- | SuccessFactors to Active Directory User Provisioning | `accountDisabled` | `Switch(\[emplStatus\], "True", "A", "False", "U", "False", "P", "False")` |

- | SuccessFactors to Azure AD User Provisioning | `accountEnabled` | `Switch(\[emplStatus\], "False", "A", "True", "U", "True", "P", "True")` |

- | `$.employmentNav.results\[0\].<br>jobInfoNav.results\[0\].emplStatus` | `$.employmentNav..jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P' )\].emplStatusNav.externalCode` | With this find-replace, we're adding the ability to expand emplStatusNav OData object. |

- | `$.employmentNav.results\[0\].<br>jobInfoNav.results\[0\]` | `$.employmentNav..jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P')\]` | With this find-replace, we instruct the connector to always retrieve attributes associated with the active SuccessFactors EmpJobInfo record. Attributes associated with terminated/inactive records in SuccessFactors are ignored. |

- | `$.employmentNav.results\[0\]` | `$.employmentNav..results\[?(@.jobInfoNav..results\[?(@.emplStatusNav.externalCode == 'A' \|\| @.emplStatusNav.externalCode == 'U' \|\| @.emplStatusNav.externalCode == 'P')\])\]` | With this find-replace, we instruct the connector to always retrieve attributes associated with the active SuccessFactors Employment record. Attributes associated with terminated/inactive records in SuccessFactors are ignored. |

- | SuccessFactors to Active Directory User Provisioning | `accountDisabled` | `Switch(\[activeEmploymentsCount\], "False", "0", "True")` | `Switch(\[emplStatus\], "True", "A", "False", "U", "False", "P", "False")` |

- | SuccessFactors to Azure AD User Provisioning | `accountEnabled` | `Switch(\[activeEmploymentsCount\], "True", "0", "False")` | `Switch(\[emplStatus\], "False", "A", "True", "U", "True", "P", "True")` |

-Permissions Management has various types of system reports that capture specific sets of data. These reports allow management, auditors, and administrators to:

-description: Frequently asked questions (FAQs) about Permissions Management.

-This article answers frequently asked questions (FAQs) about Permissions Management.

-## What's Permissions Management?

-Permissions Management is a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility into permissions assigned to all identities. For example, over-privileged workload and user identities, actions, and resources across multicloud infrastructures in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). Permissions Management detects, automatically right-sizes, and continuously monitors unused and excessive permissions. It deepens the Zero Trust security strategy by augmenting the least privilege access principle.

-## Can a customer use Permissions Management if they have other identities with access to their IaaS platform that aren't yet in Azure AD (for example, if part of their business has Okta or AWS Identity & Access Management (IAM))?

-Yes, a customer can detect, mitigate, and monitor the risk of 'backdoor' accounts that are local to AWS IAM, GCP, or from other identity providers such as Okta or AWS IAM.

-## Can non-cloud customers use Permissions Management on-premises?

-Permissions Management complements Azure AD PIM. Azure AD PIM provides just-in-time access for admin roles in Azure (as well as Microsoft Online Services and apps that use groups), while Permissions Management allows multicloud discovery, remediation, and monitoring of privileged access across Azure, AWS, and GCP.

-## What public cloud infrastructures are supported by Permissions Management?

-Permissions Management has a data collector that collects access permissions assigned to various identities, activity logs, and resources metadata. This gathers full visibility into permissions granted to all identities to access the resources and details on usage of granted permissions.

-Permissions Management offers granular visibility into all identities and their permissions granted versus used, across cloud infrastructures to uncover any action performed by any identity on any resource. This isn't limited to just user identities, but also workload identities such as virtual machines, access keys, containers, and scripts. The dashboard gives an overview of permission profile to locate the riskiest identities and resources.

-Customers only need to track the evolution of their Permission Creep Index to monitor permissions usage. They can do this in the "Analytics" tab in their Permissions Management dashboard where they can see how the PCI of each identity or resource is evolving over time.

-Yes, as of July 1st, 2022, new customers must acquire a free 45-day trial license or a paid license to use the service. You can enable a trial here: [https://aka.ms/TryPermissionsManagement](https://aka.ms/TryPermissionsManagement) or you can directly purchase resource-based licenses here: [https://aka.ms/BuyPermissionsManagement](https://aka.ms/BuyPermissionsManagement)

-To find out how many resources you have across your multicloud infrastructure, select Settings (gear icon) and view the Billable Resources tab in Permissions Management.

-## What do I do if IΓÇÖm using Public Preview version of Entra Permissions Management?

-If you are using the Public Preview version of Entra Permissions Management, your current deployment(s) will continue to work through October 1st.

-After October 1st you will need to move over to use the newly released version of the service and enable a 45-day trial or purchase licenses to continue using the service.

-For information on how to create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md).

-description: How to add or remove a user in Permissions Management through Azure Active Directory (AD).

-# Add or remove a user in Permissions Management

-For information on how to create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md).

-<!

-## Create a schedule to automatically generate and share a report

-1. In the **Audit** tab, load the query you want to use to generate your report.

-2. Select **Settings** (the gear icon).

-3. In **Repeat on**, select on which days of the week you want the report to run.

-4. In **Date**, select the date when you want the query to run.

-5. In **hh mm** (time), select the time when you want the query to run.

-6. In **Request file format**, select the file format you want for your report.

-7. In **Share report with people**, enter email addresses for people to whom you want to send the report.

-8. Select **Schedule**.

- Permissions Management generates the report as set in Steps 3 to 6, and emails it to the recipients you specified in Step 7.

-## Delete the schedule for a report

-1. In the **Audit** tab, load the query whose report schedule you want to delete.

-2. Select the ellipses menu **(…)** on the far right, and then select **Delete schedule**.

- Permissions Management deletes the schedule for running the query. The query itself isn't deleted.

->

-description: How to clone a role/policy in the Just Enough Permissions (JEP) Controller.

-This article describes how you can use the **Remediation** dashboard in Permissions Management to clone roles/policies for the Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) authorization systems.

-1. On the Permissions Management Permissions Management home page, select the **Remediation** tab, and then select the **Role/Policies** tab.

-description: How to create and view activity alerts and alert triggers in Permissions Management.

- To remove a parameter, select the minus sign **(-)**.

- - The user who creates an alert trigger is automatically subscribed to the alert, and will receive emails about the alert.

- - **Deactivate**: The alert will still be listed, but will no longer send emails to subscribed users.

-This article describes how to create or approve a request for permissions in the **Remediation** dashboard in Permissions Management. You can create and approve requests for the Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) authorization systems.

-description: How to create a custom query in the Audit dashboard in Permissions Management.

-description: How to select group-based permissions settings in Permissions Management with the User management dashboard.

-This article describes how you can create and manage group-based permissions in Permissions Management with the User management dashboard.

-description: How to create a role/policy in the Remediation dashboard in Permissions Management.

-This article describes how you can use the **Remediation** dashboard in Permissions Management to create roles/policies for the Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) authorization systems.

-description: How to create a rule in the Autopilot dashboard in Permissions Management.

-description: How to delete a role/policy in the Just Enough Permissions (JEP) Controller.

-This article describes how you can use the **Remediation** dashboard in Permissions Management to delete roles/policies for the Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) authorization systems.

-description: How to modify a role/policy in the Remediation dashboard in Permissions Management.

-This article describes how you can use the **Remediation** dashboard in Permissions Management to modify roles/policies for the Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) authorization systems.

-description: How to view notification settings for a rule in the Autopilot dashboard in Permissions Management.

-This article describes how to view notification settings for a rule in the Permissions Management **Autopilot** dashboard.

-description: How to generate, view, and apply rule recommendations in the Autopilot dashboard in Permissions Management.

-description: How to revoke access to high-risk and unused tasks or assign read-only status for Microsoft Azure and Google Cloud Platform (GCP) identities in the Remediation dashboard in Permissions Management.

-description: How to view and filter information about roles/ policies in the Remediation dashboard in Permissions Management.

- <!Add Link: [documentation](https://developer.cloudknox.io/)>

-<!## Next steps>

-<!View integrated authorization systems](product-integrations)>

-<>

-<>

-description: Permissions Management glossary

-# The Permissions Management glossary

-This glossary provides a list of some of the commonly used cloud terms in Permissions Management. These terms will help Permissions Management users navigate through cloud-specific terms and cloud-generic terms.

-## Commonly-used acronyms and terms

-| OIDC | OpenID Connect. An authentication protocol that verifies user identity when a user is trying to access a protected HTTPs end point. OIDC is an evolutionary development of ideas implemented earlier in OAuth. |

-description: How to onboard an Amazon Web Services (AWS) account on Permissions Management.

-This article describes how to onboard an Amazon Web Services (AWS) account on Permissions Management.

-> A *global administrator* or *root user* (an admin for all authorization system types) can perform the tasks in this article after the global administrator has initially completed the steps provided in [Enable Permissions Management on your Azure Active Directory tenant](onboard-enable-tenant.md).

-<!-- diagram from gargi -->

-You can enable or disable the controller in Azure at the Subscription level of you Management Group(s).

-1. Execute the **sh mciem-workload-identity-pool.sh** to create the workload identity pool, provider, and service account.

-1. Execute the **sh mciem-member-projects.sh** to give Permissions Management permissions to access each of the member projects.

-1. Optionally, execute **mciem-enable-gcp-api.sh** to enable all recommended GCP APIs.

-description: How to enable Permissions Management in your organization.

-> [!NOTE]

-> There are two ways to enable a trial or a full product license, self-service and volume licensing.

-> For self-service, navigate to the M365 portal at [https://aka.ms/TryPermissionsManagement](https://aka.ms/TryPermissionsManagement) and purchase licenses or sign up for a free trial. The second way is through Volume Licensing or Enterprise agreements. If your organization falls under a volume license or enterprise agreement scenario, please contact your Microsoft representative.

- This app is used to set up an OpenID Connect (OIDC) connection to your GCP project. OIDC is an interoperable authentication protocol based on the OAuth 2.0 family of specifications. The scripts generated will create the app of this specified name in your Azure AD tenant with the right configuration.

-1. In the **Permissions Management Onboarding - GCP OIDC Account Details & IDP Access** page, enter the **OIDC Project Number** and **OIDC Project ID**of the GCP project in which the OIDC provider and pool will be created. You can change the role name to your requirements.

-1. You can either download and run the script at this point or you can run it in the Google Cloud Shell.

-1. Select **Next** after sucessfully running the setup script.

-Choose from 3 options to manage GCP projects.

-You have the ability to specify only certain GCP member projects to manage and monitor with MEPM (up to 100 per collector). Follow the steps below to configure these GCP member projects to be monitored:

-description: View current Microsoft Permissions Management partners and their websites.

-Microsoft verified partners can help you onboard Microsoft Entra Permissions Management and run a risk assessment across your entire multicloud environment.

-| EPM partner | Website |

-* For an overview of Permissions Management, see [What's Permissions Management?](overview.md)

-description: How to get started with your Entra Permissions free trial

-1. The **Info** tab displays the **Privilege creep index** and **Service control policy (SCP)** information about the account.

-For more information about the **Privilege creep index** and SCP information, see [View key statistics and data about your authorization system](ui-dashboard.md).

-* **Authorization server** - The identity platform is the authorization server. Also called an *identity provider* or *IdP*, it securely handles the end-user's information, their access, and the trust relationships between the parties in the auth flow. The authorization server issues the security tokens your apps and APIs use for granting, denying, or revoking access to resources (authorization) after the user has signed in (authenticated).

-The parties in an authentication flow use **bearer tokens** to assure, verify, and authenticate a principal (user, host, or service) and to grant or deny access to protected resources (authorization). Bearer tokens in the identity platform are formatted as [JSON Web Tokens](https://tools.ietf.org/html/rfc7519) (JWT).

-Your client app needs a way to trust the security tokens issued to it by the identity platform. The first step in establishing trust is by [registering your app](quickstart-register-app.md). When you register your app, the identity platform automatically assigns it some values, while others you configure based on the application's type.

-The identity platform offers authentication and authorization services using standards-compliant implementations of OAuth 2.0 and OpenID Connect (OIDC) 1.0. Standards-compliant authorization servers like the identity platform provide a set of HTTP endpoints for use by the parties in an auth flow to execute the flow.

-**We strongly advise against crafting your own library or raw HTTP calls to execute authentication flows.** A [Microsoft Authentication Library](reference-v2-libraries.md) is safer and easier. However, if your scenario prevents you from using our libraries or you'd just like to learn more about the identity platform's implementation, we have protocol reference:

-For authorization approaches that rely on information about the authenticated entity, an application evaluates information exchanged during authentication. For example, by using the information that was provided within a [security token](./security-tokens.md). For information not contained in a security token, an application might make extra calls to external resources.

-You define app roles by using the [Azure portal](https://portal.azure.com) during the [app registration process](quickstart-register-app.md). App roles are defined on an application registration representing a service, app or API. When a user signs in to the application, Azure AD emits a `roles` claim for each role that the user or service principal has been granted. This can be used to implement claim-based authorization. App roles can be assigned [to a user or a group of users](../manage-apps/add-application-portal-assign-users.md). App roles can also be assigned to the service principal for another application, or [to the service principal for a managed identity](../managed-identities-azure-resources/how-to-assign-app-role-managed-identity-powershell.md).

-Third-party applications are intended to understand ID tokens. ID tokens shouldn't be used for authorization purposes. Access tokens are used for authorization. The claims provided by ID tokens can be used for UX inside your application, as keys in a database, and providing access to the client application. For more information about the claims used in an ID token, see the [ID token claims reference](id-token-claims-reference.md).

-### Install the Microsoft.Identity.Web.MicrosoftGraph client library package

-Install the [Microsoft.Identity.Web.MicrosoftGraph NuGet package](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) in your project by using the .NET Core command-line interface or the Package Manager Console in Visual Studio.

-dotnet add package Microsoft.Identity.Web.MicrosoftGraph

-Install-Package Microsoft.Identity.Web.MicrosoftGraph

- //var users = await graphServiceClient.Users.Request().GetAsync();

-Install the [Microsoft.Identity.Web](https://www.nuget.org/packages/Microsoft.Identity.Web/) and [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet packages in your project by using the .NET Core command-line interface or the Package Manager Console in Visual Studio.

-dotnet add package Microsoft.Identity.Web.MicrosoftGraph

-Install-Package Microsoft.Identity.Web.MicrosoftGraph

- var user = await _graphServiceClient.Me.Request().GetAsync();

- using (var photoStream = await _graphServiceClient.Me.Photo.Content.Request().GetAsync())

-| `email` | The reported email address for this user | JWT, SAML | MSA, Azure AD | This value is included if the user is a guest in the tenant. For managed users (the users inside the tenant), it must be requested through this optional claim or, on v2.0 only, with the OpenID scope. This value isn't guaranteed to be correct, and is mutable over time - never use it for authorization or to save data for a user. For more information, see [Secure applications and APIs by validating claims](claims-validation.md). If you require an addressable email address in your app, request this data from the user directly, using this claim as a suggestion or prefill in your UX. |

-> var user = await _graphServiceClient.Me.Request().GetAsync();

-> ViewData["ApiResult"] = user.DisplayName;

-> ### Microsoft.Identity.Web.MicrosoftGraph

-> Microsoft Identity Web (in the [Microsoft.Identity.Web.TokenAcquisition](https://www.nuget.org/packages/Microsoft.Identity.Web.TokenAcquisition) package) is the library that's used to request tokens for accessing an API protected by the Microsoft identity platform. This quickstart requests tokens by using the application's own identity instead of delegated permissions. The authentication flow in this case is known as a [client credentials OAuth flow](v2-oauth2-client-creds-grant-flow.md). For more information on how to use MSAL.NET with a client credentials flow, see [this article](https://aka.ms/msal-net-client-credentials). Given the daemon app in this quickstart calls Microsoft Graph, you install the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) package, which handles automatically authenticated requests to Microsoft Graph (and references itself Microsoft.Identity.Web.TokenAcquisition)

-> Microsoft.Identity.Web.MicrosoftGraph can be installed by running the following command in the Visual Studio Package Manager Console:

-> dotnet add package Microsoft.Identity.Web.MicrosoftGraph

-> .Request()

-> .WithAppOnly()

-> .GetAsync();

-You provide a certificate instead of the client secret, or [workload identity federation](/azure/active-directory/workload-identities/workload-identity-federation.md) credentials.

-Alternatively, if you want to call Microsoft Graph, add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) package.

- <PackageReference Include="Microsoft.Identity.Web.MicrosoftGraph" Version="2.6.1" />

-[CredentialDescription](/dotnet/api/microsoft.identity.abstractions.credentialdescription?view=msal-model-dotnet-latest) for details.

- .Request()

- .WithAppOnly()

- .GetAsync();

-1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to the project.

-1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to your project.

-In this scenario, you've added `.AddMicrosoftGraph()` in *Startup.cs* as specified in [Code configuration](scenario-web-api-call-api-app-configuration.md#option-1-call-microsoft-graph), and you can directly inject the `GraphServiceClient` in your controller or page constructor for use in the actions. The following example Razor page displays the photo of the signed-in user.

- var user = await _graphServiceClient.Me.Request().GetAsync();

- using (var photoStream = await _graphServiceClient.Me.Photo.Content.Request().GetAsync())

- var user = await graphServiceClient.Me.Request().GetAsync();

- using (var photoStream = await graphServiceClient.Me.Photo.Content.Request().GetAsync())

-1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to your project.

-1. Add the [Microsoft.Identity.Web.MicrosoftGraph](https://www.nuget.org/packages/Microsoft.Identity.Web.MicrosoftGraph) NuGet package to your project.

-You want to call Microsoft Graph. In this scenario, you've added `AddMicrosoftGraph` in *Startup.cs* as specified in [Code configuration](scenario-web-app-call-api-app-configuration.md#option-1-call-microsoft-graph), and you can directly inject the `GraphServiceClient` in your controller or page constructor for use in the actions. The following example Razor page displays the photo of the signed-in user.

- var user = await _graphServiceClient.Me.Request().GetAsync();

- using (var photoStream = await _graphServiceClient.Me.Photo.Content.Request().GetAsync())

- var user = await graphServiceClient.Me.Request().GetAsync();

- using (var photoStream = await graphServiceClient.Me.Photo.Content.Request().GetAsync())

-## Update the application code with your tenant information

-Now you need to update your application code configuration with the application ID from the application registration, your customer tenant name, and a client secret value.

-We have several samples and how-to guides that can help you update your application to integrate with a user flow, based on app type, platform, and language. See [Samples for customer identity and access management (CIAM) in Azure Active Directory](samples-ciam-all.md).

- | `https://cxone.niceincontact,com/<guid>` |

-| FQDN | Port | Use |

-|--|--|-|

-| **`login.microsoftonline.com`** | **`HTTPS:443`** | Required for Active Directory Authentication. |

-| **`*.ods.opinsights.azure.com`** | **`HTTPS:443`** | Required for Microsoft Defender to upload security events to the cloud.|

-| **`*.oms.opinsights.azure.com`** | **`HTTPS:443`** | Required to Authenticate with LogAnalytics workspaces.|

-docker-compose up -d

-docker-compose down

-## KMS V2 support

-Since AKS version 1.27 and above, enabling the KMS feature configures KMS V2. With KMS V2, you aren't limited to the 2,000 secrets support. For more information, you can refer to the [KMS V2 Improvements](https://kubernetes.io/blog/2023/05/16/kms-v2-moves-to-beta/).

-If your cluster version is less than 1.27 and you already enabled KMS, use the following steps to migrate to KMS V2:

-5. Perform the storage migration

-Disable KMS on an existing cluster using the `az aks update` command with the `--disable-azure-keyvault-kms` flag.

-Update all secrets using the `kubectl get secrets` command with the `--all-namespaces` flag.

-Upgrade the AKS cluster using the `az aks upgrade` command and specify your desired version as `1.27.x` or higher for `--kubernetes-version`.

-Example:

-You can reenable the KMS feature on the cluster to encrypt the secrets. After that, the AKS cluster uses KMS V2.

-If you donΓÇÖt want to do the KMS v2 migration, you can create a new 1.27+ cluster with KMS enabled.

-Re-encrypt all secrets under KMS V2 using the `kubectl get secrets` command with the `--all-namespaces` flag.

-* An Azure API Management instance (Any tier will work, including 'Consumption', however certain features applicable to the full scenario are not available in this tier (rate-limit-by-key and dedicated Virtual IP), these restrictions are called out below in the article where appropriate).

-1. Now set the Display Name, choose something unique and relevant to the service being created. In this example, we will use the name "Backend Application".

-1. Under 'User Attributes and claims', click 'Show More...' then choose the claim options that you want your users to enter and have returned in the token. Check at least 'Display Name' and 'Email Address' to collect, with 'Display Name' and 'Email Addresses' to return (pay careful attention to the fact that you are collecting emailaddress, singular, and asking to return email addresses, multiple), and click 'OK', then click 'Create'.

- > Now your Function API is deployed and should throw 401 responses if the correct JWT is not supplied as an Authorization: Bearer header, and should return data when a valid request is presented.

-1. Click the 'settings' tab, then under subscription - switch off the 'Subscription Required' checkbox as we will use the Oauth JWT token in this case to rate limit. Note that if you are using the consumption tier, this would still be required in a production environment.

-1. If you're using the Consumption tier of API Management, then you should remove both rate-limit-by-key policy as this policy is not available when using the Consumption tier of Azure API Management.

