| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| active-directory-b2c | Embedded Login | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/embedded-login.md | The **Sources** attribute contains the URI of your web application. Add a space - The URI must use the https scheme. - The full URI of the web app must be specified. Wildcards are not supported. -In addition, we recommend that you also block your own domain name from being embedded in an iframe by setting the Content-Security-Policy and X-Frame-Options headers respectively on your application pages. This will mitigate security concerns around older browsers related to nested embedding of iframes. +In addition, we recommend that you also block your own domain name from being embedded in an iframe by setting the `Content-Security-Policy` and `X-Frame-Options` headers respectively on your application pages. This will mitigate security concerns around older browsers related to nested embedding of iframes. ## Adjust policy user interface -With Azure AD B2C [user interface customization](customize-ui.md), you have almost full control over the HTML and CSS content presented to users. Follow the steps for customizing an HTML page using content definitions. To fit the Azure AD B2C user interface into the iframe size, provide clean HTML page without background and extra spaces. +With Azure AD B2C [user interface customization](customize-ui.md), you have almost full control over the HTML and CSS content presented to users. Follow the steps for customizing an HTML page using content definitions. To fit the Azure AD B2C user interface into the iframe size, provide clean HTML page without a background and extra spaces. The following CSS code hides the Azure AD B2C HTML elements and adjusts the size of the panel to fill the iframe. div.api_container{ } ``` -In some cases, you might want to notify to your application of which Azure AD B2C page is currently being presented. For example, when a user selects the sign-up option, you might want the application to respond by hiding the links for signing in with a social account or adjusting the iframe size. +In some cases, you may want to notify your application about the Azure AD B2C page that's currently being presented. For example, when a user selects the sign-up option, you may want the application to respond by hiding the links for signing in with a social account or adjusting the iframe size. -To notify your application of the current Azure AD B2C page, [enable your policy for JavaScript](./javascript-and-page-layout.md), and then use HTML5 post messages. The following JavaScript code sends a post message to the app with `signUp`: +To notify your application about the current Azure AD B2C page, [enable your policy for JavaScript](./javascript-and-page-layout.md), and then use HTML5 to post messages. The following JavaScript code sends a post message to the app with `signUp`: ```javascript window.parent.postMessage("signUp", '*'); window.parent.postMessage("signUp", '*'); When a user selects the sign-in button, the [web app](integrate-with-app-code-samples.md#web-apps-and-apis) generates an authorization request that takes the user to Azure AD B2C sign-in experience. After sign-in is complete, Azure AD B2C returns an ID token, or authorization code, to the configured redirect URI within your application. -To support embedded login, the iframe **src** property points to the sign-in controller, such as `/account/SignUpSignIn`, which generates the authorization request and redirects the user to Azure AD B2C policy. +To support embedded login, the iframe `src` attribute points to the sign-in controller, such as `/account/SignUpSignIn`, which generates the authorization request and redirects the user to Azure AD B2C policy. ```html <iframe id="loginframe" frameborder="0" src="/account/SignUpSignIn"></iframe> The redirect URI can be the same redirect URI used by the iframe. You can skip t ## Configure a single-page application -For a single-page application, you'll also need to a second "sign-in" HTML page that loads into the iframe. This sign-in page hosts the authentication library code that generates the authorization code and returns the token. +For a single-page application, you'll also need a second "sign-in" HTML page that loads into the iframe. This sign-in page hosts the authentication library code that generates the authorization code and returns the token. -When the single-page application needs the access token, use JavaScript code to obtain the access token from the iframe and object that contains it. +When the single-page application needs the access token, use JavaScript code to obtain the access token from the iframe and the object that contains it. > [!NOTE] > Running MSAL 2.0 in an iframe is not currently supported. |
| active-directory-b2c | Whats New Docs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/whats-new-docs.md | -Welcome to what's new in Azure Active Directory B2C documentation. This article lists new docs that have been added and those that have had significant updates in the last three months. To learn what's new with the B2C service, see [What's new in Azure Active Directory](../active-directory/fundamentals/whats-new.md). +Welcome to what's new in Azure Active Directory B2C documentation. This article lists new docs that have been added and those that have had significant updates in the last three months. To learn what's new with the B2C service, see [What's new in Azure Active Directory](../active-directory/fundamentals/whats-new.md) and [Azure AD B2C developer release notes](custom-policy-developer-notes.md) ## May 2022 |
| active-directory-domain-services | Network Considerations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/network-considerations.md | As you design the virtual network for Azure AD DS, the following considerations A managed domain connects to a subnet in an Azure virtual network. Design this subnet for Azure AD DS with the following considerations: -* A managed domain must be deployed in its own subnet. Don't use an existing subnet or a gateway subnet. This includes the usage of remote gateways settings in the virtual network peering which puts the managed domain in an unsupported state. +* A managed domain must be deployed in its own subnet. Using an existing subnet, gateway subnet, or remote gateways settings in the virtual network peering is unsupported. * A network security group is created during the deployment of a managed domain. This network security group contains the required rules for correct service communication. * Don't create or use an existing network security group with your own custom rules. * A managed domain requires 3-5 IP addresses. Make sure that your subnet IP address range can provide this number of addresses. |
| active-directory | Define Conditional Rules For Provisioning User Accounts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md | Scoping filters are configured as part of the attribute mappings for each Azure >[!IMPORTANT] > - The IsMemberOf filter is not supported currently. > - The members attribute on a group is not supported currently.-> - EQUALS and NOT EQUALS are not supported for multi-valued attributes -> - Scoping filters will return "false" if the value is null / empty +> - Filtering is not supported for multi-valued attributes. +> - Scoping filters will return "false" if the value is null / empty. 9. Optionally, repeat steps 7-8 to add more scoping clauses. |
| active-directory | Application Proxy Configure Complex Application | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-complex-application.md | Here is an example of the request. ```http-PATCH https://graph.microsoft.com/beta/applications/{<object-id-of--the-complex-app} +PATCH https://graph.microsoft.com/beta/applications/{<object-id-of--the-complex-app-under-APP-Registrations} Content-type: application/json { |
| active-directory | Howto Mfa Mfasettings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfa-mfasettings.md | The following Azure AD Multi-Factor Authentication settings are available in the | [Notifications](#notifications) | Enable notifications of events from MFA Server. | | [OATH tokens](concept-authentication-oath-tokens.md) | Used in cloud-based Azure AD Multi-Factor Authentication environments to manage OATH tokens for users. | | [Phone call settings](#phone-call-settings) | Configure settings related to phone calls and greetings for cloud and on-premises environments. |-| Providers | This will show any existing authentication providers that you have associated with your account. Adding new providers is disabled as of September 1, 2018. | +| Providers | This will show any existing authentication providers that you've associated with your account. Adding new providers is disabled as of September 1, 2018. |  If your organization uses the NPS extension to provide MFA to on-premises applic | Azure AD tenant type | Trusted IP feature options | |: |: |-| Managed |**Specific range of IP addresses**: Administrators specify a range of IP addresses that can bypass multi-factor authentication for users who sign in from the company intranet. A maximum of 50 trusted IP ranges can be configured.| -| Federated |**All Federated Users**: All federated users who sign in from inside the organization can bypass multi-factor authentication. Users bypass verification by using a claim that's issued by Active Directory Federation Services (AD FS).<br/>**Specific range of IP addresses**: Administrators specify a range of IP addresses that can bypass multi-factor authentication for users who sign in from the company intranet. | +| Managed |**Specific range of IP addresses**: Administrators specify a range of IP addresses that can bypass multi-factor authentications for users who sign in from the company intranet. A maximum of 50 trusted IP ranges can be configured.| +| Federated |**All Federated Users**: All federated users who sign in from inside the organization can bypass multi-factor authentications. Users bypass verifications by using a claim that's issued by Active Directory Federation Services (AD FS).