instances | Study's Series | Study's Instances | Study Series' Instances |

+| :- | :: | :-: | :: | :: | :-: | :: |

+| `StudyInstanceUID` | X | X | X | | | |

+| `PatientName` | X | X | X | | | |

+| `PatientID` | X | X | X | | | |

+| `PatientBirthDate` | X | X | X | | | |

+| `AccessionNumber` | X | X | X | | | |

+| `ReferringPhysicianName` | X | X | X | | | |

+| `StudyDate` | X | X | X | | | |

+| `StudyDescription` | X | X | X | | | |

+| `ModalitiesInStudy` | X | X | X | | | |

+| `SeriesInstanceUID` | | X | X | X | X | |

+| `Modality` | | X | X | X | X | |

+| `PerformedProcedureStepStartDate` | | X | X | X | X | |

+| `ManufacturerModelName` | | X | X | X | X | |

+| `SOPInstanceUID` | | | X | | X | X |

+#### Search matching

+We support the following matching types.

+| Search Type | Supported Attribute | Example |

+| :- | : | : |

+| Range Query | `StudyDate`/`PatientBirthDate` | `{attributeID}={value1}-{value2}`. For date/ time values, we support an inclusive range on the tag. This is mapped to `attributeID >= {value1} AND attributeID <= {value2}`. If `{value1}` isn't specified, all occurrences of dates/times prior to and including `{value2}` are matched. Likewise, if `{value2}` isn't specified, all occurrences of `{value1}` and subsequent dates/times are matched. However, one of these values has to be present. `{attributeID}={value1}-` and `{attributeID}=-{value2}` are valid, however, `{attributeID}=-` is invalid. |

+| Exact Match | All supported attributes | `{attributeID}={value1}` |

+| Fuzzy Match | `PatientName`, `ReferringPhysicianName` | Matches any component of the name that starts with the value. |

+#### Attribute ID

+Tags can be encoded in several ways for the query parameter. We have partially implemented the standard as defined in [PS3.18 6.7.1.1.1](http://dicom.nema.org/medical/dicom/2019a/output/chtml/part18/sect_6.7.html#sect_6.7.1.1.1). The following encodings for a tag are supported:

+| Value | Example |

+| : | : |

+| `{group}{element}` | `0020000D` |

+| `{dicomKeyword}` | `StudyInstanceUID` |

+Example query searching for instances:

+`../instances?Modality=CT&00280011=512&includefield=00280010&limit=5&offset=0`

+### Search response

+The response is an array of DICOM datasets. Depending on the resource, by *default* the following attributes are returned:

+#### Default Study tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0020) | `StudyDate` |

+| (0008, 0050) | `AccessionNumber` |

+| (0008, 1030) | `StudyDescription` |

+| (0009, 0090) | `ReferringPhysicianName` |

+| (0010, 0010) | `PatientName` |

+| (0010, 0020) | `PatientID` |

+| (0010, 0030) | `PatientBirthDate` |

+| (0020, 000D) | `StudyInstanceUID` |

+#### Default Series tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0060) | `Modality` |

+| (0008, 1090) | `ManufacturerModelName` |

+| (0020, 000E) | `SeriesInstanceUID` |

+| (0040, 0244) | `PerformedProcedureStepStartDate` |

+#### Default Instance tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0018) | `SOPInstanceUID` |

+If `includefield=all`, the following attributes are included along with default attributes. Along with the default attributes, this is the full list of attributes supported at each resource level.

+#### Additional Study tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0005) | `SpecificCharacterSet` |

+| (0008, 0030) | `StudyTime` |

+| (0008, 0056) | `InstanceAvailability` |

+| (0008, 0201) | `TimezoneOffsetFromUTC` |

+| (0008, 0063) | `AnatomicRegionsInStudyCodeSequence` |

+| (0008, 1032) | `ProcedureCodeSequence` |

+| (0008, 1060) | `NameOfPhysiciansReadingStudy` |

+| (0008, 1080) | `AdmittingDiagnosesDescription` |

+| (0008, 1110) | `ReferencedStudySequence` |

+| (0010, 1010) | `PatientAge` |

+| (0010, 1020) | `PatientSize` |

+| (0010, 1030) | `PatientWeight` |

+| (0010, 2180) | `Occupation` |

+| (0010, 21B0) | `AdditionalPatientHistory` |

+| (0010, 0040) | `PatientSex` |

+| (0020, 0010) | `StudyID` |

+#### Additional Series tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0005) | SpecificCharacterSet |

+| (0008, 0201) | TimezoneOffsetFromUTC |

+| (0020, 0011) | SeriesNumber |

+| (0020, 0060) | Laterality |

+| (0008, 0021) | SeriesDate |

+| (0008, 0031) | SeriesTime |

+| (0008, 103E) | SeriesDescription |

+| (0040, 0245) | PerformedProcedureStepStartTime |

+| (0040, 0275) | RequestAttributesSequence |

+#### Additional Instance tags

+| Tag | Attribute Name |

+| :-- | :- |

+| (0008, 0005) | SpecificCharacterSet |

+| (0008, 0016) | SOPClassUID |

+| (0008, 0056) | InstanceAvailability |

+| (0008, 0201) | TimezoneOffsetFromUTC |

+| (0020, 0013) | InstanceNumber |

+| (0028, 0010) | Rows |

+| (0028, 0011) | Columns |

+| (0028, 0100) | BitsAllocated |

+| (0028, 0008) | NumberOfFrames |

+The following attributes are returned:

+* All the match query parameters and UIDs in the resource url.

+* `IncludeField` attributes supported at that resource level.

+* If the target resource is `All Series`, then `Study` level attributes are also returned.

+* If the target resource is `All Instances`, then `Study` and `Series` level attributes are also returned.

+* If the target resource is `Study's Instances`, then `Series` level attributes are also returned.

+* `NumberOfStudyRelatedInstances` aggregated attribute is supported in `Study` level `includeField`.

+* `NumberOfSeriesRelatedInstances` aggregated attribute is supported in `Series` level `includeField`.

+### Search response codes

+The query API returns one of the following status codes in the response:

+| Code | Description |

+| : | :- |

+| `200 (OK)` | The response payload contains all the matching resources. |

+| `204 (No Content)` | The search completed successfully but returned no results. |

+| `400 (Bad Request)` | The server was unable to perform the query because the query component was invalid. Response body contains details of the failure. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+### Additional notes

+* Querying using the `TimezoneOffsetFromUTC (00080201)` isn't supported.

+* The query API doesn't return `413 (request entity too large)`. If the requested query response limit is outside of the acceptable range, a bad request is returned. Anything requested within the acceptable range, will be resolved.

+* When target resource is Study/Series, there's a potential for inconsistent study/series level metadata across multiple instances. For example, two instances could have different patientName. In this case, the latest wins and you can search only on the latest data.

+* Paged results are optimized to return matched _newest_ instance first, this may result in duplicate records in subsequent pages if newer data matching the query was added.

+* Matching is case in-sensitive and accent in-sensitive for PN VR types.

+* Matching is case in-sensitive and accent sensitive for other string VR types.

+* Only the first value is indexed of a single valued data element that incorrectly has multiple values.

+* Using the default attributes or limiting the number of results requested maximizes performance.

+### Delete

+This transaction isn't part of the official DICOMweb&trade; Standard. It uses the DELETE method to remove representations of Studies, Series, and Instances from the store.

+| Method | Path | Description |

+| :-- | : | :- |

+| DELETE | ../studies/{study} | Delete all instances for a specific study. |

+| DELETE | ../studies/{study}/series/{series} | Delete all instances for a specific series within a study. |

+| DELETE | ../studies/{study}/series/{series}/instances/{instance} | Delete a specific instance within a series. |

+Parameters `study`, `series`, and `instance` correspond to the DICOM attributes `StudyInstanceUID`, `SeriesInstanceUID`, and `SopInstanceUID` respectively.

+There are no restrictions on the request's `Accept` header, `Content-Type` header or body content.

+> [!NOTE]

+> After a Delete transaction, the deleted instances will not be recoverable.

+### Response status codes

+| Code | Description |

+| : | :- |

+| `204 (No Content)` | When all the SOP instances have been deleted. |

+| `400 (Bad Request)` | The request was badly formatted. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | When the specified series wasn't found within a study or the specified instance wasn't found within the series. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+### Delete response payload

+The response body is empty. The status code is the only useful information returned.

+## Worklist Service (UPS-RS)

+The DICOM service supports the Push and Pull SOPs of the [Worklist Service (UPS-RS)](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#chapter_11). This service provides access to one Worklist containing Workitems, each of which represents a Unified Procedure Step (UPS).

+Throughout, the variable `{workitem}` in a URI template stands for a Workitem UID.

+Available UPS-RS endpoints include:

+|Verb| Path | Description |

+|: |: |: |

+|POST| {s}/workitems{?AffectedSOPInstanceUID}| Create a work item|

+|POST| {s}/workitems/{instance}{?transaction}| Update a work item

+|GET| {s}/workitems{?query*} | Search for work items

+|GET| {s}/workitems/{instance}| Retrieve a work item

+|PUT| {s}/workitems/{instance}/state| Change work item state

+|POST| {s}/workitems/{instance}/cancelrequest | Cancel work item|

+|POST |{s}/workitems/{instance}/subscribers/{AETitle}{?deletionlock} | Create subscription|

+|POST| {s}/workitems/1.2.840.10008.5.1.4.34.5/ | Suspend subscription|

+|DELETE | {s}/workitems/{instance}/subscribers/{AETitle} | Delete subscription

+|GET | {s}/subscribers/{AETitle}| Open subscription channel |

+### Create Workitem

+This transaction uses the POST method to create a new Workitem.

+| Method | Path | Description |

+| :-- | :-- | :- |

+| POST | ../workitems | Create a Workitem. |

+| POST | ../workitems?{workitem} | Creates a Workitem with the specified UID. |

+If not specified in the URI, the payload dataset must contain the Workitem in the `SOPInstanceUID` attribute.

+The `Accept` and `Content-Type` headers are required in the request, and must both have the value `application/dicom+json`.

+There are several requirements related to DICOM data attributes in the context of a specific transaction. Attributes may be

+required to be present, required to not be present, required to be empty, or required to not be empty. These requirements can be

+found [in this table](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3).

+> [!NOTE]

+> Although the reference table above says that SOP Instance UID shouldn't be present, this guidance is specific to the DIMSE protocol and is handled differently in DICOMWebΓäó. SOP Instance UID should be present in the dataset if not in the URI.

+> [!NOTE]

+> All the conditional requirement codes including 1C and 2C are treated as optional.

+#### Create response status codes

+| Code | Description |

+| :-- | :- |

+| `201 (Created)` | The target Workitem was successfully created. |

+| `400 (Bad Request)` | There was a problem with the request. For example, the request payload didn't satisfy the requirements above. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `409 (Conflict)` | The Workitem already exists. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Create response payload

+A success response has no payload. The `Location` and `Content-Location` response headers contain a URI reference to the created Workitem.

+A failure response payload contains a message describing the failure.

+### Request cancellation

+This transaction enables the user to request cancellation of a non-owned Workitem.

+There are [four valid Workitem states](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.1.1-1):

+* `SCHEDULED`

+* `IN PROGRESS`

+* `CANCELED`

+* `COMPLETED`

+This transaction will only succeed against Workitems in the `SCHEDULED` state. Any user can claim ownership of a Workitem by setting its Transaction UID and changing its state to `IN PROGRESS`. From then on, a user can only modify the Workitem by providing the correct Transaction UID. While UPS defines Watch and Event SOP classes that allow cancellation requests and other events to be forwarded, this DICOM service doesn't implement these classes, and so cancellation requests on workitems that are `IN PROGRESS` will return failure. An owned Workitem can be canceled via the [Change Workitem State](#change-workitem-state) transaction.

+| Method | Path | Description |

+| : | :- | :-- |

+| POST | ../workitems/{workitem}/cancelrequest | Request the cancellation of a scheduled Workitem |

+The `Content-Type` header is required, and must have the value `application/dicom+json`.

+The request payload may include Action Information as [defined in the DICOM Standard](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.2-1).

+#### Request cancellation response status codes

+| Code | Description |

+| : | :- |

+| `202 (Accepted)` | The request was accepted by the server, but the Target Workitem state hasn't necessarily changed yet. |

+| `400 (Bad Request)` | There was a problem with the syntax of the request. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. For example, the Target Workitem is in the `SCHEDULED` or `COMPLETED` state. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Request cancellation response payload

+A success response has no payload, and a failure response payload contains a message describing the failure.

+If the Workitem Instance is already in a canceled state, the response includes the following HTTP Warning header:

+`299: The UPS is already in the requested state of CANCELED.`

+### Retrieve Workitem

+This transaction retrieves a Workitem. It corresponds to the UPS DIMSE N-GET operation.

+Refer to: https://dicom.nema.org/medical/dicom/current/output/html/part18.html#sect_11.5

+If the Workitem exists on the origin server, the Workitem shall be returned in an Acceptable Media Type. The returned Workitem shall not contain the Transaction UID (0008,1195) Attribute. This is necessary to preserve this Attribute's role as an access lock.

+| Method | Path | Description |

+| : | :- | : |

+| GET | ../workitems/{workitem} | Request to retrieve a Workitem |

+The `Accept` header is required and must have the value `application/dicom+json`.

+#### Retrieve Workitem response status codes

+| Code | Description |

+| :- | :- |

+| 200 (OK) | Workitem Instance was successfully retrieved. |

+| 400 (Bad Request) | There was a problem with the request. |

+| 401 (Unauthorized) | The client isn't authenticated. |

+| 403 (Forbidden) | The user isn't authorized. |

+| 404 (Not Found) | The Target Workitem wasn't found. |

+| 503 (Service Unavailable) | The service is unavailable or busy. Try again later. |

+#### Retrieve Workitem response payload

+* A success response has a single part payload containing the requested Workitem in the Selected Media Type.

+* The returned Workitem shall not contain the Transaction UID (0008, 1195) attribute of the Workitem, since that should only be known to the Owner.

+### Update Workitem

+This transaction modifies attributes of an existing Workitem. It corresponds to the UPS DIMSE N-SET operation.

+Refer to: https://dicom.nema.org/medical/dicom/current/output/html/part18.html#sect_11.6

+To update a Workitem currently in the `SCHEDULED` state, the `Transaction UID` attribute shall not be present. For a Workitem in the `IN PROGRESS` state, the request must include the current Transaction UID as a query parameter. If the Workitem is already in the `COMPLETED` or `CANCELED` states, the response is `400 (Bad Request)`.