- > If you're using the API Management consumption tier then instead of rate limiting by the JWT subject or incoming IP Address (Limit call rate by key policy is not supported today for the "Consumption" tier), you can Limit by call rate quota see [here](rate-limit-policy.md).

- backend: "{APIBASEURL}/hello" // The location that we will call for the backend api, this should be hosted in API Management, suffixed with the name of the API operation (in the sample this is '/hello').

-The *authority* value needs to be in the format:- https://{b2ctenantname}.b2clogin.com/tfp/{b2ctenantname}.onmicrosoft.com}/{signupandsigninpolicyname}, if you have used our sample names and your b2c tenant is called 'contoso' then you would expect the authority to be 'https://contoso.b2clogin.com/tfp/contoso.onmicrosoft.com}/Frontendapp_signupandsignin'.

-If you're currently using App Service Environment v1 or v2, you have the opportunity to migrate your workloads to [App Service Environment v3](overview.md). App Service Environment v3 has [advantages and feature differences](overview.md#feature-differences) that provide enhanced support for your workloads and can reduce overall costs. Consider using the [migration feature](migrate.md) if your environment falls into one of the [supported scenarios](migrate.md#supported-scenarios). If your environment isn't currently supported by the migration feature, you can wait for support if your scenario is listed in the [upcoming supported scenarios](migrate.md#migration-feature-limitations). Otherwise, you can choose to use one of the manual migration options given in this article.

-If your App Service Environment [won't be supported for migration](migrate.md#migration-feature-limitations) with the migration feature, you must use one of the manual methods to migrate to App Service Environment v3.

-For any migration method that doesn't use the [migration feature](migrate.md), you'll need to [create the App Service Environment v3](creation.md) and a new subnet using the method of your choice. There are [feature differences](overview.md#feature-differences) between App Service Environment v1/v2 and App Service Environment v3 as well as [networking changes](networking.md) that will involve new (and for internet-facing environments, additional) IP addresses. You'll need to update any infrastructure that relies on these IPs.

-Note that multiple App Service Environments can't exist in a single subnet. If you need to use your existing subnet for your new App Service Environment v3, you'll need to delete the existing App Service Environment before you create a new one. For this scenario, the recommended migration method is to [back up your apps and then restore them](#back-up-and-restore) in the new environment after it gets created and configured. There will be application downtime during this process because of the time it takes to delete the old environment, create the new App Service Environment v3, configure any infrastructure and connected resources to work with the new environment, and deploy your apps onto the new environment.

-App Service Environment v3 uses Isolated v2 App Service plans that are priced and sized differently than those from Isolated plans. Review the [SKU details](https://azure.microsoft.com/pricing/details/app-service/windows/) to understand how you're new environment will need to be sized and scaled to ensure appropriate capacity. There's no difference in how you create App Service plans for App Service Environment v3 compared to previous versions.

-You can select a custom backup and restore it to an App Service in your App Service Environment v3. You must create the App Service you will restore to before restoring the app. You can choose to restore the backup to the production slot, an existing slot, or a newly created slot that you can create during the restoration process.

-This solution is recommended for users that are using Windows App Service and can't migrate using the [migration feature](migrate.md). You'll need to set up your new App Service Environment v3 before cloning any apps. Cloning an app can take up to 30 minutes to complete. Cloning can be done using PowerShell as described in the [documentation](../app-service-web-app-cloning.md#cloning-an-existing-app-to-an-app-service-environment) or using the Azure portal.

-1. Give your app a **Name**. This name can be the same as the old app, but note the site's default URL using the new environment will be different. You'll need to update any custom DNS or connected resources to point to the new URL.

-1. You can use an existing Windows **App Service plan** from your new environment if you created one already, or create a new one. The available Windows App Service plans in your new App Service Environment v3, if any, will be listed in the dropdown.

-Once your migration and any testing with your new environment is complete, delete your old App Service Environment, the apps that are on it, and any supporting resources that you no longer need. You'll continue to be charged for any resources that haven't been deleted.

- Downtime is dependent on your migration process. If you have a different App Service Environment that you can point traffic to while you migrate or if you can use a different subnet to create your new environment, you won't have downtime. However, if you must use the same subnet, there will be downtime resulting from the time it takes to delete the old environment, create the App Service Environment v3, create the new App Service plans, re-create the apps, and update any resources that need to know about the new IP addresses.

- No, apps that run on App Service Environment v1 and v2 shouldn't need any modifications to run on App Service Environment v3.

- The migration feature supports this [migration scenario](./migrate.md#supported-scenarios). You can migrate using a manual method if you don't want to use the migration feature. You can configure your [custom domain suffix](./how-to-custom-domain-suffix.md) when creating your App Service Environment v3 or any time after that.

- You'll now be on App Service Environment v3 so be sure to review the [features and feature differences](overview.md#feature-differences) compared to previous versions. For ILB App Service Environment, you'll keep the same ILB IP address. For internet facing App Service Environment, the public IP address and the outbound IP address will change. Note for internet facing App Service Environment, previously there was a single IP for both inbound and outbound. For App Service Environment v3, they're separate. For more information, see [App Service Environment v3 networking](networking.md#addresses).

-In order to simplify and normalize security configuration, App Service apps typically run the various development frameworks with their default settings. The frameworks and runtime components provided by the platform are updated regularly to satisfy security and compliance requirements, for this reason we do not guarantee specific minor/patch versions and recommend customers target major version as needed.

-A best practice is to always use the environment variables `%SystemDrive%` and `%ResourceDrive%` instead of hard-coded file paths. The root path returned from these two environment variables has shifted over time from `d:\` to `c:\`. However, older applications hard-coded with file path references to `d:\` will continue to work because the App Service platform automatically remaps `d:\` to instead point at `c:\`. As noted above, it is highly recommended to always use the environment variables when building file paths and avoid confusion over platform changes to the default root file path.

-It is important to monitor your disk utilization as your application grows. If the disk quota is reached, it can have adverse effects to your application. For example:

-Due to how Azure services work, the specific virtual machine responsible for hosting a UNC share will change over time. It is guaranteed that UNC shares will be mounted by different virtual machines as they are brought up and down during the normal course of Azure operations. For this reason, apps should never make hard-coded assumptions that the machine information in a UNC file path will remain stable over time. Instead, they should use the convenient *faux* absolute path `%HOME%\site` that App Service provides. This faux absolute path provides a portable, app-and-user-agnostic method for referring to one's own app. By using `%HOME%\site`, one can transfer shared files from app to app without having to configure a new absolute path for each transfer.

-The `%HOME%` directory in an app maps to a content share in Azure Storage dedicated for that app, and its size is defined by your [pricing tier](https://azure.microsoft.com/pricing/details/app-service/). It may include directories such as those for content, error and diagnostic logs, and earlier versions of the app created by source control. These directories are available to the app's application code at runtime for read and write access. Because the files are not stored locally, they are persistent across app restarts.

-| SKU Family | B1/S1/etc. | B2/S2/etc. | B3/S3/etc. |

-| - | - | - | - |

-|Basic, Standard, Premium | 11 GB | 15 GB | 58 GB |

-| PremiumV2, PremiumV3, Isolated | 21 GB | 61 GB | 140 GB |

-There is also a limited capability for apps to establish one local loopback connection, and have an app listen on that local loopback socket. This feature exists primarily to enable apps that listen on local loopback sockets as part of their functionality. Each app sees a "private" loopback connection. App "A" cannot listen to a local loopback socket established by app "B".

-As noted earlier, apps run inside of low-privileged worker processes using a random application pool identity. Application code has access to the memory space associated with the worker process, as well as any child processes that may be spawned by CGI processes or other applications. However, one app cannot access the memory or data of another app even if it is on the same virtual machine.

-Apps can spawn and run arbitrary code. It is allowable for an app to do things like spawn a command shell or run a PowerShell script. However, even though arbitrary code and processes can be spawned from an app, executable programs and scripts are still restricted to the privileges granted to the parent application pool. For example, an app can spawn an executable that makes an outbound HTTP call, but that same executable cannot attempt to unbind the IP address of a virtual machine from its NIC. Making an outbound network call is allowed to low-privileged code, but attempting to reconfigure network settings on a virtual machine requires administrative privileges.

-Apps have read-only access to much (though not all) of the registry of the virtual machine they are running on. In practice, this means registry keys that allow read-only access to the local Users group are accessible by apps. One area of the registry that is currently not supported for either read or write access is the HKEY\_CURRENT\_USER hive.

-New Customers are not allowed to create v1 from 1 July 2023. However, any existing V1 customers can continue to create resources until August 2024 and manage V1 resources until the retirement date of 28 April 2026.

-Once the deadline arrives V1 gateways are not supported. Any V1 SKU resources that are still active are stopped, and force deleted.

-Customers who did not have Application Gateway V1 SKU in their subscriptions in the month of June 2023 are considered as new customers. These customers wonΓÇÖt be able to create new V1 gateways from 1 July 2023.

-No, Microsoft cannot migrate user's data on their behalf. Users must do the migration themselves by using the self-serve options provided.

-Application Gateway v1 is built on legacy components and customers have deployed the gateways in many different ways in their architecture ,due to which customer involvement is required for migration.This also allows users to plan the migration during a maintenance window, which can help to ensure that the migration is successful with minimal downtime for the user's applications.

-The Azure PowerShell script creates a new v2 gateway with an appropriate size to handle the traffic on your existing v1 gateway. Autoscaling is disabled by default, but you can enable AutoScaling when you run the script.

-### Does this script support certificates uploaded to Azure Key Vault ?

-No. Currently the script doesn't support certificates in Key Vault.

-|`arcdata` Azure CLI extension version|1.5.1 ([Download](https://aka.ms/az-cli-arcdata-ext))|

-| `--mi_client_id` | String | The client ID of the managed identity for authentication with Azure Blob |

-## Configuration requirements

-### Static Configuration

-Static configuration is recommended for Arc resource bridge because the resource bridge needs three static IPs in the same subnet for the control plane, appliance VM, and reserved appliance VM (for upgrade). The control plane corresponds to the `controlplanenedpoint` parameter, the appliance VM IP to `k8snodeippoolstart`, and reserved appliance VM to `k8snodeippoolend` in the `createconfig` command that creates the resource bridge configuration files. If using DHCP, reserve those IP addresses, ensuring the IPs are outside of the assignable DHCP range of IPs (i.e. the control plane IP should be treated as a reserved/static IP that no other machine on the network will use or receive from DHCP).

-### IP Address Prefix

-The subnet of the IP addresses for Arc resource bridge must lie in the IP address prefix that is passed in the `ipaddressprefix` parameter during the configuration creation. The IP address prefix is the IP prefix that is exposed by the network to which Arc resource bridge is connected. It is entered as the subnet's IP address range for the virtual network and subnet mask (IP Mask) in CIDR notation, for example `192.168.7.1/24`. The minimum IP prefix is /29. The IP address prefix should have enough available IP addresses for Gateway IP, Control Plane IP, appliance VM IP, and reserved appliance VM IP. Consult your system or network administrator to obtain the IP address prefix in CIDR notation. An IP Subnet CIDR calculator may be used to obtain this value.

-### DNS Server IPs

-DNS Server must have internal and external endpoint resolution. The appliance VM and control plane need to resolve the management machine and vice versa. All three must be able to reach the required URLs for deployment.

-### Gateway IP

-The gateway IP should be an IP from within the subnet designated in the IP address prefix.

-### Example minimum configuration for static IP deployment

-Below is an example of valid configuration values that can be passed during configuration file creation for Arc resource bridge. It is strongly recommended to use static IP addresses when deploying Arc resource bridge. Notice that the IP addresses for the Gateway, Control Plane, appliance VM and DNS server IP (for internal resolution) are within the IP prefix - this key detail ensures the successful deployment of the appliance VM.

-IP address Prefix (CIDR format): 192.168.0.0/29

-Gateway (IP format): 192.168.0.1

-VM IP Pool Start (IP format): 192.168.0.2

-VM IP Pool End (IP format): 192.168.0.3

-Control Plane IP (IP format): 192.168.0.4

-DNS servers (IP list format): 192.168.0.1, 10.0.0.5, 10.0.0.6

-If using a proxy, Arc resource bridge must be configured for proxy so that it can connect to the Azure services. To configure the Arc resource bridge with proxy, provide the proxy certificate file path during creation of the configuration files. Only pass the single proxy certificate. If a certificate bundle is passed then the deployment will fail. The proxy server endpoint can't be a .local domain. The proxy server has to also be routable/reachable from IPs within the IP prefix. Proxy configuration of the management machine isn't configured by Arc resource bridge.

-There are only two certificates that should be relevant when deploying the Arc resource bridge behind an SSL proxy: the SSL certificate for your SSL proxy (so that the management machine and on-premises appliance VM trust your proxy FQDN and can establish an SSL connection to it), and the SSL certificate of the Microsoft download servers. This certificate must be trusted by your proxy server itself, as the proxy is the one establishing the final connection and needs to trust the endpoint. Non-Windows machines may not trust this second certificate by default, so you may need to ensure that it's trusted.

-In order to deploy Arc resource bridge, images need to be downloaded to the management machine and then uploaded to the on-premises private cloud gallery. If your proxy server throttles download speed, this may impact your ability to download the required images (~3 GB) within the allotted time (90 min).

-1. The client VM used for testing should be *in the same region* as your Azure Cache for Redis instance.

-1. Make sure the client VM you use has *at least as much compute and bandwidth* as the cache instance being tested.

-1. Configure your [network isolation](cache-network-isolation.md) and [firewall](cache-configure.md#firewall) settings to ensure that the client VM is able to access your Azure Cache for Redis instance.

-1. If you're using TLS/SSL on your cache instance, you need to add the `--tls` parameter to your redis-benchmark command or use a proxy like [stunnel](https://www.stunnel.org/https://docsupdatetracker.net/index.html).

-1. `Redis-benchmark` uses port 6379 by default. Use the `-p` parameter to override this setting. You need to do use `-p`, if you're using the SSL/TLS (port 6380) or are using the Enterprise tier (port 10000).

-1. If you're using an Azure Cache for Redis instance that uses [clustering](cache-how-to-scale.md), you need to add the `--cluster` parameter to your `redis-benchmark` command. Enterprise tier caches using the [Enterprise clustering policy](cache-best-practices-enterprise-tiers.md#clustering-on-enterprise) can be treated as nonclustered caches and don't need this setting.

-1. Launch `redis-benchmark` from the CLI or shell of the VM. For instructions on how to configure and run the tool, see the [redis-benchmark documentation](https://redis.io/docs/management/optimization/benchmarks/) and the [redis-benchmark examples](#redis-benchmark-examples) sections.

->[!CAUTION]

-

-| | | | | | |

-| | | | | | |

-

-> [!Important]

-> P5 instances in the China East and China North regions use 20 cores, not 32 cores.

-**Enterprise Cluster Policy**

-| | | | | | |

-**OSS Cluster Policy**

-| | | | | | |

-In addition to scaling up by moving to larger cache size, you can boost performance by [scaling out](cache-how-to-scale.md#how-to-scale-up-and-outenterprise-and-enterprise-flash-tiers). In the Enterprise tiers, scaling out is called increasing the _capacity_ of the cache instance. A cache instance by default has capacity of two--meaning a primary and replica node. An Enterprise cache instance with a capacity of four indicates that the instance was scaled out by a factor of two. Scaling out provides access to more memory and vCPUs. Details on how many vCPUs are used by the core Redis process at each cache size and capacity can be found at the [Enterprise tiers best practices page](cache-best-practices-enterprise-tiers.md#sharding-and-cpu-utilization). Scaling out is most effective when using the OSS cluster policy.

-**Scaling out - Enterprise cluster policy**

-| | | | |

-| | | |

-**Scaling out - OSS cluster policy**

-| | | | |

-| | | |

-| F300 | 610,000 | 970,000 |

-1. (Optional) In the <a name="custom-props">**Custom properties**</a> section, if you've configured action groups for this alert rule, you can add custom properties in key:value pairs to the alert notification payload to add more information to it. Add the property **Name** and **Value** for the custom property you want included in the payload.

- You can also use custom properties to extract and manipulate data from alert payloads that use the [common schema](alerts-common-schema.md). You can use those values in the action group webhook or logic app.

-

- > [!NOTE]

- > In this phase the custom properties are not part of the e-mail template

- The format for extracting values from the common schema, use a "$", and then the path of the [Common alert schema](alerts-common-schema.md) field inside curly brackets. For example: `${data.essentials.monitorCondition}`.

- In the following examples, values in the **custom properties** are used to utilize data from the payload:

- 1. In the <a name="managed-id">**Identity**</a> section, select which identity is used by the log alert rule to send the log query. This identity is used for authentication when the alert rule executes the log query.

- 1. In the **Name** field, enter the name of the variable, such as **AffectedResources**.

- 1. Populate the fields of the **Read a resource** action with the array values from the `AffectedResources` variable. In each of the fields, select the field and scroll down to **Enter a custom value**. Select **Add dynamic content**, and then select the **Expression** tab. Enter the strings from this table:

-* [Learn more about the common alert schema](./alerts-common-schema.md)

-[Create ITSM work items from Azure alerts](./itsmc-overview.md)

-Yu can use telemetry processors to configure rules that are applied to request, dependency, and trace telemetry. For example, you can:

-If you don't see the *Use managed identity* option, you are using an SPN clusters. In that case, you must use command line tools to migrate. See other tabs for migration instructions and templates.

-For new aks cluster:

-**Enable Monitoring with MSI without syslog for new aks cluster**

-**Enable Monitoring with MSI with syslog for new aks cluster**

-**Enable Monitoring with MSI for existing aks cluster:**

-| Azure Monitor Logs | Logs ingestion API | Collect log data from any REST client and store in Log Analytics workspace using a data collection rule. | [Logs ingestion API in Azure Monitor (preview)](logs/logs-ingestion-api-overview.md) |

- externalLabels:

- cluster: <AKS-CLUSTER-NAME>

- ## https://prometheus.io/docs/prometheus/latest/configuration/configuration/#remote_write

- remoteWrite:

- - url: 'http://localhost:8081/api/v1/write'

- ## Azure Managed Prometheus currently exports some default mixins in Grafana.

- ## These mixins are compatible with Azure Monitor agent on your Azure Kubernetes Service cluster.

- ## However, these mixins aren't compatible with Prometheus metrics scraped by the Kube Prometheus stack.

- ## In order to make these mixins compatible, uncomment remote write relabel configuration below:

-

- ## writeRelabelConfigs:

- ## - sourceLabels: [metrics_path]

- ## regex: /metrics/cadvisor

- ## targetLabel: job

- ## replacement: cadvisor

- ## action: replace

- ## - sourceLabels: [job]

- ## regex: 'node-exporter'

- ## targetLabel: job

- ## replacement: node

- ## action: replace

- containers:

- - name: prom-remotewrite

- image: <CONTAINER-IMAGE-VERSION>

- imagePullPolicy: Always

- ports:

- - name: rw-port

- containerPort: 8081

- livenessProbe:

- httpGet:

- path: /health

- port: rw-port

- initialDelaySeconds: 10

- timeoutSeconds: 10

- readinessProbe:

- httpGet:

- path: /ready

- port: rw-port

- initialDelaySeconds: 10

- timeoutSeconds: 10

- env:

- - name: INGESTION_URL

- value: <INGESTION_URL>

- - name: LISTENING_PORT

- value: '8081'

- - name: IDENTITY_TYPE

- value: userAssigned

- - name: AZURE_CLIENT_ID

- value: <MANAGED-IDENTITY-CLIENT-ID>

- # Optional parameter

- - name: CLUSTER

- value: <CLUSTER-NAME>

-description: Use Azure Data Explorer to query data that was exported from your Log Analytics workspace to an Azure Storage account.

-# Query exported data from Azure Monitor by using Azure Data Explorer

-Exporting data from Azure Monitor to an Azure Storage account enables low-cost retention and the ability to reallocate logs to different regions. Use Azure Data Explorer to query data that was exported from your Log Analytics workspaces. After configuration, supported tables that are sent from your workspaces to a storage account will be available as a data source for Azure Data Explorer.

-The process flow is to:

-1. Export data from the Log Analytics workspace to the storage account.

-1. Create an external table in your Azure Data Explorer cluster and mapping for the data types.

-1. Query data from Azure Data Explorer.

-## Send data to Azure Storage

-Azure Monitor logs can be exported to a storage account by using any of the following options:

-> [!TIP]

-> You can use an existing Azure Data Explorer cluster or create a new dedicated cluster with the needed configurations.

-## Create an external table located in Azure Blob Storage

-Use [external tables](/azure/data-explorer/kusto/query/schema-entities/externaltables) to link Azure Data Explorer to a storage account. An external table is a Kusto schema entity that references data stored outside a Kusto database. Like tables, an external table has a well-defined schema. Unlike tables, data is stored and managed outside of a Kusto cluster. The exported data from the previous section is saved in JSON lines.

-To create a reference, you require the schema of the exported table. Use the [getschema](/azure/data-explorer/kusto/query/getschemaoperator) operator from Log Analytics to retrieve this information, which includes the table's columns and their data types.

-You can now use the output to create the Kusto query for building the external table.

-Follow the guidance in [Create and alter external tables in Azure Storage or Azure Data Lake](/azure/data-explorer/kusto/management/external-tables-azurestorage-azuredatalake) to create an external table in a JSON format. Then run the query from your Azure Data Explorer database.

->[!NOTE]

->The external table creation is built from two processes. The first process is to create the external table. The second process is to create the mapping.