<br/>**Specific range of IP addresses**: Administrators specify a range of IP addresses that can bypass multi-factor authentication for users who sign in from the company intranet. | Trusted IP bypass works only from inside the company intranet. If you select the **All Federated Users** option and a user signs in from outside the company intranet, the user has to authenticate by using multi-factor authentication. The process is the same even if the user presents an AD FS claim. When trusted IPs are used, multi-factor authentication isn't required for browse #### User experience outside the corporate network -Regardless of whether trusted IP are defined, multi-factor authentication is required for browser flows. App passwords are required for older rich-client applications. +Regardless of whether trusted IPs are defined, multi-factor authentication is required for browser flows. App passwords are required for older rich-client applications. #### Enable named locations by using Conditional Access To enable trusted IPs by using Conditional Access policies, complete the followi 1. Select **Configure MFA trusted IPs**. 1. On the **Service Settings** page, under **Trusted IPs**, choose one of these options: - * **For requests from federated users originating from my intranet**: To choose this option, select the checkbox. All federated users who sign in from the corporate network bypass multi-factor authentication by using a claim that's issued by AD FS. Ensure that AD FS has a rule to add the intranet claim to the appropriate traffic. If the rule doesn't exist, create the following rule in AD FS: + * **For requests from federated users originating from my intranet**: To choose this option, select the checkbox. All federated users who sign in from the corporate network bypass multi-factor authentications by using a claim that's issued by AD FS. Ensure that AD FS has a rule to add the intranet claim to the appropriate traffic. If the rule doesn't exist, create the following rule in AD FS: - `c:[Type== "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork"] => issue(claim = c);` + `c:[Type== "https://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork"] => issue(claim = c);` * **For requests from a specific range of public IPs**: To choose this option, enter the IP addresses in the text box, in CIDR notation. * For IP addresses that are in the range *xxx.xxx.xxx*.1 through *xxx.xxx.xxx*.254, use notation like ***xxx.xxx.xxx*.0/24**. * For a single IP address, use notation like ***xxx.xxx.xxx.xxx*/32**.- * Enter up to 50 IP address ranges. Users who sign in from these IP addresses bypass multi-factor authentication. + * Enter up to 50 IP address ranges. Users who sign in from these IP addresses bypass multi-factor authentications. 1. Select **Save**. If you don't want to use Conditional Access policies to enable trusted IPs, you * **For requests from federated users on my intranet**: To choose this option, select the checkbox. All federated users who sign in from the corporate network bypass multi-factor authentication by using a claim that's issued by AD FS. Ensure that AD FS has a rule to add the intranet claim to the appropriate traffic. If the rule doesn't exist, create the following rule in AD FS: - `c:[Type== "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork"] => issue(claim = c);` + `c:[Type== "https://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork"] => issue(claim = c);` * **For requests from a specified range of IP address subnets**: To choose this option, enter the IP addresses in the text box, in CIDR notation. * For IP addresses that are in the range *xxx.xxx.xxx*.1 through *xxx.xxx.xxx*.254, use notation like ***xxx.xxx.xxx*.0/24**. * For a single IP address, use notation like ***xxx.xxx.xxx.xxx*/32**.- * Enter up to 50 IP address ranges. Users who sign in from these IP addresses bypass multi-factor authentication. + * Enter up to 50 IP address ranges. Users who sign in from these IP addresses bypass multi-factor authentications. 1. Select **Save**. To enable and configure the option to allow users to remember their MFA status a 1. Select **Per-user MFA**. 1. Under **multi-factor authentication** at the top of the page, select **service settings**. 1. On the **service settings** page, under **remember multi-factor authentication**, select **Allow users to remember multi-factor authentication on devices they trust**.-1. Set the number of days to allow trusted devices to bypass multi-factor authentication. For the optimal user experience, extend the duration to 90 or more days. +1. Set the number of days to allow trusted devices to bypass multi-factor authentications. For the optimal user experience, extend the duration to 90 or more days. 1. Select **Save**. #### Mark a device as trusted |
| active-directory | Troubleshoot Conditional Access What If | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/conditional-access/troubleshoot-conditional-access-what-if.md | The What If tool is located in the **Azure portal** > **Azure Active Directory**  -> [!NOTE] -> The What If tool currently does not evaluate policies in report-only mode. - ## Gathering information -The What If tool requires only a **User** to get started. +The What If tool requires only a **User** or **Workload identity** to get started. The following additional information is optional but will help to narrow the scope for specific cases. -* Cloud apps or actions +* Cloud apps, actions, or authentication context * IP address * Country/Region * Device platform-* Client apps (preview) -* Device state (preview) +* Client apps +* Device state * Sign-in risk+* User risk level +* Service principal risk (Preview) +* Filter for devices This information can be gathered from the user, their device, or the Azure AD sign-ins log. At any point, you can select **Reset** to clear any criteria input and return to ### Policies that will apply -This list will show which Conditional Access policies would apply given the conditions. The list will include both the grant and session controls that apply. Examples include requiring multi-factor authentication to access a specific application. +This list will show which Conditional Access policies would apply given the conditions. The list will include both the grant and session controls that apply including those from policies in report-only mode. Examples include requiring multi-factor authentication to access a specific application. ### Policies that will not apply -This list will show Conditional Access policies that wouldn't apply if the conditions applied. The list will include any policies and the reason why they don't apply. Examples include users and groups that may be excluded from a policy. +This list will show Conditional Access policies that wouldn't apply if the conditions applied. The list will include any policies and the reason why they don't apply including those from policies in report-only mode. Examples include users and groups that may be excluded from a policy. ## Use case This test could be expanded to incorporate other data points to narrow the scope ## Next steps -* [What is Conditional Access?](overview.md) +* [What is Conditional Access report-only mode?](concept-conditional-access-report-only.md) * [What is Azure Active Directory Identity Protection?](../identity-protection/overview-identity-protection.md) * [What is a device identity?](../devices/overview.md) * [How it works: Azure AD Multi-Factor Authentication](../authentication/concept-mfa-howitworks.md) |
| active-directory | Authorization Basics | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/authorization-basics.md | Title: Authorization basics description: Learn about the basics of authorization in the Microsoft identity platform. -+ |
| active-directory | Custom Rbac For Developers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/custom-rbac-for-developers.md | Title: Custom role-based access control (RBAC) for application developers - Microsoft identity platform description: Learn about what custom RBAC is and why it's important to implement in your applications. -+ |
| active-directory | Howto Implement Rbac For Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-implement-rbac-for-apps.md | Title: Implement role-based access control in apps description: Learn how to implement role-based access control in your applications. -+ |
| active-directory | Secure Group Access Control | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/secure-group-access-control.md | Title: Secure access control using groups in Azure AD description: Learn about how groups are used to securely control access to resources in Azure AD. -+ |
| active-directory | Secure Least Privileged Access | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/secure-least-privileged-access.md | Title: "Increase app security with the principle of least privilege" description: Learn how the principle of least privilege can help increase the security of your application, its data, and which features of the Microsoft identity platform you can use to implement least privileged access. -+ |
| active-directory | Security Best Practices For App Registration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/security-best-practices-for-app-registration.md | Title: Best practices for Azure AD application registration configuration description: Learn about a set of best practices and general guidance on Azure AD application registration configuration. -+ |
| active-directory | Zero Trust For Developers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/zero-trust-for-developers.md | Title: "Increase app security by following Zero Trust principles" description: Learn how following the Zero Trust principles can help increase the security of your application, its data, and which features of the Microsoft identity platform you can use to build Zero Trust-ready apps. -+ |