+| Method | Path | Description |

+| : | : | :-- |

+| POST | ../workitems/{workitem}?{transaction-uid} | Update Workitem Transaction |

+The `Content-Type` header is required, and must have the value `application/dicom+json`.

+The request payload contains a dataset with the changes to be applied to the target Workitem. When modifying a sequence, the request must include all Items in the sequence, not just the Items to be modified.

+When multiple Attributes need updated as a group, do this as multiple Attributes in a single request, not as multiple requests.

+There are many requirements related to DICOM data attributes in the context of a specific transaction. Attributes may be

+required to be present, required to not be present, required to be empty, or required to not be empty. These requirements can be

+found in [this table](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3).

+> [!NOTE]

+> All the conditional requirement codes including 1C and 2C are treated as optional.

+> [!NOTE]

+> The request can't set the value of the Procedure Step State (0074,1000) attribute. Procedure Step State is managed using the Change State transaction, or the Request Cancellation transaction.

+#### Update Workitem transaction response status codes

+| Code | Description |

+| :- | :- |

+| `200 (OK)` | The Target Workitem was updated. |

+| `400 (Bad Request)` | There was a problem with the request. For example: (1) the Target Workitem was in the `COMPLETED` or `CANCELED` state. (2) the Transaction UID is missing. (3) the Transaction UID is incorrect. (4) the dataset didn't conform to the requirements.

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Update Workitem transaction response payload

+The origin server shall support header fields as required in [Table 11.6.3-2](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#table_11.6.3-2).

+A success response shall have either no payload or a payload containing a Status Report document.

+A failure response payload may contain a Status Report describing any failures, warnings, or other useful information.

+### Change Workitem state

+This transaction is used to change the state of a Workitem. It corresponds to the UPS DIMSE N-ACTION operation "Change UPS State". State changes are used to claim ownership, complete, or cancel a Workitem.

+Refer to: https://dicom.nema.org/medical/dicom/current/output/html/part18.html#sect_11.7

+If the Workitem exists on the origin server, the Workitem shall be returned in an Acceptable Media Type. The returned Workitem shall not contain the Transaction UID (0008,1195) attribute. This is necessary to preserve this Attribute's role as an access lock as described [here.](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#sect_CC.1.1)

+| Method | Path | Description |

+| : | : | :-- |

+| PUT | ../workitems/{workitem}/state | Change Workitem State |

+The `Accept` header is required, and must have the value `application/dicom+json`.

+The request payload shall contain the Change UPS State Data Elements. These data elements are:

+* **Transaction UID (0008, 1195)**. The request payload shall include a Transaction UID. The user agent creates the Transaction UID when requesting a transition to the `IN PROGRESS` state for a given Workitem. The user agent provides that Transaction UID in subsequent transactions with that Workitem.

+* **Procedure Step State (0074, 1000)**. The legal values correspond to the requested state transition. They are: `IN PROGRESS`, `COMPLETED`, or `CANCELED`.

+#### Change Workitem state response status codes

+| Code | Description |

+| :- | :- |

+| `200 (OK)` | Workitem Instance was successfully retrieved. |

+| `400 (Bad Request)` | The request can't be performed for one of the following reasons: (1) the request is invalid given the current state of the Target Workitem. (2) the Transaction UID is missing. (3) the Transaction UID is incorrect |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Change Workitem state response payload

+* Responses include the header fields specified in [section 11.7.3.2](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#sect_11.7.3.2).

+* A success response shall have no payload.

+* A failure response payload may contain a Status Report describing any failures, warnings, or other useful information.

+### Search Workitems

+This transaction enables you to search for Workitems by attributes.

+| Method | Path | Description |

+| :-- | :- | :-- |

+| GET | ../workitems? | Search for Workitems |

+The following `Accept` header(s) are supported for searching:

+* `application/dicom+json`

+#### Supported Search Parameters

+The following parameters for each query are supported:

+| Key | Support Value(s) | Allowed Count | Description |

+| : | :- | : | :- |

+| `{attributeID}=` | `{value}` | 0...N | Search for attribute/ value matching in query. |

+| `includefield=` | `{attributeID}`<br/>`all` | 0...N | The additional attributes to return in the response. Only top-level attributes can be specified to be included - not attributes that are part of sequences. Both public and private tags are supported. When `all` is provided, see [Search Response](#search-response) for more information about which attributes will be returned for each query type. If a mixture of `{attributeID}` and `all` is provided, the server defaults to using 'all'. |

+| `limit=` | `{value}` | 0...1 | Integer value to limit the number of values returned in the response. Value can be between the range `1 >= x <= 200`. Defaulted to `100`. |

+| `offset=` | `{value}` | 0...1 | Skip {value} results. If an offset is provided larger than the number of search query results, a `204 (no content)` response is returned. |

+| `fuzzymatching=` | `true` \| `false` | 0...1 | If true fuzzy matching is applied to any attributes with the Person Name (PN) Value Representation (VR). It does a prefix word match of any name part inside these attributes. For example, if `PatientName` is `John^Doe`, then `joh`, `do`, `jo do`, `Doe` and `John Doe` all match. However `ohn` will **not** match. |

+##### Searchable Attributes

+We support searching on these attributes:

+| Attribute Keyword |

+| :- |

+|`PatientName`|

+|`PatientID`|

+|`ReferencedRequestSequence.AccessionNumber`|

+|`ReferencedRequestSequence.RequestedProcedureID`|

+|`ScheduledProcedureStepStartDateTime`|

+|`ScheduledStationNameCodeSequence.CodeValue`|

+|`ScheduledStationClassCodeSequence.CodeValue`|

+|`ScheduledStationGeographicLocationCodeSequence.CodeValue`|

+|`ProcedureStepState`|

+|`StudyInstanceUID`|

+##### Search Matching

+We support these matching types:

+| Search Type | Supported Attribute | Example |

+| :- | : | : |

+| Range Query | `ScheduledΓÇïProcedureΓÇïStepΓÇïStartΓÇïDateΓÇïTime` | `{attributeID}={value1}-{value2}`. For date/time values, we support an inclusive range on the tag. This will be mapped to `attributeID >= {value1} AND attributeID <= {value2}`. If `{value1}` isn't specified, all occurrences of dates/times prior to and including `{value2}` will be matched. Likewise, if `{value2}` isn't specified, all occurrences of `{value1}` and subsequent dates/times will be matched. However, one of these values has to be present. `{attributeID}={value1}-` and `{attributeID}=-{value2}` are valid, however, `{attributeID}=-` is invalid. |

+| Exact Match | All supported attributes | `{attributeID}={value1}` |

+| Fuzzy Match | `PatientName` | Matches any component of the name that starts with the value. |

+> [!NOTE]

+> While we don't support full sequence matching, we do support exact match on the attributes listed above that are contained in a sequence.

+##### Attribute ID

+Tags can be encoded in many ways for the query parameter. We have partially implemented the standard as defined in [PS3.18 6.7.1.1.1](http://dicom.nema.org/medical/dicom/2019a/output/chtml/part18/sect_6.7.html#sect_6.7.1.1.1). The following encodings for a tag are supported:

+| Value | Example |

+| :-- | : |

+| `{group}{element}` | `00100010` |

+| `{dicomKeyword}` | `PatientName` |

+Example query:

+`../workitems?PatientID=K123&0040A370.00080050=1423JS&includefield=00404005&limit=5&offset=0`

+#### Search Response

+The response is an array of `0...N` DICOM datasets with the following attributes returned:

+* All attributes in [DICOM PowerShell 3.4 Table CC.2.5-3](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3) with a Return Key Type of 1 or 2

+* All attributes in [DICOM PowerShell 3.4 Table CC.2.5-3](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3) with a Return Key Type of 1C for which the conditional requirements are met

+* All other Workitem attributes passed as match parameters

+* All other Workitem attributes passed as `includefield` parameter values

+#### Search Response Codes

+The query API returns one of the following status codes in the response:

+| Code | Description |

+| :-- | :- |

+| `200 (OK)` | The response payload contains all the matching resource. |

+| `206 (Partial Content)` | The response payload contains only some of the search results, and the rest can be requested through the appropriate request. |

+| `204 (No Content)` | The search completed successfully but returned no results. |

+| `400 (Bad Request)` | There was a problem with the request. For example, invalid Query Parameter syntax. The response body contains details of the failure. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Additional Notes

+The query API will not return `413 (request entity too large)`. If the requested query response limit is outside of the acceptable range, a bad request is returned. Anything requested within the acceptable range, will be resolved.

+* Paged results are optimized to return matched newest instance first, this may result in duplicate records in subsequent pages if newer data matching the query was added.

+* Matching is case insensitive and accent insensitive for PN VR types.

+* Matching is case insensitive and accent sensitive for other string VR types.

+* If there's a scenario where canceling a Workitem and querying the same happens at the same time, then the query will most likely exclude the Workitem that's getting updated and the response code will be `206 (Partial Content)`.

+### Next Steps

+For more information about the DICOM service, see

+>[!div class="nextstepaction"]

+>[Overview of the DICOM service](dicom-services-overview.md)

+ Title: DICOM Conformance Statement version 1 for Azure Health Data Services

+description: This document provides details about the DICOM Conformance Statement v1 for Azure Health Data Services.

+# DICOM Conformance Statement v1

+Additionally, the following nonstandard API(s) are supported:

+This version of the conformance statement corresponds to the `v1` version of the REST APIs.

+You can find example requests for supported transactions in the [Postman collection](https://github.com/microsoft/dicom-server/blob/main/docs/resources/Conformance-as-Postman.postman_collection.json).

+The service ignores the 128-byte File Preamble, and replaces its contents with null characters. This behavior ensures that no files passed through the service are vulnerable to the [malicious preamble vulnerability](https://dicom.nema.org/medical/dicom/current/output/chtml/part10/sect_7.5.html). However, this preamble sanitization also means that [preambles used to encode dual format content](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6489422/) such as TIFF can't be used with the service.

+The [Studies Service](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#chapter_10) allows users to store, retrieve, and search for DICOM Studies, Series, and Instances. We've added the nonstandard Delete transaction to enable a full resource lifecycle.

+Parameter `study` corresponds to the DICOM attribute StudyInstanceUID. If it's specified, any instance that doesn't belong to the provided study is rejected with a `43265` warning code.

+#### Store required attributes

+Each file stored must have a unique combination of `StudyInstanceUID`, `SeriesInstanceUID`, and `SopInstanceUID`. The warning code `45070` is returned if a file with the same identifiers already exists.

+The response payload populates a DICOM dataset with the following elements:

+Each dataset in the `FailedSOPSequence` has the following elements (if the DICOM file attempting to be stored could be read):

+Each dataset in the `ReferencedSOPSequence` has the following elements:

+When the requested transfer syntax is different from original file, the original file is transcoded to requested transfer syntax. The original file needs to be one of the following formats for transcoding to succeed, otherwise transcoding may fail:

+An unsupported `transfer-syntax` results in `406 Not Acceptable`.

+Retrieving metadata doesn't return attributes with the following value representations:

+* Data hasn't changed since the last request: `HTTP 304 (Not Modified)` response is sent with no response body.

+* Data has changed since the last request: `HTTP 200 (OK)` response is sent with updated ETag. Required data is also returned as part of the body.

+| `400 (Bad Request)` | The request was badly formatted. For example, the provided study instance identifier didn't conform to the expected UID format, or the requested transfer-syntax encoding isn't supported. |

+| `includefield=` | `{attributeID}`<br/>`all` | 0...N | The additional attributes to return in the response. Both, public and private tags are supported.<br/>When `all` is provided, refer to [Search Response](#search-response) for more information about which attributes are returned for each query type.<br/>If a mixture of `{attributeID}` and `all` is provided, the server defaults to using `all`. |

+| `offset=` | `{value}` | 0..1 | Skip `{value}` results.<br/>If an offset is provided larger than the number of search query results, a 204 (no content) response is returned. |

+| `fuzzymatching=` | `true` / `false` | 0..1 | If true fuzzy matching is applied to PatientName attribute. It does a prefix word match of any name part inside PatientName value. For example, if PatientName is "John^Doe", then "joh", "do", "jo do", "Doe" and "John Doe" all match. However, "ohn" doesn't match. |

+| Range Query | `StudyDate`/`PatientBirthDate` | `{attributeID}={value1}-{value2}`. For date/ time values, we support an inclusive range on the tag. This is mapped to `attributeID >= {value1} AND attributeID <= {value2}`. If `{value1}` isn't specified, all occurrences of dates/times prior to and including `{value2}` are matched. Likewise, if `{value2}` isn't specified, all occurrences of `{value1}` and subsequent dates/times are matched. However, one of these values has to be present. `{attributeID}={value1}-` and `{attributeID}=-{value2}` are valid, however, `{attributeID}=-` is invalid. |

+| Fuzzy Match | `PatientName`, `ReferringPhysicianName` | Matches any component of the name that starts with the value. |

+Tags can be encoded in several ways for the query parameter. We have partially implemented the standard as defined in [PS3.18 6.7.1.1.1](http://dicom.nema.org/medical/dicom/2019a/output/chtml/part18/sect_6.7.html#sect_6.7.1.1.1). The following encodings for a tag are supported:

+`../instances?Modality=CT&00280011=512&includefield=00280010&limit=5&offset=0`

+The response is an array of DICOM datasets. Depending on the resource, by *default* the following attributes are returned:

+#### Default Study tags

+#### Default Series tags

+#### Default Instance tags

+If `includefield=all`, the following attributes are included along with default attributes. Along with the default attributes, this is the full list of attributes supported at each resource level.

+The following attributes are returned:

+* `IncludeField` attributes supported at that resource level.

+* The query API doesn't return `413 (request entity too large)`. If the requested query response limit is outside of the acceptable range, a bad request is returned. Anything requested within the acceptable range will be resolved.

+* When target resource is Study/Series, there's a potential for inconsistent study/series level metadata across multiple instances. For example, two instances could have different patientName. In this case, the latest wins and you can search only on the latest data.

+* Paged results are optimized to return matched _newest_ instance first, this may result in duplicate records in subsequent pages if newer data matching the query was added.

+* Only the first value is indexed of a single valued data element that incorrectly has multiple values.

+This transaction isn't part of the official DICOMweb&trade; Standard. It uses the DELETE method to remove representations of Studies, Series, and Instances from the store.