-The following PowerShell script creates the [create](/azure/data-explorer/kusto/management/external-tables-azurestorage-azuredatalake#create-external-table-mapping) commands for the table and the mapping:

-```powershell

-PARAM(

- $resourcegroupname, #The name of the Azure resource group

- $TableName, # The Log Analytics table you want to convert to an external table

- $MapName, # The name of the map

- $subscriptionId, # The ID of the subscription

- $WorkspaceId, # The Log Analytics WorkspaceId

- $WorkspaceName, # The Log Analytics workspace name

- $BlobURL, # The Blob URL where the data is saved

- $ContainerAccessKey, # The blob container Access Key (option to add an SAS URL)

- $ExternalTableName = $null # The External Table name, null to use the same name

-)

-if($null -eq $ExternalTableName) {

- $ExternalTableName = $TableName

-}

-$query = $TableName + ' | getschema | project ColumnName, DataType'

-$output = (Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceId -Query $query).Results

-$FirstCommand = @()

-$SecondCommand = @()

-foreach ($record in $output) {

- if ($record.DataType -eq 'System.DateTime') {

- $dataType = 'datetime'

- } elseif ($record.DataType -eq 'System.Int32') {

- $dataType = 'int32'

- } elseif ($record.DataType -eq 'System.Double') {

- $dataType = 'double'

- } else {

- $dataType = 'string'

- }

- $FirstCommand += $record.ColumnName + ":" + "$dataType" + ","

- $SecondCommand += "{`"column`":" + "`"" + $record.ColumnName + "`"," + "`"datatype`":`"$dataType`",`"path`":`"$." + $record.ColumnName + "`"},"

-}

-$schema = ($FirstCommand -join '') -replace ',$'

-$mapping = ($SecondCommand -join '') -replace ',$'

-$CreateExternal = @'

-.create external table {0} ({1})

-kind=blob

-partition by (TimeGeneratedPartition:datetime = bin(TimeGenerated, 1min))

-pathformat = (datetime_pattern("'y='yyyy'/m='MM'/d='dd'/h='HH'/m='mm", TimeGeneratedPartition))

-dataformat=multijson

-(

- h@'{2}/WorkspaceResourceId=/subscriptions/{4}/resourcegroups/{6}/providers/microsoft.operationalinsights/workspaces/{5};{3}'

-)

-with

-(

- docstring = "Docs",

- folder = "ExternalTables"

-)

-'@ -f $TableName, $schema, $BlobURL, $ContainerAccessKey, $subscriptionId, $WorkspaceName.ToLower(), $resourcegroupname.ToLower(),$WorkspaceId

-$createMapping = @'

-.create external table {0} json mapping "{1}" '[{2}]'

-'@ -f $ExternalTableName, $MapName, $mapping

-Write-Host -ForegroundColor Red 'Copy and run the following commands (one by one), on your Azure Data Explorer cluster query window to create the external table and mappings:'

-write-host -ForegroundColor Green $CreateExternal

-Write-Host -ForegroundColor Green $createMapping

-```

-The following image shows an example of the output:

->[!TIP]

->* Copy, paste, and then run the output of the script in your Azure Data Explorer client tool to create the table and mapping.

->* To use all the data inside the container, alter the script and change the URL to be `https://your.blob.core.windows.net/containername;SecKey`.

-## Query the exported data from Azure Data Explorer

-After you configure the mapping, you can query the exported data from Azure Data Explorer. Your query requires the [external_table](/azure/data-explorer/kusto/query/externaltablefunction) function, as shown in the following example:

-```kusto

-external_table("HBTest","map") | take 10000

-```

-[](media/azure-data-explorer-query-storage/external-table-query.png#lightbox)

-## Next steps

-Learn to [write queries in Azure Data Explorer](/azure/data-explorer/write-queries).

-> Other tools that use the Azure API for querying - for example, Grafana and Power BI - cannot access Basic Logs.

-If a cluster is deleted, billing for the cluster will stop even if the cluster is within it's 31-day commitment period.

-> Looking to adjust retention settings on your Application Insights tables? The table names have changed for workspace based components, see [Application Insights Table Structure](https://learn.microsoft.com/azure/azure-monitor/app/convert-classic-resource#table-structure)

-Workspaces cannot be created in or moved to the **Standard** or **Premium** pricing tiers since October 1, 2016. Workspaces already in these pricing tiers can continue to use them, but if a workspace is moved out of these tiers, it can't be moved back. The Standard and Preium pricing tiers have fixed data retention of 30 days and 365 days, respectively. Workspaces in these pricing tiers don't support the use of [Basic Logs](basic-logs-configure.md) and Data Archive. Data ingestion meters on your Azure bill for these legacy tiers are called "Data Analyzed."

-description: Steps that you must perform when migrating from Data Collector API and custom fields-enabled tables to DCR-based custom log collection.

-# Migrate from Data Collector API and custom fields-enabled tables to DCR-based custom log collection

-This article describes how to migrate from [Data Collector API](data-collector-api.md) or [custom fields](custom-fields.md) in Azure Monitor to [DCR-based custom log collection](../essentials/data-collection-rule-overview.md). It includes configuration required for custom tables created in your Log Analytics workspace so that they can be used by [Logs ingestion API](logs-ingestion-api-overview.md) and [workspace transformations](../essentials/data-collection-transformations.md#workspace-transformation-dcr).

-> [!IMPORTANT]

-> You do not need to follow this article if you are configuring your DCR-based custom logs [using the Azure Portal](tutorial-workspace-transformations-portal.md) since the configuration will be performed for you. This article only applies if you're configuring using Resource Manager templates APIs.

-## Background

-To use a table with the [Logs ingestion API](logs-ingestion-api-overview.md) or with a [workspace transformation](../essentials/data-collection-transformations.md#workspace-transformation-dcr), it must be configured to support new features. When you complete the process described in this article, the following actions are taken:

-## Applicable scenarios

-This article is only applicable if all of the following criteria apply:

-If all of these conditions aren't true, then you can use DCR-based log collection without following the procedure described here.

-## Migration procedure

-If the table that you're targeting with DCR-based log collection fits the criteria above, then you must perform the following steps:

-1. Configure your data collection rule (DCR) following procedures at [Send data to Azure Monitor using Logs ingestion API (Resource Manager templates)](tutorial-logs-ingestion-api.md) or [Add transformation in workspace data collection rule to Azure Monitor using Resource Manager templates](tutorial-workspace-transformations-api.md).

-1. If using the Logs ingestion API, also [configure the data collection endpoint (DCE)](tutorial-logs-ingestion-api.md#create-data-collection-endpoint) and the agent or component that will be sending data to the API.

-1. Issue the following API call against your table. This call is idempotent, so there will be no effect if the table has already been migrated.

- ```rest

- POST https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}/migrate?api-version=2021-12-01-preview

- ```

-1. Discontinue use of the Data Collector API and start using the new Logs ingestion API.

-### Focus navigation

-Choose whether or not to enable focus navigation.

-If enabled, only one screen at a time will be visible as you step through a process in the portal. If disabled, as you move through the steps of a process, you'll be able to move between them through a horizontal scroll bar.

-* Back up of databases with extensions in their names arenΓÇÖt supported. This is because the IIS server performs the [file extension request filtering](/iis/configuration/system.webserver/security/requestfiltering/fileextensions). However, note that we have allowlisted _.ad_, _.cs_, and _.master_ that can be used in the database names.

-> [Download the detailed Resource Planner](https://download.microsoft.com/download/A/B/5/AB5D86F0-DCB7-4DC3-9872-6155C96DE500/SQL%20Server%20in%20Azure%20VM%20Backup%20Scale%20Calculator.xlsx) to calculate the approximate number of protected databases that are recommended per server based on the VM resources, bandwidth and the backup policy.

-* Your capabilities on the VM when connecting via native client are dependent on what is enabled on the native client.

-* You can configure this feature by either modifying an existing Bastion deployment, or you can deploy Bastion with the feature configuration already specified.

-> [!IMPORTANT]

-> [!INCLUDE [Pricing](../../includes/bastion-pricing.md)]

->

-# How to run Multivariate Anomaly Detection API in Postman?

-## Multivariate Anomaly Detection API

-# Best practices for using the Multivariate Anomaly Detection API

-This article will provide guidance around recommended practices to follow when using the multivariate Anomaly Detection (MVAD) APIs.

-Follow the instructions in this section to avoid errors while using MVAD. If you still get errors, please refer to the [full list of error codes](./troubleshoot.md) for explanations and actions to take.

- Anything beyond that or "before" the leading sliding window won't impact the inference result at all and may only cause performance downgrade.Anything below that may lead to an `NotEnoughInput` error.

-We have two variables collected from two sensors which send one data point every 30 seconds. However, the sensors aren't sending data points at a strict even frequency, but sometimes earlier and sometimes later. Because MVAD will take into consideration correlations between different variables, timestamps must be properly aligned so that the metrics can correctly reflect the condition of the system. In the above example, timestamps of variable 1 and variable 2 must be properly 'rounded' to their frequency before alignment.

-Let's see what happens if they're not pre-processed. If we set `alignMode` to be `Outer` (which means union of two sets), the merged table will be

-`nan` indicates missing values. Obviously, the merged table isn't what you might have expected. Variable 1 and variable 2 interleave, and the MVAD model can't extract information about correlations between them. If we set `alignMode` to `Inner`, the merged table will be empty as there's no common timestamp in variable 1 and variable 2.

-Therefore, the timestamps of variable 1 and variable 2 should be pre-processed (rounded to the nearest 30-second timestamps) and the new time series are

-We have provided severity which indicates the significance of anomalies. False positives may be filtered out by setting up a threshold on the severity. Sometimes too many false positives may appear when there are pattern shifts in the inference data. In such cases a model may need to be retrained on new data. If the training data contains too many anomalies, there could be false negatives in the detection results. This is because the model learns patterns from the training data and anomalies may bring bias to the model. Thus proper data cleaning may help reduce false negatives.

-The Univariate Anomaly Detection API enables you to monitor and detect abnormalities in your time series data without having to know machine learning. The algorithms adapt by automatically identifying and applying the best-fitting models to your data, regardless of industry, scenario, or data volume. Using your time series data, the API determines boundaries for anomaly detection, expected values, and which data points are anomalies.

-The function **[series_uv_anomalies_fl()](/azure/data-explorer/kusto/functions-library/series-uv-anomalies-fl?tabs=adhoc)** detects anomalies in time series by calling the [Univariate Anomaly Detection API](../overview.md). The function accepts a limited set of time series as numerical dynamic arrays and the required anomaly detection sensitivity level. Each time series is converted into the required JSON (JavaScript Object Notation) format and posts it to the Anomaly Detector service endpoint. The service response has dynamic arrays of high/low/all anomalies, the modeled baseline time series, its normal high/low boundaries (a value above or below the high/low boundary is an anomaly) and the detected seasonality.

-The function **[series_uv_change_points_fl()](/azure/data-explorer/kusto/functions-library/series-uv-change-points-fl?tabs=adhoc)** finds change points in time series by calling the Univariate Anomaly Detection API. The function accepts a limited set of time series as numerical dynamic arrays, the change point detection threshold, and the minimum size of the stable trend window. Each time series is converted into the required JSON format and posts it to the Anomaly Detector service endpoint. The service response has dynamic arrays of change points, their respective confidence, and the detected seasonality.

-* Multivariate Anomaly Detection SDK is updated to match with GA API for four languages.

-* Multivariate anomaly detection APIs deployed in five more regions: East Asia, West US, Central India, Korea Central, Germany West Central.

-* Multivariate anomaly detection APIs deployed in five more regions: West US 3, Japan East, Brazil South, Central US, Norway East. Now in total 15 regions are supported.

-* Multivariate anomaly detection APIs deployed in four more regions: Australia East, Canada Central, North Europe, and Southeast Asia. Now in total 10 regions are supported.

-* Multivariate anomaly detection APIs available in more regions: West US 2, West Europe, East US 2, South Central US, East US, and UK South.

-* Multivariate anomaly detection APIs preview in selected regions (West US 2, West Europe).

-* May 7, 2021 [New to Anomaly Detector: Multivariate Capabilities](/shows/AI-Show/New-to-Anomaly-Detector-Multivariate-Capabilities) - AI Show on the new multivariate anomaly detection APIs with Tony Xing and Seth Juarez

-Typically, the integration with Microsoft Speech Services is handled by a telephony client connected to the customers SIP/RTP processor, for example, to a Session Border Controller (SBC).

-For easier integration the Speech Service also supports ΓÇ£ALAW in WAV containerΓÇ¥ and ΓÇ£MULAW in WAV containerΓÇ¥ for audio streaming.

-> In addition, consider implementing a Text to speech cache to store all synthesized audio and playback from the cache in case a string has previously been synthesized.

-> Customer-managed keys are only available resources created after 27 June, 2020. To use CMK with Speech Services, you will need to create a new Speech resource. Once the resource is created, you can use Azure Key Vault to set up your managed identity.

-To request the ability to use customer-managed keys, fill out and submit Customer-Managed Key Request Form. It will take approximately 3-5 business days to hear back on the status of your request. Depending on demand, you may be placed in a queue and approved as space becomes available. Once approved for using CMK with Speech Services, you'll need to create a new Speech resource from the Azure portal.

-Our goal with Custom Commands is to reduce your cognitive load to learn all the different technologies and focus building your voice commanding app. First step for using Custom Commands to <a href="https://portal.azure.com/#create/Microsoft.CognitiveServicesSpeechServices" target="_blank">create an Azure Speech resource </a>. You can author your Custom Commands app on the Speech Studio and publish it, after which an on-device application can communicate with it using the Speech SDK.

-description: Custom Speech is a set of online tools that allows you to evaluate and improve the Microsoft speech to text accuracy for your applications, tools, and products.

-1. [Upload test data](./how-to-custom-speech-upload-data.md). Upload test data to evaluate the Microsoft speech to text offering for your applications, tools, and products.

-The first public preview release of the Cognitive Services Speech Devices SDK.

-> Microsoft limits access to embedded speech. You can apply for access through the Azure Cognitive Services [embedded speech limited access review](https://aka.ms/csgate-embedded-speech). For more information, see [Limited access for embedded speech](/legal/cognitive-services/speech-service/embedded-speech/limited-access-embedded-speech?context=/azure/cognitive-services/speech-service/context/context).

-When the Speech SDK connects to the Speech Service, it checks the Transport Layer Security (TLS/SSL) certificate. The Speech SDK verifies that the certificate reported by the remote endpoint is trusted and hasn't been revoked. This verification provides a layer of protection against attacks involving spoofing and other related vectors. The check is accomplished by retrieving a certificate revocation list (CRL) from a certificate authority (CA) used by Azure. A list of Azure CA download locations for updated TLS CRLs can be found in [this document](../../security/fundamentals/tls-certificate-changes.md).

-If a destination posing as the Speech Service reports a certificate that's been revoked in a retrieved CRL, the SDK will terminate the connection and report an error via a `Canceled` event. The authenticity of a reported certificate can't be checked without an updated CRL. Therefore, the Speech SDK will also treat a failure to download a CRL from an Azure CA location as an error.

-The default maximum CRL size used by the Speech SDK (10 MB) can be adjusted per config object. The property key for this adjustment is `CONFIG_MAX_CRL_SIZE_KB` and the value, specified as a string, is by default "10000" (10 MB). For example, when creating a `SpeechRecognizer` object (that manages a connection to the Speech Service), you can set this property in its `SpeechConfig`. In the snippet below, the configuration is adjusted to permit a CRL file size up to 15 MB.

-To turn off certificate revocation checks, set the property `"OPENSSL_DISABLE_CRL_CHECK"` to `"true"`. Then, while connecting to the Speech Service, there will be no attempt to check or download a CRL and no automatic verification of a reported TLS/SSL certificate.

-description: Learn how to monitor for connection status and manually pre-connect or disconnect from the Speech Service.

-`SpeechRecognizer` and other objects in the Speech SDK automatically connect to the Speech Service when it's appropriate. Sometimes, you may either want additional control over when connections begin and end or want more information about when the Speech SDK establishes or loses its connection. The supporting `Connection` class provides this capability.

-A `Connection` can be obtained from most top-level Speech SDK objects via a static `From...` factory method, e.g. `Connection::FromRecognizer(recognizer)` for `SpeechRecognizer`.

-A `Connection` raises `Connected` and `Disconnected` events when the corresponding status change happens in the Speech SDK's connection to the Speech Service. You can listen to these events to know the latest connection state.

-`Connection` has explicit methods to start or end a connection to the Speech Service. Reasons you may want to use these include:

-The scripts are hosted at [Cognitive Services Voice Assistant - Custom Commands](https://github.com/Azure-Samples/Cognitive-Services-Voice-Assistant/tree/master/custom-commands). Clone the scripts in the bash directory to your repository. Make sure you maintain the same path.

-The scripts are hosted at [Cognitive Services Voice Assistant - Custom Commands](https://github.com/Azure-Samples/Cognitive-Services-Voice-Assistant/tree/master/custom-commands). Clone the scripts in the bash directory to your repository. Make sure you maintain the same path.

-## Test programatically with the Cognitive Services Voice Assistant Test Tool

-In this article, you learn how to quantitatively measure and improve the accuracy of the Microsoft speech to text model or your own custom models. [Audio + human-labeled transcript](how-to-custom-speech-test-and-train.md#audio--human-labeled-transcript-data-for-training-or-testing) data is required to test accuracy. You should provide from 30 minutes to 5 hours of representative audio.

-You can test the accuracy of your custom model by creating a test. A test requires a collection of audio files and their corresponding transcriptions. You can compare a custom model's accuracy with a Microsoft speech to text base model or another custom model. After you [get](#get-test-results) the test results, [evaluate](#evaluate-word-error-rate) the word error rate (WER) compared to speech recognition results.

-You need audio or text data for testing the accuracy of Microsoft speech recognition or training your custom models. For information about the data types supported for testing or training your model, see [Training and testing datasets](how-to-custom-speech-test-and-train.md).

-1. Specify the dataset location, and then select **Next**. You can choose a local file or enter a remote location such as Azure Blob URL. If you select remote location, and you don't use trusted Azure services security mechanism (see next Note), then the remote location should be an URL that can be retrieved with a simple anonymous GET request. For example, a [SAS URL](/azure/storage/common/storage-sas-overview) or a publicly accessible URL. URLs that require extra authorization, or expect user interaction are not supported.

-description: The Speech Service SDK supports numerous programming languages for speech to text and text to speech conversion, along with speech translation. This article discusses memory management tooling built into the SDK.

-This guide will take you through the steps to begin developing a voice assistant on Windows.

-To start developing a voice assistant for Windows, you will need to make sure you have the proper development environment.

-Some resources necessary for a completely customized voice agent on Windows will require resources from Microsoft. The [UWP Voice Assistant Sample](windows-voice-assistants-faq.yml#the-uwp-voice-assistant-sample) provides sample versions of these resources for initial development and testing, so this section is unnecessary for initial development.

-These are the requirements to create a basic dialog service using Direct Line Speech.

-description: In this article we describe a tool released on GitHub that enables customers push audio files to Speech Service easily and quickly

-For each request to the service, keyword verification returns one of two responses: accepted or rejected. The processing latency varies depending on the length of the keyword and the length of the audio segment expected to contain the keyword. Processing latency doesn't include network cost between the client and Azure Speech services.

-| End-to-end keyword recognition with speech to text | Best suited for products that will use a customized on-device keyword model from custom keyword with Azure Speech keyword verification and speech to text. This scenario is the most common. | <ul><li>[Voice assistant sample code](https://github.com/Azure-Samples/Cognitive-Services-Voice-Assistant)</li><li>[Tutorial: Voice enable your assistant built using Azure Bot Service with the C# Speech SDK](./tutorial-voice-enable-your-bot-speech-sdk.md)</li><li>[Tutorial: Create a custom commands application with simple voice commands](./how-to-develop-custom-commands-application.md)</li></ul> |

-The Speech service provides speech to text and text to speech capabilities with an [Azure Speech resource](~/articles/cognitive-services/cognitive-services-apis-create-account.md?tabs=speech#create-a-new-azure-cognitive-services-resource). You can transcribe speech to text with high accuracy, produce natural-sounding text to speech voices, translate spoken audio, and use speaker recognition during conversations.

-> * <a href="https://portal.azure.com/#create/Microsoft.CognitiveServicesSpeechServices" target="_blank">Create an Azure Speech resource in a region that supports Custom Commands.</a> Refer to the **Region Availability** section above for list of supported regions.

-3. From Azure portal, create Speech Service resources for each region.

-You should create Speech Service resources in both a main and a secondary region by following the same steps as used for default endpoints.

-Custom Speech Service doesn't support automatic failover. We suggest the following steps to prepare for manual or automatic failover implemented in your client code. In these steps, you replicate custom models in a secondary region. With this preparation, your client code can switch to a secondary region when the primary region fails.

- Microsoft Speech Service Text to speech API

-# Speech Services in sovereign clouds

-This section contains Speech Services endpoint information for the usage with [Speech SDK](speech-sdk.md), [Speech to text REST API](rest-speech-to-text.md), and [Text to speech REST API](rest-text-to-speech.md).

-#### Speech Services REST API

-Speech Services REST API endpoints in Azure Government have the following format:

-This section contains Speech Services endpoint information for the usage with [Speech SDK](speech-sdk.md), [Speech to text REST API](rest-speech-to-text.md), and [Text to speech REST API](rest-text-to-speech.md).