| active-directory | Howto Vm Sign In Azure Ad Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/devices/howto-vm-sign-in-azure-ad-linux.md | The following Linux distributions are currently supported during the preview of | Distribution | Version | | | |+| Common Base Linux Mariner (CBL-Mariner) | CBL-Mariner 1, CBL-Mariner 2 | | CentOS | CentOS 7, CentOS 8 |-| Debian | Debian 9, Debian 10 | +| Debian | Debian 9, Debian 10, Debian 11 | | openSUSE | openSUSE Leap 42.3, openSUSE Leap 15.1+ | | RedHat Enterprise Linux (RHEL) | RHEL 7.4 to RHEL 7.10, RHEL 8.3+ | | SUSE Linux Enterprise Server (SLES) | SLES 12, SLES 15.1+ |-| Ubuntu Server | Ubuntu Server 16.04 to Ubuntu Server 20.04 | +| Ubuntu Server | Ubuntu Server 16.04 to Ubuntu Server 22.04 | The following Azure regions are currently supported for this feature: Ensure your VM is configured with the following functionality: Ensure your client meets the following requirements: -- SSH client must support OpenSSH based certificates for authentication. You can use Azure CLI (2.21.1 or higher) with OpenSSH (included in Windows 10 version 1803 or higher) or Azure Cloud Shell to meet this requirement. -- SSH extension for Azure CLI. You can install this using `az extension add --name ssh`. You donΓÇÖt need to install this extension when using Azure Cloud Shell as it comes pre-installed.-- If youΓÇÖre using any other SSH client other than Azure CLI or Azure Cloud Shell that supports OpenSSH certificates, youΓÇÖll still need to use Azure CLI with SSH extension to retrieve ephemeral SSH cert and optionally a config file and then use the config file with your SSH client.+- SSH client must support OpenSSH based certificates for authentication. You can use Az CLI (2.21.1 or higher) with OpenSSH (included in Windows 10 version 1803 or higher) or Azure Cloud Shell to meet this requirement. +- SSH extension for Az CLI. You can install this using `az extension add --name ssh`. You donΓÇÖt need to install this extension when using Azure Cloud Shell as it comes pre-installed. +- If youΓÇÖre using any other SSH client other than Az CLI or Azure Cloud Shell that supports OpenSSH certificates, youΓÇÖll still need to use Az CLI with SSH extension to retrieve ephemeral SSH cert and optionally a config file and then use the config file with your SSH client. - TCP connectivity from the client to either the public or private IP of the VM (ProxyCommand or SSH forwarding to a machine with connectivity also works). > [!IMPORTANT] Ensure your client meets the following requirements: ## Enabling Azure AD login in for Linux VM in Azure -To use Azure AD login in for Linux VM in Azure, you need to first enable Azure AD login option for your Linux VM, configure Azure role assignments for users who are authorized to login in to the VM and then use SSH client that supports OpensSSH such as Azure CLI or Az Cloud Shell to SSH to your Linux VM. There are multiple ways you can enable Azure AD login for your Linux VM, as an example you can use: +To use Azure AD login in for Linux VM in Azure, you need to first enable Azure AD login option for your Linux VM, configure Azure role assignments for users who are authorized to login in to the VM and then use SSH client that supports OpensSSH such as Az CLI or Az Cloud Shell to SSH to your Linux VM. There are multiple ways you can enable Azure AD login for your Linux VM, as an example you can use: - Azure portal experience when creating a Linux VM - Azure Cloud Shell experience when creating a Windows VM or for an existing Linux VM az role assignment create \ For more information on how to use Azure RBAC to manage access to your Azure subscription resources, see the article [Steps to assign an Azure role](../../role-based-access-control/role-assignments-steps.md). -## Install SSH extension for Azure CLI +## Install SSH extension for Az CLI -If youΓÇÖre using Azure Cloud Shell, then no other setup is needed as both the minimum required version of Azure CLI and SSH extension for Azure CLI are already included in the Cloud Shell environment. +If youΓÇÖre using Azure Cloud Shell, then no other setup is needed as both the minimum required version of Az CLI and SSH extension for Az CLI are already included in the Cloud Shell environment. -Run the following command to add SSH extension for Azure CLI +Run the following command to add SSH extension for Az CLI ```azurecli az extension add --name ssh az extension show --name ssh You can enforce Conditional Access policies such as require multi-factor authentication, require compliant or hybrid Azure AD joined device for the device running SSH client, and checking for risk before authorizing access to Linux VMs in Azure that are enabled with Azure AD login in. The application that appears in Conditional Access policy is called "Azure Linux VM Sign-In". > [!NOTE]-> Conditional Access policy enforcement requiring device compliance or Hybrid Azure AD join on the client device running SSH client only works with Azure CLI running on Windows and macOS. It is not supported when using Azure CLI on Linux or Azure Cloud Shell. +> Conditional Access policy enforcement requiring device compliance or Hybrid Azure AD join on the client device running SSH client only works with Az CLI running on Windows and macOS. It is not supported when using Az CLI on Linux or Azure Cloud Shell. ## Login using Azure AD user account to SSH into the Linux VM -### Using Azure CLI +### Using Az CLI First do az login and then az ssh vm. The following example automatically resolves the appropriate IP address for the az ssh vm -n myVM -g AzureADLinuxVM ``` -If prompted, enter your Azure AD login credentials at the login page, perform an MFA, and/or satisfy device checks. YouΓÇÖll only be prompted if your Azure CLI session doesnΓÇÖt already meet any required Conditional Access criteria. Close the browser window, return to the SSH prompt, and youΓÇÖll be automatically connected to the VM. +If prompted, enter your Azure AD login credentials at the login page, perform an MFA, and/or satisfy device checks. YouΓÇÖll only be prompted if your az CLI session doesnΓÇÖt already meet any required Conditional Access criteria. Close the browser window, return to the SSH prompt, and youΓÇÖll be automatically connected to the VM. YouΓÇÖre now signed in to the Azure Linux virtual machine with the role permissions as assigned, such as VM User or VM Administrator. If your user account is assigned the Virtual Machine Administrator Login role, you can use sudo to run commands that require root privileges. Use the following example to authenticate to Azure CLI using the service princip az login --service-principal -u <sp-app-id> -p <password-or-cert> --tenant <tenant-id> ``` -Once authentication with a service principal is complete, use the normal Azure CLI SSH commands to connect to the VM. +Once authentication with a service principal is complete, use the normal Az CLI SSH commands to connect to the VM. ```azurecli az ssh vm -n myVM -g AzureADLinuxVM For customers who are using previous version of Azure AD login for Linux that wa ## Using Azure Policy to ensure standards and assess compliance -Use Azure Policy to ensure Azure AD login is enabled for your new and existing Linux virtual machines and assess compliance of your environment at scale on your Azure Policy compliance dashboard. With this capability, you can use many levels of enforcement: you can flag new and existing Linux VMs within your environment that donΓÇÖt have Azure AD login enabled. You can also use Azure Policy to deploy the Azure AD extension on new Linux VMs that donΓÇÖt have Azure AD login enabled, and remediate existing Linux VMs to the same standard. In addition to these capabilities, you can also use Azure Policy to detect and flag Linux VMs that have non-approved local accounts created on their machines. To learn more, review [Azure Policy](../../governance/policy/overview.md). +Use Azure Policy to ensure Azure AD login is enabled for your new and existing Linux virtual machines and assess compliance of your environment at scale on your Azure Policy compliance dashboard. With this capability, you can use many levels of enforcement: you can flag new and existing Linux VMs within your environment that donΓÇÖt have Azure AD login enabled. You can also use Azure Policy to deploy the Azure AD extension on new Linux VMs that donΓÇÖt have Azure AD login enabled, as well as remediate existing Linux VMs to the same standard. In addition to these capabilities, you can also use Azure Policy to detect and flag Linux VMs that have non-approved local accounts created on their machines. To learn more, review [Azure Policy](../../governance/policy/overview.md). ## Troubleshoot sign-in issues Some common errors when you try to SSH with Azure AD credentials include no Azure roles assigned, and repeated prompts to sign in. Use the following sections to correct these issues. -### Missing application --If the Azure Linux VM Sign-in application is missing from Conditional Access, use the following steps to remediate the issue: --1. Check to make sure the application isn't in the tenant by: - 1. Sign in to the **Azure portal**. - 1. Browse to **Azure Active Directory** > **Enterprise applications** - 1. Remove the filters to see all applications, and search for "VM". If you don't see Azure Linux VM Sign-in as a result, the service principal is missing from the tenant. --Another way to verify it is via Graph PowerShell: --1. [Install the Graph PowerShell SDK](/powershell/microsoftgraph/installation) if you haven't already done so. -1. `Connect-MgGraph -Scopes "ServicePrincipalEndpoint.ReadWrite.All","Application.ReadWrite.All"` -1. Sign-in with a Global Admin account -1. Consent to permission prompt -1. `Get-MgServicePrincipal -ConsistencyLevel eventual -Search '"DisplayName:Azure Linux VM"'` - 1. If this command results in no output and returns you to the PowerShell prompt, you can create the Service Principal with the following Graph PowerShell command: - 1. `New-MgServicePrincipal -AppId ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0` - 1. Successful output will show that the AppID and the Application Name Azure Linux VM Sign-in was created. -1. Sign out of Graph PowerShell when complete with the following command: `Disconnect-MgGraph` - ### CouldnΓÇÖt retrieve token from local cache You must run az login again and go through an interactive sign in flow. Review the section [Using Az Cloud Shell](#using-az-cloud-shell). Virtual machine scale set VM connections may fail if the virtual machine scale s ### AllowGroups / DenyGroups statements in sshd_config cause first login to fail for Azure AD users -Cause 1: If sshd_config contains either AllowGroups or DenyGroups statements, the first login fails for Azure AD users. If the statement was added after a user already has a successful login, they can log in. +Cause 1: If sshd_config contains either AllowGroups or DenyGroups statements, the very first login fails for Azure AD users. If the statement was added after a user already has a successful login, they can log in. Solution 1: Remove AllowGroups and DenyGroups statements from sshd_config. |