+| Method | Path | Description |

+| :-- | : | :- |

+| DELETE | ../studies/{study} | Delete all instances for a specific study. |

+| DELETE | ../studies/{study}/series/{series} | Delete all instances for a specific series within a study. |

+### Response status codes

+The response body is empty. The status code is the only useful information returned.

+| Method | Path | Description |

+| :-- | :-- | :- |

+| POST | ../workitems | Create a Workitem. |

+| POST | ../workitems?{workitem} | Creates a Workitem with the specified UID. |

+There are several requirements related to DICOM data attributes in the context of a specific transaction. Attributes may be

+required to be present, required to not be present, required to be empty, or required to not be empty. These requirements can be

+found [in this table](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3).

+> [!NOTE]

+> Although the reference table above says that SOP Instance UID shouldn't be present, this guidance is specific to the DIMSE protocol and is handled differently in DICOMWebΓäó. SOP Instance UID should be present in the dataset if not in the URI.

+> [!NOTE]

+> All the conditional requirement codes including 1C and 2C are treated as optional.

+#### Create response status codes

+| Code | Description |

+| :-- | :- |

+| `201 (Created)` | The target Workitem was successfully created. |

+| `400 (Bad Request)` | There was a problem with the request. For example, the request payload didn't satisfy the requirements above. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `409 (Conflict)` | The Workitem already exists. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+#### Create response payload

+A success response has no payload. The `Location` and `Content-Location` response headers contain a URI reference to the created Workitem.

+A failure response payload contains a message describing the failure.

+### Request cancellation

+This transaction only succeeds against Workitems in the `SCHEDULED` state. Any user can claim ownership of a Workitem by setting its Transaction UID and changing its state to `IN PROGRESS`. From then on, a user can only modify the Workitem by providing the correct Transaction UID. While UPS defines Watch and Event SOP classes that allow cancellation requests and other events to be forwarded, this DICOM service doesn't implement these classes, and so cancellation requests on workitems that are `IN PROGRESS` returns failure. An owned Workitem can be canceled via the [Change Workitem State](#change-workitem-state) transaction.

+| Method | Path | Description |

+| : | :- | :-- |

+| POST | ../workitems/{workitem}/cancelrequest | Request the cancellation of a scheduled Workitem |

+#### Request cancellation response status codes

+| Code | Description |

+| : | :- |

+| `202 (Accepted)` | The request was accepted by the server, but the Target Workitem state hasn't necessarily changed yet. |

+| `400 (Bad Request)` | There was a problem with the syntax of the request. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. For example, the Target Workitem is in the `SCHEDULED` or `COMPLETED` state. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+#### Request cancellation response payload

+A success response has no payload, and a failure response payload contains a message describing the failure.

+If the Workitem Instance is already in a canceled state, the response includes the following HTTP Warning header:

+`299: The UPS is already in the requested state of CANCELED.`

+| Method | Path | Description |

+| : | :- | : |

+| GET | ../workitems/{workitem} | Request to retrieve a Workitem |

+#### Retrieve Workitem response status codes

+| Code | Description |

+| :- | :- |

+| 200 (OK) | Workitem Instance was successfully retrieved. |

+| 400 (Bad Request) | There was a problem with the request. |

+| 401 (Unauthorized) | The client isn't authenticated. |

+| 403 (Forbidden) | The user isn't authorized. |

+| 404 (Not Found) | The Target Workitem wasn't found. |

+#### Retrieve Workitem response payload

+To update a Workitem currently in the `SCHEDULED` state, the `Transaction UID` attribute shall not be present. For a Workitem in the `IN PROGRESS` state, the request must include the current Transaction UID as a query parameter. If the Workitem is already in the `COMPLETED` or `CANCELED` states, the response is `400 (Bad Request)`.

+| Method | Path | Description |

+| : | : | :-- |

+| POST | ../workitems/{workitem}?{transaction-uid} | Update Workitem Transaction |

+The request payload contains a dataset with the changes to be applied to the target Workitem. When modifying a sequence, the request must include all Items in the sequence, not just the Items to be modified.

+When multiple Attributes need to be updated as a group, do this as multiple Attributes in a single request, not as multiple requests.

+There are many requirements related to DICOM data attributes in the context of a specific transaction. Attributes may be

+required to be present, required to not be present, required to be empty, or required to not be empty. These requirements can be

+found in [this table](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#table_CC.2.5-3).

+> [!NOTE]

+> All the conditional requirement codes including 1C and 2C are treated as optional.

+> [!NOTE]

+> The request can't set the value of the Procedure Step State (0074,1000) attribute. Procedure Step State is managed using the Change State transaction, or the Request Cancellation transaction.

+#### Update Workitem transaction response status codes

+| Code | Description |

+| :- | :- |

+| `200 (OK)` | The Target Workitem was updated. |

+| `400 (Bad Request)` | There was a problem with the request. For example: (1) the Target Workitem was in the `COMPLETED` or `CANCELED` state. (2) the Transaction UID is missing. (3) the Transaction UID is incorrect. (4) the dataset didn't conform to the requirements.

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. |

+| `415 (Unsupported Media Type)` | The provided `Content-Type` isn't supported. |

+#### Update Workitem transaction response payload

+### Change Workitem state

+If the Workitem exists on the origin server, the Workitem shall be returned in an Acceptable Media Type. The returned Workitem shall not contain the Transaction UID (0008,1195) attribute. This is necessary to preserve this Attribute's role as an access lock as described [here.](https://dicom.nema.org/medical/dicom/current/output/html/part04.html#sect_CC.1.1)

+| Method | Path | Description |

+| : | : | :-- |

+| PUT | ../workitems/{workitem}/state | Change Workitem State |

+* **Transaction UID (0008, 1195)**. The request payload shall include a Transaction UID. The user agent creates the Transaction UID when requesting a transition to the `IN PROGRESS` state for a given Workitem. The user agent provides that Transaction UID in subsequent transactions with that Workitem.

+* **Procedure Step State (0074, 1000)**. The legal values correspond to the requested state transition. They are: `IN PROGRESS`, `COMPLETED`, or `CANCELED`.

+#### Change Workitem state response status codes

+| Code | Description |

+| :- | :- |

+| `200 (OK)` | Workitem Instance was successfully retrieved. |

+| `400 (Bad Request)` | The request can't be performed for one of the following reasons: (1) the request is invalid given the current state of the Target Workitem. (2) the Transaction UID is missing. (3) the Transaction UID is incorrect |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `404 (Not Found)` | The Target Workitem wasn't found. |

+| `409 (Conflict)` | The request is inconsistent with the current state of the Target Workitem. |

+#### Change Workitem state response payload

+* Responses include the header fields specified in [section 11.7.3.2](https://dicom.nema.org/medical/dicom/current/output/html/part18.html#sect_11.7.3.2).

+| Method | Path | Description |

+| :-- | :- | :-- |

+| GET | ../workitems? | Search for Workitems |

+* `application/dicom+json`

+| Key | Support Value(s) | Allowed Count | Description |

+| : | :- | : | :- |

+| `{attributeID}=` | `{value}` | 0...N | Search for attribute/ value matching in query. |

+| `includefield=` | `{attributeID}`<br/>`all` | 0...N | The additional attributes to return in the response. Only top-level attributes can be specified to be included - not attributes that are part of sequences. Both public and private tags are supported. When `all` is provided, see [Search Response](#search-response) for more information about which attributes are returned for each query type. If a mixture of `{attributeID}` and `all` is provided, the server defaults to using 'all'. |

+| `limit=` | `{value}` | 0...1 | Integer value to limit the number of values returned in the response. Value can be between the range `1 >= x <= 200`. Defaulted to `100`. |

+| `offset=` | `{value}` | 0...1 | Skip {value} results. If an offset is provided larger than the number of search query results, a `204 (no content)` response is returned. |

+| `fuzzymatching=` | `true` \| `false` | 0...1 | If true fuzzy matching is applied to any attributes with the Person Name (PN) Value Representation (VR). It does a prefix word match of any name part inside these attributes. For example, if `PatientName` is `John^Doe`, then `joh`, `do`, `jo do`, `Doe` and `John Doe` all match. However `ohn` does **not** match. |

+| Search Type | Supported Attribute | Example |

+| :- | : | : |

+| Range Query | `ScheduledΓÇïProcedureΓÇïStepΓÇïStartΓÇïDateΓÇïTime` | `{attributeID}={value1}-{value2}`. For date/time values, we support an inclusive range on the tag. This will be mapped to `attributeID >= {value1} AND attributeID <= {value2}`. If `{value1}` isn't specified, all occurrences of dates/times prior to and including `{value2}` will be matched. Likewise, if `{value2}` isn't specified, all occurrences of `{value1}` and subsequent dates/times will be matched. However, one of these values has to be present. `{attributeID}={value1}-` and `{attributeID}=-{value2}` are valid, however, `{attributeID}=-` is invalid. |

+| Exact Match | All supported attributes | `{attributeID}={value1}` |

+| Fuzzy Match | `PatientName` | Matches any component of the name that starts with the value. |

+Tags can be encoded in many ways for the query parameter. We have partially implemented the standard as defined in [PS3.18 6.7.1.1.1](http://dicom.nema.org/medical/dicom/2019a/output/chtml/part18/sect_6.7.html#sect_6.7.1.1.1). The following encodings for a tag are supported:

+| Value | Example |

+| :-- | : |

+| `{group}{element}` | `00100010` |

+| `{dicomKeyword}` | `PatientName` |

+The response is an array of `0...N` DICOM datasets with the following attributes returned:

+The query API returns one of the following status codes in the response:

+| Code | Description |

+| :-- | :- |

+| `200 (OK)` | The response payload contains all the matching resource. |

+| `206 (Partial Content)` | The response payload contains only some of the search results, and the rest can be requested through the appropriate request. |

+| `204 (No Content)` | The search completed successfully but returned no results. |

+| `400 (Bad Request)` | There was a problem with the request. For example, invalid Query Parameter syntax. The response body contains details of the failure. |

+| `401 (Unauthorized)` | The client isn't authenticated. |

+| `403 (Forbidden)` | The user isn't authorized. |

+| `503 (Service Unavailable)` | The service is unavailable or busy. Try again later. |

+The query API will not return `413 (request entity too large)`. If the requested query response limit is outside of the acceptable range, a bad request is returned. Anything requested within the acceptable range, will be resolved.

+For more information about the DICOM service, see

+# Enable audit and diagnostic logging in the DICOM service

+## Enable logs

+1. To enable logging DICOM service, select your DICOM service in the Azure portal.

+## Log details

+The log schema used differs based on the destination. Log Analytics has a schema that will differ from other destinations. Each log type will also have a schema that differs.

+### Audit log details

+#### Raw logs

+The DICOM service returns the following fields in the audit log as seen when streamed outside of Log Analytics:

+|location|String|The location of the server that processed the request.

+|level|String|Log level (Informational, Error).

+#### Log Analytics logs

+The DICOM service returns the following fields in the audit log in Log Analytics:

+|Field Name |Type |Notes |

+||||

+|CorrelationId|String|Correlation ID

+|OperationName|String|Describes the type of operation (for example, Retrieve, Store, Query, etc.)

+|TimeGenerated [UTC]|DateTime|Date and time of the event.

+|_ResourceId|String| Azure path to the resource.

+|Identity|Dynamic|A generic property bag containing identity information (currently doesn't apply to DICOM).

+|Uri|String|The request URI.

+|ResultType|String| The available values currently are Started, Succeeded, or Failed.

+|StatusCode|Int|The HTTP Status Code (for example, 200)

+|Type|String|Type of log (it's always AHDSDicomAuditLogs in this case).

+|TenantId|String| Tenant ID.

+### Diagnostic log details

+#### Raw logs

+The DICOM service returns the following fields in the audit log as seen when streamed outside of Log Analytics:

+|Field Name |Type |Notes |

+||||

+|correlationId|String|Correlation ID

+|operationName|String|Describes the type of operation (for example, Retrieve, Store, Query, etc.)

+|time|DateTime|Date and time of the event.

+|resultDescription|String|Description of the log entry. An example here is a diagnostic log with a validation warning message when storing a file.

+|resourceId|String| Azure path to the resource.

+|identity|Dynamic|A generic property bag containing identity information (currently doesn't apply to DICOM).

+|location|String|The location of the server that processed the request.

+|properties|String|Additional information about the event in JSON array format. Examples include DICOM identifiers present in the request.

+|level|String|Log level (Informational, Error).

+#### Log Analytics logs

+The DICOM service returns the following fields in the audit log in Log Analytics:

+|Field Name |Type |Notes |

+||||

+|CorrelationId|String|Correlation ID

+|OperationName|String|Describes the type of operation (for example, Retrieve, Store, Query, etc.)

+|TimeGenerated|DateTime|Date and time of the event.

+|Message|String|Description of the log entry. An example here is a diagnostic log with a validation warning message when storing a file.

+|Location|String|The location of the server that processed the request.

+|Properties|String|Additional information about the event in JSON array format. Examples include DICOM identifiers present in the request.

+|LogLevel|String|Log level (Informational, Error).

+## Sample Log Analytics queries

+description: Learn how to deploy the MedTech service using an Azure Resource Manager template.

+In this quickstart, learn how to:

+The ARM template used to deploy the resources in this quickstart is available at [Azure Quickstart Templates](/samples/azure/azure-quickstart-templates/iotconnectors/) by using the *azuredeploy.json* file on [GitHub](https://github.com/azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.healthcareapis/workspaces/iotconnectors/).

+ :::image type="content" source="media\deploy-arm-template\iot-deploy-quickstart-options.png" alt-text="Screenshot of Azure portal page displaying deployment options for the Azure Health Data Service MedTech service." lightbox="media\deploy-arm-template\iot-deploy-quickstart-options.png":::

+ :::image type="content" source="media\deploy-arm-template\iot-review-and-create-button.png" alt-text="Screenshot that shows the Review + create button selected in the Azure portal.":::

+ :::image type="content" source="media\deploy-arm-template\iot-validation-completed.png" alt-text="Screenshot that shows the Review + create pane displaying the Validation Passed message.":::

+ :::image type="content" source="media\deploy-arm-template\iot-create-button.png" alt-text="Screenshot that shows the highlighted Create button.":::

+ :::image type="content" source="media\deploy-arm-template\iot-deployment-complete-banner.png" alt-text="Screenshot that shows a green checkmark and the message Your deployment is complete.":::

+ > * Two MedTech services accessing the same device message event hub.