-#### Speech Services REST API

-Speech Services REST API endpoints in Azure China have the following format:

-1. [Download a model for the disconnected container](#download-a-model-for-the-disconnected-container). For this step, use a regular Azure Speech Service resource which is either configured to use a "**S0 - Standard**" pricing tier or a "**Speech to Text (Custom)**" commitment tier pricing plan.

-1. [Download the disconnected container license](#download-the-disconnected-container-license). For this step, use an Azure Speech Service resource which is configured to use the "**DC0 Commitment (Disconnected)**" pricing plan.

-1. [Run the disconnected container for service](#run-the-disconnected-container). For this step, use an Azure Speech Service resource which is configured to use the "**DC0 Commitment (Disconnected)**" pricing plan.

-For this step, use a regular Azure Speech Service resource which is either configured to use a "**S0 - Standard**" pricing tier or a "**Speech to Text (Custom)**" commitment tier pricing plan.

-For this step, use an Azure Speech Service resource which is configured to use the "**DC0 Commitment (Disconnected)**" pricing plan.

-For this step, use an Azure Speech Service resource which is configured to use the "**DC0 Commitment (Disconnected)**" pricing plan.

-> Disconnected container pricing and commitment tiers vary from standard containers. For more information, see [Speech Services pricing](https://azure.microsoft.com/pricing/details/cognitive-services/speech-services/).

-> Connected and disconnected container pricing and commitment tiers vary. For more information, see [Speech Services pricing](https://azure.microsoft.com/pricing/details/cognitive-services/speech-services/).

-Speech Service automatically encrypts your data when it is persisted it to the cloud. Speech service encryption protects your data and to help you to meet your organizational security and compliance commitments.

-This article explains how to set up and use Private Link and private endpoints with Speech Services in Azure Cognitive Services.

-This article then describes how to remove private endpoints later, but still use the Speech resource.

-> The resolved IP address points to a virtual network proxy endpoint, which dispatches the network traffic to the private endpoint for the Cognitive Services resource. The behavior will be different for a resource with a custom domain name but *without* private endpoints. See [this section](#dns-configuration) for details.

-A Speech resource with a custom domain interacts with Speech Services in a different way.

-A Speech resource with a custom domain name and a private endpoint turned on uses a different way to interact with Speech Services. This section explains how to use such a resource with the Speech Services REST APIs and the [Speech SDK](speech-sdk.md).

-> A Speech resource without private endpoints that uses a custom domain name also has a special way of interacting with Speech Services.

- - In the log file, search for `SPEECH-ConnectionUrl`. In matching lines, the `value` parameter contains the full URL that your application used to reach Speech Services.

-This section explains how to use a Speech resource with a custom domain name but *without* any private endpoints with the Speech Services REST APIs and [Speech SDK](speech-sdk.md). This might be a resource that was once used in a private endpoint scenario, but then had its private endpoints deleted.

-description: Speech Studio is a set of UI-based tools for building and integrating features from Azure Speech service in your applications.

-description: Get an overview of the benefits and capabilities of the speech to text feature of the Speech Service.

-description: In this Azure Speech CLI quickstart, you interact with speech to text, text to speech, and speech translation without having to write code.

-# Quickstart: Get started with the Azure Speech CLI

-In this article, you'll learn how to use the Azure Speech CLI (also called SPX) to access Speech services such as speech to text, text to speech, and speech translation, without having to write any code. The Speech CLI is production ready, and you can use it to automate simple workflows in the Speech service by using `.bat` or shell scripts.

-Common tasks when using Azure Speech services, are batch operations. In this article, you'll learn how to do batch speech to text (speech recognition), batch text to speech (speech synthesis) with the Speech CLI. Specifically, you'll learn how to:

-> However only [Speech to text REST API](rest-speech-to-text.md) is documented in the Swagger specification. See the documents referenced in the previous paragraph for the information on all other Speech Services REST APIs.

-# How to use conversation summarization (preview)

-> [!IMPORTANT]

-> The conversation summarization feature is a preview capability provided ΓÇ£AS ISΓÇ¥ and ΓÇ£WITH ALL FAULTS.ΓÇ¥ As such, Conversation Summarization (preview) should not be implemented or deployed in any production use. The customer is solely responsible for any use of conversation summarization.

-# How to use document summarization (preview)

-> [!IMPORTANT]

-> The summarization features described in this documentation are preview capabilities provided ΓÇ£AS ISΓÇ¥ and ΓÇ£WITH ALL FAULTS.ΓÇ¥ As such, document summarization (preview) should not be implemented or deployed in any production use. The customer is solely responsible for any use of document summarization.

-# [Conversation summarization (preview)](#tab/conversation-summarization)

-## Languages supported by conversation summarization (preview)

-# What is document and conversation summarization (preview)?

-# Quickstart: using document summarization and conversation summarization (preview)

-Use this article to learn which regions are supported by all summarization features. More regions will be added to this list as they become available.

-|East US|&#9989;|&#9989;|&#9989;|&#10060;|

-|Southeast Asia|&#10060;|&#10060;|&#10060;|&#9989;|

-Azure Communication Services Call Automation can be used to build calling workflows for customer service scenarios, as depicted in the high-level architecture below. You can answer inbound calls or make outbound calls. Execute actions like playing a welcome message, connecting the customer to a live agent on an ACS Calling SDK client app to answer the incoming call request. With support for ACS PSTN or Direct Routing, you can then connect this workflow back to your contact center.

-Call Automation uses a REST API interface to receive requests and provide responses to all actions performed within the service. Due to the asynchronous nature of calling, most actions will have corresponding events that are triggered when the action completes successfully or fails.

-Using the IncomingCall event from Event Grid and Call Automation SDK, a call can be answered by your application. This action allows for IVR scenarios where an inbound PSTN call can be answered programmatically by your application. Other scenarios include answering a call on behalf of a user.

-Using the IncomingCall event from Event Grid, a call can be redirected to one or more endpoints creating a single or simultaneous ringing (sim-ring) scenario. This means the call isn't answered by your application, it's simply ΓÇÿredirectedΓÇÖ to another destination endpoint to be answered.

-When your application answers a call or places an outbound call to an endpoint, that call can be transferred to another destination endpoint. Transferring a 1:1 call will remove your application's ability to control the call using the Call Automation SDKs.

-When your application has answered a one-to-one call, the hang-up action will remove the call leg and terminate the call with the other endpoint. If there are more than two participants in the call (group call), performing a ΓÇÿhang-upΓÇÖ action will remove your applicationΓÇÖs endpoint from the group call.

-Whether your application has answered a one-to-one or group call, or placed an outbound call with one or more participants, this action will remove all participants and end the call. This operation is triggered by setting `forEveryOne` property to true in Hang-Up call action.

-Based on business logic your application may need to cancel ongoing and queued media operations. Depending on the media operation canceled and the ones in queue, you will received a webhook event indicating that the action has been canceled.

-The following table outlines the current events emitted by Azure Communication Services. The two tables below show events emitted by Event Grid and from the Call Automation as webhook events.

-| RemoveParticipantSucceeded| Your application has successfuly removed a participant from the call. |

-To understand which events are published for different actions, refer to [this guide](../../how-tos/call-automation/actions-for-call-control.md) that provides code samples as well as sequence diagrams for various call control flows.

-Check out our how-to guide to learn [how-to play custom voice prompts](../../how-tos/call-automation/play-action.md) to users.

-## Known Issues

-It's possible that when a call is created using Call Automation, you won't get a value in the `serverCallId`. If that's the case, get the `serverCallId` from the `CallConnected` event method described in [Get serverCallId](../../quickstarts/call-automation/callflows-for-customer-interactions.md).

-description: Quickstart on how to use Call Automation to answer a call, recognize DTMF input, and add a participant to a call.

-zone_pivot_groups: acs-js-csharp-java-python

-# Build a customer interaction workflow using Call Automation

-In this quickstart, you'll learn how to build an application that uses the Azure Communication Services Call Automation SDK to handle the following scenario:

-## Subscribe to IncomingCall event

-IncomingCall is an Azure Event Grid event for notifying incoming calls to your Communication Services resource. To learn more about it, see [this guide](../../concepts/call-automation/incoming-call-notification.md).

-1. Navigate to your resource on Azure portal and select `Events` from the left side menu.

-2. Select `+ Event Subscription` to create a new subscription.

-3. Filter for Incoming Call event.

-4. Choose endpoint type as web hook and provide the public url generated for your application by ngrok. Make sure to provide the exact api route that you programmed to receive the event previously. In this case, it would be <ngrok_url>/api/incomingCall.

- 

- If your application does not send 200Ok back to Event Grid in time, Event Grid will use exponential backoff retry to send the incoming call event again. However, an incoming call only rings for 30 seconds, and acting on a call after that will not work. To avoid retries after a call expires, we recommend setting the retry policy in the `Additional Features` tab as: Max Event Delivery Attempts to 2 and Event Time to Live to 1 minute. Learn more about retries [here](../../../event-grid/delivery-and-retry.md).

-5. Select create to start the creation of subscription and validation of your endpoint as mentioned previously. The subscription is ready when the provisioning status is marked as succeeded.

-This subscription currently has no filters and hence all incoming calls will be sent to your application. To filter for specific phone number or a communication user, use the Filters tab.

-## Testing the application

-1. Place a call to the number you acquired in the Azure portal.

-2. Your Event Grid subscription to the `IncomingCall` should execute and call your application that will request to answer the call.

-3. When the call is connected, a `CallConnected` event will be sent to your application's callback url. At this point, the application will request audio to be played and to receive input from the caller.

-4. From your phone, press any three number keys, or press one number key and then # key.

-5. When the input has been received and recognized, the application will make a request to add a participant to the call.

-6. Once the added user answers, you can talk to them.

-## Clean up resources

-If you want to clean up and remove a Communication Services subscription, you can delete the resource or resource group. Deleting the resource group also deletes any other resources associated with it. Learn more about [cleaning up resources](../create-communication-resource.md#clean-up-resources).

-## Next steps

-description: Provides a how-to for redirecting inbound telephony calls with Call Automation.

-zone_pivot_groups: acs-csharp-java

-# Redirect inbound telephony calls with Call Automation

-Get started with Azure Communication Services by using the Call Automation SDKs to build automated calling workflows that listen for and manage inbound calls placed to a phone number or received via ACS direct routing.

-## Subscribe to IncomingCall event

-IncomingCall is an Azure Event Grid event for notifying incoming calls to your Communication Services resource. To learn more about it, see [this guide](../../concepts/call-automation/incoming-call-notification.md).

-1. Navigate to your resource on Azure portal and select `Events` from the left side menu.

-2. Select `+ Event Subscription` to create a new subscription.

-3. Filter for Incoming Call event.

-4. Choose endpoint type as web hook and provide the public url generated for your application by ngrok. Make sure to provide the exact api route that you programmed to receive the event previously. In this case, it would be <ngrok_url>/api/incomingCall.

- 

- If your application does not send 200Ok back to Event Grid in time, Event Grid will use exponential backoff retry to send the incoming call event again. However, an incoming call only rings for 30 seconds, and acting on a call after that will not work. To avoid retries after a call expires, we recommend setting the retry policy in the `Additional Features` tab as: Max Event Delivery Attempts to 2 and Event Time to Live to 1 minute. Learn more about retries [here](../../../event-grid/delivery-and-retry.md).

-5. Select create to start the creation of subscription and validation of your endpoint as mentioned previously. The subscription is ready when the provisioning status is marked as succeeded.

-This subscription currently has no filters and hence all incoming calls will be sent to your application. To filter for specific phone number or a communication user, use the Filters tab.

-## Testing the application

-1. Place a call to the number you acquired in the Azure portal (see prerequisites above).

-2. Your Event Grid subscription to the IncomingCall should execute and call your application.

-3. The call will be redirected to the endpoint(s) you specified in your application.

-Since this call flow involves a redirected call instead of answering it, pre-call web hook callbacks to notify your application the other endpoint accepted the call aren't published.

-## Clean up resources

-If you want to clean up and remove a Communication Services subscription, you can delete the resource or resource group. Deleting the resource group also deletes any other resources associated with it. Learn more about [cleaning up resources](../../quickstarts/create-communication-resource.md#clean-up-resources).

-## Next steps

-Azure Monitor alerts proactively notify you when important conditions are found in your monitoring data.

-Azure Communications Gateway doesn't currently support alerts.

-> [Connect and attest the CVM through Microsoft Azure Attestation Sample App](quick-create-confidential-vm-azure-cli-amd.md)

-zone_pivot_groups: programming-languages-set-ten

-* You can use the [Azure Cloud Shell][Azure Cloud Shell] or a local installation of the Azure CLI to run the command examples in this article. If you'd like to use it locally, version 2.0.74 or later is required. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][Install Azure CLI].

-* You can use the [Azure Cloud Shell][Azure Cloud Shell] or a local installation of the Azure CLI to run the command examples in this article. If you'd like to use it locally, version 2.0.74 or later is required. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][Install Azure CLI].

-> [!NOTE]

-> Compound indexes are only used in queries that sort results. For queries that have multiple filters that don't need to sort, create multipe single field indexes.

-|[Azure plan](https://azure.microsoft.com/offers/ms-azr-0017g/) and [Azure plan for DevTest](https://azure.microsoft.com/offers/ms-azr-0148g/) | Owners of the subscription |

-A billing account owner uses the following steps to cancel a subscription.

-description: Learn how to fetch stored credentials from Azure key vault and use them during data factory pipeline runs.

-## FAQ - Adaptive application controls

-### Are there any options to enforce the application controls?

-No enforcement options are currently available. Adaptive application controls are intended to provide **security alerts** if any application runs other than the ones you've defined as safe. They have a range of benefits ([What are the benefits of adaptive application controls?](#what-are-the-benefits-of-adaptive-application-controls)) and are customizable as shown on this page.

-### Why do I see a Qualys app in my recommended applications?

-[Microsoft Defender for Servers](defender-for-servers-introduction.md) includes vulnerability scanning for your machines. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Defender for Cloud. For details of this scanner and instructions for how to deploy it, see [Defender for Cloud's integrated Qualys vulnerability assessment solution](deploy-vulnerability-assessment-vm.md).

-To ensure no alerts are generated when Defender for Cloud deploys the scanner, the adaptive application controls recommended allowlist includes the scanner for all machines.

-For example, let's say the existing NSG rule is to allow traffic from 140.20.30.10/24 on port 22. Based on traffic analysis, adaptive network hardening might recommend narrowing the range to allow traffic from 140.23.30.10/29, and deny all other traffic to that port. For the full list of supported ports, see the FAQ entry [Which ports are supported?](#which-ports-are-supported).

-## FAQ - Adaptive network hardening

-### Which ports are supported?

-Adaptive network hardening recommendations are only supported on the following specific ports (for both UDP and TCP):

-13, 17, 19, 22, 23, 53, 69, 81, 111, 119, 123, 135, 137, 138, 139, 161, 162, 389, 445, 512, 514, 593, 636, 873, 1433, 1434, 1900, 2049, 2301, 2323, 2381, 3268, 3306, 3389, 4333, 5353, 5432, 5555, 5800, 5900, 5900, 5985, 5986, 6379, 6379, 7000, 7001, 7199, 8081, 8089, 8545, 9042, 9160, 9300, 11211, 16379, 26379, 27017, 37215

-### Are there any prerequisites or VM extensions required for adaptive network hardening?

-Adaptive network hardening is an agentless feature of Microsoft Defender for Cloud - nothing needs to be installed on your machines to benefit from this network hardening tool.

-### When should I use a "Deny all traffic" rule?

-A **Deny all traffic** rule is recommended when, as a result of running the algorithm, Defender for Cloud does not identify traffic that should be allowed, based on the existing NSG configuration. Therefore, the recommended rule is to deny all traffic to the specified port. The name of this type of rule is displayed as "*System Generated*". After enforcing this rule, its actual name in the NSG will be a string comprised of the protocol, traffic direction, "DENY", and a random number.

-## FAQ - Hardening an OS according to the security baseline

- - [Availability](#availability)

- - [What are the hardening recommendations?](#what-are-the-hardening-recommendations)

- - [Compare machines in your subscriptions with the OS security baselines](#compare-machines-in-your-subscriptions-with-the-os-security-baselines)

- - [FAQ - Hardening an OS according to the security baseline](#faqhardening-an-os-according-to-the-security-baseline)

- - [How do I deploy the prerequisites for the security configuration recommendations?](#how-do-i-deploy-the-prerequisites-for-the-security-configuration-recommendations)

- - [Why is a machine shown as not applicable?](#why-is-a-machine-shown-as-not-applicable)

- - [Next steps](#next-steps)

-### How do I deploy the prerequisites for the security configuration recommendations?

-To deploy the Guest Configuration extension with its prerequisites:

-### Why is a machine shown as not applicable?

-The list of resources in the **Not applicable** tab includes a **Reason** column. Some of the common reasons include:

-| Reason | Details |

-|-|--|

-| **No scan data available on the machine** | There aren't any compliance results for this machine in Azure Resource Graph. All compliance results are written to Azure Resource Graph by the Guest Configuration extension. You can check the data in Azure Resource Graph using the sample queries in [Azure Policy Guest Configuration - sample ARG queries](../governance/policy/samples/resource-graph-samples.md?tabs=azure-cli#azure-policy-guest-configuration).|

-| **Guest Configuration extension is not installed on the machine** | The machine is missing the Guest Configuration extension, which is a prerequisite for assessing the compliance with the Azure security baseline. |

-| **System managed identity is not configured on the machine** | A system-assigned, managed identity must be deployed on the machine. |

-| **The recommendation is disabled in policy** | The policy definition that assesses the OS baseline is disabled on the scope that includes the relevant machine. |

-## FAQ - Inventory

-### Why aren't all of my resources shown, such as subscriptions, machines, storage accounts?

-The inventory view lists your Defender for Cloud connected resources from a Cloud Security Posture Management (CSPM) perspective. The filters show only the resources with active recommendations.

-For example, if you have access to eight subscriptions but only seven currently have recommendations, filter by **Resource type = Subscriptions** shows only the seven subscriptions with active recommendations:

-### Why do some of my resources show blank values in the Defender for Cloud or monitoring agent columns?

-Not all Defender for Cloud monitored resources require agents. For example, Defender for Cloud doesn't require agents to monitor Azure Storage accounts or PaaS resources, such as disks, Logic Apps, Data Lake Analysis, and Event Hubs.

-When pricing or agent monitoring isn't relevant for a resource, nothing will be shown in those columns of inventory.

- 1. For the Auto-provisioning configuration agent type, select **Azure Monitor Agent**.

- :::image type="content" source="media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png" alt-text="Screenshot showing selecting Azure Monitor Agent for auto-provisioning." lightbox="media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png":::

- - You can't enable [collection of additional security events](#additional-security-events-collection).

-When you install the Azure Monitor Agent with auto-provisioning, you can define the destination workspace of the installed extensions. By default, the destination is the ΓÇ£default workspaceΓÇ¥ that Defender for Cloud creates for each region in the subscription: `defaultWorkspace-<subscriptionId>-<regionShortName>`. Defender for Cloud automatically configures the data collection rules, workspace solution, and additional extensions for that workspace.

-The Azure Monitor Agent requires Log analytics workspace solutions. These solutions are automatically installed when you auto-provision the Azure Monitor Agent with the default workspace.

-### Additional extensions for Defender for Cloud

-The Azure Monitor Agent requires more extensions. The ASA extension, which supports endpoint protection recommendations, fileless attack detection, and Adaptive Application controls, is automatically installed when you auto-provision the Azure Monitor Agent.

-### Additional security events collection

-When you auto-provision the Log Analytics agent in Defender for Cloud, you can choose to collect additional security events to the workspace. When you auto-provision the Azure Monitor agent in Defender for Cloud, the option to collect additional security events to the workspace isn't available. Defender for Cloud doesn't rely on these security events, but they can be helpful for investigations through Microsoft Sentinel.

-If you want to collect security events when you auto-provision the Azure Monitor Agent, you can create a [Data Collection Rule](../azure-monitor/essentials/data-collection-rule-overview.md) to collect the required events. Learn [how do it with PowerShell or with Azure Policy](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-to-configure-security-events-collection-with-azure-monitor/ba-p/3770719).

-Like for Log Analytics workspaces, Defender for Cloud users are eligible for [500-MB of free data](plan-defender-for-servers-data-workspace.md#log-analytics-pricing-faq) daily on defined data types that include security events.

-## FAQ

-### How does scanning affect the instances?

-Since the scanning process is an out-of-band analysis of snapshots, it doesn't impact the actual workloads and isn't visible by the guest operating system.

-### How does scanning affect the account/subscription?

-The scanning process has minimal footprint on your accounts and subscriptions.

-| Cloud provider | Changes |

-|||

-| Azure | - Adds a ΓÇ£VM Scanner OperatorΓÇ¥ role assignment<br>- Adds a ΓÇ£vmScannersΓÇ¥ resource with the relevant configurations used to manage the scanning process |

-| AWS | - Adds role assignment<br>- Adds authorized audience to OpenIDConnect provider<br>- Snapshots are created next to the scanned volumes, in the same account, during the scan (typically for a few minutes) |

-### What is the scan freshness?

-Each VM is scanned every 24 hours.

-### Which permissions are used by agentless scanning?

-The roles and permissions used by Defender for Cloud to perform agentless scanning on your Azure and AWS environments are listed here. In Azure, these permissions are automatically added to your subscriptions when you enable agentless scanning. In AWS, these permissions are [added to the CloudFormation stack in your AWS connector](enable-vulnerability-assessment-agentless.md#agentless-vulnerability-assessment-on-aws).