+ > * A MedTech service and a storage writer application accessing the same device message event hub.

+* Event Hubs namespace and event hub. In this deployment, the event hub is named *devicedata*.

+ * An event hub consumer group. In this deployment, the consumer group is named *$Default*.

+ * An Azure Event Hubs Data Sender role. In this deployment, the sender role is named *devicedatasender* and can be used to provide access to the device event hub using a shared access signature (SAS). To learn more about authorizing access using a SAS, see [Authorizing access to Event Hubs resources using Shared Access Signatures](../../event-hubs/authorize-access-shared-access-signature.md).

+* A Health Data Services workspace.

+* A Health Data Services Fast Healthcare Interoperability Resources FHIR service.

+* A Health Data Services MedTech service with the required [system-assigned managed identity](../../active-directory/managed-identities-azure-resources/overview.md) roles:

+ * For the event hub, the Azure Event Hubs Data Receiver role is assigned in the [Access control section (IAM)](../../role-based-access-control/overview.md) of the device message event hub.

+ * For the FHIR service, the FHIR Data Writer role is assigned in the [Access control section (IAM)](../../role-based-access-control/overview.md) of the FHIR service.

+After you have successfully deployed an instance of the MedTech service, you'll still need to provide conforming and valid device and FHIR destination mappings.

+ * To learn about the device mapping, see [Overview of the MedTech service device mapping](overview-of-device-mapping.md).

+ * To learn about the FHIR destination mapping, see [Overview of the MedTech service FHIR destination mapping](overview-of-fhir-destination-mapping.md).

+In this quickstart, you learned how to deploy the MedTech service in the Azure portal using an ARM template with the **Deploy to Azure** button.

+ :::image type="content" source="media\deploy-manual-config\select-device-mapping-button.png" alt-text="Screenshot of Basics tab filled out correctly." lightbox="media\deploy-manual-config\select-device-mapping-button.png":::

+ :::image type="content" source="media\deploy-manual-config\validate-and-review-medtech-service.png" alt-text="Screenshot of validation success with details displayed." lightbox="media\deploy-manual-config\validate-and-review-medtech-service.png":::

+ :::image type="content" source="media\deploy-manual-post\created-medtech-service.png" alt-text="Screenshot of the MedTech service deployment completion." lightbox="media\deploy-manual-post\created-medtech-service.png":::

+ :::image type="content" source="media\deploy-manual-post\validate-medtech-service-managed-identity-added-to-event-hub.png" alt-text="Screenshot of the MedTech service system-assigned managed identity being successfully granted access to the event hub with a red box around the message." lightbox="media\deploy-manual-post\validate-medtech-service-managed-identity-added-to-event-hub.png":::

+For enhanced workflows and ease of use, you can use the MedTech service to receive messages from devices you create and manage through an IoT hub in [Azure IoT Hub](../../iot-hub/iot-concepts-and-iot-hub.md). This tutorial uses an Azure Resource Manager template (ARM template) and a **Deploy to Azure** button to deploy a MedTech service. The template deploys an IoT hub to create and manage devices, and then routes the device messages to an event hub for the MedTech service to read and process.

+> To learn how the MedTech service transforms and persists device data into the FHIR service as FHIR Observations, see [Overview of the MedTech service device data processing stages](overview-of-device-data-processing-stages.md).

+> * Open an ARM template in the Azure portal.

+> * Configure the template for your deployment.

+> * Create a device.

+> * Send a test message.

+> * Review metrics for the test message.

+The ARM template used to deploy the resources in this tutorial is available at [Azure Quickstart Templates](/samples/azure/azure-quickstart-templates/iotconnectors-with-iothub/) by using the *azuredeploy.json* file on [GitHub](https://github.com/azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.healthcareapis/workspaces/iotconnectors-with-iothub).

+ - **Basename**: A value that's appended to the name of the Azure resources and services that are deployed. The examples in this tutorial use the basename *azuredocsdemo*. You can choose your own basename value.

+ > * Two MedTech services accessing the same device message event hub.

+ > * A MedTech service and a storage writer application accessing the same device message event hub.

+* An Event Hubs namespace and event hub. In this deployment, the event hub is named *devicedata*.

+ * An event hub consumer group. In this deployment, the consumer group is named *$Default*.

+ * An Azure Event Hubs Data Sender role. In this deployment, the sender role is named *devicedatasender* and can be used to provide access to the device event hub using a shared access signature (SAS). To learn more about authorizing access using a SAS, see [Authorizing access to Event Hubs resources using Shared Access Signatures](../../event-hubs/authorize-access-shared-access-signature.md). The Azure Event Hubs Data Sender role isn't used in this tutorial.

+* An IoT hub with [message routing](../../iot-hub/iot-hub-devguide-messages-d2c.md) configured to send device messages to the event hub.

+* A [user-assigned managed identity](../../active-directory/managed-identities-azure-resources/overview.md), which provides send access from the IoT hub to the event hub. The managed identity has the Azure Event Hubs Data Sender role in the [Access control section (IAM)](../../role-based-access-control/overview.md) of the event hub.

+ - For the event hub, the Azure Event Hubs Data Receiver role is assigned in the [Access control section (IAM)](../../role-based-access-control/overview.md) of the event hub.

+- Conforming and valid MedTech service [device](overview-of-device-mapping.md) and [FHIR destination mappings](overview-of-fhir-destination-mapping.md). **Resolution type** is set to **Create**.

+> To learn about the MedTech service resolution types **Create** and **Lookup**, see [Destination properties](deploy-manual-config.md#destination-properties).

+* Read the IoT hub-routed test message from the event hub.

+* Transform the test message into five FHIR Observations.

+* Persist the FHIR Observations to your FHIR service.

+4. Select your IoT hub. The name of your IoT hub is the *basename* you provided when you provisioned the resources prefixed with **ih-**. An example hub name is *ih-azuredocsdemo*.

+5. In Explorer, in **Azure IoT Hub**, select **…** and choose **Create Device**. An example device name is *iot-001*.

+ > In this device-to-cloud (D2C) example, *cloud* is the IoT hub in the Azure IoT Hub that receives the device message. Azure IoT Hub supports two-way communications. To set up a cloud-to-device (C2D) scenario, select **Send C2D Message to Device Cloud**.

+ * **Device(s) to send messages from**: The name of the device you created.

+ * **Message(s) per device**: **1**.

+ * **Interval between two messages**: **1 second(s)**.

+ * **Message**: **Plain Text**.

+ * **Edit**: Clear any existing text, and then paste the following JSON.

+* **Number of Incoming Messages**: Received the incoming test message from the device message event hub.

+* **Number of Normalized Messages**: Created five normalized messages.

+* **Number of Measurements**: Created five measurements.

+* **Number of FHIR resources**: Created five FHIR resources that are persisted in your FHIR service.

+[  ](./media/iot-edge-for-linux-on-windows-security/eflow-cr-partition-layout.png#lightbox)

+Stay up-to-date with the latest [IoT Edge for Linux on Windows updates](./iot-edge-for-linux-on-windows-updates.md).

+ Title: Tutorial - IoT data visualization with Power BI

+description: This tutorial uses Power BI to visualize temperature and humidity data that is collected from the sensor and sent to your Azure IoT hub.

+You can use Microsoft Power BI to visualize real-time sensor data that your Azure IoT hub receives. To do so, configure an Azure Stream Analytics job to consume the data from IoT Hub and route it to a dataset in Power BI.

+[Microsoft Power BI](https://powerbi.microsoft.com/) is a data visualization tool that you can use to perform self-service and enterprise business intelligence (BI) over large data sets. [Azure Stream Analytics](https://azure.microsoft.com/services/stream-analytics/#overview) is a fully managed, real-time analytics service designed to help you analyze and process fast moving streams of data that can be used to get insights, build reports or trigger alerts and actions.

+If you don't have an Azure subscription, [create a free account](https://azure.microsoft.com/free/) before you begin.

+Before you begin this tutorial, have the following prerequisites in place:

+* Complete one of the [Send telemetry](../iot-develop/quickstart-send-telemetry-iot-hub.md) quickstarts in the development language of your choice. Alternatively, you can use any device app that sends temperature telemetry; for example, the [Raspberry Pi online simulator](iot-hub-raspberry-pi-web-simulator-get-started.md) or one of the [Embedded device](../iot-develop/quickstart-devkit-mxchip-az3166.md) quickstarts. These articles cover the following requirements:

+* A Power BI account. [Try Power BI for free.](https://powerbi.microsoft.com/)

+Create a Stream Analytics job. After you create the job, you define the inputs, outputs, and the query used to retrieve the data.

+Create a Stream Analytics job that you'll use to route data from IoT Hub to Power BI.

+1. In the [Azure portal](https://portal.azure.com), select **Create a resource**. Type *Stream Analytics Job* in the search box and select it from the drop-down list. On the **Stream Analytics job** overview page, select **Create**

+2. In the **Basics** tab of the **New Stream Analytics job** page, enter the following information:

+ | Parameter | Value |

+ | | -- |

+ | **Subscription** | Select the subscription that contains your IoT hub. |

+ | **Resource group** | Select the resource group that contains your IoT hub. |

+ | **Name** | Enter the name of the job. The name must be globally unique. |

+ | **Region** | Select the region where your IoT hub is located. |

+ Leave all other fields at their defaults.

+ :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/create-stream-analytics-job.png" alt-text="Screenshot that shows creating a Stream Analytics job.":::

+4. Once the job is created, select **Go to resource**.

+### Add an input to the Stream Analytics job

+Configure the Stream Analytics job to collect data from your IoT hub.

+1. Open the Stream Analytics job.

+2. Select **Inputs** from the **Job simulation** section of the navigation menu.

+3. Select **Add input**, then select **IoT Hub** from the drop-down list.

+ :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/add-input-iot-hub.png" alt-text="Screenshot that shows selecting IoT Hub from the add input menu.":::

+4. On the new input pane, enter the following information:

+ | Parameter | Value |

+ | | -- |

+ | **Input alias** | Enter a unique alias for the input. For example, `PowerBIVisualizationInput`. |

+ | **Subscription** | Select the Azure subscription you're using for this tutorial. |

+ | **IoT Hub** | Select the IoT hub you're using for this tutorial. |

+ | **Consumer group** | Select the consumer group you created previously. |

+ | **Shared access policy name** | Select the name of the shared access policy you want the Stream Analytics job to use for your IoT hub. For this tutorial, you can select *service*. The *service* policy is created by default on new IoT hubs and grants permission to send and receive on cloud-side endpoints exposed by the IoT hub. To learn more, see [Access control and permissions](iot-hub-dev-guide-sas.md#access-control-and-permissions). |

+ | **Shared access policy key** | This field is automatically filled, based on your selection for the shared access policy name. |

+ | **Endpoint** | Select **Messaging**. |

+ Leave all other fields at their defaults.

+5. Select **Save**.

+1. Select **Outputs** from the **Job simulation** section of the navigation menu.

+2. Select **Add output**, and then select **Power BI** from the drop-down list.

+ :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/add-output-power-bi.png" alt-text="Screenshot that shows selecting Power BI from the add output menu.":::

+3. After you've signed in to Power BI, enter the following information to create a Power BI output:

+ | Parameter | Value |

+ | | -- |

+ | **Output alias** | A unique alias for the output. For example, `PowerBIVisualizationOutput`. |

+ | **Group workspace** | Select your target group workspace. |

+ | **Authentication mode** | The portal warns you if you don't have the correct permissions to use managed identities for authentication. If that's the case, select **User token** instead. |

+ | **Dataset name** | Enter a dataset name. |

+ | **Table name** | Enter a table name. |

+4. Select **Authorize** and sign in to your Power BI account.

+1. Select **Query** from the **Job simulation** section of the navigation menu.

+2. In the query editor, replace `[YourOutputAlias]` with the output alias of the job.

+3. Replace `[YourInputAlias]` with the input alias of the job.

+4. Add the following `WHERE` clause as the last line of the query. This line ensures that only messages with a **temperature** property will be forwarded to Power BI.

+ ```sql

+ WHERE temperature IS NOT NULL

+ ```

+5. Your query should look similar to the following screenshot. Select **Save query**.

+ :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/add-query-to-stream-analytics-job.png" alt-text=" Screenshot that shows adding a query to a Stream Analytics job.":::

+### Run the Stream Analytics job

+1. In the Stream Analytics job, select **Overview**.

+1. Select **Start** > **Now** > **Start**. Once the job successfully starts, the job status changes from **Stopped** to **Running**.

+The following steps show you how to create and publish a report using the Power BI service.

+1. Make sure that your IoT device is running and sending temperature data to IoT hub.

+2. Sign in to your [Power BI](https://powerbi.microsoft.com/) account.

+3. Select **Workspaces** from the side menu, then select the group workspace you chose in the Stream Analytics job output.

+4. On your workspace view, you should see the dataset that you specified when you created the output for the Stream Analytics job.

+ :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/power-bi-create-report.png" alt-text="Screenshot that shows creating a Microsoft Power BI report.":::

+ 3. Drag **EventEnqueuedUtcTime** to **X Axis** on the **Visualizations** pane.

+ 4. Drag **temperature** to **Y Axis**.

+7. Select **File** > **Save** to save the report. When prompted, enter a name for your report.

+8. Still on the report pane, select **File** > **Embed report** > **Website or portal**.

+ > :::image type="content" source="./media/iot-hub-live-data-visualization-in-power-bi/contact-admin.png" alt-text="Screenshot that shows the Contact your administrator notification.":::

+9. You're provided the report link that you can share with anyone for report access and a code snippet that you can use to integrate the report into a blog or website. Copy the link in the **Secure embed code** window and then close the window.

+10. Open a web browser and paste the link into the address bar to view your report in the browser.

+In this tutorial, you created a Stream Analytics job and a dataset in Power BI.

+If you plan to complete other tutorials, you may want to keep the resource group and IoT hub, so you can reuse them later.

+### Clean up Azure resources

+Your Stream Analytics job should be in the same resource group as your IoT hub. If you don't need the IoT hub or the other resources you created any longer, you can delete the entire resource group in the Azure portal. Or, you can delete individual resources.

+1. In the Azure portal, navigate to your resource group.

+1. Review the resources in your group. If you want to delete them all, select **Delete resource group**. If you want to delete an individual resource, right-click the resource, select **Delete** from the context menu, and follow the prompts.