- - `Microsoft.Compute/disks/read`

- - `Microsoft.Compute/disks/beginGetAccess/action`

- - `Microsoft.Compute/virtualMachines/instanceView/read`

- - `Microsoft.Compute/virtualMachines/read`

- - `Microsoft.Compute/virtualMachineScaleSets/instanceView/read`

- - `Microsoft.Compute/virtualMachineScaleSets/read`

- - `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read`

- - `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read`

- | Attribute | Value |

- |||

- | SID | **VmScannerDeleteSnapshotAccess** |

- | Actions | ec2:DeleteSnapshot |

- | Conditions | "StringEquals":{"ec2:ResourceTag/CreatedByΓÇ¥:<br>"Microsoft Defender for Cloud"} |

- | Resources | arn:aws:ec2:::snapshot/ |

- | Effect | Allow |

- | Attribute | Value |

- |||

- | SID | **VmScannerAccess** |

- | Actions | ec2:ModifySnapshotAttribute <br> ec2:DeleteTags <br> ec2:CreateTags <br> ec2:CreateSnapshots <br> ec2:CopySnapshots <br> ec2:CreateSnapshot |

- | Conditions | None |

- | Resources | arn:aws:ec2:::instance/ <br> arn:aws:ec2:::snapshot/ <br> arn:aws:ec2:::volume/ |

- | Effect | Allow |

- | Attribute | Value |

- |||

- | SID | **VmScannerVerificationAccess** |

- | Actions | ec2:DescribeSnapshots <br> ec2:DescribeInstanceStatus |

- | Conditions | None |

- | Resources | * |

- | Effect | Allow |

- | Attribute | Value |

- |||

- | SID | **VmScannerEncryptionKeyCreation** |

- | Actions | kms:CreateKey |

- | Conditions | None |

- | Resources | * |

- | Effect | Allow |

- | Attribute | Value |

- |||

- | SID | **VmScannerEncryptionKeyManagement** |

- | Actions | kms:TagResource <br> kms:GetKeyRotationStatus <br> kms:PutKeyPolicy <br> kms:GetKeyPolicy <br> kms:CreateAlias <br> kms:ListResourceTags |

- | Conditions | None |

- | Resources | arn:aws:kms::${AWS::AccountId}:key/ <br> arn:aws:kms:*:${AWS::AccountId}:alias/DefenderForCloudKey |

- | Effect | Allow |

- | Attribute | Value |

- |||

- | SID | **VmScannerEncryptionKeyUsage** |

- | Actions | kms:GenerateDataKeyWithoutPlaintext <br> kms:DescribeKey <br> kms:RetireGrant <br> kms:CreateGrant <br> kms:ReEncryptFrom |

- | Conditions | None |

- | Resources | arn:aws:kms::${AWS::AccountId}:key/ |

- | Effect | Allow |

-### Which data is collected from snapshots?

-Agentless scanning collects data similar to the data an agent collects to perform the same analysis. Raw data, PIIs or sensitive business data isn't collected, and only metadata results are sent to Defender for Cloud.

-### What are the costs related to agentless scanning?

-Agentless scanning is included in Defender Cloud Security Posture Management (CSPM) and Defender for Servers P2 plans. No other costs will incur to Defender for Cloud when enabling it.

-> [!NOTE]

-> AWS charges for retention of disk snapshots. Defender for Cloud scanning process actively tries to minimize the period during which a snapshot is stored in your account (typically up to a few minutes), but you may be charged by AWS a minimal overhead cost for the disk snapshots storage.

-### How are VM snapshots secured?

-Agentless scanning protects disk snapshots according to MicrosoftΓÇÖs highest security standards. To ensure VM snapshots are private and secure during the analysis process, some of the measures taken are:

-Learn more about how to [enable vulnerability assessment with agentless scanning](enable-vulnerability-assessment-agentless.md).

-Microsoft Defender for Cloud generates detailed security alerts and recommendations. To analyze the information in these alerts and recommendations, you can export them to Azure Log Analytics, Event Hubs, or to another [SIEM, SOAR, or IT Service Management solution](export-to-siem.md). You can stream the alerts and recommendations as they're generated or define a schedule to send periodic snapshots of all of the new data.

-With **continuous export**, you fully customize *what* will be exported and *where* it will go. For example, you can configure it so that:

-|Required roles and permissions:|<ul><li>**Security admin** or **Owner** on the resource group</li><li>Write permissions for the target resource.</li><li>If you're using the [Azure Policy 'DeployIfNotExist' policies](#configure-continuous-export-at-scale-using-the-supplied-policies), you'll also need permissions for assigning policies</li><li>To export data to Event Hubs, you'll need Write permission on the Event Hubs Policy.</li><li>To export to a Log Analytics workspace:<ul><li>if it **has the SecurityCenterFree solution**, you'll need a minimum of read permissions for the workspace solution: `Microsoft.OperationsManagement/solutions/read`</li><li>if it **doesn't have the SecurityCenterFree solution**, you'll need write permissions for the workspace solution: `Microsoft.OperationsManagement/solutions/action`</li><li>Learn more about [Azure Monitor and Log Analytics workspace solutions](/previous-versions/azure/azure-monitor/insights/solutions)</li></ul></li></ul>|

- - **Streaming** ΓÇô assessments will be sent when a resourceΓÇÖs health state is updated (if no updates occur, no data will be sent).

- - **Snapshots** ΓÇô a snapshot of the current state of the selected data types will be sent once a week per subscription. To identify snapshot data, look for the field ``IsSnapshot``.

- 1. In the **Basics** tab, set the scope for the policy. To use centralized management, assign the policy to the Management Group containing the subscriptions that will use continuous export configuration.

-You can export data to an Azure Event Hubs or Log Analytics workspace in a different tenant, without using [Azure Lighthouse](../lighthouse/overview.md). When collecting data into a tenant, you can analyze the data from one central location.

-To export data to an Azure Event Hubs or Log Analytics workspace in a different tenant:

-You'll now need to add the relevant role assignment on the destination Event Hub.

-1. Navigate to the selected Event Hub.

- :::image type="content" source="media/continuous-export/windows-security-resource.png" alt-text="Screenshot that shows you where to enter and search for Windows Azure Security Resource Provider." lightbox="media/continuous-export/windows-security-resource.png":::

-You'll now see new Microsoft Defender for Cloud alerts or recommendations (depending on your configured continuous export rules and the condition you defined in your Azure Monitor alert rule) in Azure Monitor alerts, with automatic triggering of an action group (if provided).

-## FAQ - Continuous export

-### What are the costs involved in exporting data?

-There's no cost for enabling a continuous export. Costs might be incurred for ingestion and retention of data in your Log Analytics workspace, depending on your configuration there.

-Many alerts are only provided when you've enabled Defender plans for your resources. A good way to preview the alerts you'll get in your exported data is to see the alerts shown in Defender for Cloud's pages in the Azure portal.

-Learn more about [Log Analytics workspace pricing](https://azure.microsoft.com/pricing/details/monitor/).

-Learn more about [Azure Event Hubs pricing](https://azure.microsoft.com/pricing/details/event-hubs/).

-For general information about Defender for Cloud pricing, see the [pricing page](https://azure.microsoft.com/pricing/details/defender-for-cloud/).

-### Does the export include data about the current state of all resources?

-No. Continuous export is built for streaming of **events**:

-### Why are recommendations sent at different intervals?

-Different recommendations have different compliance evaluation intervals, which can range from every few minutes to every few days. So, the amount of time that it takes for recommendations to appear in your exports varies.

-### Does continuous export support any business continuity or disaster recovery (BCDR) scenarios?

-Continuous export can be helpful in to prepare for BCDR scenarios where the target resource is experiencing an outage or other disaster. However, it's the organization's responsibility to prevent data loss by establishing backups according to the guidelines from Azure Event Hubs, Log Analytics workspace, and Logic App.

-Learn more in [Azure Event Hubs - Geo-disaster recovery](../event-hubs/event-hubs-geo-dr.md).

-### What is the minimum SAS policy permissions required when exporting data to Azure Event Hubs?

-**Send** is the minimum SAS policy permissions required. For step-by-step instructions, see **Step 1. Create an Event Hubs namespace and event hub with send permissions** in [this article](./export-to-splunk-or-qradar.md#step-1-create-an-event-hubs-namespace-and-event-hub-with-send-permissions).

-> Read [Defender for Cloud frequently asked questions (FAQ)](faq-general.yml) for a list of common questions that can also be useful during the designing and planning phase.

-> To find a list of supported VMs, read the [Defender for Cloud frequently asked questions (FAQ)](faq-vms.yml).

-## FAQ - Defender for Containers

-### What are the options to enable the new plan at scale?

-You can use the Azure Policy `Configure Microsoft Defender for Containers to be enabled`, to enable Defender for Containers at scale. You can also see all of the options that are available to [enable Microsoft Defender for Containers](defender-for-containers-enable.md).

-### Does Microsoft Defender for Containers support AKS clusters with virtual machines scale sets?

-Yes.

-### Does Microsoft Defender for Containers support AKS without scale set (default)?

-No. Only Azure Kubernetes Service (AKS) clusters that use Virtual Machine Scale Sets for the nodes is supported.

-### Do I need to install the Log Analytics VM extension on my AKS nodes for security protection?

-No, AKS is a managed service, and manipulation of the IaaS resources isn't supported. The Log Analytics VM extension isn't needed and may result in extra charges.

-> [!div class="nextstepaction"]

-> [Enable Defender for Containers](defender-for-containers-enable.md)

-## FAQ

-### How does Defender for Containers scan an image?

-Defender for Containers pulls the image from the registry and runs it in an isolated sandbox with the Qualys scanner. The scanner extracts a list of known vulnerabilities.

-Defender for Cloud filters and classifies findings from the scanner. When an image is healthy, Defender for Cloud marks it as such. Defender for Cloud generates security recommendations only for images that have issues to be resolved. By only notifying you when there are problems, Defender for Cloud reduces the potential for unwanted informational alerts.

-### How can I identify pull events performed by the scanner?

-To identify pull events performed by the scanner, do the following steps:

-1. Search for pull events with the UserAgent of *AzureContainerImageScanner*.

-1. Extract the identity associated with this event.

-1. Use the extracted identity to identify pull events from the scanner.

-### What is the difference between Not Applicable Resources and Unverified Resources?

-### Does Microsoft share any information with Qualys in order to perform image scans?

-No, the Qualys scanner is hosted by Microsoft, and no customer data is shared with Qualys.

-### Can I get the scan results via REST API?

-Yes. The results are under [Sub-Assessments REST API](/rest/api/defenderforcloud/sub-assessments/list). Also, you can use Azure Resource Graph (ARG), the Kusto-like API for all of your resources: a query can fetch a specific scan.

-### Why is Defender for Cloud alerting me to vulnerabilities about an image that isnΓÇÖt in my registry?

-Some images may reuse tags from an image that was already scanned. For example, you may reassign the tag ΓÇ£LatestΓÇ¥ every time you add an image to a digest. In such cases, the ΓÇÿoldΓÇÖ image does still exist in the registry and may still be pulled by its digest. If the image has security findings and is pulled, it will expose security vulnerabilities.

-### Does Defender for Containers scan images in Microsoft Container Registry?

-Currently, Defender for Containers can scan images in Azure Container Registry (ACR) and AWS Elastic Container Registry (ECR) only.

-Docker Registry, Microsoft Artifact Registry/Microsoft Container Registry, and Microsoft Azure Red Hat OpenShift (ARO) built-in container image registry are not supported.

-Images should first be imported to ACR. Learn more about [importing container images to an Azure container registry](../container-registry/container-registry-import-images.md?tabs=azure-cli).

-Learn more about the Defender for Cloud [Defender plans](defender-for-cloud-introduction.md#protect-cloud-workloads).

-## FAQs

-### Can I get the scan results via REST API?

-Yes. The results are under [Sub-Assessments REST API](/rest/api/defenderforcloud/sub-assessments/list). Also, you can use Azure Resource Graph (ARG), the Kusto-like API for all of your resources: a query can fetch a specific scan.

-## FAQ - Microsoft Defender for SQL servers on machines

-### If I enable this Microsoft Defender plan on my subscription, are all SQL servers on the subscription protected?

-No. To defend a SQL Server deployment on an Azure virtual machine, or a SQL Server running on an Azure Arc-enabled machine, Defender for Cloud requires:

-The subscription *status*, shown in the SQL server page in the Azure portal, reflects the default workspace status and applies to all connected machines. Only the SQL servers on hosts with a Log Analytics agent reporting to that workspace are protected by Defender for Cloud.

-### Is there a performance effect from deploying Microsoft Defender for Azure SQL on machines?

-The focus of **Microsoft Defender for SQL on machines** is obviously security. But we also care about your business and so we've prioritized performance to ensure the minimal effect on your SQL servers.

-The service has a split architecture to balance data uploading and speed with performance:

-Lab tests of our solution showed CPU usage averaging 3% for peak slices, comparing it against benchmark loads. An analysis of our current user data shows a negligible effect on CPU and memory usage.

-Of course, performance always varies between environments, machines, and loads. The statements and numbers above are provided as a general guideline, not a guarantee for any individual deployment.

-## FAQ - Microsoft Defender for Storage (classic) pricing

-### Can I switch from an existing per-transaction pricing under the Defender for Storage (classic) plan to the new per-storage account pricing under the new Defender for Storage plan?

-Yes, you can migrate to the per-storage account pricing under the new Defender for Storage plan in the Azure portal or using any of the supported enablement methods.

-### Can I return to per-transaction pricing in the Defender for Storage (classic) plan after switching to per-storage account pricing?

-Yes, you can [enable per-transaction pricing](#set-up-microsoft-defender-for-storage-classic) under the Defender for Storage (classic) plan to migrate back from per-storage account pricing using all enablement methods except for the Azure portal.

-### Will you continue supporting per-transaction pricing in the Defender for Storage (classic) plan?

-Yes, you can [enable per-transaction pricing](#set-up-microsoft-defender-for-storage-classic) under the Defender for Storage (classic) plan from all the supported enablement methods, except for the Azure portal.

-### Under the Defender for Storage (classic) per-storage account pricing, can I exclude specific storage accounts from protections?

-No, you can only enable per-storage account pricing under the Defender for Storage (classic) plan at the subscription level. All storage accounts in the subscriptions are protected.

-### How long does it take for per-storage account pricing to be enabled in the Defender for Storage (classic) plan?

-When you enable Microsoft Defender for Storage at the subscription level for per-storage account or per-transaction pricing under the Defender for Storage (classic) plan, it takes up to 24 hours for the plan to be enabled.

-### Is there any difference in the feature set of per-storage account pricing compared to the legacy per-transaction pricing in the Defender for Storage (classic) plan?

-No. Both per-storage account and per-transaction pricing under the Defender for Storage (classic) plan include the same features. The only difference is the pricing structure.

-### How can I estimate the cost for each pricing under the Defender for Storage (classic) plan?

-To estimate the cost according to each pricing for your environment under the Defender for Storage (classic) plan, we created a [pricing estimation workbook](https://aka.ms/dfstoragecosttool) and a PowerShell script that you can run in your environment.

-Defender for Storage (classic) continually analyzes the telemetry stream generated by the [Azure Blob Storage](https://azure.microsoft.com/services/storage/blobs/), [Azure Files](https://azure.microsoft.com/products/storage/files/), and [Azure Data Lake Storage](https://azure.microsoft.com/products/storage/data-lake-storage) services. When potentially malicious activities are detected, security alerts are generated. These alerts are displayed in Microsoft Defender for Cloud, together with the details of the suspicious activity along with the relevant investigation steps, remediation actions, and security recommendations.

-Analyzed telemetry of Azure Blob Storage includes operation types such as `Get Blob`, `Put Blob`, `Get Container ACL`, `List Blobs`, and `Get Blob Properties`. Examples of analyzed Azure Files operation types include `Get File`, `Create File`, `List Files`, `Get File Properties`, and `Put Range`.

-Defender for Storage (classic) doesn't access the Storage account data and has no impact on its performance.

-For more clarification about Defender for Storage (classic), see the [commonly asked questions](#common-questionsmicrosoft-defender-for-storage-classic).

-|**Unusual behavior in an account** | Behavior that deviates from a learned baseline, such as a change of access permissions in an account, unusual access inspection, unusual data exploration, unusual deletion of blobs/files, or unusual data extraction. |

-|**Hash reputation based Malware detection** | Detection of known malware based on full blob/file hash. This can help detect ransomware, viruses, spyware, and other malware uploaded to an account, prevent it from entering the organization, and spreading to more users and resources. See also [Limitations of hash reputation analysis](#limitations-of-hash-reputation-analysis). |

-Alerts include details of the incident that triggered them, and recommendations on how to investigate and remediate threats. Alerts can be exported to Microsoft Sentinel or any other third-party SIEM or any other external tool. Learn more in [Stream alerts to a SIEM, SOAR, or IT Service Management solution](export-to-siem.md).

-## Common questions - Microsoft Defender for Storage (classic)

-### Are there differences in features between the new Defender for Storage plan and the legacy Defender for Storage Classic plan?

-Yes. The new Defender for Storage plan offers additional security capabilities, such as near real-time malware scanning and sensitive data threat detection. This plan also provides a more predictable pricing structure for better control over coverage and costs. Learn more about the [benefits of migrating to the new plan](defender-for-storage-classic-migrate.md).

-### How do I estimate charges at the account level?

-To get an estimate of Defender for Storage classic costs, use the [Price Estimation Workbook](https://portal.azure.com/#blade/AppInsightsExtension/UsageNotebookBlade/ComponentId/Azure%20Security%20Center/ConfigurationId/community-Workbooks%2FAzure%20Security%20Center%2FPrice%20Estimation/Type/workbook/WorkbookTemplateName/Price%20Estimation) in the Azure portal.

-### Can I exclude a specific Azure Storage account from a protected subscription?

-Yes, you can [exclude specific storage accounts](defender-for-storage-classic-enable.md#exclude-a-storage-account-from-a-protected-subscription-in-the-per-transaction-plan) from protected subscriptions in Defender for Storage (classic).

-### Can I switch from the per-transaction pricing in Defender for Storage (classic) to the new Defender for Storage plan?

-Yes, you can move to the new Defender for Storage plan with per-storage account pricing through the Azure portal or other supported methods. This change isn't automatic, you'll need to actively make the switch. Learn about how to [migrate to the new Defender for Storage](defender-for-storage-classic-migrate.md).

-### Can I exclude specific storage accounts from protection in the new Defender for Storage plan?

-Yes, the new Defender for Storage plan with per-storage account pricing allows you to exclude and configure specific storage accounts within protected subscriptions. However, you'll need to set up the exclusion again after you migrate to the new plan. Learn about how to [migrate to the new Defender for Storage](defender-for-storage-classic-migrate.md).

-> [!div class="nextstepaction"]

-> [Enable Defender for Storage (classic)](defender-for-storage-classic-enable.md)

-\* Azure DNS Zone is not supported for Malware Scanning and sensitive data threat detection.

-Defender for Storage continuously analyzes data and control plane logs from protected storage accounts when enabled. There's no need to turn on resource logs for security benefits. Using Microsoft Threat Intelligence, it identifies suspicious signatures such as malicious IP addresses, Tor exit nodes, and potentially dangerous apps. It also builds data models and uses statistical and machine-learning methods to spot baseline activity anomalies, which may indicate malicious behavior. You'll receive security alerts for suspicious activities, but Defender for Storage ensures you won't get too many similar alerts. Activity monitoring won't affect performance, ingestion capacity, or access to your data.

-Malware Scanning in Defender for Storage helps protect storage accounts from malicious content by performing a full malware scan on uploaded content in near real time, leveraging Microsoft Defender Antivirus capabilities. It is designed to help fulfill security and compliance requirements to handle untrusted content. Every file type is scanned, and scan results are returned for every file. The Malware Scanning capability is an agentless SaaS solution that allows simple setup at scale, with zero maintenance, and supports automating response at scale.

-This is a configurable feature in the new Defender for Storage plan. You can choose to enable or disable it with no additional cost.

-The new Microsoft Defender for Storage plan has predictable pricing based on the number of storage accounts you protect. With the option to enable at the subscription or resource level and exclude specific storage accounts from protected subscriptions, you have increased flexibility to manage your security coverage. The pricing plan simplifies the cost calculation process, allowing you to scale easily as your needs change. Additional charges may apply to storage accounts with high-volume transactions.

-By default, the limit is set to 5,000GB per month per storage account. Once this threshold is exceeded, scanning will cease for the remaining blobs, with a 20GB confidence interval. For configuration details, refer to [configure Defender for Storage](../storage/common/azure-defender-storage-configure.md).

-**Malware Scanning** leverages Microsoft Defender Antivirus (MDAV) to scan blobs uploaded to Blob storage, providing a comprehensive analysis that includes deep file scans and hash reputation analysis. This feature provides an enhanced level of detection against potential threats.

-**Hash reputation analysis** detects potential malware in Blob storage and Azure Files by comparing the hash values of newly uploaded blobs/files against those of known malware by [Microsoft Threat Intelligence](https://go.microsoft.com/fwlink/?linkid=2128684). Not all file protocols and operation types are supported with this capability, leading to some operations not being monitored for potential malware uploads. Unsupported use cases include SMB file shares and when a blob is created using [Put Block](/rest/api/storageservices/put-block) and [Put Block List](/rest/api/storageservices/put-block-list).

-## Common questions

-### Is it possible to enable Defender for Storage on a resource level?

-Yes, it's possible to enable Defender for Storage at the resource level and set up Malware Scanning and Sensitivity Scanning accordingly. Keep in mind that enabling it at the subscription level is the recommended approach, as it will automatically protect all new storage accounts.

-### Can I exclude certain storage accounts from protection?

-Yes, you can exclude storage accounts from protection.

-### How long does it take for subscription-level enablement to take effect?

-Enabling Defender for Storage at the subscription level may take up to 24 hours to be fully enabled across all storage accounts.

-### Is there a difference in features between the new and Defender for Storage (classic)?

-Yes, there is a difference in the capabilities of the two plans. New and future security capabilities will only be available in the new Defender for Storage plan. If you want to access these new capabilities, you'll need to enable the new plan.

-### Will the Defender for Storage (classic) continue to be supported?

-The Defender for Storage (classic) will still continue to be supported for three years after the release of the new Defender for Storage to general availability (GA).

-### Can I switch back to the Defender for Storage (classic)?

-Yes, you can use the REST API to return to the Defender for Storage (classic) plan.

-If you want to switch back to the Defender for Storage (classic) plan, you need to do two things. First, disable the new Defender for Storage plan that is enabled now. Second, check if there are any policies that can re-enable the new plan and turn them off too. The two Azure built-in policies enabling the new plan are **Configure Microsoft Defender for Storage to be enabled** and **Configure basic Microsoft Defender for Storage to be enabled (Activity Monitoring only).**

-### How can I calculate the cost of each plan?

-To estimate the cost of Defender for Storage, we've provided a pricing estimation workbook and a PowerShell script that you can run in your environment.

-> [!div class="nextstepaction"]

-> [Enable Defender for Storage](enable-enhanced-security.md)

-## FAQ - BYOL vulnerability scanner

-### If I deploy a Qualys agent, what communications settings are required?

-The Qualys Cloud Agent is designed to communicate with Qualys's SOC at regular intervals for updates, and to perform the various operations required for product functionality. To allow the agent to communicate seamlessly with the SOC, configure your network security to allow inbound and outbound traffic to the Qualys SOC CIDR and URLs.

-There are multiple Qualys platforms across various geographic locations. The SOC CIDR and URLs differ depending on the host platform of your Qualys subscription. To identify your Qualys host platform, use this page <https://www.qualys.com/platform-identification/>.

-### Why do I have to specify a resource group when configuring a BYOL solution?

-When you set up your solution, you must choose a resource group to attach it to. The solution isn't an Azure resource, so it won't be included in the list of the resource groupΓÇÖs resources. Nevertheless, it's attached to that resource group. If you later delete the resource group, the BYOL solution is unavailable.

-> [!div class="nextstepaction"]

-> [Remediate the findings from your vulnerability assessment solution](remediate-vulnerability-findings-vm.md)

- - **Unhealthy resources** ΓÇô A vulnerability scanner extension can be deployed to these machines.

- - **Not applicable resources** ΓÇô these machines [aren't supported for the vulnerability scanner extension](#why-does-my-machine-show-as-not-applicable-in-the-recommendation).

-## FAQ

-### Are there any additional charges for the Qualys license?

-No. The built-in scanner is free to all Microsoft Defender for Servers users. The recommendation deploys the scanner with its licensing and configuration information. No additional licenses are required.

-### What prerequisites and permissions are required to install the Qualys extension?

-You'll need write permissions for any machine on which you want to deploy the extension.

-The Microsoft Defender for Cloud vulnerability assessment extension (powered by Qualys), like other extensions, runs on top of the Azure Virtual Machine agent. So it runs as Local Host on Windows, and Root on Linux.

-During setup, Defender for Cloud checks to ensure that the machine can communicate over HTTPS (default port 443) with the following two Qualys data centers:

-The extension doesn't currently accept any proxy configuration details. However, you can configure the Qualys agent's proxy settings locally in the Virtual Machine. Please follow the guidance in the Qualys documentation:

-### Can I remove the Defender for Cloud Qualys extension?

-If you want to remove the extension from a machine, you can do it manually or with any of your programmatic tools.

-You'll need the following details:

-### How can I check that the Qualys extension is properly installed?

-You can use the `curl` command to check the connectivity to the relevant Qualys URL. A valid response would be: `{"code":404,"message":"HTTP 404 Not Found"}`

-In addition, make sure that the DNS resolution for these URLs is successful and that everything is [valid with the certificate authority](https://success.qualys.com/support/s/article/000001856) that is used.

-### How does the extension get updated?

-Like the Microsoft Defender for Cloud agent itself and all other Azure extensions, minor updates of the Qualys scanner might automatically happen in the background. All agents and extensions are tested extensively before being automatically deployed.

-### Why does my machine show as "not applicable" in the recommendation?

-If you have machines in the **not applicable** resources group, Defender for Cloud can't deploy the vulnerability scanner extension on those machines because:

- | **Vendor** | **OS** | **Supported versions** |

- ||--|--|

- | Microsoft | Windows | All |

- | Amazon | Amazon Linux | 2015.09-2018.03 |

- | Amazon | Amazon Linux 2 | 2017.03-2.0.2021 |

- | Red Hat | Enterprise Linux | 5.4+, 6, 7-7.9, 8-8.6, 9 beta |

- | Red Hat | CentOS | 5.4-5.11, 6-6.7, 7-7.8, 8-8.5 |

- | Red Hat | Fedora | 22-33 |

- | SUSE | Linux Enterprise Server (SLES) | 11, 12, 15, 15 SP1, 15 SP2, 15 SP3 |

- | SUSE | openSUSE | 12, 13, 15.0-15.3 |

- | SUSE | Leap | 42.1 |

- | Oracle | Enterprise Linux | 5.11, 6, 7-7.9, 8-8.5 |

- | Debian | Debian | 7.x-11.x |

- | Ubuntu | Ubuntu | 12.04 LTS, 14.04 LTS, 15.x, 16.04 LTS, 18.04 LTS, 19.10, 20.04 LTS |

-### Can the built-in vulnerability scanner find vulnerabilities on the VMs network?

-No. The scanner runs on your machine to look for vulnerabilities of the machine itself, not for your network.

-### Does the scanner integrate with my existing Qualys console?

-The Defender for Cloud extension is a separate tool from your existing Qualys scanner. Licensing restrictions mean that it can only be used within Microsoft Defender for Cloud.

-### How quickly will the scanner identify newly disclosed critical vulnerabilities?

-Within 48 hrs of the disclosure of a critical vulnerability, Qualys incorporates the information into their processing and can identify affected machines.

-description: If you're having issues with Defender for DevOps perhaps, you can solve it with these frequently asked questions.

-# Defender for DevOps frequently asked questions (FAQ)

-If you're having issues with Defender for DevOps these frequently asked questions may assist you,

-## FAQ

-### Scan specific folders for secrets in ADO repos with CredScan

-If you want to scan specific folders in Azure DevOps repos with CredScan, you can use:

-env:

- credscan_targetdirectory: 'NameOfFolderToScanForSecrets/'

-A full ADO YAML file for a pipeline that does CredScan scanning for secrets on a specific folder could look like this:

-```yml

-trigger:

- branches:

- include:

- - main

- - master

-

-pool:

- vmImage: "windows-latest"

-

-steps:

- - task: MicrosoftSecurityDevOps@1

- displayName: "Microsoft Security DevOps"

- inputs:

- categories: 'secrets'

- break: false

- env:

- credscan_targetdirectory: 'NameOfFolderToScanForSecrets/'

-```

-### I'm getting an error while trying to connect

-When you select the *Authorize* button, the account that you're logged in with is used. That account can have the same email but may have a different tenant. Make sure you have the right account/tenant combination selected in the popup consent screen and Visual Studio.

-You can [check which account is signed in](https://app.vssps.visualstudio.com/profile/view).

-### Why can't I find my repository

-The Azure DevOps service only supports `TfsGit`.

-Ensure that you've [onboarded your repositories](./quickstart-onboard-devops.md?branch=main) to Microsoft Defender for Cloud. If you still can't see your repository, ensure that you're signed in with the correct Azure DevOps organization user account. Your Azure subscription and Azure DevOps Organization need to be in the same tenant. If the user for the connector is wrong, you need to delete the previously created connector, sign in with the correct user account and re-create the connector.

-### Secret scan didn't run on my code

-To ensure your code is scanned for secrets, make sure you've [onboarded your repositories](./quickstart-onboard-devops.md?branch=main) to Defender for Cloud.

-In addition to onboarding resources, you must have the [Microsoft Security DevOps (MSDO) Azure DevOps extension](./azure-devops-extension.md?branch=main) configured for your pipelines. The extension runs secret scan along with other scanners.

-If no secrets are identified through scans, the total exposed secret for the resource shows `Healthy` in Defender for Cloud.

-If secret scan isn't enabled (meaning MSDO isn't configured for your pipeline) or a scan isn't performed for at least 14 days, the resource shows as `N/A` in Defender for Cloud.

-### I donΓÇÖt see generated SARIF file in the path I chose to drop it

-If you donΓÇÖt see SARIF file in the expected path, you may have chosen a different drop path than the `CodeAnalysisLogs/msdo.sarif` one. Currently you should drop your SARIF files to `CodeAnalysisLogs/msdo.sarif`.

-### I donΓÇÖt see the results for my ADO projects in Microsoft Defender for Cloud

-When you use classic pipeline configuration, make sure you don't change artifact name. This can result not seeing the results for your project.

-Currently, OSS vulnerability findings are only available for GitHub repositories. Azure DevOps repositories will have the total exposed secrets, IaC misconfigurations, and code security findings available. It will show `N/A` for OSS vulnerabilities. You can learn more about how to [Review your findings](defender-for-devops-introduction.md).

-### Why is my Azure DevOps repository not refreshing to healthy?

-For a previously unhealthy scan result to be healthy again, updated healthy scan results need to be from the same build definition as the one that generated the findings in the first place. A common scenario where this issue occurs is when testing with different pipelines. For results to refresh appropriately, scan results need to be for the same pipeline(s) and branch(es).

-If no scan is performed for 14 days, the scan results revert to `N/A`.

-### I donΓÇÖt see Recommendations for findings

-Ensure that you've onboarded the project with the connector and that your repository (that build is for), is onboarded to Microsoft Defender for Cloud. You can learn how to [onboard your DevOps repository](./quickstart-onboard-devops.md?branch=main) to Defender for Cloud.

-You must have more than a [stakeholder license](https://azure.microsoft.com/pricing/details/devops/azure-devops-services/) to the repos to onboard them, and you need to be at least the security reader on the subscription where the connector is created. You can confirm if you've onboarded the repositories by seeing them in the inventory list in Microsoft Defender for Cloud.

-### What information does Defender for DevOps store about me and my enterprise, and where is the data stored and processed?

-Defender for DevOps connects to your source code management system, for example, Azure DevOps, GitHub, to provide a central console for your DevOps resources and security posture. Defender for DevOps processes and stores the following information:

-Data is stored within the region your connector is created in and flows into [Microsoft Defender for Cloud](defender-for-cloud-introduction.md). You should consider which region to create your connector in, for any data residency requirements as you design and create your DevOps connector.

-Defender for DevOps currently doesn't process or store your code, build, and audit logs.

-Learn more about [Microsoft Privacy Statement](https://go.microsoft.com/fwLink/?LinkID=521839&amp;clcid=0x9).

-### Why are Delete Source and Write Code permissions required for Azure DevOps?

-Azure DevOps doesn't have the necessary granularity for its permissions. These permissions are required for some of the Defender for DevOps features, such as pull request annotations in order to work.

-### Is Exemptions capability available and tracked for app sec vulnerability management?

-Exemptions aren't available for Defender for DevOps within Microsoft Defender for Cloud.

-### Is continuous, automatic scanning available?

-Currently scanning occurs at build time.

-### Is it possible to block the developers committing code with exposed secrets?

-The ability to block developers from committing code with exposed secrets isn't currently available.

-### I'm not able to configure Pull Request Annotations

-Make sure you have write (owner/contributor) access to the subscription. If you don't have this type of access today, you can get it through [activating an Azure Active Directory role in PIM](/azure/active-directory/privileged-identity-management/pim-how-to-activate-role).

-### What programming languages are supported by Defender for DevOps?

-The following languages are supported by Defender for DevOps:

-### I'm getting an error that informs me that there's no CLI tool

-When you run the pipeline in Azure DevOps, you receive the following error:

-`no such file or directory, scandir 'D:\a\_msdo\versions\microsoft.security.devops.cli'`.

-This error can be seen in the extensions job as well.

-This error occurs if you're missing the dependency of `dotnet6` in the pipeline's YAML file. DotNet6 is required to allow the Microsoft Security DevOps extension to run. Include this as a task in your YAML file to eliminate the error.

-

-You can learn more about [Microsoft Security DevOps](https://marketplace.visualstudio.com/items?itemName=ms-securitydevops.microsoft-security-devops-azdevops).

-### Can I migrate the connector to a different region?

-For example, can I migrate the connector from the Central US region to the West Europe region?

-We donΓÇÖt support automatic migration for the Defender for DevOps connectors from one region to another at this time.

-If you want to move a connectorΓÇÖs location, for example a GitHub or Azure DevOps connector, to be stored in a different region than the original one where the connector was created, the recommendation is to delete the existing connector and then to create another connector in the new region.

-## Next steps

-For more help, contact the Azure experts on the [MSDN Azure and Stack Overflow forums](https://azure.microsoft.com/support/forums/). Or file an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/) and select Get support. For information about using Azure Support, read the [Microsoft Azure support FAQ](https://azure.microsoft.com/support/faq/).

-> [New AWS Connector in Microsoft Defender for Cloud](episode-one.md)

-## FAQ - Exemption rules

-### What happens when one recommendation is in multiple policy initiatives?

-Sometimes, a security recommendation appears in more than one policy initiative. If you've got multiple instances of the same recommendation assigned to the same subscription, and you create an exemption for the recommendation, it will affect all of the initiatives that you have permission to edit.

-For example, the recommendation **** is part of the default policy initiative assigned to all Azure subscriptions by Microsoft Defender for Cloud. It's also in XXXXX.

-If you try to create an exemption for this recommendation, you'll see one of the two following messages:

- *This recommendation is included in several policy initiatives: [initiative names separated by comma]. Exemptions will be created on all of them.*

- *You have limited permissions to apply the exemption on all the policy initiatives, the exemptions will be created only on the initiatives with sufficient permissions.*

-### Are there any recommendations that don't support exemption?

-These generally available recommendations don't support exemption:

-## FAQ - Microsoft Defender for Cloud integration with Microsoft Defender for Endpoint

-### What's this "MDE.Windows" / "MDE.Linux" extension running on my machine?

-In the past, Microsoft Defender for Endpoint was provisioned by the Log Analytics agent. When [we expanded support to include Windows Server 2019](release-notes-archive.md#microsoft-defender-for-endpoint-integration-with-azure-defender-now-supports-windows-server-2019-and-windows-10-on-windows-virtual-desktop-released-for-general-availability-ga) and Linux, we also added an extension to perform the automatic onboarding.

-Defender for Cloud automatically deploys the extension to machines running:

-> [!IMPORTANT]

-> If you delete the MDE.Windows/MDE.Linux extension, it will not remove Microsoft Defender for Endpoint. To offboard the machine, see [Offboard Windows servers.](/microsoft-365/security/defender-endpoint/configure-server-endpoints#offboard-windows-servers).

-### I enabled the solution but the `MDE.Windows`/`MDE.Linux` extension isn't showing on my machine

-If you enabled the integration, but still don't see the extension running on your machines:

-1. You need to wait at least 12 hours to be sure there's an issue to investigate.

-1. If after 12 hours you still don't see the extension running on your machines, check that you've met [Prerequisites](#prerequisites) for the integration.

-1. Ensure you've enabled the [Microsoft Defender for Servers](defender-for-servers-introduction.md) plan for the subscriptions related to the machines you're investigating.

-1. If you've moved your Azure subscription between Azure tenants, some manual preparatory steps are required before Defender for Cloud will deploy Defender for Endpoint. For full details, [contact Microsoft support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview).

-### What are the licensing requirements for Microsoft Defender for Endpoint?

-Licenses for Defender for Endpoint for servers are included with **Microsoft Defender for Servers**.

-### Do I need to buy a separate anti-malware solution to protect my machines?

-No. With MDE integration in Defender for Servers, you'll also get malware protection on your machines.

-### If I already have a license for Microsoft Defender for Endpoint, can I get a discount for Microsoft Defender for Servers?

-If you already have a license for **Microsoft Defender for Endpoint for Servers** , you won't pay for that part of your [Microsoft Defender for Servers Plan 2](plan-defender-for-servers-select-plan.md#plan-features) license. Learn more about [the Microsoft 365 license](/microsoft-365/security/defender-endpoint/minimum-requirements#licensing-requirements).

-To request your discount, [contact Defender for Cloud's support team](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). You'll need to provide the relevant workspace ID, region, and number of Microsoft Defender for Endpoint for servers licenses applied for machines in the given workspace.

-The discount will be effective starting from the approval date, and won't take place retroactively.

-### How do I switch from a third-party EDR tool?

-Full instructions for switching from a non-Microsoft endpoint solution are available in the Microsoft Defender for Endpoint documentation: [Migration overview](/windows/security/threat-protection/microsoft-defender-atp/switch-to-microsoft-defender-migration).

-### Which Microsoft Defender for Endpoint plan is supported in Defender for Servers?

-Defender for Servers Plan 1 and Plan 2 provides the capabilities of [Microsoft Defender for Endpoint Plan 2](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint).

-## FAQ - Just-in-time virtual machine access

-### What permissions are needed to configure and use JIT?

-JIT Requires [Microsoft Defender for Servers Plan 2](plan-defender-for-servers-select-plan.md#plan-features) to be enabled on the subscription.

-**Reader** and **SecurityReader** roles can both view the JIT status and parameters.

-If you want to create custom roles that can work with JIT, you'll need the details from the table below.

-If you are setting up JIT on your Amazon Web Service (AWS) VM, you will need to [connect your AWS account](quickstart-onboard-aws.md) to Microsoft Defender for Cloud.

-> [!TIP]

-> To create a least-privileged role for users that need to request JIT access to a VM, and perform no other JIT operations, use the [Set-JitLeastPrivilegedRole script](https://github.com/Azure/Azure-Security-Center/tree/main/Powershell%20scripts/JIT%20Scripts/JIT%20Custom%20Role) from the Defender for Cloud GitHub community pages.

-| To enable a user to: | Permissions to set|

-| | |

-|Configure or edit a JIT policy for a VM | *Assign these actions to the role:* <ul><li>On the scope of a subscription or resource group that is associated with the VM:<br/> `Microsoft.Security/locations/jitNetworkAccessPolicies/write` </li><li> On the scope of a subscription or resource group of VM: <br/>`Microsoft.Compute/virtualMachines/write`</li></ul> |

-|Request JIT access to a VM | *Assign these actions to the user:* <ul><li> `Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action` </li><li> `Microsoft.Security/locations/jitNetworkAccessPolicies/*/read` </li><li> `Microsoft.Compute/virtualMachines/read` </li><li> `Microsoft.Network/networkInterfaces/*/read` </li> <li> `Microsoft.Network/publicIPAddresses/read` </li></ul> |

-|Read JIT policies| *Assign these actions to the user:* <ul><li>`Microsoft.Security/locations/jitNetworkAccessPolicies/read`</li><li>`Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action`</li><li>`Microsoft.Security/policies/read`</li><li>`Microsoft.Security/pricings/read`</li><li>`Microsoft.Compute/virtualMachines/read`</li><li>`Microsoft.Network/*/read`</li>|

-> [!Note]

-> Only the `Microsoft.Security` permissions are relevant for AWS.

-Learn more about [how JIT works](just-in-time-access-overview.md) and the [permissions required to configure and use JIT](just-in-time-access-overview.md#what-permissions-are-needed-to-configure-and-use-jit).

-| Required roles and permissions: | **Reader**, **SecurityReader**, or a [custom role](just-in-time-access-overview.md#what-permissions-are-needed-to-configure-and-use-jit) can view the JIT status and parameters.<br>To create a least-privileged role for users that only need to request JIT access to a VM, use the [Set-JitLeastPrivilegedRole script](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Powershell%20scripts/JIT%20Scripts/JIT%20Custom%20Role). |

-## FAQ - MFA in Defender for Cloud

-### We're already using CA policy to enforce MFA. Why do we still get the Defender for Cloud recommendations?

-To investigate why the recommendations are still being generated, verify the following configuration options in your MFA CA policy:

-### We're using a third-party MFA tool to enforce MFA. Why do we still get the Defender for Cloud recommendations?

-Defender for Cloud's MFA recommendations doesn't support third-party MFA tools (for example, DUO).

-If the recommendations are irrelevant for your organization, consider marking them as "mitigated" as described in [Exempting resources and recommendations from your secure score](exempt-resource.md). You can also [disable a recommendation](tutorial-security-policy.md#disable-a-security-recommendation).

-### Why does Defender for Cloud show user accounts without permissions on the subscription as "requiring MFA"?

-Defender for Cloud's MFA recommendations refers to [Azure RBAC](../role-based-access-control/role-definitions-list.md) roles and the [Azure classic subscription administrators](../role-based-access-control/classic-administrators.md) role. Verify that none of the accounts have such roles.

-### We're enforcing MFA with PIM. Why are PIM accounts shown as noncompliant?