+To remove the resource group and all of its resources, you can also use the [az group delete](/cli/azure/group#az-group-delete) command:

+You created a dataset, **PowerBiVisualizationDataSet**, in Power BI. You can delete your dataset and the associated report you created from the Power BI service.

+1. Sign in to your [Power BI](https://powerbi.microsoft.com/) account.

+1. Select **Workspaces**, then select the name of the workspace that contains your dataset.

+1. Hover over the **PowerBiVisualizationDataSet** dataset and select the three horizontal dots that appear to open the **More options** menu.

+1. Select **Delete** and follow the prompts. When you remove the dataset, the report is removed as well.

+## Next steps

+In this tutorial, you learned how to use Power BI to visualize real-time sensor data from your Azure IoT hub.

+For another way to visualize data from Azure IoT Hub, see the following tutorial:

+> [Use a web app to visualize real-time sensor data from Azure IoT Hub](iot-hub-live-data-visualization-in-web-apps.md).

+Azure Lab Services enables you to set up a [template virtual machine](./classroom-labs-concepts.md#template-virtual-machine) in a lab, which serves as a base image for the VMs of your students. Teaching a networking, security or IT class can require an environment with multiple VMs. These VMs also need to communicate with each other.

+Nested virtualization enables you to create a multi-VM environment inside a lab's template virtual machine. Publishing the template provides each lab user with a virtual machine that has multiple VMs within it. This article explains the concepts of nested virtualization on a template VM in Azure Lab Services, and how to enable it.

+- The host VM requires extra configuration to let the client machines have internet connectivity.

+- Virtualization applications other than Hyper-V are [*not* supported for nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization#3rd-party-virtualization-apps). This includes any software that requires hardware virtualization extensions.

+To enable nested virtualization on a template VM, you first connect to the template VM with a remote desktop client. You then make the required configuration changes inside the template VM.

+You can accomplish the tasks listed previously by using a script, or by using Windows tools. Follow these steps to [enable nested virtualization on a template VM](./how-to-enable-nested-virtualization-template-vm-using-script.md).

+> [!NOTE]

+> Virtualization applications other than Hyper-V are [*not* supported for nested virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization#3rd-party-virtualization-apps). This includes any software that requires hardware virtualization extensions.

+ * The **Liquid** built-in connector lets you select a map that you previously uploaded to your logic app resource or to a linked integration account, but not both.

+ * Supports XSLT 1.0, 2.0, and 3.0.

+ * Azure Logic Apps allocates finite memory for processing XML transformations. If you create Consumption workflows, and your map or payload transformations have high memory consumption, such transformations might fail, resulting in out of memory errors. To avoid this scenario, consider these options:

+ * Edit your maps or payloads to reduce memory consumption.

+ * Create [Standard logic app workflows](logic-apps-overview.md#resource-environment-differences), which run in single-tenant Azure Logic Apps and offer dedicated and flexible options for compute and memory resources.

+ * If you're working on a [Standard logic app resource and workflow](logic-apps-overview.md#resource-environment-differences), you can link your integration account to your logic app resource, upload maps directly to your logic app resource, or both, based on the following scenarios:

+ * If you already have an integration account with the artifacts that you need or want to use, you can link your integration account to multiple Standard logic app resources where you want to use the artifacts. That way, you don't have to upload maps to each individual logic app. For more information, review [Link your logic app resource to your integration account](logic-apps-enterprise-integration-create-integration-account.md?tabs=standard#link-account).

+ * If you don't have an integration account or only plan to use your artifacts across multiple workflows within the *same logic app resource*, you can [directly add maps to your logic app resource](logic-apps-enterprise-integration-maps.md) using either the Azure portal or Visual Studio Code.

+ > [!NOTE]

+ >

+ > The Liquid built-in connector lets you select a map that you previously uploaded to your logic app resource or to a linked integration account, but not both.

+ So, if you don't have or need an integration account, you can use the upload option. Otherwise, you can use the linking option. Either way, you can use these artifacts across all child workflows within the same logic app resource.

+ You still need an integration account to store other artifacts, such as partners, agreements, and certificates, along with using the [AS2](logic-apps-enterprise-integration-as2.md), [X12](logic-apps-enterprise-integration-x12.md), and [EDIFACT](logic-apps-enterprise-integration-edifact.md) operations.

+## April 26, 2023

+[Data Science VM ΓÇô Ubuntu 20.04](https://azuremarketplace.microsoft.com/marketplace/apps/microsoft-dsvm.ubuntu-2004?tab=Overview)

+Version `23.04.24`

+Main changes:

+- SDK `1.50.0`

+- Dotnet upgraded to `6.0` SDK

+- PyTorch GPU functionality fixed in `azureml_py38_PT_and_TF environment.

+- Blobfuse upgraded to blobfuse2

+* [Cluster](#cluster-quota)

+#### Cluster quota

+This issue will occur when you do not have enough Azure ML Compute cluster quota. This quota defines the total number of clusters that may be in use at one time per subscription to deploy CPU or GPU nodes in Azure Cloud.

+A possible mitigation is to check if there are unused deployments that you can delete. Or you can submit a [request for a quota increase](how-to-manage-quotas.md#request-quota-increases). Make sure to select `Machine Learning Service: Cluster Quota` as the quota type for this quota increase request.

+If you receive an error similar to "Row size too large (> 8126)", you may want to turn OFF the parameter **innodb_strict_mode**. The server parameter **innodb_strict_mode** can't be modified globally at the server level because if row data size is larger than 8k, the data is truncated without an error, which can lead to potential data loss. We recommend modifying the schema to fit the page size limit.

+The binary log contains ΓÇ£eventsΓÇ¥ that describe database changes such as table creation operations or changes to table data. It also contains events for statements that potentially could have made changes. The binary log is used mainly for two purposes, replication and data recovery operations. Usually, the binary logs are purged as soon as the handle is free from service, backup or the replica set. If there are multiple replicas, the binary logs wait for the slowest replica to read the changes before it's been purged. If you want to persist binary logs for a more duration of time, you can configure the parameter binlog_expire_logs_seconds. If the binlog_expire_logs_seconds is set to 0, which is the default value, it purges as soon as the handle to the binary log is freed. If binlog_expire_logs_seconds > 0, then it would wait until the seconds configured before it purges. For Azure database for MySQL, managed features like backup and read replica purging of binary files are handled internally. When you replicate the data-out from the Azure Database for MySQL service, this parameter needs to be set in primary to avoid purging of binary logs before the replica reads from the changes from the primary. If you set the binlog_expire_logs_seconds to a higher value, then the binary logs won't be purged soon enough and can lead to increase in the storage billing.

+ ```sql

+ +--++-+--+--++-+-+++++-+-+--+

+ | Db | Name | Definer | Time zone | Type | Execute at | Interval value | Interval field | Starts | Ends | Status | Originator | character_set_client | collation_connection | Database Collation |

+ +--++-+--+--++-+-+++++-+-+--+

+ | db1 | test_event_01 | azureuser@% | SYSTEM | RECURRING | NULL | 1 | MINUTE | 2023-04-05 14:47:04 | 2023-04-05 15:47:04 | ENABLED | 3221153808 | latin1 | latin1_swedish_ci | latin1_swedish_ci |

+ +--++-+--+--++-+-+++++-+-+--+

+ 1 row in set (0.23 sec)

+ ```

+5. After few minutes, query the rows from the table to begin viewing the rows inserted every minute as per the `event_scheduler` parameter you configured:

+ ```azurecli

+ mysql> select * from tab1;

+ +-++-+

+ | id | CreatedAt | CreatedBy |

+ +-++-+

+ | 1 | 2023-04-05 14:47:04 | azureuser@% |

+ | 2 | 2023-04-05 14:48:04 | azureuser@% |

+ | 3 | 2023-04-05 14:49:04 | azureuser@% |

+ | 4 | 2023-04-05 14:50:04 | azureuser@% |

+ +-++-+

+ 4 rows in set (0.23 sec)

+ ```

+6. After an hour, run a Select statement on the table to view the complete result of the values inserted into table every minute for an hour as the `event_scheduler` is configured in our case.

+ ```azurecli

+ mysql> select * from tab1;

+ +-++-+

+ | id | CreatedAt | CreatedBy |

+ +-++-+

+ | 1 | 2023-04-05 14:47:04 | azureuser@% |

+ | 2 | 2023-04-05 14:48:04 | azureuser@% |

+ | 3 | 2023-04-05 14:49:04 | azureuser@% |

+ | 4 | 2023-04-05 14:50:04 | azureuser@% |

+ | 5 | 2023-04-05 14:51:04 | azureuser@% |

+ | 6 | 2023-04-05 14:52:04 | azureuser@% |

+ ..< 50 lines trimmed to compact output >..

+ | 56 | 2023-04-05 15:42:04 | azureuser@% |

+ | 57 | 2023-04-05 15:43:04 | azureuser@% |

+ | 58 | 2023-04-05 15:44:04 | azureuser@% |

+ | 59 | 2023-04-05 15:45:04 | azureuser@% |

+ | 60 | 2023-04-05 15:46:04 | azureuser@% |

+ | 61 | 2023-04-05 15:47:04 | azureuser@% |

+ +-++-+

+ 61 rows in set (0.23 sec)

+ ```

+#### Other scenarios

+You can set up an event based on the requirements of your specific scenario. A few similar examples of scheduling SQL statements to run at different time intervals follow.

+**Run a SQL statement now and repeat one time per day with no end**

+```sql

+CREATE EVENT <event name>

+ON SCHEDULE

+EVERY 1 DAY

+STARTS (TIMESTAMP(CURRENT_DATE) + INTERVAL 1 DAY + INTERVAL 1 HOUR)

+COMMENT 'Comment'

+DO

+<your statement>;

+```

+**Run a SQL statement every hour with no end**

+```sql

+CREATE EVENT <event name>

+ON SCHEDULE

+EVERY 1 HOUR

+COMMENT 'Comment'

+DO

+<your statement>;

+```

+**Run a SQL statement every day with no end**

+```sql

+CREATE EVENT <event name>

+ON SCHEDULE

+EVERY 1 DAY

+STARTS str_to_date( date_format(now(), '%Y%m%d 0200'), '%Y%m%d %H%i' ) + INTERVAL 1 DAY

+COMMENT 'Comment'

+DO

+<your statement>;