-Defender for Cloud's MFA recommendations currently doesn't support PIM accounts. You can add these accounts to a CA Policy in the Users/Group section.

-### Can I exempt or dismiss some of the accounts?

-The capability to exempt some accounts that donΓÇÖt use MFA is available on the new recommendations in preview:

-To exempt account(s), follow these steps:

-1. Select an MFA recommendation associated with an unhealthy account.

-1. In the Accounts tab, select an account to exempt.

-1. Select the three dots button, then select **Exempt account**.

-1. Select a scope and exemption reason.

-If you would like to see which accounts are exempt, navigate to **Exempted accounts** for each recommendation.

-> [!TIP]

-> When you exempt an account, it won't be shown as unhealthy and won't cause a subscription to appear unhealthy.

-### Are there any limitations to Defender for Cloud's identity and access protections?

-There are some limitations to Defender for Cloud's identity and access protections:

-## Log Analytics pricing FAQ

-### If I enable Defender for Clouds Servers plan on the subscription level, do I need to enable it on the workspace level?

-When you enable the Servers plan on the subscription level, Defender for Cloud enables the Servers plan on your default workspaces automatically. Connect to the default workspace by selecting **Connect Azure VMs to the default workspace(s) created by Defender for Cloud** option and selecting **Apply**.

-However, if you're using a custom workspace in place of the default workspace, you need to enable the Servers plan on all of your custom workspaces that don't have it enabled.

-If you're using a custom workspace and enable the plan on the subscription level only, the `Microsoft Defender for servers should be enabled on workspaces` recommendation appears on the Recommendations page. This recommendation gives you the option to enable the servers plan on the workspace level with the Fix button. You're charged for all VMs in the subscription even if the Servers plan isn't enabled for the workspace. The VMs won't benefit from features that depend on the Log Analytics workspace, such as Microsoft Defender for Endpoint, VA solution (MDVM/Qualys), and Just-in-Time VM access.

-Enabling the Servers plan on both the subscription and its connected workspaces, won't incur a double charge. The system will identify each unique VM.

-If you enable the Servers plan on cross-subscription workspaces, connected VMs from all subscriptions will be billed, including subscriptions that don't have the Servers plan enabled.

-### Will I be charged for machines without the Log Analytics agent installed?

-Yes. When you enable [Microsoft Defender for Servers](defender-for-servers-introduction.md) on an Azure subscription or a connected AWS account, you'll be charged for all machines that are connected to your Azure subscription or AWS account. The term machines include Azure virtual machines, Azure Virtual Machine Scale Sets instances, and Azure Arc-enabled servers. Machines that don't have Log Analytics installed are covered by protections that don't depend on the Log Analytics agent.

-### If a Log Analytics agent reports to multiple workspaces, will I be charged twice?

-If a machine, reports to multiple workspaces, and all of them have Defender for Servers enabled, the machines will be billed for each attached workspace.

-### If a Log Analytics agent reports to multiple workspaces, is the 500-MB free data ingestion available on all of them?

-Yes. If you configure your Log Analytics agent to send data to two or more different Log Analytics workspaces (multi-homing), you'll get 500-MB free data ingestion for each workspace. It's calculated per node, per reported workspace, per day, and available for every workspace that has a 'Security' or 'AntiMalware' solution installed. You'll be charged for any data ingested over the 500-MB limit.

-### Is the 500-MB free data ingestion calculated for an entire workspace or strictly per machine?

-You receive a daily allowance of 500 MB of free data ingestion for each virtual machine (VM) connected to the workspace. This allocation specifically applies to the [security data types](#what-data-types-are-included-in-the-500-mb-data-daily-allowance) collected directly by Defender for Cloud.

-The data allowance is a daily rate calculated across all connected machines. Your total daily free limit is equal to the **[number of machines] x 500 MB**. So even if on a given day some machines send 100 MB and others send 800 MB, if the total data from all machines doesn't exceed your daily free limit, you won't be charged extra.

-### What data types are included in the 500-MB data daily allowance?

-Defender for Cloud's billing is closely tied to the billing for Log Analytics. [Microsoft Defender for Servers](defender-for-servers-introduction.md) provides a 500 MB/node/day allocation for machines against the following subset of [security data types](/azure/azure-monitor/reference/tables/tables-category#security):

-If the workspace is in the legacy Per Node pricing tier, the Defender for Cloud and Log Analytics allocations are combined and applied jointly to all billable ingested data.

-### How can I monitor my daily usage?

-You can view your data usage in two different ways, the Azure portal, or by running a script.

-**To view your usage in the Azure portal**:

-1. Sign in to the [Azure portal](https://portal.azure.com).

-1. Navigate to **Log Analytics workspaces**.

-1. Select your workspace.

-1. Select **Usage and estimated costs**.

- :::image type="content" source="media/plan-defender-for-servers-data-workspace/data-usage.png" alt-text="Screenshot of your data usage of your log analytics workspace. " lightbox="media/plan-defender-for-servers-data-workspace/data-usage.png":::

-You can also view estimated costs under different pricing tiers by selecting :::image type="icon" source="media/plan-defender-for-servers-data-workspace/drop-down-icon.png" border="false"::: for each pricing tier.

-**To view your usage by using a script**:

-1. Sign in to the [Azure portal](https://portal.azure.com).

-1. Navigate to **Log Analytics workspaces** > **Logs**.

-1. Select your time range. Learn about [time ranges](../azure-monitor/logs/log-analytics-tutorial.md).

-1. Copy and past the following query into the **Type your query here** section.

- ```azurecli

- let Unit= 'GB';

- Usage

- | where IsBillable == 'TRUE'

- | where DataType in ('SecurityAlert', 'SecurityBaseline', 'SecurityBaselineSummary', 'SecurityDetection', 'SecurityEvent', 'WindowsFirewall', 'MaliciousIPCommunication', 'SysmonEvent', 'ProtectionStatus', 'Update', 'UpdateSummary')

- | project TimeGenerated, DataType, Solution, Quantity, QuantityUnit

- | summarize DataConsumedPerDataType = sum(Quantity)/1024 by DataType, DataUnit = Unit

- | sort by DataConsumedPerDataType desc

- ```

-1. Select **Run**.

- :::image type="content" source="media/plan-defender-for-servers-data-workspace/select-run.png" alt-text="Screenshot showing where to enter your query and where the select run button is located." lightbox="media/plan-defender-for-servers-data-workspace/select-run.png":::

-You can learn how to [Analyze usage in Log Analytics workspace](../azure-monitor/logs/analyze-usage.md).

-Based on your usage, you won't be billed until you've used your daily allowance. If you're receiving a bill, it's only for the data used after the 500-MB limit is reached, or for other service that doesn't fall under the coverage of Defender for Cloud.

-### How can I manage my costs?

-You may want to manage your costs and limit the amount of data collected for a solution by limiting it to a particular set of agents. Use [solution targeting](/previous-versions/azure/azure-monitor/insights/solution-targeting) to apply a scope to the solution and target a subset of computers in the workspace. If you're using solution targeting, Defender for Cloud lists the workspace as not having a solution.

-> [!IMPORTANT]

-> Solution targeting has been deprecated because the Log Analytics agent is being replaced with the Azure Monitor agent and solutions in Azure Monitor are being replaced with insights. You can continue to use solution targeting if you already have it configured, but it is not available in new regions.

-> The feature will not be supported after August 31, 2024.

-> Regions that support solution targeting until the deprecation date are:

->

-> | Region code | Region name |

-> | : | :- |

-> | CCAN | canadacentral |

-> | CHN | switzerlandnorth |

-> | CID | centralindia |

-> | CQ | brazilsouth |

-> | CUS | centralus |

-> | DEWC | germanywestcentral |

-> | DXB | UAENorth |

-> | EA | eastasia |

-> | EAU | australiaeast |

-> | EJP | japaneast |

-> | EUS | eastus |

-> | EUS2 | eastus2 |

-> | NCUS | northcentralus |

-> | NEU | NorthEurope |

-> | NOE | norwayeast |

-> | PAR | FranceCentral |

-> | SCUS | southcentralus |

-> | SE | KoreaCentral |

-> | SEA | southeastasia |

-> | SEAU | australiasoutheast |

-> | SUK | uksouth |

-> | WCUS | westcentralus |

-> | WEU | westeurope |

-> | WUS | westus |

-> | WUS2 | westus2 |

->

-> | Air-gapped clouds | Region code | Region name |

-> | :- | :- | :- |

-> | UsNat | EXE | usnateast |

-> | UsNat | EXW | usnatwest |

-> | UsGov | FF | usgovvirginia |

-> | China | MC | ChinaEast2 |

-> | UsGov | PHX | usgovarizona |

-> | UsSec | RXE | usseceast |

-> | UsSec | RXW | ussecwest |

-After you work through these planning steps, review [Defender for Server access roles](plan-defender-for-servers-roles.md).

- > For the list of supported operating systems, see [What operating systems for my EC2 instances are supported?](#what-operating-systems-for-my-ec2-instances-are-supported) in the FAQ.

-## FAQ - AWS in Defender for Cloud

-### What operating systems for my EC2 instances are supported?

-For a list of the AMIs with the SSM Agent preinstalled see [this page in the AWS docs](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-technical-details.html#ami-preinstalled-agent).

-For other operating systems, the SSM Agent should be installed manually using the following instructions:

-### For the CSPM plan, what IAM permissions are needed to discover AWS resources?

-The following IAM permissions are needed to discover AWS resources:

-| DataCollector | AWS Permissions |

-|--|--|

-| API Gateway | `apigateway:GET` |

-| Application Auto Scaling | `application-autoscaling:Describe*` |

-| Auto scaling | `autoscaling-plans:Describe*` <br> `autoscaling:Describe*` |

-| Certificate manager | `acm-pca:Describe*` <br> `acm-pca:List*` <br> `acm:Describe*` <br> `acm:List*` |

-| CloudFormation | `cloudformation:Describe*` <br> `cloudformation:List*` |

-| CloudFront | `cloudfront:DescribeFunction` <br> `cloudfront:GetDistribution` <br> `cloudfront:GetDistributionConfig` <br> `cloudfront:List*` |

-| CloudTrail | `cloudtrail:Describe*` <br> `cloudtrail:GetEventSelectors` <br> `cloudtrail:List*` <br> `cloudtrail:LookupEvents` |

-| CloudWatch | `cloudwatch:Describe*` <br> `cloudwatch:List*` |

-| CloudWatch logs | `logs:DescribeLogGroups` <br> `logs:DescribeMetricFilters` |

-| CodeBuild | `codebuild:DescribeCodeCoverages` <br> `codebuild:DescribeTestCases` <br> `codebuild:List*` |

-| Config Service | `config:Describe*` <br> `config:List*` |

-| DMS ΓÇô database migration service | `dms:Describe*` <br> `dms:List*` |

-| DAX | `dax:Describe*` |

-| DynamoDB | `dynamodb:Describe*` <br> `dynamodb:List*` |

-| Ec2 | `ec2:Describe*` <br> `ec2:GetEbsEncryptionByDefault` |

-| ECR | `ecr:Describe*` <br> `ecr:List*` |

-| ECS | `ecs:Describe*` <br> `ecs:List*` |

-| EFS | `elasticfilesystem:Describe*` |

-| EKS | `eks:Describe*` <br> `eks:List*` |

-| Elastic Beanstalk | `elasticbeanstalk:Describe*` <br> `elasticbeanstalk:List*` |

-| ELB ΓÇô elastic load balancing (v1/2) | `elasticloadbalancing:Describe*` |

-| Elastic search | `es:Describe*` <br> `es:List*` |

-| EMR ΓÇô elastic map reduce | `elasticmapreduce:Describe*` <br> `elasticmapreduce:GetBlockPublicAccessConfiguration` <br> `elasticmapreduce:List*` <br> `elasticmapreduce:View*` |

-| GuardDuty | `guardduty:DescribeOrganizationConfiguration` <br> `guardduty:DescribePublishingDestination` <br> `guardduty:List*` |

-| IAM | `iam:Generate*` <br> `iam:Get*` <br> `iam:List*` <br> `iam:Simulate*` |

-| KMS | `kms:Describe*` <br> `kms:List*` |

-| Lambda | `lambda:GetPolicy` <br> `lambda:List*` |

-| Network firewall | `network-firewall:DescribeFirewall` <br> `network-firewall:DescribeFirewallPolicy` <br> `network-firewall:DescribeLoggingConfiguration` <br> `network-firewall:DescribeResourcePolicy` <br> `network-firewall:DescribeRuleGroup` <br> `network-firewall:DescribeRuleGroupMetadata` <br> `network-firewall:ListFirewallPolicies` <br> `network-firewall:ListFirewalls` <br> `network-firewall:ListRuleGroups` <br> `network-firewall:ListTagsForResource` |

-| RDS | `rds:Describe*` <br> `rds:List*` |

-| RedShift | `redshift:Describe*` |

-| S3 and S3Control | `s3:DescribeJob` <br> `s3:GetEncryptionConfiguration` <br> `s3:GetBucketPublicAccessBlock` <br> `s3:GetBucketTagging` <br> `s3:GetBucketLogging` <br> `s3:GetBucketAcl` <br> `s3:GetBucketLocation` <br> `s3:GetBucketPolicy` <br> `s3:GetReplicationConfiguration` <br> `s3:GetAccountPublicAccessBlock` <br> `s3:GetObjectAcl` <br> `s3:GetObjectTagging` <br> `s3:List*` |

-| SageMaker | `sagemaker:Describe*` <br> `sagemaker:GetSearchSuggestions` <br> `sagemaker:List*` <br> `sagemaker:Search` |

-| Secret manager | `secrets

-| Simple notification service ΓÇô SNS | `sns:Check*` <br> `sns:List*` |

-| SSM | `ssm:Describe*` <br> `ssm:List*` |

-| SQS | `sqs:List*` <br> `sqs:Receive*` |

-| STS | `sts:GetCallerIdentity` |

-| WAF | `waf-regional:Get*` <br> `waf-regional:List*` <br> `waf:List*` <br> `wafv2:CheckCapacity` <br> `wafv2:Describe*` <br> `wafv2:List*` |

-API calls performed by Defender for Cloud count against the [Azure DevOps Global consumption limit](/azure/devops/integrate/concepts/rate-limits). For more information, see the [FAQ section](#faq).

-## FAQ

-### Do API calls made by Defender for Cloud count against my consumption limit?

-Yes, API calls made by Defender for Cloud count against the [Azure DevOps Global consumption limit](/azure/devops/integrate/concepts/rate-limits). Defender for Cloud makes calls on-behalf of the user who onboards the connector.

-### Why is my organization list empty in the UI?

-If your organization list is empty in the UI after you onboarded an Azure DevOps connector, you need to ensure that the organization in Azure DevOps is connected to the Azure tenant that has the user who authenticated the connector.

-For information on how to correct this issue, check out the [DevOps trouble shooting guide](troubleshooting-guide.md#troubleshoot-azure-devops-organization-connector-issues).

-### I have a large Azure DevOps organization with many repositories. Can I still onboard?

-Yes, there is no limit to how many Azure DevOps repositories you can onboard to Defender for DevOps.

-However, there are two main implications when onboarding large organizations ΓÇô speed and throttling. The speed of discovery for your DevOps repositories is determined by the number of projects for each connector (approximately 100 projects per hour). Throttling can happen because Azure DevOps API calls have a [global rate limit](/azure/devops/integrate/concepts/rate-limits) and we limit the calls for project discovery to use a small portion of overall quota limits.

-Consider using an alternative Azure DevOps identity (i.e., an Organization Administrator account used as a service account) to avoid individual accounts from being throttled when onboarding large organizations. Below are some scenarios of when to use an alternate identity to onboard a Defender for DevOps connector:

-Once you have onboarded the Azure DevOps repositories using this account and [configured and ran the Microsoft Security DevOps Azure DevOps extension](/azure/defender-for-cloud/azure-devops-extension) in your CI/CD pipeline, then the scanning results will appear near instantaneously in Microsoft Defender for Cloud.

-Learn more about [Defender for DevOps](defender-for-devops-introduction.md).

-Learn how to [configure pull request annotations](enable-pull-request-annotations.md) in Defender for Cloud.

-## FAQ - Connecting GCP projects to Microsoft Defender for Cloud

-### Is there an API for connecting my GCP resources to Defender for Cloud?

-Yes. To create, edit, or delete Defender for Cloud cloud connectors with a REST API, see the details of the [Connectors API](/rest/api/defenderforcloud/security-connectors).

-### What GCP regions are supported by Defender for Cloud?

-Defender for Cloud supports and scans all available regions on GCP public cloud.

-## FAQ - Regulatory compliance dashboard

-### How do I know which benchmark or standard to use?

-[Microsoft cloud security benchmark](/security/benchmark/azure/introduction) (MCSB) is the canonical set of security recommendations and best practices defined by Microsoft, aligned with common compliance control frameworks including [CIS Control Framework](https://www.cisecurity.org/benchmark/azure/), [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) and PCI-DSS. MCSB is a comprehensive cloud agnostic set of security principles designed to recommend the most up-to-date technical guidelines for Azure along with other clouds such as AWS and GCP. We recommend MCSB to customers who want to maximize their security posture and align their compliance status with industry standards.

-The [CIS Benchmark](https://www.cisecurity.org/benchmark/azure/) is authored by an independent entity ΓÇô Center for Internet Security (CIS) ΓÇô and contains recommendations on a subset of core Azure services. We work with CIS to try to ensure that their recommendations are up to date with the latest enhancements in Azure, but they're sometimes delayed and can become outdated. Nonetheless, some customers like to use this objective, third-party assessment from CIS as their initial and primary security baseline.

-Since weΓÇÖve released the Microsoft cloud security benchmark, many customers have chosen to migrate to it as a replacement for CIS benchmarks.

-### What standards are supported in the compliance dashboard?

-By default, the regulatory compliance dashboard shows you the Microsoft cloud security benchmark. The Microsoft cloud security benchmark is the Microsoft-authored guidelines for security, and compliance best practices based on common compliance frameworks. Learn more in the [Microsoft cloud security benchmark introduction](../security/benchmarks/introduction.md).

-To track your compliance with any other standard, you'll need to explicitly add them to your dashboard.

-

-You can add other standards such as Azure CIS 1.3.0, NIST SP 800-53, NIST SP 800-171, SWIFT CSP CSCF-v2020, UK Official and UK NHS, HIPAA, Canada Federal PBMM, ISO 27001, SOC2-TSP, and PCI-DSS 3.2.1.

-**AWS**: When users onboard, every AWS account has the AWS Foundational Security Best Practices assigned. This is the AWS-specific guideline for security and compliance best practices based on common compliance frameworks.

-Users that have one Defender bundle enabled can enable other standards.

-Available AWS regulatory standards:

-To add regulatory compliance standards on AWS accounts:

-1. Navigate to **Environment settings**.

-1. Select the relevant account.

-1. Select **Standards**.

-1. Select **Add** and choose **Standard**.

-1. Choose a standard from the drop-down menu.

-1. Select **Save**.

- :::image type="content" source="media/update-regulatory-compliance-packages/add-aws-regulatory-compliance.png" alt-text="Screenshot of adding regulatory compliance standard to AWS account." lightbox="media/update-regulatory-compliance-packages/add-aws-regulatory-compliance.png":::

-More standards will be added to the dashboard and included in the information on [Customize the set of standards in your regulatory compliance dashboard](update-regulatory-compliance-packages.md).

-### Why do some controls appear grayed out?

-For each compliance standard in the dashboard, there's a list of the standard's controls. For the applicable controls, you can view the details of passing and failing assessments.

-Some controls are grayed out. These controls don't have any Defender for Cloud assessments associated with them. Some may be procedure or process-related, and so can't be verified by Defender for Cloud. Some don't have any automated policies or assessments implemented yet, but will have in the future. And some controls may be the platform's responsibility as explained in [Shared responsibility in the cloud](../security/fundamentals/shared-responsibility.md).

-### How can I remove a built-in standard, like PCI-DSS, ISO 27001, or SOC2 TSP from the dashboard?

-To customize the regulatory compliance dashboard, and focus only on the standards that are applicable to you, you can remove any of the displayed regulatory standards that aren't relevant to your organization. To remove a standard, follow the instructions in [Remove a standard from your dashboard](update-regulatory-compliance-packages.md#remove-a-standard-from-your-dashboard).

-### I made the suggested changes based on the recommendation, but it isn't being reflected in the dashboard?

-After you take action to resolve recommendations, wait 12 hours to see the changes to your compliance data. Assessments are run approximately every 12 hours, so you'll see the effect on your compliance data only after the assessments run.

-### What permissions do I need to access the compliance dashboard?

-To access all compliance data in your tenant, you need to have at least a **Reader** level of permissions on the applicable scope of your tenant, or all relevant subscriptions.

-The minimum set of roles for accessing the dashboard and managing standards is **Resource Policy Contributor** and **Security Admin**.

-### The regulatory compliance dashboard isn't loading for me

-To use the regulatory compliance dashboard, Defender for Cloud must be enabled at the subscription level. If the dashboard isn't loading correctly, try the following steps:

-1. Clear your browser's cache.

-1. Try a different browser.

-1. Try opening the dashboard from a different network location.

-### How can I view a report of passing and failing controls per standard in my dashboard?

-On the main dashboard, you can see a report of passing and failing controls for (1) the 'top 4' lowest compliance standards in the dashboard. To see all the passing/failing controls status, select (2) **Show all _x_** (where x is the number of standards you're tracking). A context plane displays the compliance status for every one of your tracked standards.