+```

+ ```sql

+ physif="net2"

+ | TS_NET2_IP | The terminal server PE2 to TS NET2 IP |

+ | TS_NET2_NETMASK | The terminal server PE2 to TS NET2 netmask |

+ | TS_NET2_GW | The terminal server PE2 to TS NET2 gateway |

+This article describes how to integrate partner network ground stations for customers with partner network contracts. In order to use Azure Orbital Ground Station to make contacts with partner network ground station sites, your spacecraft must be authorized in the portal.

+- [Contributor permissions](https://learn.microsoft.com/azure/role-based-access-control/rbac-and-directory-admin-roles#azure-roles) at the subscription level.

+- A [Basic Support Plan](https://azure.microsoft.com/support/plans/) or higher is required for a spacecraft authorization request.

+- A spacecraft license is required for private spacecraft.

+- An active contract with the partner network(s) you wish to integrate with Azure Orbital Ground Station:

+ - [KSAT Lite](https://azuremarketplace.microsoft.com/marketplace/apps/kongsbergsatelliteservicesas1657024593438.ksatlite?exp=ubp8&tab=Overview)

+- A ground station license for each of the partner network sites you wish to contact is required for private spacecraft.

+- A registered spacecraft object. Learn more on how to [register a spacecraft](register-spacecraft.md).

+## Obtain licencses

+Obtain the proper **spacecraft license(s)** for a private spacecraft. Additionally, work with the partner network to obtain a **ground station license** for each partner network site you intend to use with your spacecraft.

+ > [!NOTE]

+ > Public spacecraft do not require licensing for authorization. The Azure Orbital Ground Station service supports several public satellites including Aqua, Suomi NPP, JPSS-1/NOAA-20, and Terra.

+## Create spacecraft resource

+Create a registered spacecraft object on the Orbital portal by following the [spacecraft registration](register-spacecraft.md) instructions.

+2. Select **New support request** in the Support + troubleshooting section of the left-hand blade.

+3. In the **New support request** page, enter or select this information in the Basics tab:

+4. Select the Details tab at the top of the page

+5. In the Details tab, enter this information in the Problem details section:

+| Description | List your spacecraft's **frequency bands** and **desired partner network ground stations**. |

+| File upload | Upload all pertinent **spacecraft licensing material**, **ground station licensing material**, **partner network contract details**, or **partner POCs**, if applicable. |

+6. Complete the **Advanced diagnostic information** and **Support method** sections of the **Details** tab.

+7. Select the **Review + create** tab, or select the **Review + create** button.

+8. Select **Create**.

+After the authorization request is generated, our regulatory team will investigate the request and validate the material. The partner network must inform Microsoft of the ground station license approval(s) to complete the spacecraft authorization. Once verified, we will enable your spacecraft to communicate with the partner network ground stations outlined in the request.

+## Confirm spacecraft is authorized

+1. In the Azure portal search box, enter **Spacecraft**. Select **Spacecraft** in the search results.

+2. In the Spacecraft page, select the **newly registered spacecraft**.

+3. In the new spacecraft's overview page, check that the **Authorization status** shows **Allowed**.

+## Supportability and retirement policy of the underlying operating system

+Azure Database for PostgreSQL - Flexible Server is a fully managed open-source database. The underlying operating system is an integral part of the service. Microsoft continually works to ensure ongoing security updates and maintenance for security compliance and vulnerability mitigation, regardless of whether it is provided by a third-party or an internal vendor. Automatic upgrades during scheduled maintenance keep your managed database secure, stable, and up-to-date.

+>[!IMPORTANT]

+## Edit or delete a custom classification

+To update or edit a custom classification, follow these steps:

+1. In your Microsoft Purview account, select the **Data map**, and then **Classifications**.

+1. Select the **Custom** tab.

+1. Select the classification you want to edit, then select the **Edit** button.

+ :::image type="content" source="media/create-a-custom-classification-and-classification-rule/select-edit.png" alt-text="Screenshot of the custom classification page, showing a classification selected and the edit button highlighted." border="true":::

+1. Now can edit the description of this custom classification. Select the **Ok** button when you're finished to save your changes.

+To delete a custom classification:

+1. After opening the **Data map**, and then **Classifications**, select the **Custom** tab.

+1. Select the classification you want to delete, or multiple classifications you want to delete, and then select the **Delete** button.

+ :::image type="content" source="media/create-a-custom-classification-and-classification-rule/select-delete.png" alt-text="Screenshot of the custom classification page, showing a classification selected and the delete button highlighted." border="true":::

+You can also edit or delete a classification from inside the classification itself. Just select your classification, then select the **Edit** or **Delete** buttons in the top menu.

+## Enable or disable classification rules

+1. In your Microsoft Purview account, select the **Data map**, and then **Classification rules**.

+1. Select the **Custom** tab.

+1. You can check the current status of a classification rule by looking at the **Status** column in the table.

+1. Select the classification rule, or multiple classification rules, that you want to enable or disable.

+1. Select either the **Enable** or **Disable** buttons in the top menu.

+ :::image type="content" source="media/create-a-custom-classification-and-classification-rule/enable-or-disable.png" alt-text="Screenshot of the custom classification rule page, showing a classification rule selected and the enable and disable buttons highlighted." border="true":::

+You can also update the status of a rule when editing the rule.

+## Edit or delete a classification rule

+To update or edit a custom classification rule, follow these steps:

+1. In your Microsoft Purview account, select the **Data map**, and then **Classification rules**.

+1. Select the **Custom** tab.

+1. Select the classification rule you want to edit, then select the **Edit** button.

+ :::image type="content" source="media/create-a-custom-classification-and-classification-rule/select-edit-rule.png" alt-text="Screenshot of the custom classification rule page, showing a classification rule selected and the edit button highlighted." border="true":::

+1. Now you can edit the state, the description, and the associated classification rule.

+1. Select the **Continue** button.

+1. You can upload a new file for your regular expression or dictionary rule to match against, and update your match threshold and column pattern match.

+1. Select **Apply** to save your changes. Scans will need to be rerun with the new rule to apply changes across your assets.

+To delete a custom classification:

+1. After opening the **Data map**, and then **Classification rules**, select the **Custom** tab.

+1. Select the classification rule you want to delete, and then select the **Delete** button.

+ :::image type="content" source="media/create-a-custom-classification-and-classification-rule/select-delete-rule.png" alt-text="Screenshot of the custom classification rule page, showing a classification rule selected and the delete button highlighted." border="true":::

+As described in the [insights concepts](concept-insights.md), the data stewardship report is part of the "Health" section of the Data Estate Insights App. This report offers a one-stop shop experience for data, governance, and quality focused users like chief data officers and data stewards to get actionable insights into key areas of gap in their data estate.

+* [Enable and schedule your data estate insights reports](how-to-schedule-data-estate-insights.md).

+1. Access the [Microsoft Purview Governance Portal](https://web.purview.azure.com/) and open your Microsoft Purview account.

+## View data stewardship dashboard

+The dashboard is purpose-built for the governance and quality focused users, like data stewards and chief data officers, to understand the data estate health of their organization. The dashboard shows high level KPIs that need to reduce governance risks:

+* **Asset curation**: All data assets are categorized into three buckets - "Fully curated", "Partially curated" and "Not curated", based on certain attributes of assets being present. An asset is "Fully curated" if it has at least one classification tag, an assigned Data Owner and a description. If any of these attributes is missing, but not all, then the asset is categorized as "Partially curated" and if all of them are missing, then it's "Not curated".

+* **Asset data ownership**: Assets that have the owner attribute within "Contacts" tab as blank are categorized as "No owner", else it's categorized as "Owner assigned".

+### Data estate health

+Data estate health is a scorecard view that helps management and governance focused users, like chief data officers, understand critical governance metrics that can be looked at by collection hierarchy.

+* **Assets**: Count of assets by collection drill-down

+* **Owner assigned**: Count of assets with data owner assigned on them

+* **Out of date**: Percentage of assets that have not been updated in over 365 days.

+* **New**: Count of new assets pushed in the Data Map in the last 30 days

+* **Updated**: Count of assets updated in the Data Map in the last 30 days

+* **Deleted**: Count of deleted assets from the Data Map in the last 30 days

+You can also drill down by collection paths. As you hover on each column name, it provides description of the column, provides recommended percentage ranges, and takes you to the detailed graph for further drill-down.

+### Asset curation

+All data assets are categorized into three buckets - ***Fully curated***, ***Partially curated*** and ***Not curated***, based on whether assets have been given certain attributes.

+An asset is ***Fully curated*** if it has at least one classification tag, an assigned data owner, and a description.

+If any of these attributes is missing, but not all, then the asset is categorized as ***Partially curated***. If all of them are missing, then it's listed as ***Not curated***.

+For further information about which assets aren't fully curated, you can select **View details** link that will take you into the deeper view.

+In the **View details** page, if you select a specific collection, it will list all assets with attribute values or blanks, that make up the ***fully curated*** assets.

+### Trends and gap analysis

+Learn more about Microsoft Purview Data Estate Insights through:

+* [Data Estate Insights Concepts](concept-insights.md)

+> In the UI you can currently only select up to 25 assets.

+> [Data lineage extraction is currently supported only for stored procedure runs.](#troubleshoot-lineage-extraction) Lineage is also supported if Azure SQL tables or views are used as a source/sink in [Azure Data Factory Copy and Data Flow activities](how-to-link-azure-data-factory.md).

+[Azure HDInsight](reliability-hdinsight.md)|

+ Title: Reliability in Azure HDInsight

+description: Find out about reliability in Azure HDInsight

+CustomerIntent: As a cloud architect/engineer, I need general guidance on migrating HDInsight to using availability zones.

+# Reliability in Azure HDInsight

+This article describes reliability support in Azure HDInsight, and covers [availability zones](#availability-zone-support). For a more detailed overview of reliability in Azure, see [Azure reliability](/azure/architecture/framework/resiliency/overview).

+## Availability zone support

+Azure availability zones are at least three physically separate groups of datacenters within each Azure region. Datacenters within each zone are equipped with independent power, cooling, and networking infrastructure. In the case of a local zone failure, availability zones are designed so that if one zone is affected, regional services, capacity, and high availability are supported by the remaining two zones. Failures can range from software and hardware failures to events such as earthquakes, floods, and fires. Tolerance to failures is achieved with redundancy and logical isolation of Azure services. For more detailed information on availability zones in Azure, see [Availability zone service and regional support](availability-zones-service-support.md).

+Azure HDInsight supports a [zonal deployment configuration](availability-zones-service-support.md#azure-services-with-availability-zone-support). Azure HDInsight cluster nodes are placed in a single zone that you select in the selected region. A zonal HDInsight cluster is isolated from any outages that occur in other zones. However, if an outage impacts the specific zone chosen for the HDInsight cluster, the cluster won't be available. This deployment model provides inexpensive, low latency network connectivity within the cluster. Replicating this deployment model into multiple availability zones can provide a higher level of availability to protect against hardware failure.

+>[!IMPORTANT]

+>For deployments where users don't specify a specific zone, node types are not zone resilient and can experience downtime during an outage in any zone in that region.

+## Prerequisites

+- Availability zones are only supported for clusters created after June 15, 2023. Availability zone settings can't be updated after the cluster is created. You also can't update an existing, non-availability zone cluster to use availability zones.

+- Clusters must be created under a custom VNet.

+

+- You need to bring your own SQL DB for Ambari DB and external metastore, such as Hive metastore, so that you can config these DBs in the same availability zone.

+

+- Your HDInsight clusters must be created with the availability zone option in one of the following regions:

+ - Australia East

+ - Brazil South

+ - Canada Central

+ - Central US

+ - East US

+ - East US 2

+ - France Central

+ - Germany West Central

+ - Japan East

+ - Korea Central

+ - North Europe

+ - Qatar Central

+ - Southeast Asia

+ - South Central US

+ - UK South

+ - US Gov Virginia

+ - West Europe

+ - West US 2

+## Create an HDInsight cluster using availability zone

+You can use Azure Resource Manager (ARM) template to launch an HDInsight cluster into a specified availability zone.

+In the resources section, you need to add a section of ΓÇÿzonesΓÇÖ and provide which availability zone you want this cluster to be deployed into.

+```json

+ "resources": [

+ {

+ "type": "Microsoft.HDInsight/clusters",

+ "apiVersion": "2021-06-01",

+ "name": "[parameters('cluster name')]",

+ "location": "East US 2",

+ "zones": [

+ "1"

+ ],

+ }

+ ]

+```

+

+### Verify nodes within one availability Zone across zones

+When the HDInsight cluster is ready, you can check the location to see which availability zone they're deployed in.

+**Get API response**:

+```json

+ [

+ {

+ "location": "East US 2",

+ "zones": [

+ "1"

+ ],

+ }

+ ]

+```

+### Scale up the cluster

+You can scale up an HDInsight cluster with more worker nodes. The newly added worker nodes will be placed in the same availability zone of this cluster.

+### Availability zone redeployment

+Azure HDInsight clusters currently doesn't support in-place migration of existing cluster instances to availability zone support. However, you can choose to [recreate your cluster](#create-an-hdinsight-cluster-using-availability-zone), and choose a different availability zone or region during the cluster creation. A secondary standby cluster in a different region and a different availability zone can be used in disaster recovery scenarios.

+### Zone down experience

+When an availability zone goes down:

+ - You can't ssh to this cluster.

+ - You can't delete or scale up or scale down this cluster.

+ - You can't submit jobs or see job history.

+ - You still can submit new cluster creation request in a different region.

+## Next steps

+> [!div class="nextstepaction"]

+> [Reliability in Azure](availability-zones-overview.md)

+ Title: Security baseline for Azure Monitor for SAP solutions

+description: Learn about security baseline for Azure Monitor for SAP solutions

+#Customer intent: As a SAP BASIS or cloud infrastructure team, I want to learn about security baseline provided by Azure Monitor for SAP solutions.

+# Security baseline for Azure Monitor for SAP solutions

+This security baseline applies guidance from the Microsoft cloud security benchmarks version 1.0. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure.

+You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions is listed in the Regulatory Compliance section of the Microsoft Defender for Cloud dashboard.

+When a feature has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance with the Microsoft cloud security benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.

+When Azure Monitor for SAP solutions is deployed, a managed resource group is deployed with it.

+This managed resource group contains services such as Azure Log Analytics, Azure Functions, Azure Storage and Azure Key Vault.

+## Security baseline for relevant servicea

+- [Azure Log Analytics](/security/benchmark/azure/baselines/azure-monitor-security-baseline)

+- [Azure Functions](/security/benchmark/azure/baselines/functions-security-baseline)

+- [Azure Storage](/security/benchmark/azure/baselines/storage-security-baseline)

+- [Azure Key Vault](/security/benchmark/azure/baselines/key-vault-security-baseline)

+## Next steps

+> [!div class="nextstepaction"]

+> [Learn about Azure Monitor for SAP solutions provider types](providers.md)