-### How can I download a report with compliance data in a format other than PDF?

-When you select **Download report**, select the standard and the format (PDF or CSV). The resulting report will reflect the current set of subscriptions you've selected in the portal's filter.

-Currently, there's no support for downloading a report for a custom policy; only for the supplied regulatory standards.

-### How can I create exceptions for some of the policies in the regulatory compliance dashboard?

-For policies are built into Defender for Cloud and included in the secure score, you can create exemptions for one or more resources directly in the portal as explained in [Exempting resources and recommendations from your secure score](exempt-resource.md).

-For other policies, you can create an exemption directly in the policy itself, by following the instructions in [Azure Policy exemption structure](../governance/policy/concepts/exemption-structure.md).

-### What Microsoft Defender plans or licenses do I need to use the regulatory compliance dashboard?

-If you've got *any* of the Microsoft Defender plans (except for Defender for Servers Plan 1) enabled on *any* of your Azure resources, you can access Defender for Cloud's regulatory compliance dashboard and all of its data.

-> [!NOTE]

-> For Defender for Servers you'll get regulatory compliance only for plan 2.

-You can learn more about the [permissions used to scan AWS instances](concept-agentless-data-collection.md#which-permissions-are-used-by-agentless-scanning).

-## FAQ - Secure score

-### If I address only three out of four recommendations in a security control, will my secure score change?

-No. It won't change until you remediate all of the recommendations for a single resource. To get the maximum score for a control, you must remediate all recommendations for all resources.

-### If a recommendation isn't applicable to me, and I disable it in the policy, will my security control be fulfilled and my secure score updated?

-Yes. We recommend disabling recommendations when they're inapplicable in your environment. For instructions on how to disable a specific recommendation, see [Disable security recommendations](./tutorial-security-policy.md#disable-a-security-recommendation).

-### If a security control offers me zero points towards my secure score, should I ignore it?

-In some cases, you'll see a control max score greater than zero, but the impact is zero. When the incremental score for fixing resources is negligible, it's rounded to zero. Don't ignore these recommendations because they still bring security improvements. The only exception is the "Additional Best Practice" control. Remediating these recommendations won't increase your score, but it will enhance your overall security.

-### FAQ

-#### What happens to the old scan results and baselines after I switch to express configuration?

-Old results and baselines settings remain available on your storage account, but won't be updated or used by the system. You don't need to maintain these files for SQL vulnerability assessment to work after you switch to express configuration, but you can keep your old baseline definitions for future reference.

-When express configuration is enabled, you don't have direct access to the result and baseline data because it's stored on internal Microsoft storage.

-#### Can I set up recurring scans with express configuration?

-Express configuration automatically sets up reccuring scans for all databases under your server. This is the default and is not configurable at server or database level.

-#### Is there a way with express configuration to get the weekly email report that is provided in the classic configuration?

-You can use workflow automation and Logic Apps email scheduling, following the Microsoft Defender for Cloud processes:

-#### Why canΓÇÖt I set database policies anymore?

-SQL vulnerability assessment reports all vulnerabilities and misconfigurations in your environment, so it helps to have all databases included. Defender for SQL is billed per server, not per database.

-#### Can I revert back to the classic configuration?

-Yes. You can revert back to the classic configuration using the existing REST APIs and PowerShell cmdlets. When you revert back to the classic configuration, you see a notification in the Azure portal to change to the express configuration.

-#### Will we see express configuration for other types of SQL?

-Stay tuned for updates!

-#### Can I choose which experience will be the default?

-No. Express configuration will be the default for every new supported Azure SQL database.

-#### Does express configuration change scan behavior?

-No, express configuration provides the same scanning behavior and performance.

-#### Does express configuration have any effect on pricing?

-Express configuration doesn't require a storage account, so you don't need to pay extra storage fees unless you choose to keep old scan and baseline data.

-#### What does the 1-MB cap per rule mean?

-Any individual rule can't produce results that are more than 1 MB. When that limit is reached, the results for the rule are stopped. You can't set a baseline for the rule, the rule isn't included in the overall recommendation health, and the results are shown as "Not applicable".

-> Learn more about Defender for Cloud's regulatory compliance dashboard in the [frequently asked questions](regulatory-compliance-dashboard.md#faqregulatory-compliance-dashboard).

-## FAQ - Workflow automation

-### Does workflow automation support any business continuity or disaster recovery (BCDR) scenarios?

-When preparing your environment for BCDR scenarios, where the target resource is experiencing an outage or other disaster, it's the organization's responsibility to prevent data loss by establishing backups according to the guidelines from Azure Event Hubs, Log Analytics workspace, and Logic Apps.

-For every active automation, we recommend you create an identical (disabled) automation and store it in a different location. When there's an outage, you can enable these backup automations and maintain normal operations.

-Learn more about [Business continuity and disaster recovery for Azure Logic Apps](../logic-apps/business-continuity-disaster-recovery-guidance.md).

-> - If you are using Group Policy Object (GPO), it is recommended that you enable audit policies Process Creation Event 4688 and the *CommandLine* field inside event 4688. For more information about Process Creation Event 4688, see Defender for Cloud's [FAQ](./faq-data-collection-agents.yml#what-happens-when-data-collection-is-enabled-). For more information about these audit policies, see [Audit Policy Recommendations](/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations).

-|**IEC** | Codesys V3<br>IEC 60870-5-7 (IEC 62351-3 + IEC 62351-5)<br> IEC 60870-5-101 (encapsulated serial)<br> IEC 60870-5-103 (encapsulated serial)<br> IEC 60870-5-104<br> IEC 60870-5-104 ASDU_APCI<br> IEC 60870 ICCP TASE.2<br> IEC 61850 GOOSE<br> IEC 61850 MMS<br> IEC 61850 SMV (SAMPLED-VALUES)<br> LonTalk (LonWorks) |

- - zerotrust-services

- - zerotrust-services

- - zerotrust-services

- - zerotrust-services

-description: Learn how to configure an auto-stop schedule to automatically shutdown dev boxes in a pool at a specified time.

-To save on costs, you can enable an Auto-stop schedule on a dev box pool. Microsoft Dev Box Preview will attempt to shut down all dev boxes in that pool at the time specified in the schedule. You can configure one stop time in one timezone for each pool.

- |**Stop time**| Select a time to shutdown all the dev boxes in the pool. All Dev Boxes in this pool will be shut down at this time, everyday.|

- |**Stop time**| Select a time to shutdown all the dev boxes in the pool. All Dev Boxes in this pool will be shut down at this time, everyday.|

-

-If you don't already have a certificate, you can create a sample certificate using the [step CLI](https://smallstep.com/docs/step-cli/installation/). Consider installing manually for Windows.

-Once you installed Step, in Windows PowerShell, run the command to create root and intermediate certificates.

-.\step certificate create client1-authnID client1-authnID.pem client1-authnID.key --ca .step/certs/intermediate_ca.crt --ca-key .step/secrets/intermediate_ca_key --no-password --insecure --not-after 2400h

-

-Application rules are preferred over network rules to inspect traffic destined to private endpoints because Azure Firewall always SNATs traffic with application rules. SNAT is recommended when inspecting traffic destined to a private endpoint due to the limitation described here: [What is a private endpoint?][private-endpoint-overview]. If you're planning on using network rules instead, it is recommended to configure Azure Firewall to always perform SNAT: [Azure Firewall SNAT private IP address ranges][firewall-snat-private-ranges].

-A secured virtual hub is managed by Microsoft and it cannot be linked to a [Private DNS Zone](../dns/private-dns-privatednszone.md). This is required to resolve a [private link resource](../private-link/private-endpoint-overview.md#private-link-resource) FQDN to its corresponding private endpoint IP address.

- - **IP address-based network rules** - the custom DNS settings described in the previous point are **optional**. You can simply configure the custom DNS servers to point to the private IP of the DNS forwarder virtual machine.

-Lastly, and regardless of the type of rules configured in the Azure Firewall, make sure [Network Policies][network-policies-overview] (at least for UDR support) are enabled in the subnet(s) where the private endpoints are deployed. This will ensure traffic destined to private endpoints will not bypass the Azure Firewall.

-If needed, you can edit the CIDR prefixes that will be inspected via Azure Firewall in a secured hub as follows:

-1. Navigate to *Secured virtual hubs* in the firewall policy associated with the Azure Firewall deployed in the secured virtual hub and select the secured virtual hub where traffic filtering destined to private endpoints will be configured.

-3. Select **Private traffic prefixes** to edit the CIDR prefixes that will be inspected via Azure Firewall in secured virtual hub and add one /32 prefix for each private endpoint.

-To inspect traffic from clients in the same virtual network as private endpoints, it is not required to specifically override the /32 routes from private endpoints. As long as **Network Policies** are enabled in the private endpoints subnet(s), a UDR with a wider address range will take precedence. For instance, configure this UDR with **Next hop type** set to **Virtual Appliance**, **Next hop address** set to the private IP of the Azure Firewall, and **Address prefix** destination set to the subnet dedicated to all private endpoint deployed in the virtual network. **Propagate gateway routes** must be set to **Yes**.

-In most cases, these problems are caused by one of the following issues:

-2. Verify **Security configuration** in the firewall policy associated with the Azure Firewall deployed in the secured virtual hub. In case traffic destined to private endpoints is not being logged in the firewall, try adding the /32 prefix for each private endpoint to the list of **Private Traffic Prefixes**.

- Azure virtual WAN doesn't advertise the prefixes configured under **Private traffic prefixes** in firewall policy **Security configuration** to on-premises. It's expected that the /32 entries won't show in the routing tables of your on-premises routing devices.

- When filtering traffic destined to [Azure Files](../storage/files/storage-files-introduction.md) private endpoints, **AzureFirewallNetworkRule** log entries will only be generated when a client first mounts or connects to the file share. Azure Firewall won't generate logs for [CRUD](https://en.wikipedia.org/wiki/Create,_read,_update_and_delete) operations for files in the file share. This is because CRUD operations are carried over the persistent TCP channel opened when the client first connects or mounts to the file share.

-The number of origin groups, origins, and endpoints don't affect your composite routing limit. However, there are other limits that apply to these resources. For more information, see [Azure subscription and service limits, quotas, and constraints](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-front-door-standard-and-premium-tier-service-limits).

-For information about quota limits, refer to [Front Door limits, quotas and constraints](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-front-door-standard-and-premium-tier-service-limits).

-> * If you're running a large Azure Front Door profile, review [**Azure Front Door service limits**](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-front-door-standard-and-premium-tier-service-limits) and [**Azure Front Door routing limits**](front-door-routing-limits.md) to better manage your Azure Front Door.

-If your origin requires the host header to match the origin hostname, make sure that the origin host header includes the hostname of the origin.

-If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free)

-The following mappings are to the **PCI v3.2.1 2018 PCI DSS 3.2.1** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-The following mappings are to the **DoD Impact Level 4** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-|[SQL managed instances should use customer-managed keys to encrypt data at rest](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fac01ad65-10e5-46df-bdd9-6b0cad13e1d2) |Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Deny.json) |

-The following mappings are to the **DoD Impact Level 5** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-|[SQL managed instances should use customer-managed keys to encrypt data at rest](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fac01ad65-10e5-46df-bdd9-6b0cad13e1d2) |Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |Audit, Deny, Disabled |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Deny.json) |

-The following mappings are to the **NIST SP 800-171 R2** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-The following mappings are to the **NIST SP 800-53 Rev. 4** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-|[SQL managed instances should use customer-managed keys to encrypt data at rest](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F048248b0-55cd-46da-b1ff-39efd52db260) |Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |AuditIfNotExists, Disabled |[1.0.2](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json) |

-The following mappings are to the **NIST SP 800-171 R2** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-The following mappings are to the **NIST SP 800-53 Rev. 4** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-|[SQL managed instances should use customer-managed keys to encrypt data at rest](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F048248b0-55cd-46da-b1ff-39efd52db260) |Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. This recommendation applies to organizations with a related compliance requirement. |AuditIfNotExists, Disabled |[1.0.2](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlManagedInstance_EnsureServerTDEisEncryptedWithYourOwnKey_Audit.json) |

-The following mappings are to the **PCI DSS 3.2.1** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-The following mappings are to the **[Preview]: SWIFT CSCF v2021** controls. Use the

-navigation on the right to jump directly to a specific **compliance domain**. Many of the controls

-In this article, we explore using the MedTech service and the Azure Machine Learning Service.

-In this article, we explore using the MedTech service and Microsoft Power Business Intelligence (Power BI).

-In this article, we explore using the MedTech service and Microsoft Teams for notifications.

-In this tutorial, you learn how to:

-In this article, learn how to configure the MedTech service metrics in the Azure portal. You'll also learn how to pin the MedTech service metrics tile to an Azure portal dashboard for later viewing.

-In this article, you'll learn how to use the MedTech service monitoring and health check tabs in the Azure portal. The monitoring and health check tabs provide access to crucial MedTech service metrics and health checks. These metrics and health checks can be used in assessing the health and performance of your MedTech service and can be useful seeing patterns and/or trends or assisting with troubleshooting your MedTech service.

-This article provides an introductory overview of the MedTech service. The MedTech service is a Platform as a Service (PaaS) within the Azure Health Data Services. The MedTech service enables you to ingest device data, transform it into a unified FHIR format, and store it in an enterprise-scale, secure, and compliant cloud environment. 

- 3. If needed, you can migrate back to the Baltimore root by selecting **Baltimore CyberTrust Root** and saving the changes. This option is available until 15 May 2023 and will then be disabled as Microsoft will start initiating the migration.

- - zerotrust-services

-> Azure App Service certificate configuration through Azure Portal does not support Key Vault RBAC permission model. You can use Azure PowerShell, Azure CLI, ARM template deployments with **Key Vault Secrets User** and **Key Vault Reader** role assignemnts for 'Microsoft Azure App Service' global indentity.

- - zerotrust-services

-## Scenario: Third party firewall

-Work is distributed at the file level, for both structured and unstructured data. As a consequence, only [file datasets](v1/how-to-create-register-datasets.md#filedataset) or [URI folders](reference-yaml-data.md) are supported for this feature. Each worker processes batches of `Mini batch size` files at a time. Further parallelism can be achieved if `Max concurrency per instance` is increased.

-> [!TIP]

-> You can also perform integration in the opposite direction, using Azure Synapse spark pool from Azure Machine Learning. For more information, see [Link Azure Synapse and Azure Machine Learning](v1/how-to-link-synapse-ml-workspaces.md).

-TypeError: Descriptors cannot not be created directly. If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.ΓÇ¥ It is followed by the proposition to install the appropriate version of protobuf library.

-* [Create & use software environments (SDK v1)](how-to-use-environments.md#update-an-existing-environment)

-* [Create & manage environments (CLI v2)](how-to-manage-environments-v2.md#update)

-* [Create & use software environments (SDK v1)](how-to-use-environments.md#update-an-existing-environment)

-* [Create & manage environments (CLI v2)](how-to-manage-environments-v2.md#update)

-For a code first experience, see how to set up [model explanations for automated ML experiments with the Azure Machine Learning Python SDK](./v1/how-to-machine-learning-interpretability-automl.md).

- 1. The **Confirm details** form is a summary of the information previously populated in the **Basic info** and **Settings and preview** forms. You also have the option to create a data profile for your dataset using a profiling enabled compute. Learn more about [data profiling](v1/how-to-connect-data-ui.md#profile).

- > Your compute name will indicate if the compute you select/create is *profiling enabled*. (See the section [data profiling](v1/how-to-connect-data-ui.md#profile) for more details).

- Explain best model | Select to enable or disable, in order to show explanations for the recommended best model. <br> This functionality is not currently available for [certain forecasting algorithms](./v1/how-to-machine-learning-interpretability-automl.md#interpretability-during-training-for-the-best-model).

- * You can either provide your own test dataset or opt to use a percentage of your training dataset. Test data must be in the form of an [Azure Machine Learning TabularDataset](./v1/how-to-create-register-datasets.md#tabulardataset).

-The model explanations dashboard provides an overall analysis of the trained model along with its predictions and explanations. It also lets you drill into an individual data point and its individual feature importance. [Learn more about the explanation dashboard visualizations](./v1/how-to-machine-learning-interpretability-aml.md#visualizations).

-> If you are looking to deploy a model that was generated via the `automl` package with the Python SDK, you must [register your model](./v1/how-to-deploy-and-where.md) to the workspace.

- Use custom deployment assets| Enable this feature if you want to upload your own scoring script and environment file. Otherwise, automated ML provides these assets for you by default. [Learn more about scoring scripts](./v1/how-to-deploy-and-where.md).

-* [Learn how to consume a web service](v1/how-to-consume-web-service.md).

-# Invoking batch endpoints from Event Grid events in storage

-Event Grid is a fully managed service that enables you to easily manage events across many different Azure services and applications. It simplifies building event-driven and serverless applications. In this tutorial we are going to learn how to create a Logic App that can subscribe to the Event Grid event associated with new files created in a storage account and trigger a batch endpoint to process the given file.

-The workflow will work in the following way:

-1. It will be triggered when a new blob is created in a specific storage account.

-2. Since the storage account can contain multiple data assets, event filtering will be applied to only react to events happening in a specific folder inside of it. Further filtering can be done is needed.

-3. It will get an authorization token to invoke batch endpoints using the credentials from a Service Principal.

-4. It will trigger the batch endpoint (default deployment) using the newly created file as input.

-> When using Logic App connected with event grid to invoke batch deployment, a job for each file that triggers the event of *blog created* will be generated. However, keep in mind that batch deployments distribute the work at the file level. Since this execution is specifying only one file, then, there will not be any parallelization happening in the deployment. Instead, you will be taking advantage of the capability of batch deployments of executing multiple scoring jobs under the same compute cluster. If you need to run jobs on entire folders in an automatic fashion, we recommend you to switch to [Invoking batch endpoints from Azure Data Factory](how-to-use-batch-azure-data-factory.md).

-* This example assumes that you have a model correctly deployed as a batch endpoint. Particularly, we are using the *heart condition classifier* created in the tutorial [Using MLflow models in batch deployments](how-to-mlflow-batch.md).

-* This example assumes that your batch deployment runs in a compute cluster called `cpu-cluster`.

-* The Logic App we are creating will communicate with Azure Machine Learning batch endpoints using REST. To know more about how to use the REST API of batch endpoints read [Create jobs and input data for batch endpoints](how-to-access-data-batch-endpoints-jobs.md?tabs=rest).

-We will be using cloud URIs provided by Event Grid to indicate the input data to send to the deployment job. Batch deployments use the identity of the compute to mount the data. The identity of the job is used to read the data once mounted for external storage accounts. You will need to assign a user-assigned managed identity to the compute cluster in order to ensure it does have access to mount the underlying data. Follow these steps to ensure data access:

- # [Azure Machine Learning CLI](#tab/cli)

- # [Azure Machine Learning SDK for Python](#tab/sdk)

- # [Azure Machine Learning CLI](#tab/cli)

- # [Azure Machine Learning SDK for Python](#tab/sdk)

- compute_name = "cpu-cluster"

-This Logic App will use parameters to store specific pieces of information that you will need to run the batch deployment.

- | `tenant_id` | Tenant ID where the endpoint is deployed | `00000000-0000-0000-00000000` |

- | `client_id` | The client ID of the service principal used to invoke the endpoint | `00000000-0000-0000-00000000` |

- | `client_secret` | The client secret of the service principal used to invoke the endpoint | `ABCDEFGhijkLMNOPQRstUVwz` |

- | `endpoint_uri` | The endpoint scoring URI | `https://<endpoint_name>.<region>.inference.ml.azure.com/jobs` |

-We want to trigger the Logic App each time a new file is created in a given folder (data asset) of a Storage Account. The Logic App will also use the information of the event to invoke the batch endpoint and passing the specific file to be processed.

- > Notice that this last action will trigger the batch deployment job, but it will not wait for its completion. AzureLogic Apps is not designed for long-running applications. If you need to wait for the job to complete, we recommend you to switch to [Invoking batch endpoints from Azure Data Factory](how-to-use-batch-azure-data-factory.md).

-* [Invoking batch endpoints from Azure Data Factory](how-to-use-batch-azure-data-factory.md)

-* **If a registered model with the name doesnΓÇÖt exist**, the method registers a new model, creates version 1, and returns a ModelVersion MLflow object.

-> * [Visualize runs with TensorBoard](v1/how-to-monitor-tensorboard.md)

-> **Explainability** is supported only for **multi-class classification** and **multi-label classification**. While generating explanations on online endpoint, if you encounter timeout issues, use [batch scoring notebook](https://github.com/Azure/azureml-examples/tree/main/v1/python-sdk/tutorials/automl-with-azureml/image-classification-multiclass-batch-scoring) to generate explanations.

-> While generating explanations on online endpoint, make sure to select only few classes based on confidence score in order to avoid timeout issues on the endpoint or use the endpoint with GPU instance type. To generate explanations for large number of classes in multi-label classification, refer to [batch scoring notebook](https://github.com/Azure/azureml-examples/tree/main/v1/python-sdk/tutorials/automl-with-azureml/image-classification-multiclass-batch-scoring).

-* An Azure Machine Learning script run configuration file. If you don't have one, you can follow [this resource](./v1/how-to-set-up-training-targets.md)

-| [The Azure Machine Learning CLI 1.0](v1/reference-azure-machine-learning-cli.md) | GA | YES | YES |

-| [Custom Cognitive Search](./v1/how-to-deploy-model-cognitive-search.md) | Public Preview | YES | YES |