+- April 25, 2023: Adjust mount options in [HA for HANA Scale-up with ANF on SLES](sap-hana-high-availability-netapp-files-suse.md), [HANA scale-out with standby node with ANF on SLES](./sap-hana-scale-out-standby-netapp-files-suse.md), [HA for HANA Scale-out HA on SLES](sap-hana-high-availability-scale-out-hsr-suse.md), [HA for HANA scale-up with ANF on RHEL](./sap-hana-high-availability-netapp-files-red-hat.md), [HANA scale-out with standby node on Azure VMs with ANF on RHEL](./sap-hana-scale-out-standby-netapp-files-rhel.md), [HA for HANA scale-out on RHEL](./sap-hana-high-availability-scale-out-hsr-rhel.md), [HA for SAP NW on SLES with ANF](./high-availability-guide-suse-netapp-files.md) , [HA for SAP NW on RHEL with ANF](./high-availability-guide-rhel-netapp-files.md) and [HA for SAP NW on SLES with simple mount and NFS](high-availability-guide-suse-nfs-simple-mount.md)

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=3,tcp 192.168.24.5:/sapQAS /saptmp

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys,tcp 192.168.24.5:/sapQAS /saptmp

+ 192.168.24.5:/sapQAS/sapmntQAS /sapmnt/QAS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 192.168.24.5:/sapQAS/usrsapQASsys /usr/sap/QAS/SYS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 192.168.24.4:/transSAP /usr/sap/trans nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 192.168.24.5:/sapQAS/sapmntQAS /sapmnt/QAS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ 192.168.24.5:/sapQAS/usrsapQASsys /usr/sap/QAS/SYS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ 192.168.24.4:/transSAP /usr/sap/trans nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ directory='/usr/sap/QAS/ASCS00' fstype='nfs' force_unmount=safe options='sec=sys,nfsvers=4.1' \

+ directory='/usr/sap/QAS/ERS01' fstype='nfs' force_unmount=safe options='sec=sys,nfsvers=4.1' \

+ 192.168.24.5:/sapQAS/sapmntQAS /sapmnt/QAS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 192.168.24.4:/transSAP /usr/sap/trans nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 192.168.24.5:/sapQAS/sapmntQAS /sapmnt/QAS nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ 192.168.24.4:/transSAP /usr/sap/trans nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ 92.168.24.5:/sapQAS/usrsapQASpas /usr/sap/QAS/D02 nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 92.168.24.5:/sapQAS/usrsapQASpas /usr/sap/QAS/D02 nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ 92.168.24.5:/sapQAS/usrsapQASaas /usr/sap/QAS/D03 nfs rw,hard,rsize=65536,wsize=65536,nfsvers=3

+ 92.168.24.5:/sapQAS/usrsapQASaas /usr/sap/QAS/D03 nfs rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=3,tcp 10.1.0.4:/sapQAS /saptmp

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys,tcp 10.1.0.4:/sapQAS /saptmp

+ sudo crm configure primitive fs_<b>QAS</b>_ASCS Filesystem device='<b>10.1.0.4</b>:/usrsap<b>qas</b>/usrsap<b>QAS</b>ascs' directory='/usr/sap/<b>QAS</b>/ASCS<b>00</b>' fstype='nfs' options='sec=sys,nfsvers=4.1' \

+ sudo crm configure primitive fs_<b>QAS</b>_ERS Filesystem device='<b>10.1.0.4</b>:/usrsap<b>qas</b>/usrsap<b>QAS</b>ers' directory='/usr/sap/<b>QAS</b>/ERS<b>01</b>' fstype='nfs' options='sec=sys,nfsvers=4.1' \

+ sudo mount -t nfs sapnfsafs.file.core.windows.net:/sapnfsafs/sapnw1 /saptmp -o vers=4.1,sec=sys

+ echo "sapnfsafs.file.core.windows.net:/sapnfsafs/sapnw1/sapmntNW1 /sapmnt/NW1 nfs vers=4.1,sec=sys 0 0" >> /etc/fstab

+ echo "sapnfsafs.file.core.windows.net:/sapnfsafs/sapnw1/usrsapNW1/ /usr/sap/NW1 nfs vers=4.1,sec=sys 0 0" >> /etc/fstab

+ echo "sapnfsafs.file.core.windows.net:/sapnfsafs/saptrans /usr/sap/trans nfs vers=4.1,sec=sys 0 0" >> /etc/fstab

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=3,tcp 10.27.1.5:/sapnw1 /saptmp

+ sudo mount -t nfs -o rw,hard,rsize=65536,wsize=65536,nfsvers=4.1,sec=sys,tcp 10.27.1.5:/sapnw1 /saptmp

+ echo "10.27.1.5:/sapnw1/sapmntNW1 /sapmnt/NW1 nfs nfsvers=3,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/sapnw1/usrsapNW1 /usr/sap/NW1 nfs nfsvers=3,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/saptrans /usr/sap/trans nfs nfsvers=3,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/sapnw1/sapmntNW1 /sapmnt/NW1 nfs nfsvers=4.1,sec=sys,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/sapnw1/usrsapNW1 /usr/sap/NW1 nfs nfsvers=4.1,sec=sys,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/saptrans /usr/sap/trans nfs nfsvers=4.1,sec=sys,hard 0 0" >> /etc/fstab

+ echo "sapnfsafs.file.core.windows.net:/sapnfsafs/sapnw1/sapmntNW1 /sapmnt/NW1 nfs vers=4.1,sec=sys 0 0" >> /etc/fstab

+ echo "sapnfsafs.file.core.windows.net:/sapnfsafs/saptrans /usr/sap/trans nfs vers=4.1,sec=sys 0 0" >> /etc/fstab

+ echo "10.27.1.5:/sapnw1/sapmntNW1 /sapmnt/NW1 nfs nfsvers=3,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/saptrans /usr/sap/trans nfs nfsvers=3, hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/sapnw1/sapmntNW1 /sapmnt/NW1 nfs nfsvers=4.1,sec=sys,hard 0 0" >> /etc/fstab

+ echo "10.27.1.5:/saptrans /usr/sap/trans nfs nfsvers=4.1,sec=sys,hard 0 0" >> /etc/fstab

+ Title: 'Azure Premium Files NFS and SMB for SAP'

+description: Using Azure Premium Files NFS and SMB for SAP workload

+tags: azure-resource-manager

+# Using Azure Premium Files NFS and SMB for SAP workload

+This document is about Azure Premium Files file shares used for SAP workload. Both NFS volumes and SMB file shares are covered. For considerations around Azure NetApp Files for SMB or NFS volumes, see the following two documents:

+- [Azure Storage types for SAP workload](./planning-guide-storage.md)

+- [NFS v4.1 volumes on Azure NetApp Files for SAP HANA](./hana-vm-operations-netapp.md)

+> [!IMPORTANT]

+> The suggestions for the storage configurations in this document are meant as directions to start with. Running workload and analyzing storage utilization patterns, you might realize that you are not utilizing all the storage bandwidth or IOPS provided. You might consider downsizing on storage then. Or in contrary, your workload might need more storage throughput than suggested with these configurations. As a result, you might need to deploy more capacity to increase IOPS or throughput. In the field of tension between storage capacity required, storage latency needed, storage throughput and IOPS required and least expensive configuration, Azure offers enough different storage types with different capabilities and different price points to find and adjust to the right compromise for you and your SAP workload.

+For SAP workloads, the supported uses of Azure Files shares are:

+- sapmnt volume for a distributed SAP system

+- transport directory for SAP landscape

+- /hana/shared for HANA scale-out

+- file interface between your SAP landscape and other applications

+> [!NOTE]

+> No SAP DBMS workloads are supported on Azure Premium Files volumes, NFS or SMB. For support restrictions on Azure storage types for SAP NetWeaver/application layer of S/4HANA, read the [SAP support note 2015553](https://launchpad.support.sap.com/#/notes/2015553)

+## Important considerations for Azure Premium Files shares with SAP

+When you plan your deployment with Azure Files, consider the following important points. The term share in this section applies to both SMB share and NFS volume.

+- The minimum share size is 100 gibibytes (GiB). With Azure Premium Files, you pay for the [capacity of the provisioned shares](/azure/storage/files/understanding-billing#provisioned-model).

+- Size your file shares not only based on capacity requirements, but also on IOPS and throughput requirements. For details, see [Azure files share targets](/azure/storage/files/storage-files-scale-targets#azure-file-share-scale-targets).

+- Test the workload to validate your sizing and ensure that it meets your performance targets. To learn how to troubleshoot performance issues with NFS on Azure Files, consult [Troubleshoot Azure file share performance](/azure/storage/files/storage-troubleshooting-files-performance).

+- Deploy a separate `sapmnt` share for each SAP system.

+- Don't use the `sapmnt` share for any other activity, such as interfaces.

+- Don't use the `saptrans` share for any other activity, such as interfaces.

+- If your SAP system has a heavy load of batch jobs, you might have millions of job logs. If the SAP batch job logs are stored in the file system, pay special attention to the sizing of the `sapmnt` share. Reorganize the job log files regularly as per [SAP note 16083](https://launchpad.support.sap.com/#/notes/16083). As of SAP_BASIS 7.52, the default behavior for the batch job logs is to be stored in the database. For details, see [SAP note 2360818 | Job log in the database][https://launchpad.support.sap.com/#/notes/2360818].

+- Avoid consolidating the shares for too many SAP systems in a single storage account. There are also [scalability and performance targets for storage accounts](/azure/storage/files/storage-files-scale-targets#storage-account-scale-targets). Be careful to not exceed the limits for the storage account, too.

+- In general, don't consolidate the shares for more than *five* SAP systems in a single storage account. This guideline helps you avoid exceeding the storage account limits and simplifies performance analysis.

+- In general, avoid mixing shares like `sapmnt` for non-production and production SAP systems in the same storage account.

+- Use a [private endpoint](/azure/storage/files/storage-files-networking-endpoints) with Azure Files. In the unlikely event of a zonal failure, your NFS sessions automatically redirect to a healthy zone. You don't have to remount the NFS shares on your VMs. Use of private link can result in extra charges for the data processed, see details about [private link pricing](https://azure.microsoft.com/pricing/details/private-link/).

+- If you're deploying your VMs across availability zones, use a [storage account with ZRS](/azure/storage/common/storage-redundancy#zone-redundant-storage) in the Azure regions that support ZRS.

+- Azure Premium Files doesn't currently support automatic cross-region replication for disaster recovery scenarios. See [guidelines on DR for SAP applications](disaster-recovery-overview-guide.md) for available options.

+Carefully consider when consolidating multiple activities into one file share or multiple file shares in one storage accounts. Distributing these shares onto separate storage accounts improves throughput, resiliency and simplifies the performance analysis. If many SAP SIDs and shares are consolidated onto a single Azure Files storage account and the storage account performance is poor due to hitting the throughput limits. It can become difficult to identify which SID or volume is causing the problem.

+## NFS additional considerations

+- We recommend that you deploy on SLES 15 SP2 or higher, RHEL 8.4 or higher to benefit from [NFS client improvements](/azure/storage/files/storage-troubleshooting-files-nfs#ls-hangs-for-large-directory-enumeration-on-some-kernels).

+- Mount the NFS shares with [documented mount](/azure/storage/files/storage-files-how-to-mount-nfs-shares) options, with [troubleshooting](/azure/storage/files/storage-troubleshooting-files-nfs#cannot-connect-to-or-mount-an-nfs-azure-file-share) information available for mount or connection problems.

+- For SAP J2EE systems, placing `/usr/sap/<SID>/J<nr>` on NFS on Azure Files isn't supported.

+## SMB additional considerations

+- SAP software provisioning manager (SWPM) version 1.0 SP32, SWPM 2.0 SP09 or higher is required to use Azure Files SMB. SAPInst patch must be 749.0.91 or higher. If SWPM/SAPInst doesn't accept more than 13 characters for file share server, then the SWPM version is too old.

+- During the installation of the SAP PAS Instance, SWPM/SAPInst will ask to input a transport hostname. The FQDN of the storage account should be entered <storage_account>.file.core.windows.net or with IP address/hostname of the private endpoint, if used.

+- When you integrate the active directory domain with Azure Files SMB for [SAP high availability deployment](high-availability-guide-windows-azure-files-smb.md), the SAP users and groups must be added to the ΓÇÿsapmntΓÇÖ share. The SAP users should have permission `Storage File Data SMB Share Elevated Contributor` set in the Azure portal.

+## Next steps

+For more information, see:

+- [Azure Storage types for SAP workload](planning-guide-storage.md)

+- [SAP HANA High Availability guide for Azure virtual machines](sap-hana-availability-overview.md)

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb1-shared-mnt00001 /hana/shared

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb1-log-mnt00001 /hana/log

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb1-data-mnt00001 /hana/data

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb2-shared-mnt00001 /hana/shared

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb2-log-mnt00001 /hana/log

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.32.2.4:/hanadb2-data-mnt00001 /hana/data

+ sudo pcs resource create hana_data1 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb1-data-mnt00001 directory=/hana/data fstype=nfs options=rw,nfvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb1_nfs

+ sudo pcs resource create hana_log1 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb1-log-mnt00001 directory=/hana/log fstype=nfs options=rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb1_nfs

+ sudo pcs resource create hana_shared1 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb1-shared-mnt00001 directory=/hana/shared fstype=nfs options=rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb1_nfs

+ sudo pcs resource create hana_data2 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb2-data-mnt00001 directory=/hana/data fstype=nfs options=rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb2_nfs

+ sudo pcs resource create hana_log2 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb2-log-mnt00001 directory=/hana/log fstype=nfs options=rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb2_nfs

+ sudo pcs resource create hana_shared2 ocf:heartbeat:Filesystem device=10.32.2.4:/hanadb2-shared-mnt00001 directory=/hana/shared fstype=nfs options=rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 --group hanadb2_nfs

+ 10.3.1.4:/hanadb1-data-mnt00001 /hana/data/HN1/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.3.1.4:/hanadb1-log-mnt00001 /hana/log/HN1/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.3.1.4:/hanadb1-shared-mnt00001 /hana/shared/HN1 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.3.1.4:/hanadb2-data-mnt00001 /hana/data/HN1/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.3.1.4:/hanadb2-log-mnt00001 /hana/log/HN1/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.3.1.4:/hanadb2-shared-mnt00001 /hana/shared/HN1 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ options="bind,defaults,rw,hard,rsize=262144,wsize=262144,proto=tcp,noatime,_netdev,nfsvers=4.1,lock,sec=sys" \

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.23.1.7:/HN1-shared-s1 /hana/shared

+ sudo mount -o rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 10.23.1.7:/HN1-shared-s2 /hana/shared

+ fstype=nfs options='defaults,rw,hard,timeo=600,rsize=262144,wsize=262144,proto=tcp,noatime,sec=sys,nfsvers=4.1,lock,_netdev' op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 \

+ fstype=nfs options='defaults,rw,hard,timeo=600,rsize=262144,wsize=262144,proto=tcp,noatime,sec=sys,nfsvers=4.1,lock,_netdev' op monitor interval=20s on-fail=fence timeout=120s OCF_CHECK_LEVEL=20 \

+ 10.23.1.7:/HN1-shared-s1 /hana/shared nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.7:/HN1-shared-s2 /hana/shared nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ sapnfsafs.file.core.windows.net:/sapnfsafs/hn1-shared-s1 /hana/shared nfs nfsvers=4.1,sec=sys 0 0

+ sapnfsafs.file.core.windows.net:/sapnfsafs/hn1-shared-s2 /hana/shared nfs nfsvers=4.1,sec=sys 0 0

+ options="bind,defaults,rw,hard,proto=tcp,noatime,nfsvers=4.1,lock" \

+ mount -t nfs -o sec=sys,nfsvers=4.1 <b>10.9.0.4</b>:/<b>HN1</b>-shared /mnt/tmp

+ 10.9.0.4:/<b>HN1</b>-data-mnt00001 /hana/data/<b>HN1</b>/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-data-mnt00002 /hana/data/<b>HN1</b>/mnt00002 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-log-mnt00001 /hana/log/<b>HN1</b>/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-log-mnt00002 /hana/log/HN1/mnt00002 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-shared/shared /hana/shared nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb1</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb2</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.9.0.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb3</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ mount -t nfs -o sec=sys,nfsvers=4.1 <b>10.23.1.4</b>:/<b>HN1</b>-shared /mnt/tmp

+ 10.23.1.5:/<b>HN1</b>-data-mnt00001 /hana/data/<b>HN1</b>/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.6:/<b>HN1</b>-data-mnt00002 /hana/data/<b>HN1</b>/mnt00002 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.4:/<b>HN1</b>-log-mnt00001 /hana/log/<b>HN1</b>/mnt00001 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.6:/<b>HN1</b>-log-mnt00002 /hana/log/HN1/mnt00002 nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.4:/<b>HN1</b>-shared/shared /hana/shared nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb1</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb2</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ 10.23.1.4:/<b>HN1</b>-shared/usr-sap-<b>hanadb3</b> /usr/sap/<b>HN1</b> nfs rw,nfsvers=4.1,hard,timeo=600,rsize=262144,wsize=262144,noatime,lock,_netdev,sec=sys 0 0

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/darktrace1655286944672.darktrace_mss?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-arubaclearpass?tab=Overview) in the Azure Marketplace.

+3. Enter the **ConfluenceAccessToken**, **ConfluenceUsername**, **ConfluenceHomeSiteName** (short site name part, as example HOMESITENAME from `https://HOMESITENAME.atlassian.net`) and deploy.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/arista-networks.awake-security?tab=Overview) in the Azure Marketplace.

+See documentation to [setup JWT authentication](https://developer.box.com/guides/authentication/jwt/jwt-setup/) and [obtain JSON file with credentials](https://developer.box.com/guides/authentication/jwt/with-sdk/#prerequisites).

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py python Forwarder_AMA_installer.py

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoasa?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoasa?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/cisco.cisco-firepower-estreamer?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscoseg?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-citrixadc?tab=Overview) in the Azure Marketplace.

+ sudo wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/citrix.citrix_waf_mss?tab=Overview) in the Azure Marketplace.

+The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-claroty?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+The [Corelight](https://corelight.com/) data connector enables incident responders and threat hunters who use Microsoft Sentinel to work faster and more effectively. The data connector enables ingestion of events from [Zeek](https://zeek.org/) and [Suricata](https://suricata.io/) via Corelight Sensors into Microsoft Sentinel.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/cyberark.cyberark_epv_events_mss?tab=Overview) in the Azure Marketplace.

+ sudo wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+[Follow these instructions](https://docs.exabeam.com/en/advanced-analytics/i56/advanced-analytics-administration-guide/125371-configure-advanced-analytics.html#UUID-6d28da8d-6d3e-5aa7-7c12-e67dc804f894) to send Exabeam Advanced Analytics activity log data via syslog.

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-exabeamadvancedanalytics?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/microsoftsentinelcommunity.azure-sentinel-solution-forcepoint-csg?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-fortinetfortigate?tab=Overview) in the Azure Marketplace.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+The [Illumio Core](https://www.illumio.com/products/illumio-core) data connector provides the capability to ingest Illumio Core logs into Microsoft Sentinel.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+>**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/sschuur/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt) which is deployed with the Microsoft Sentinel Solution.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+| **Kusto function url** | https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Morphisec/Parsers/Morphisec |

+| **Supported by** | [Morphisec](https://support.morphisec.com/hc) |

+in queries and workbooks. [Follow steps to get this Kusto function.](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Morphisec/Parsers/Morphisec)

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+- **Netskope API Token**: A Netskope API Token is required. [See the documentation to learn more about Netskope API](https://innovatechcloud.goskope.com). **Note:** A Netskope account is required.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+| **Supported by** | [NXLog](https://nxlog.co/community-forum/t/819-support-tickets) |

+| **Supported by** | [NXLog](https://nxlog.co/community-forum/t/819-support-tickets) |

+| **Supported by** | [NXLog](https://nxlog.co/community-forum/t/819-support-tickets) |

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/nxlogltd1589381969261.nxlog_dns_logs?tab=Overview) in the Azure Marketplace.

+| **Supported by** | [NXLog](https://nxlog.co/community-forum/t/819-support-tickets) |

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ > This data connector depends on a parser based on a Kusto Function to work as expected [**RSASecurIDAMEvent**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/RSA%20SecurID/Parsers/RSASecurIDAMEvent.txt) which is deployed with the Microsoft Sentinel Solution.

+| **Supported by** | [Senserva](https://www.senserva.com/support/) |

+Visit [Senserva Setup](https://www.senserva.com/portal/) for information on setting up the Senserva data connection, support, or any other questions. The Senserva installation will configure a Log Analytics Workspace for output. Deploy Microsoft Sentinel onto the configured Log Analytics Workspace to finish the data connection setup by following [this onboarding guide.](/azure/sentinel/quickstart-onboard)

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+- **REST API Credentials/permissions**: Both a **TenableAccessKey** and a **TenableSecretKey** is required to access the Tenable REST API. [See the documentation to learn more about API](https://developer.tenable.com/reference#vulnerability-management). Check all [requirements and follow the instructions](https://docs.tenable.com/tenableio/Content/Platform/Settings/MyAccount/GenerateAPIKey.htm) for obtaining credentials.

+ [Follow the instructions](https://docs.tenable.com/tenableio/Content/Platform/Settings/MyAccount/GenerateAPIKey.htm) to obtain the required API credentials.

+To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: [Get Azure AD tokens for users by using MSAL

+](/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token)

+>Endpoint: `https://apis.sentinelus.net/[WorkspaceID]/threatintelligence:upload-indicators?api-version=2022-07-01`

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+> 1. If you have not installed the vCenter solution from ContentHub then [Follow the steps](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/VMware%20vCenter/Parsers/vCenter.txt) to use the Kusto function alias, **vCenter**

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python3 cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py

+ python3 cef_troubleshoot.py {0}

+| **Azure functions app code** | https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/ZeroNetworks/Data%20Connectors/SegmentFunctionConnector/AzureFunction_ZeroNetworks_Segment_Audit.zip |

+1. Download the [Azure Function App](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/ZeroNetworks/Data%20Connectors/SegmentFunctionConnector/AzureFunction_ZeroNetworks_Segment_Audit.zip) file. Extract archive to your local development computer.

+The [Zoom](https://zoom.us/) Reports data connector provides the capability to ingest [Zoom Reports](https://developers.zoom.us/docs/api/) events into Microsoft Sentinel through the REST API. Refer to [API documentation](https://developers.zoom.us/docs/api/) for more information. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.

+- **REST API Credentials/permissions**: **ZoomApiKey** and **ZoomApiSecret** are required for Zoom API. [See the documentation to learn more about API](https://developers.zoom.us/docs/internal-apps/jwt/). Check all [requirements and follow the instructions](https://developers.zoom.us/docs/internal-apps/jwt/) for obtaining credentials.

+ [Follow the instructions](https://developers.zoom.us/docs/internal-apps/jwt/) to obtain the credentials.

+ sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py python cef_installer.py {0} {1}

+ sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py python cef_troubleshoot.py {0}

+ | where Computer == "vm-linux"

+ | where Computer == "vm-linux"

+We recommend that you monitor the health of process servers in the portal to ensure that they are connected and working properly, and that replication is progressing for the source machines that are associated with the process server.

+- [Review best practices].(vmware-physical-azure-troubleshoot-process-server.md#best-practices-for-process-server-deployment)

+Connectivity issues between the source server and the process server or between the process server and Azure often cause initial and ongoing replication failures.

+* **Two virtual machines with the same instance UUID**: If two virtual machines under the vCenter have the same instance UUID, the first virtual machine discovered by the configuration server is displayed in the Azure portal. To resolve this issue, ensure that no two virtual machines have the same instance UUID. This scenario is commonly seen in instances where a backup VM becomes active and is logged into our discovery records. Refer to [Azure Site Recovery VMware-to-Azure: How to clean up duplicate or stale entries](https://social.technet.microsoft.com/wiki/contents/articles/32026.asr-vmware-to-azure-how-to-cleanup-duplicatestale-entries.aspx) to resolve.

+* **Azure Site Recovery management servers**: If the virtual machine is used as a management server under one or more of the following roles - Configuration server /scale-out process server / Master target server, then you won't be able to choose the virtual machine from the portal. Management servers cannot be replicated.

+* **vCenter not connected**: Check if vCenter is in a connected state. To verify, go to Recovery Services vault > Site Recovery Infrastructure > Configuration Servers > Click on respective configuration server > a blade opens on your right with details of associated servers. Check if vCenter is connected. If it's in a "Not Connected" state, resolve the issue, and then [refresh the configuration server](vmware-azure-manage-configuration-server.md#refresh-configuration-server) on the portal. After this, virtual machine is not listed on the portal.

+* **ESXi powered off**: If the ESXi host under which the virtual machine resides is in a powered-off state, then the virtual machine is not listed or is not selectable on the Azure portal. Power on the ESXi host, and [refresh the configuration server](vmware-azure-manage-configuration-server.md#refresh-configuration-server) on the portal. After this, virtual machine is listed on the portal.

+* **Pending reboot**: If there is a pending reboot on the virtual machine, then you won't be able to select the machine on the Azure portal. Ensure to complete the pending reboot activities and [refresh the configuration server](vmware-azure-manage-configuration-server.md#refresh-configuration-server). After this, virtual machine is listed on the portal.

+* **IP not found or Machine does not have an IP address**: If the virtual machine doesn't have a valid IP address associated with it, then you are not able to select the machine on the Azure portal. Ensure to assign a valid IP address to the virtual machine, and [refresh the configuration server](vmware-azure-manage-configuration-server.md#refresh-configuration-server). It could also be caused if the machine does not have a valid IP address associated with one of its NICs. Either assign a valid IP address to all NICs or remove the NIC that's missing the IP. After this, the virtual machine is listed on the portal.

+Another reason could be that the machine was cloned. When machines move between a hypervisor and if BIOS ID changes, then the mobility agent blocks the replication. Replication of cloned machines is not supported by Site Recovery.

+## No crash-consistent recovery point available for the VM in the last 'XXX' minutes

+Following is a list of some of the most common issues:

+Over and above ensuring that there are no connectivity, bandwidth, or time sync-related issues, ensure that:

+**Possible Causes:**

+- The data change rate (write bytes/sec) on the listed disks of the virtual machine is more than the [Azure Site Recovery supported limits](site-recovery-vmware-deployment-planner-analyze-report.md#azure-site-recovery-limits) for the replication target storage account type.

+- There is a sudden spike in the churn rate due to which a high amount of data is pending upload.

+**To resolve the issue:**

+- Ensure that the target storage account type (Standard or Premium) is provisioned as per the churn rate requirement at the source.

+- If you are already replicating to a Premium managed disk (asrseeddisk type), ensure that the size of the disk supports the observed churn rate as per Site Recovery limits. You can increase the size of the asrseeddisk if necessary. Follow these steps:

+ - You may see a banner on the Overview blade saying that a SAS URL has been generated. Click on this banner and cancel the export. Ignore this step if you do not see the banner.

+ - As soon as the SAS URL is revoked, go to the **Configuration** blade of the Managed Disk and increase the size so that Azure Site Recovery supports the observed churn rate on the source disk.

+- If the observed churn is temporary, wait for a few hours for the pending data upload to catch up and create recovery points.

+- If the disk contains non-critical data like temporary logs, test data, etc. consider moving this data elsewhere or completely exclude this disk from replication

+2. Check the following logs on the PS for error details:

+3. To register the master target with the configuration server, navigate to folder **%PROGRAMDATA%\ASR\Agent**, and run the following on command prompt:

+Some of the most common issues are listed below

+**How to fix**: There is a known issue with SQL server 2008/2008 R2. Please refer this KB article [Azure Site Recovery Agent or other non-component VSS backup fails for a server hosting SQL Server 2008 R2](https://support.microsoft.com/help/4504103/non-component-vss-backup-fails-for-server-hosting-sql-server-2008-r2)

+**How to fix**: Refer to Kb [article](https://support.microsoft.com/help/4504104/non-component-vss-backups-such-as-azure-site-recovery-jobs-fail-on-ser)

+**How to fix**: Refer to Kb [article](https://support.microsoft.com/help/4493364/fix-error-occurs-when-you-back-up-a-virtual-machine-with-non-component)

+**How to fix**: Azure Site Recovery for Linux Operation System supports application custom scripts for app-consistency. The custom script with pre and post options will be used by the Azure Site Recovery Mobility Agent for app-consistency. [Here](./site-recovery-faq.yml) are the steps to enable it.

+In the above example **2147754994** is the error code that tells you about the failure as shown below

+*How to fix*: To generate an application consistency tag, Azure Site Recovery uses Microsoft Volume Shadow copy Service (VSS). It installs a VSS Provider for its operation to take app consistency snapshots. This VSS Provider is installed as a service. In case the VSS Provider service is not installed, the application consistency snapshot creation fails with the error ID 0x80040154 "Class not registered". </br>

+**How to fix**: To generate an application consistency tag, Azure Site Recovery uses Microsoft Volume Shadow copy Service (VSS). It installs a VSS Provider for its operation to take app consistency snapshots. This VSS Provider is installed as a service. In case the VSS Provider service is disabled, the application consistency snapshot creation fails with the error ID "The specified service is disabled and cannot be started(0x80070422)". </br>

+**How to fix**: To generate an application consistency tag, Azure Site Recovery uses Microsoft Volume Shadow copy Service (VSS).

+**How to fix**: To resolve this issue, make sure the IUSR user has the owner role for all the following folders -

+- The installation directory. For example, if the installation directory is F drive, then provide the correct permissions to:

+- The *\pushinstallsvc* folder in the installation directory. For example, if the installation directory is F drive, provide the correct permissions to -

+- The *\etc* folder in the installation directory. For example, if the installation directory is F drive, provide the correct permissions to -

+- All the items under the following path -

+This error occurs when the source machine's time moves forward and then moves back in a short time, to correct the change. You may not notice the change as the time is corrected very quickly.

+If you need more help, post your question on the [Microsoft Q&A question page for Azure Site Recovery](/answers/topics/azure-site-recovery.html). We have an active community, and one of our engineers can assist you.

+Use the Azure CLI to configure your Spring app to connect to a Cosmos NoSQL Database by using the `az spring connection create` command, as shown in the following example. Be sure to replace the variables in the example with actual values.

+> [!NOTE]

+> If you're using Cosmos Cassandra, use `--key_space` instead of `--database`. If you're using Cosmos Table, use `--table` instead of `--database`. For more information, see [Quickstart: Create a service connection in Azure Spring Apps with the Azure CLI](../service-connector/quickstart-cli-spring-cloud-connection.md).

+Follow these steps to configure your Spring app to connect to an Azure Database for MySQL Flexible Server with database username and password.

+1. Run the `az spring connection create` command, as shown in the following example. Be sure to replace the variables in the example with actual values.

+ --secret name=$DATABASE_USERNAME secret=$DATABASE_PASSWORD

+

+> [!NOTE]

+> Alternatively, you can use a system-assigned identity for a passwordless experience. For more information, see [Deploy a Spring application to Azure Spring Apps with a passwordless connection to an Azure database](/azure/developer/java/spring-framework/deploy-passwordless-spring-database-app).

+- [Install the Azure Functions Core Tools](../azure-functions/functions-run-local.md#install-the-azure-functions-core-tools) version 4.x.

+ --functions-version 4

+ :::image type="content" source="media/tutorial-managed-identities-functions/add-identity-provider.png" alt-text="Screenshot of the Azure portal showing the Add an identity provider page with Microsoft highlighted in the identity provider dropdown menu." lightbox="media/tutorial-managed-identities-functions/add-identity-provider.png":::

+ :::image type="content" source="media/tutorial-managed-identities-functions/identity-provider-settings.png" alt-text="Screenshot of the Azure portal showing the Add an identity provider page with Support account types and Unauthenticated requests highlighted." lightbox="media/tutorial-managed-identities-functions/identity-provider-settings.png":::

+You need the Application ID and the Application ID URI for later use. In the Azure portal, navigate to the Function app you created.

+To get the Application ID, select **Authentication** in the navigation pane, and then copy the **App (client) ID** value for the identity provider that includes the name of the Function app.

+To get the Application ID URI, select **Expose an API** in the navigation pane, and then copy the **Application ID URI** value.

+ azure.function.application-id.uri=<function-app-application-ID-uri>