| active-directory | Licensing Service Plan Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/enterprise-users/licensing-service-plan-reference.md | When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic - **Service plans included (friendly names)**: A list of service plans (friendly names) in the product that correspond to the string ID and GUID >[!NOTE]->This information last updated on June 14th, 2022.<br/>You can also download a CSV version of this table [here](https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv). +>This information last updated on June 20th, 2022.<br/>You can also download a CSV version of this table [here](https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv). ><br/> | Product name | String ID | GUID | Service plans included | Service plans included (friendly names) | When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic | Dynamics 365 Field Service Viral Trial | Dynamics_365_Field_Service_Enterprise_viral_trial | 29fcd665-d8d1-4f34-8eed-3811e3fca7b3 | CUSTOMER_VOICE_DYN365_VIRAL_TRIAL (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>DYN365_FS_ENTERPRISE_VIRAL_TRIAL (20d1455b-72b2-4725-8354-a177845ab77d)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>POWER_APPS_DYN365_VIRAL_TRIAL (54b37829-818e-4e3c-a08a-3ea66ab9b45d)<br/>POWER_AUTOMATE_DYN365_VIRAL_TRIAL (81d4ecb8-0481-42fb-8868-51536c5aceeb) | Customer Voice for Dynamics 365 vTrial (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>Dynamics 365 Field Service Enterprise vTrial (20d1455b-72b2-4725-8354-a177845ab77d)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Power Apps for Dynamics 365 vTrial (54b37829-818e-4e3c-a08a-3ea66ab9b45d)<br/>Power Automate for Dynamics 365 vTrial (81d4ecb8-0481-42fb-8868-51536c5aceeb) | | Dynamics 365 Finance | DYN365_FINANCE | 55c9eb4e-c746-45b4-b255-9ab6b19d5c62 | DYN365_CDS_FINANCE (e95d7060-d4d9-400a-a2bd-a244bf0b609e)<br/>DYN365_REGULATORY_SERVICE (c7657ae3-c0b0-4eed-8c1d-6a7967bd9c65)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>D365_Finance (9f0e1b4e-9b33-4300-b451-b2c662cd4ff7)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) | Common Data Service for Dynamics 365 Finance (e95d7060-d4d9-400a-a2bd-a244bf0b609e)<br/>Dynamics 365 for Finance and Operations, Enterprise edition - Regulatory Service (c7657ae3-c0b0-4eed-8c1d-6a7967bd9c65)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Dynamics 365 for Finance (9f0e1b4e-9b33-4300-b451-b2c662cd4ff7)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) | | Dynamics 365 for Case Management Enterprise Edition | DYN365_ENTERPRISE_CASE_MANAGEMENT | d39fb075-21ae-42d0-af80-22a2599749e0 | DYN365_ENTERPRISE_CASE_MANAGEMENT (2822a3a1-9b8f-4432-8989-e11669a60dc8)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) | Dynamics 365 for Case Management (2822a3a1-9b8f-4432-8989-e11669a60dc8)<br/>Microsoft Social Engagement (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Project Online Essentials (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) |-| Dynamics 365 for Customer Service Enterprise Edition | DYN365_ENTERPRISE_CUSTOMER_SERVICE | 749742bf-0d37-4158-a120-33567104deeb | D365_CSI_EMBED_CSEnterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>DYN365_ENTERPRISE_CUSTOMER_SERVICE (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Forms_Pro_Service (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72) | Dynamics 365 Customer Service Insights for CS Enterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>Dynamics 365 for Customer Service (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Dynamics 365 Customer Voice for Customer Service Enterprise (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>Project Online Essentials (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>Retired - Microsoft Social Engagement (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72) | +| Dynamics 365 for Customer Service Enterprise Edition | DYN365_ENTERPRISE_CUSTOMER_SERVICE | 749742bf-0d37-4158-a120-33567104deeb | D365_CSI_EMBED_CSEnterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>DYN365_ENTERPRISE_CUSTOMER_SERVICE (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Forms_Pro_Service (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) | Dynamics 365 Customer Service Insights for CS Enterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>Dynamics 365 for Customer Service (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Microsoft Dynamics 365 Customer Voice for Customer Service Enterprise (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>Microsoft Social Engagement (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Project Online Essentials (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) | +| Dynamics 365 for Field Service Attach to Qualifying Dynamics 365 Base Offer | D365_FIELD_SERVICE_ATTACH | a36cdaa2-a806-4b6e-9ae0-28dbd993c20e | D365_FIELD_SERVICE_ATTACH (55c9148b-d5f0-4101-b5a0-b2727cfc0916)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318) | Dynamics 365 for Field Service Attach (55c9148b-d5f0-4101-b5a0-b2727cfc0916)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318) | | DYNAMICS 365 FOR FINANCIALS BUSINESS EDITION | DYN365_FINANCIALS_BUSINESS_SKU | cc13a803-544e-4464-b4e4-6d6169a138fa | DYN365_FINANCIALS_BUSINESS (920656a2-7dd8-4c83-97b6-a356414dbd36)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b) |FLOW FOR DYNAMICS 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>POWERAPPS FOR DYNAMICS 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>DYNAMICS 365 FOR FINANCIALS (920656a2-7dd8-4c83-97b6-a356414dbd36) | | Dynamics 365 for Marketing Business Edition | DYN365_BUSINESS_MARKETING | 238e2f8d-e429-4035-94db-6926be4ffe7b | DYN365_BUSINESS_Marketing (393a0c96-9ba1-4af0-8975-fa2f853a25ac)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318) | Dynamics 365 Marketing (393a0c96-9ba1-4af0-8975-fa2f853a25ac)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318) |+| Dynamics 365 for Marketing USL | D365_MARKETING_USER | 4b32a493-9a67-4649-8eb9-9fc5a5f75c12 | DYN365_MARKETING_MSE_USER (2824c69a-1ac5-4397-8592-eae51cb8b581)<br/>DYN365_MARKETING_USER (5d7a6abc-eebd-46ab-96e1-e4a2f54a2248)<br/>Forms_Pro_Marketing (76366ba0-d230-47aa-8087-b6d55dae454f)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MCOMEETBASIC (9974d6cf-cd24-4ba2-921c-e2aa687da846) | Dynamics 365 for Marketing MSE User (2824c69a-1ac5-4397-8592-eae51cb8b581)<br/>Dynamics 365 for Marketing USL (5d7a6abc-eebd-46ab-96e1-e4a2f54a2248)<br/>Microsoft Dynamics 365 Customer Voice for Marketing (76366ba0-d230-47aa-8087-b6d55dae454f)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Teams Audio Conferencing with dial-out to select geographies (9974d6cf-cd24-4ba2-921c-e2aa687da846) | | DYNAMICS 365 FOR SALES AND CUSTOMER SERVICE ENTERPRISE EDITION | DYN365_ENTERPRISE_SALES_CUSTOMERSERVICE | 8edc2cf8-6438-4fa9-b6e3-aa1660c640cc | DYN365_ENTERPRISE_P1 (d56f3deb-50d8-465a-bedb-f079817ccac1)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014) |DYNAMICS 365 CUSTOMER ENGAGEMENT PLAN (d56f3deb-50d8-465a-bedb-f079817ccac1)<br/>FLOW FOR DYNAMICS 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>MICROSOFT SOCIAL ENGAGEMENT - SERVICE DISCONTINUATION (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>POWERAPPS FOR DYNAMICS 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>PROJECT ONLINE ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINT ONLINE (PLAN 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>OFFICE ONLINE (e95bec33-7c88-4a70-8e19-b10bd9d0c014) | | DYNAMICS 365 FOR SALES ENTERPRISE EDITION | DYN365_ENTERPRISE_SALES | 1e1a282c-9c54-43a2-9310-98ef728faace | DYN365_ENTERPRISE_SALES (2da8e897-7791-486b-b08f-cc63c8129df7)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014) | DYNAMICS 365 FOR SALES (2da8e897-7791-486b-b08f-cc63c8129df7)<br/>FLOW FOR DYNAMICS 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba)<br/>MICROSOFT SOCIAL ENGAGEMENT - SERVICE DISCONTINUATION (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>POWERAPPS FOR DYNAMICS 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>PROJECT ONLINE ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINT ONLINE (PLAN 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>OFFICE ONLINE (e95bec33-7c88-4a70-8e19-b10bd9d0c014) | | Dynamics 365 For Sales Professional | D365_SALES_PRO | be9f9771-1c64-4618-9907-244325141096 | DYN365_SALES_PRO (88d83950-ff78-4e85-aa66-abfc787f8090)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>POWERAPPS_SALES_PRO (6f9f70ce-138d-49f8-bb8b-2e701b7dde75)<br/>FLOW_SALES_PRO (f944d685-f762-4371-806d-a1f48e5bea13)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72) | Dynamics 365 for Sales Professional (88d83950-ff78-4e85-aa66-abfc787f8090)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Power Apps for Sales Pro (6f9f70ce-138d-49f8-bb8b-2e701b7dde75)<br/>Power Automate for Sales Pro (f944d685-f762-4371-806d-a1f48e5bea13)<br/>Project Online Essentials (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72) | When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic | Microsoft 365 A5 without Audio Conferencing for students use benefit | M365EDU_A5_NOPSTNCONF_STUUSEBNFT | 81441ae1-0b31-4185-a6c0-32b6b84d419f| AAD_BASIC_EDU (1d0f309f-fdf9-4b2a-9ae7-9c48b91f1426)<br/>AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>AAD_PREMIUM_P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>DYN365_CDS_O365_P3 (28b0fa46-c39a-4188-89e2-58e979a6b014)<br/>EducationAnalyticsP1 (a9b86446-fa4e-498f-a92a-41b447e03337)<br/>EXCHANGE_S_ENTERPRISE (efb87545-963c-4e0d-99df-69c6916d9eb0)<br/>Content_Explorer (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>MIP_S_CLP1 (5136a095-5cf0-4aff-bec3-e84448b38ea5)<br/>INTUNE_EDU (da24caf9-af8e-485c-b7c8-e73336da2693)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>MTP (bf28f719-7844-4079-9c78-c1307898e192)<br/>RMS_S_ENTERPRISE (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>MFA_PREMIUM (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>ADALLOM_S_STANDALONE (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>ATA (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>OFFICE_FORMS_PLAN_2 (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>KAIZALA_STANDALONE (0898bdbb-73b0-471a-81e5-20f1fe4dd66e)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Deskless (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>STREAM_O365_E3 (9e700747-8b1d-45e5-ab8d-ef187ceec156)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>MINECRAFT_EDUCATION_EDITION (4c246bbc-f513-4311-beff-eba54c353256)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>ADALLOM_S_O365 (8c098270-9dd4-4350-9b30-ba4703f3b36b)<br/>SAFEDOCS (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7)<br/>SHAREPOINTWAC_EDU (e03c7e47-402c-463c-ab25-949079bedb21)<br/>POWERAPPS_O365_P2 (c68f8d98-5534-41c8-bf36-22fa496fa792)<br/>FLOW_O365_P2 (76846ad7-7776-4c40-a281-a386362dd1b9)<br/>PROJECT_O365_P3 (b21a6b06-1988-436e-a07b-51ec6d9f52ad)<br/>SCHOOL_DATA_SYNC_P2 (500b6a2a-7a50-4f40-b5f9-160e5b8c2f48)<br/>SHAREPOINTENTERPRISE_EDU (63038b2c-28d0-45f6-bc36-33062963b498)<br/>MCOSTANDARD (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>BPOS_S_TODO_2 (c87f142c-d1e9-4363-8630-aaea9c4d9ae5)<br/>UNIVERSAL_PRINT_NO_SEEDING (b67adbaf-a096-42c9-967e-5a84edbe0086)<br/>WHITEBOARD_PLAN3 (4a51bca5-1eff-43f5-878c-177680f191af)<br/>Virtualization Rights for Windows 10 (E3/E5+VDA) (e7c91390-7625-45be-94e0-e16907e03118)<br/>YAMMER_EDU (2078e8df-cff6-4290-98cb-5408261a760a) | Azure Active Directory Basic for EDU (1d0f309f-fdf9-4b2a-9ae7-9c48b91f1426)<br/>Azure Active Directory Premium P1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Azure Active Directory Premium P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>Common Data Service - O365 P3 (28b0fa46-c39a-4188-89e2-58e979a6b014)<br/>Education Analytics (a9b86446-fa4e-498f-a92a-41b447e03337)<br/>Exchange Online (Plan 2) (efb87545-963c-4e0d-99df-69c6916d9eb0)<br/>Information Protection and Governance Analytics - Premium) (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>Information Protection for Office 365 ΓÇô Standard (5136a095-5cf0-4aff-bec3-e84448b38ea5)<br/>Intune for Education (da24caf9-af8e-485c-b7c8-e73336da2693)<br/>Microsoft 365 Apps for enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>Microsoft 365 Defender (bf28f719-7844-4079-9c78-c1307898e192)<br/>Microsoft Azure Active Directory Rights (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>Microsoft Azure Multi-Factor Authentication (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>Microsoft Cloud App Security (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>Microsoft Defender for Identity (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Microsoft Forms (Plan 2) (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>Microsoft Kaizala (0898bdbb-73b0-471a-81e5-20f1fe4dd66e)<br/>Microsoft Planner (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Microsoft StaffHub (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>Microsoft Stream for O365 E3 SKU (9e700747-8b1d-45e5-ab8d-ef187ceec156)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Minecraft Education Edition (4c246bbc-f513-4311-beff-eba54c353256)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Office 365 Advanced Security Management (8c098270-9dd4-4350-9b30-ba4703f3b36b)<br/>Office 365 SafeDocs (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7)<br/>Office for the web (Education) (e03c7e47-402c-463c-ab25-949079bedb21)<br/>Power Apps for Office 365 (c68f8d98-5534-41c8-bf36-22fa496fa792)<br/>Power Automate for Office 365 (76846ad7-7776-4c40-a281-a386362dd1b9)<br/>Project for Office (Plan E5) (b21a6b06-1988-436e-a07b-51ec6d9f52ad)<br/>School Data Sync (Plan 2) (500b6a2a-7a50-4f40-b5f9-160e5b8c2f48)<br/>SharePoint Plan 2 for EDU (63038b2c-28d0-45f6-bc36-33062963b498)<br/>Skype for Business Online (Plan 2) (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>To-Do (Plan 2) (c87f142c-d1e9-4363-8630-aaea9c4d9ae5)<br/>Universal Print Without Seeding (b67adbaf-a096-42c9-967e-5a84edbe0086)<br/>Whiteboard (Plan 3) (4a51bca5-1eff-43f5-878c-177680f191af)<br/>Windows 10 Enterprise (New) (e7c91390-7625-45be-94e0-e16907e03118)<br/>Yammer for Academic (2078e8df-cff6-4290-98cb-5408261a760a) | | MICROSOFT 365 APPS FOR BUSINESS | O365_BUSINESS | cdd28e44-67e3-425e-be4c-737fab2899d3 | FORMS_PLAN_E1 (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICE_BUSINESS (094e7854-93fc-4d55-b2c0-3ab5369ebdc1)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) | MICROSOFT FORMS (PLAN E1) (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICE 365 BUSINESS (094e7854-93fc-4d55-b2c0-3ab5369ebdc1)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>OFFICE ONLINE (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) | | MICROSOFT 365 APPS FOR BUSINESS | SMB_BUSINESS | b214fe43-f5a3-4703-beeb-fa97188220fc | FORMS_PLAN_E1 (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICE_BUSINESS (094e7854-93fc-4d55-b2c0-3ab5369ebdc1)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) | MICROSOFT FORMS (PLAN E1) (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICE 365 BUSINESS (094e7854-93fc-4d55-b2c0-3ab5369ebdc1)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>OFFICE ONLINE (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) |-| MICROSOFT 365 APPS FOR ENTERPRISE | OFFICESUBSCRIPTION | c2273bd0-dff7-4215-9ef5-2c7bcfb06425 | FORMS_PLAN_E1 (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) | MICROSOFT FORMS (PLAN E1) (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>OFFICE ONLINE (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97) | +| Microsoft 365 Apps for enterprise | OFFICESUBSCRIPTION | c2273bd0-dff7-4215-9ef5-2c7bcfb06425 | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>FORMS_PLAN_E1 (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>WHITEBOARD_PLAN2 (94a54592-cd8b-425e-87c6-97868b000b91)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30) | Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft 365 Apps for enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>Microsoft Forms (Plan E1) (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>OneDrive for Business (Plan 1) (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>Whiteboard (Plan 2) (94a54592-cd8b-425e-87c6-97868b000b91)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft 365 Apps for enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>OneDrive for Business (Plan 1) (13696edf-5a08-49f6-8134-03083ed8ba30) | | Microsoft 365 Apps for enterprise (device) | OFFICE_PROPLUS_DEVICE1 | ea4c5ec8-50e3-4193-89b9-50da5bd4cdc7 | OFFICE_PROPLUS_DEVICE (3c994f28-87d5-4273-b07a-eb6190852599) | Microsoft 365 Apps for Enterprise (Device) (3c994f28-87d5-4273-b07a-eb6190852599) | | Microsoft 365 Apps for Faculty | OFFICESUBSCRIPTION_FACULTY | 12b8c807-2e20-48fc-b453-542b6ee9d171 | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>RMS_S_BASIC (31cf2cfc-6b0d-4adc-a336-88b724ed8122)<br/>OFFICE_FORMS_PLAN_2 (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTWAC_EDU (e03c7e47-402c-463c-ab25-949079bedb21)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>WHITEBOARD_PLAN2 (94a54592-cd8b-425e-87c6-97868b000b91) | Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft 365 Apps for Enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>Microsoft Azure Rights Management Service (31cf2cfc-6b0d-4adc-a336-88b724ed8122)<br/>Microsoft Forms (Plan 2) (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Office for the Web for Education (e03c7e47-402c-463c-ab25-949079bedb21)<br/>OneDrive for Business (Plan 1) (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>Whiteboard (Plan 2) (94a54592-cd8b-425e-87c6-97868b000b91) | | Microsoft 365 Apps for Students | OFFICESUBSCRIPTION_STUDENT | c32f9321-a627-406d-a114-1f9c81aaafac | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>OFFICE_FORMS_PLAN_2 (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTWAC_EDU (e03c7e47-402c-463c-ab25-949079bedb21)<br/>ONEDRIVESTANDARD (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>WHITEBOARD_PLAN2 (94a54592-cd8b-425e-87c6-97868b000b91)<br/>RMS_S_BASIC (31cf2cfc-6b0d-4adc-a336-88b724ed8122) | Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft 365 Apps for Enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>Microsoft Forms (Plan 2) (9b5de886-f035-4ff2-b3d8-c9127bea3620)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Office for the Web for Education (e03c7e47-402c-463c-ab25-949079bedb21)<br/>OneDrive for Business (Plan 1) (13696edf-5a08-49f6-8134-03083ed8ba30)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>Whiteboard (Plan 2) (94a54592-cd8b-425e-87c6-97868b000b91<br/>Microsoft Azure Rights Management Service (31cf2cfc-6b0d-4adc-a336-88b724ed8122) | When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic | Microsoft 365 E5 Security for EMS E5 | IDENTITY_THREAT_PROTECTION_FOR_EMS_E5 | 44ac31e7-2999-4304-ad94-c948886741d4 | WINDEFATP (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>SAFEDOCS (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7) | MICROSOFT DEFENDER FOR ENDPOINT (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Office 365 SafeDocs (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7) | | Microsoft 365 E5 without Audio Conferencing | SPE_E5_NOPSTNCONF | cd2925a3-5076-4233-8931-638a8c94f773 | AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>AAD_PREMIUM_P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>RMS_S_PREMIUM (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>RMS_S_PREMIUM2 (5689bec4-755d-4753-8b61-40975025187c)<br/>DYN365_CDS_O365_P3 (28b0fa46-c39a-4188-89e2-58e979a6b014)<br/>CDS_O365_P3 (afa73018-811e-46e9-988f-f75d2b1b8430)<br/>LOCKBOX_ENTERPRISE (9f431833-0334-42de-a7dc-70aa40db46db)<br/>MIP_S_Exchange (cd31b152-6326-4d1b-ae1b-997b625182e6)<br/>EXCHANGE_S_ENTERPRISE (efb87545-963c-4e0d-99df-69c6916d9eb0)<br/>GRAPH_CONNECTORS_SEARCH_INDEX (a6520331-d7d4-4276-95f5-15c0933bc757)<br/>INFORMATION_BARRIERS (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Content_Explorer (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>ContentExplorer_Standard (2b815d45-56e4-4e3a-b65c-66cb9175b560)<br/>MIP_S_CLP2 (efb0351d-3b08-4503-993d-383af8de41e3)<br/>MIP_S_CLP1 (5136a095-5cf0-4aff-bec3-e84448b38ea5)<br/>MYANALYTICS_P2 (33c4f319-9bdd-48d6-9c4d-410b750a4a5a)<br/>M365_ADVANCED_AUDITING (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>OFFICESUBSCRIPTION (43de0ff5-c92c-492b-9116-175376d08c38)<br/>MICROSOFT_COMMUNICATION_COMPLIANCE (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>MTP (bf28f719-7844-4079-9c78-c1307898e192)<br/>MCOEV (4828c8ec-dc2e-4779-b502-87ac9ce28ab7)<br/>RMS_S_ENTERPRISE (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>MFA_PREMIUM (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>MICROSOFTBOOKINGS (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>ADALLOM_S_STANDALONE (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>COMMUNICATIONS_DLP (6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>CUSTOMER_KEY (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>DATA_INVESTIGATIONS (46129a58-a698-46f0-aa5b-17f6586297d9)<br/>WINDEFATP (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>ATA (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>MICROSOFTENDPOINTDLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>EXCEL_PREMIUM (531ee2f8-b1cb-453b-9c21-d2180d014ca5)<br/>FORMS_PLAN_E5 (e212cbc7-0961-4c40-9825-01117710dcb1)<br/>INFO_GOVERNANCE (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>INSIDER_RISK (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>KAIZALA_STANDALONE (0898bdbb-73b0-471a-81e5-20f1fe4dd66e)<br/>ML_CLASSIFICATION (d2d51368-76c9-4317-ada2-a12c004c432f)<br/> EXCHANGE_ANALYTICS (34c0d7a0-a70f-4668-9238-47f9fc208882)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>RECORDS_MANAGEMENT (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Deskless (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>STREAM_O365_E5 (6c6042f5-6f01-4d67-b8c1-eb99d36eed3e)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Nucleus (db4d623d-b514-490b-b7ef-8885eee514de)<br/>EQUIVIO_ANALYTICS (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>ADALLOM_S_O365 (8c098270-9dd4-4350-9b30-ba4703f3b36b)<br/>PAM_ENTERPRISE (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>SAFEDOCS (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>POWERAPPS_O365_P3 (9c0dab89-a30c-4117-86e7-97bda240acd2)<br/>FLOW_O365_P3 (07699545-9485-468e-95b6-2fca3738be01)<br/>BI_AZURE_P2 (70d33638-9c74-4d01-bfd3-562de28bd4ba)<br/>POWER_VIRTUAL_AGENTS_O365_P3 (ded3d325-1bdc-453e-8432-5bac26d7a014)<br/>RREMIUM_ENCRYPTION (617b097b-4b93-4ede-83de-5f075bb5fb2f)<br/>PROJECT_O365_P3 (b21a6b06-1988-436e-a07b-51ec6d9f52ad)<br/>COMMUNICATIONS_COMPLIANCE (41fcdd7d-4733-4863-9cf4-c65b83ce2df4)<br/>INSIDER_RISK_MANAGEMENT (9d0c4ee5-e4a1-4625-ab39-d82b619b1a34)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>MCOSTANDARD (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>BPOS_S_TODO_3 (3fb82609-8c27-4f7b-bd51-30634711ee67)<br/>UNIVERSAL_PRINT_01 (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>VIVA_LEARNING_SEEDED (b76fb638-6ba6-402a-b9f9-83d28acb3d86)<br/>WHITEBOARD_PLAN3 (4a51bca5-1eff-43f5-878c-177680f191af)<br/>WIN10_PRO_ENT_SUB (21b439ba-a0ca-424f-a6cc-52f954a5b111)<br/>WINDOWSUPDATEFORBUSINESS_DEPLOYMENTSERVICE (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>YAMMER_ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653) | Azure Active Directory Premium P1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Azure Active Directory Premium P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>Azure Information Protection Premium P1 (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>Azure Information Protection Premium P2 (5689bec4-755d-4753-8b61-40975025187c)<br/>Common Data Service - O365 P3 (28b0fa46-c39a-4188-89e2-58e979a6b014)<br/>Common Data Service for Teams_P3 (afa73018-811e-46e9-988f-f75d2b1b8430)<br/>Customer Lockbox (9f431833-0334-42de-a7dc-70aa40db46db)<br/>Data Classification in Microsoft 365 (cd31b152-6326-4d1b-ae1b-997b625182e6)<br/>Exchange Online (Plan 2) (efb87545-963c-4e0d-99df-69c6916d9eb0)<br/>Graph Connectors Search with Index (a6520331-d7d4-4276-95f5-15c0933bc757)<br/>Information Barriers (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Information Protection and Governance Analytics ΓÇô Premium (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>Information Protection and Governance Analytics ΓÇô Standard (2b815d45-56e4-4e3a-b65c-66cb9175b560)<br/>Information Protection for Office 365 ΓÇô Premium (efb0351d-3b08-4503-993d-383af8de41e3)<br/>Information Protection for Office 365 ΓÇô Standard (5136a095-5cf0-4aff-bec3-e84448b38ea5)<br/>Insights by MyAnalytics (33c4f319-9bdd-48d6-9c4d-410b750a4a5a)<br/>Microsoft 365 Advanced Auditing (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>Microsoft 365 Apps for Enterprise (43de0ff5-c92c-492b-9116-175376d08c38)<br/>Microsoft 365 Communication Compliance (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>Microsoft 365 Defender (bf28f719-7844-4079-9c78-c1307898e192)<br/>Microsoft 365 Phone System (4828c8ec-dc2e-4779-b502-87ac9ce28ab7)<br/>Microsoft Azure Active Directory Rights (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>Microsoft Azure Multi-Factor Authentication (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>Microsoft Bookings (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>Microsoft Cloud App Security (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>Microsoft Communications DLP (6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>Microsoft Customer Key (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>Microsoft Data Investigations (46129a58-a698-46f0-aa5b-17f6586297d9)<br/>Microsoft Defender for Endpoint (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>Microsoft Defender for Identity (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Microsoft Endpoint DLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>Microsoft Excel Advanced Analytics (531ee2f8-b1cb-453b-9c21-d2180d014ca5)<br/>Microsoft Forms (Plan E5) (e212cbc7-0961-4c40-9825-01117710dcb1)<br/>Microsoft Information Governance (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>Microsoft Insider Risk Management (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>Microsoft Kaizala (0898bdbb-73b0-471a-81e5-20f1fe4dd66e)<br/>Microsoft ML-Based Classification (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>Microsoft MyAnalytics (Full) (34c0d7a0-a70f-4668-9238-47f9fc208882)<br/>Microsoft Planner (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>Microsoft Records Management (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Microsoft StaffHub (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>Microsoft Stream for Office 365 E5 (6c6042f5-6f01-4d67-b8c1-eb99d36eed3e)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Nucleus (db4d623d-b514-490b-b7ef-8885eee514de)<br/>Office 365 Advanced eDiscovery (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>Office 365 Advanced Security Management (8c098270-9dd4-4350-9b30-ba4703f3b36b)<br/>Office 365 Privileged Access Management (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>Office 365 SafeDocs (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Power Apps for Office 365 (Plan 3) (9c0dab89-a30c-4117-86e7-97bda240acd2)<br/>Power Automate for Office 365 (07699545-9485-468e-95b6-2fca3738be01)<br/>Power BI Pro (70d33638-9c74-4d01-bfd3-562de28bd4ba)<br/>Power Virtual Agents for Office 365 P3 (ded3d325-1bdc-453e-8432-5bac26d7a014)<br/>Premium Encryption in Office 365 (617b097b-4b93-4ede-83de-5f075bb5fb2f)<br/>Project for Office (Plan E5) (b21a6b06-1988-436e-a07b-51ec6d9f52ad)<br/>Microsoft Communications Compliance (41fcdd7d-4733-4863-9cf4-c65b83ce2df4)<br/>Microsoft Insider Risk Management (9d0c4ee5-e4a1-4625-ab39-d82b619b1a34)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>Skype for Business Online (Plan 2) (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>To-Do (Plan 3) (3fb82609-8c27-4f7b-bd51-30634711ee67)<br/>Universal Print (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>Viva Learning Seeded (b76fb638-6ba6-402a-b9f9-83d28acb3d86)<br/>Whiteboard (Plan 3) (4a51bca5-1eff-43f5-878c-177680f191af)<br/>Windows 10 Enterprise (Original) (21b439ba-a0ca-424f-a6cc-52f954a5b111)<br/>Windows Update for Business Deployment Service (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>Yammer Enterprise (7547a3fe-08ee-4ccb-b430-5077c5041653) | | Microsoft 365 F1 | M365_F1 | 44575883-256e-4a79-9da4-ebe9acabe2b2 | AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>RMS_S_PREMIUM (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>RMS_S_ENTERPRISE_GOV (6a76346d-5d6e-4051-9fe3-ed3f312b5597)<br/>ADALLOM_S_DISCOVERY (932ad362-64a8-4783-9106-97849a1a30b9)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MFA_PREMIUM (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>STREAM_O365_K (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTDESKLESS (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>MCOIMP (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>YAMMER_ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653) | Azure Active Directory Premium P1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Azure Information Protection Premium P1 (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>Azure Rights Management (6a76346d-5d6e-4051-9fe3-ed3f312b5597)<br/>Cloud App Security Discovery (932ad362-64a8-4783-9106-97849a1a30b9)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Azure Multi-Factor Authentication (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>Microsoft Planner (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>Microsoft Stream for O365 K SKU (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SharePoint Online Kiosk (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>Skype for Business Online (Plan 1) (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>Yammer Enterprise (7547a3fe-08ee-4ccb-b430-5077c5041653) |-| Microsoft 365 F3 | SPE_F1 | 66b55226-6b4f-492c-910c-a3b7a3c9d993 | AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>RMS_S_PREMIUM (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>ADALLOM_S_DISCOVERY (932ad362-64a8-4783-9106-97849a1a30b9)<br/>DYN365_CDS_O365_F1 (ca6e61ec-d4f4-41eb-8b88-d96e0e14323f)<br/>CDS_O365_F1 (90db65a7-bf11-4904-a79f-ef657605145b)<br/>EXCHANGE_S_DESKLESS (4a82b400-a79f-41a4-b4e2-e94f5787b113)<br/>RMS_S_ENTERPRISE (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>MFA_PREMIUM (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>MICROSOFTBOOKINGS (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>FORMS_PLAN_K (f07046bd-2a3c-4b96-b0be-dea79d7cbfb8)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>KAIZALA_O365_P1 (73b2a583-6a59-42e3-8e83-54db46bc3278)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Deskless (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>STREAM_O365_K (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>OFFICEMOBILE_SUBSCRIPTION (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>POWERAPPS_O365_S1 (e0287f9f-e222-4f98-9a83-f379e249159a)<br/>FLOW_O365_S1 (bd91b1a4-9f94-4ecf-b45b-3a65e5c8128a)<br/>POWER_VIRTUAL_AGENTS_O365_F1 (ba2fdb48-290b-4632-b46a-e4ecc58ac11a)<br/>PROJECT_O365_F3 (7f6f28c2-34bb-4d4b-be36-48ca2e77e1ec)<br/>SHAREPOINTDESKLESS (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>MCOIMP (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>BPOS_S_TODO_FIRSTLINE (80873e7a-cd2a-4e67-b061-1b5381a676a5)<br/>UNIVERSAL_PRINT_01 (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>WHITEBOARD_FIRSTLINE1 (36b29273-c6d0-477a-aca6-6fbe24f538e3)<br/>WIN10_ENT_LOC_F1 (e041597c-9c7f-4ed9-99b0-2663301576f7)<br/>WINDOWSUPDATEFORBUSINESS_DEPLOYMENTSERVICE (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>YAMMER_ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653) | Azure Active Directory Premium P1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Azure Information Protection Premium P1 (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>Cloud App Security Discovery (932ad362-64a8-4783-9106-97849a1a30b9)<br/>Common Data Service - O365 F1 (ca6e61ec-d4f4-41eb-8b88-d96e0e14323f)<br/>Common Data Service for Teams_F1 (90db65a7-bf11-4904-a79f-ef657605145b)<br/>Exchange Online Kiosk (4a82b400-a79f-41a4-b4e2-e94f5787b113)<br/>Microsoft Azure Active Directory Rights (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>Microsoft Azure Multi-Factor Authentication (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>Microsoft Bookings (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>Microsoft Forms (Plan F1) (f07046bd-2a3c-4b96-b0be-dea79d7cbfb8)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>Microsoft Kaizala Pro Plan 1 (73b2a583-6a59-42e3-8e83-54db46bc3278)<br/>Microsoft Planner (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Microsoft StaffHub (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>Microsoft Stream for O365 K SKU (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Office for the web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Office Mobile Apps for Office 365 (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>Power Apps for Office 365 K1 (e0287f9f-e222-4f98-9a83-f379e249159a)<br/>Power Automate for Office 365 K1 (bd91b1a4-9f94-4ecf-b45b-3a65e5c8128a)<br/>Power Virtual Agents for Office 365 F1 (ba2fdb48-290b-4632-b46a-e4ecc58ac11a)<br/>Project for Office (Plan F) (7f6f28c2-34bb-4d4b-be36-48ca2e77e1ec)<br/>SharePoint Kiosk (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>Skype for Business Online (Plan 1) (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>To-Do (Firstline) (80873e7a-cd2a-4e67-b061-1b5381a676a5)<br/>Universal Print (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>Whiteboard (Firstline) (36b29273-c6d0-477a-aca6-6fbe24f538e3)<br/>Windows 10 Enterprise E3 (local only) (e041597c-9c7f-4ed9-99b0-2663301576f7)<br/>Windows Update for Business Deployment Service (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>Yammer Enterprise (7547a3fe-08ee-4ccb-b430-5077c5041653) | +| Microsoft 365 F3 | SPE_F1 | 66b55226-6b4f-492c-910c-a3b7a3c9d993 | RMS_S_ENTERPRISE (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>CDS_O365_F1 (90db65a7-bf11-4904-a79f-ef657605145b)<br/>EXCHANGE_S_DESKLESS (4a82b400-a79f-41a4-b4e2-e94f5787b113)<br/>MICROSOFTBOOKINGS (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>FORMS_PLAN_K (f07046bd-2a3c-4b96-b0be-dea79d7cbfb8)<br/>KAIZALA_O365_P1 (73b2a583-6a59-42e3-8e83-54db46bc3278)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Deskless (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Nucleus (db4d623d-b514-490b-b7ef-8885eee514de)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>OFFICEMOBILE_SUBSCRIPTION (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>PROJECT_O365_F3 (7f6f28c2-34bb-4d4b-be36-48ca2e77e1ec)<br/>SHAREPOINTDESKLESS (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>MCOIMP (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>BPOS_S_TODO_FIRSTLINE (80873e7a-cd2a-4e67-b061-1b5381a676a5)<br/>VIVA_LEARNING_SEEDED (b76fb638-6ba6-402a-b9f9-83d28acb3d86)<br/>WHITEBOARD_FIRSTLINE1 (36b29273-c6d0-477a-aca6-6fbe24f538e3)<br/>WIN10_ENT_LOC_F1 (e041597c-9c7f-4ed9-99b0-2663301576f7)<br/>YAMMER_ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653)<br/>UNIVERSAL_PRINT_01 (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>WINDOWSUPDATEFORBUSINESS_DEPLOYMENTSERVICE (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>RMS_S_PREMIUM (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>DYN365_CDS_O365_F1 (ca6e61ec-d4f4-41eb-8b88-d96e0e14323f)<br/>MFA_PREMIUM (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>ADALLOM_S_DISCOVERY (932ad362-64a8-4783-9106-97849a1a30b9)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>STREAM_O365_K (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>POWERAPPS_O365_S1 (e0287f9f-e222-4f98-9a83-f379e249159a)<br/>FLOW_O365_S1 (bd91b1a4-9f94-4ecf-b45b-3a65e5c8128a)<br/>POWER_VIRTUAL_AGENTS_O365_F1 (ba2fdb48-290b-4632-b46a-e4ecc58ac11a) | Azure Rights Management (bea4c11e-220a-4e6d-8eb8-8ea15d019f90)<br/>Common Data Service for Teams (90db65a7-bf11-4904-a79f-ef657605145b)<br/>Exchange Online Kiosk (4a82b400-a79f-41a4-b4e2-e94f5787b113)<br/>Microsoft Bookings (199a5c09-e0ca-4e37-8f7c-b05d533e1ea2)<br/>Microsoft Forms (Plan F1) (f07046bd-2a3c-4b96-b0be-dea79d7cbfb8)<br/>Microsoft Kaizala Pro (73b2a583-6a59-42e3-8e83-54db46bc3278)<br/>Microsoft Planner (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>Microsoft Search (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>Microsoft StaffHub (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Mobile Device Management for Office 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>Nucleus (db4d623d-b514-490b-b7ef-8885eee514de)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Office Mobile Apps for Office 365 (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>Project for Office (Plan F) (7f6f28c2-34bb-4d4b-be36-48ca2e77e1ec)<br/>SharePoint Kiosk (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>Skype for Business Online (Plan 1) (afc06cb0-b4f4-4473-8286-d644f70d8faf)<br/>Sway (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>To-Do (Firstline) (80873e7a-cd2a-4e67-b061-1b5381a676a5)<br/>Viva Learning Seeded (b76fb638-6ba6-402a-b9f9-83d28acb3d86)<br/>Whiteboard (Firstline) (36b29273-c6d0-477a-aca6-6fbe24f538e3)<br/>Windows 10 Enterprise E3 (Local Only) (e041597c-9c7f-4ed9-99b0-2663301576f7)<br/>Yammer Enterprise (7547a3fe-08ee-4ccb-b430-5077c5041653)<br/>Universal Print (795f6fe0-cc4d-4773-b050-5dde4dc704c9)<br/>Windows Update for Business Deployment Service (7bf960f6-2cd9-443a-8046-5dbff9558365)<br/>Azure Active Directory Premium P1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Azure Information Protection Premium P1 (6c57d4b6-3b23-47a5-9bc9-69f17b4947b3)<br/>Common Data Service (ca6e61ec-d4f4-41eb-8b88-d96e0e14323f)<br/>Microsoft Azure Multi-Factor Authentication (8a256a2b-b617-496d-b51b-e76466e88db0)<br/>Microsoft Defender for Cloud Apps Discovery (932ad362-64a8-4783-9106-97849a1a30b9)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5)<br/>Microsoft Stream for Office 365 F3 (3ffba0d2-38e5-4d5e-8ec0-98f2b05c09d9)<br/>Power Apps for Office 365 F3 (e0287f9f-e222-4f98-9a83-f379e249159a)<br/>Power Automate for Office 365 F3 (bd91b1a4-9f94-4ecf-b45b-3a65e5c8128a)<br/>Power Virtual Agents for Office 365 (ba2fdb48-290b-4632-b46a-e4ecc58ac11a) | | Microsoft 365 F5 Security Add-on | SPE_F5_SEC | 67ffe999-d9ca-49e1-9d2c-03fb28aa7a48 | MTP (bf28f719-7844-4079-9c78-c1307898e192)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>WINDEFATP (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>AAD_PREMIUM_P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>ADALLOM_S_STANDALONE (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>ATA (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f) | Microsoft 365 Defender (bf28f719-7844-4079-9c78-c1307898e192)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Microsoft Defender for Endpoint (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>Azure Active Directory Premium P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>Microsoft Defender for Cloud Apps (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>Microsoft Defender for Identity (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f) |-| Microsoft 365 F5 Security + Compliance Add-on | SPE_F5_SECCOMP | 32b47245-eb31-44fc-b945-a8b1576c439f | AAD_PREMIUM_P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>RMS_S_PREMIUM2 (5689bec4-755d-4753-8b61-40975025187c)<br/>LOCKBOX_ENTERPRISE (9f431833-0334-42de-a7dc-70aa40db46db)<br/>BPOS_S_DlpAddOn (9bec7e34-c9fa-40b7-a9d1-bd6d1165c7ed)<br/>EXCHANGE_S_ARCHIVE_ADDON (176a09a6-7ec5-4039-ac02-b2791c6ba793)<br/>INFORMATION_BARRIERS (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Content_Explorer (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>MIP_S_CLP2 (efb0351d-3b08-4503-993d-383af8de41e3)<br/>M365_ADVANCED_AUDITING (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>MICROSOFT_COMMUNICATION_COMPLIANCE (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>MTP (bf28f719-7844-4079-9c78-c1307898e192)<br/>COMMUNICATIONS_DLP (6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>CUSTOMER_KEY (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>DATA_INVESTIGATIONS (46129a58-a698-46f0-aa5b-17f6586297d9)<br/>ADALLOM_S_STANDALONE (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>WINDEFATP(871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>ATA (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>MICROSOFTENDPOINTDLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>INFO_GOVERNANCE (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>INSIDER_RISK (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>ML_CLASSIFICATION (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>RECORDS_MANAGEMENT (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>EQUIVIO_ANALYTICS (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>PAM_ENTERPRISE (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>PREMIUM_ENCRYPTION (617b097b-4b93-4ede-83de-5f075bb5fb2f) | Azure Active Directory Premium P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>Azure Information Protection Premium P2 (5689bec4-755d-4753-8b61-40975025187c)<br/>Customer Lockbox (9f431833-0334-42de-a7dc-70aa40db46db)<br/>Data Loss Prevention (9bec7e34-c9fa-40b7-a9d1-bd6d1165c7ed)<br/>Exchange Online Archiving (176a09a6-7ec5-4039-ac02-b2791c6ba793)<br/>Information Barriers (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Information Protection and Governance Analytics ΓÇô Premium (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>Information Protection for Office 365 ΓÇô Premium (efb0351d-3b08-4503-993d-383af8de41e3)<br/> Microsoft 365 Advanced Auditing (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>Microsoft 365 Communication Compliance (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>Microsoft 365 Defender (bf28f719-7844-4079-9c78-c1307898e192)<br/>Microsoft Communications DLP(6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>Microsoft Customer Key (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>Microsoft Data Investigations (46129a58-a698-46f0-aa5b-17f6586297d9)<br/> Microsoft Defender for Cloud Apps (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>Microsoft Defender for Endpoint (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>Microsoft Defender for Identity (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Microsoft Endpoint DLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>Microsoft Information Governance (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>Microsoft Insider Risk Management (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>Microsoft ML-Based Classification (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>Microsoft Records Management (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>Office 365 Advanced eDiscovery (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>Office 365 Privileged Access Management (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>Premium Encryption in Office 365 (617b097b-4b93-4ede-83de-5f075bb5fb2f) | +| Microsoft 365 F5 Security + Compliance Add-on | SPE_F5_SECCOMP | 32b47245-eb31-44fc-b945-a8b1576c439f | LOCKBOX_ENTERPRISE (9f431833-0334-42de-a7dc-70aa40db46db)<br/>BPOS_S_DlpAddOn (9bec7e34-c9fa-40b7-a9d1-bd6d1165c7ed)<br/>EXCHANGE_S_ARCHIVE_ADDON (176a09a6-7ec5-4039-ac02-b2791c6ba793)<br/>INFORMATION_BARRIERS (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Content_Explorer (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>MIP_S_CLP2 (efb0351d-3b08-4503-993d-383af8de41e3)<br/>M365_ADVANCED_AUDITING (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>MICROSOFT_COMMUNICATION_COMPLIANCE (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>MTP (bf28f719-7844-4079-9c78-c1307898e192)<br/>COMMUNICATIONS_DLP (6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>CUSTOMER_KEY (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>DATA_INVESTIGATIONS (46129a58-a698-46f0-aa5b-17f6586297d9)<br/>ATP_ENTERPRISE (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>THREAT_INTELLIGENCE (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>INFO_GOVERNANCE (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>INSIDER_RISK (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>ML_CLASSIFICATION (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>RECORDS_MANAGEMENT (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>EQUIVIO_ANALYTICS (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>PAM_ENTERPRISE (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>PREMIUM_ENCRYPTION (617b097b-4b93-4ede-83de-5f075bb5fb2f)<br/>WINDEFATP (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>MICROSOFTENDPOINTDLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>AAD_PREMIUM_P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>RMS_S_PREMIUM2 (5689bec4-755d-4753-8b61-40975025187c)<br/>ADALLOM_S_STANDALONE (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>ATA (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f) | Customer Lockbox (9f431833-0334-42de-a7dc-70aa40db46db)<br/>Data Loss Prevention (9bec7e34-c9fa-40b7-a9d1-bd6d1165c7ed)<br/>Exchange Online Archiving (176a09a6-7ec5-4039-ac02-b2791c6ba793)<br/>Information Barriers (c4801e8a-cb58-4c35-aca6-f2dcc106f287)<br/>Information Protection and Governance Analytics - Premium (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>Information Protection for Office 365 - Premium (efb0351d-3b08-4503-993d-383af8de41e3)<br/>Microsoft 365 Advanced Auditing (2f442157-a11c-46b9-ae5b-6e39ff4e5849)<br/>Microsoft 365 Communication Compliance (a413a9ff-720c-4822-98ef-2f37c2a21f4c)<br/>Microsoft 365 Defender (bf28f719-7844-4079-9c78-c1307898e192)<br/>Microsoft Communications DLP (6dc145d6-95dd-4191-b9c3-185575ee6f6b)<br/>Microsoft Customer Key (6db1f1db-2b46-403f-be40-e39395f08dbb)<br/>Microsoft Data Investigations (46129a58-a698-46f0-aa5b-17f6586297d9)<br/>Microsoft Defender for Office 365 (Plan 1) (f20fedf3-f3c3-43c3-8267-2bfdd51c0939)<br/>Microsoft Defender for Office 365 (Plan 2) (8e0c0a52-6a6c-4d40-8370-dd62790dcd70)<br/>Microsoft Information Governance (e26c2fcc-ab91-4a61-b35c-03cdc8dddf66)<br/>Microsoft Insider Risk Management (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>Microsoft ML-Based Classification (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>Microsoft Records Management (65cc641f-cccd-4643-97e0-a17e3045e541)<br/>Office 365 Advanced eDiscovery (4de31727-a228-4ec3-a5bf-8e45b5ca48cc)<br/>Office 365 Privileged Access Management (b1188c4c-1b36-4018-b48b-ee07604f6feb)<br/>Premium Encryption in Office 365 (617b097b-4b93-4ede-83de-5f075bb5fb2f)<br/>Microsoft Defender for Endpoint (871d91ec-ec1a-452b-a83f-bd76c7d770ef)<br/>Microsoft Endpoint DLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>Azure Active Directory Premium P2 (eec0eb4f-6444-4f95-aba0-50c24d67f998)<br/>Azure Information Protection Premium P2 (5689bec4-755d-4753-8b61-40975025187c)<br/>Microsoft Defender for Cloud Apps (2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2)<br/>Microsoft Defender for Identity (14ab5db5-e6c4-4b20-b4bc-13e36fd2227f) | | MICROSOFT FLOW FREE | FLOW_FREE | f30db892-07e9-47e9-837c-80727f46fd3d | DYN365_CDS_VIRAL (17ab22cd-a0b3-4536-910a-cb6eb12696c0)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>FLOW_P2_VIRAL (50e68c76-46c6-4674-81f9-75456511b170) | COMMON DATA SERVICE - VIRAL (17ab22cd-a0b3-4536-910a-cb6eb12696c0)<br/>EXCHANGE FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>FLOW FREE (50e68c76-46c6-4674-81f9-75456511b170) | | MICROSOFT 365 AUDIO CONFERENCING FOR GCC | MCOMEETADV_GOV | 2d3091c7-0712-488b-b3d8-6b97bde6a1f5 | EXCHANGE_S_FOUNDATION_GOV (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>MCOMEETADV_GOV (f544b08d-1645-4287-82de-8d91f37c02a1) | EXCHANGE FOUNDATION FOR GOVERNMENT (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>MICROSOFT 365 AUDIO CONFERENCING FOR GOVERNMENT (f544b08d-1645-4287-82de-8d91f37c02a1) | | Microsoft 365 E5 Suite features | M365_E5_SUITE_COMPONENTS | 99cc8282-2f74-4954-83b7-c6a9a1999067 | Content_Explorer (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>MICROSOFTENDPOINTDLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>INSIDER_RISK (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>ML_CLASSIFICATION (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>SAFEDOCS (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7) | Information Protection and Governance Analytics ΓÇô Premium (d9fa6af4-e046-4c89-9226-729a0786685d)<br/>Microsoft Endpoint DLP (64bfac92-2b17-4482-b5e5-a0304429de3e)<br/>Microsoft Insider Risk Management (d587c7a3-bda9-4f99-8776-9bcf59c84f75)<br/>Microsoft ML-based classification (d2d51368-76c9-4317-ada2-a12c004c432f)<br/>Office 365 SafeDocs (bf6f5520-59e3-4f82-974b-7dbbc4fd27c7) | When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic | MICROSOFT STREAM | STREAM | 1f2f344a-700d-42c9-9427-5cea1d5d7ba6 | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MICROSOFTSTREAM (acffdce6-c30f-4dc2-81c0-372e33c515ec) | EXCHANGE FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MICROSOFT STREAM (acffdce6-c30f-4dc2-81c0-372e33c515ec) | | Microsoft Stream Plan 2 | STREAM_P2 | ec156933-b85b-4c50-84ec-c9e5603709ef | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>STREAM_P2 (d3a458d0-f10d-48c2-9e44-86f3f684029e) | Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Stream Plan 2 (d3a458d0-f10d-48c2-9e44-86f3f684029e) | |Microsoft Stream Storage Add-On (500 GB) | STREAM_STORAGE | 9bd7c846-9556-4453-a542-191d527209e8 | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>STREAM_STORAGE (83bced11-77ce-4071-95bd-240133796768) | Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Microsoft Stream Storage Add-On (83bced11-77ce-4071-95bd-240133796768) |+| Microsoft Teams Audio Conferencing select dial-out | Microsoft_Teams_Audio_Conferencing_select_dial_out | 1c27243e-fb4d-42b1-ae8c-fe25c9616588 | MCOMEETBASIC (9974d6cf-cd24-4ba2-921c-e2aa687da846) | Microsoft Teams Audio Conferencing with dial-out to select geographies (9974d6cf-cd24-4ba2-921c-e2aa687da846) | | MICROSOFT TEAMS (FREE) | TEAMS_FREE | 16ddbbfc-09ea-4de2-b1d7-312db6112d70 | EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MCOFREE (617d9209-3b90-4879-96e6-838c42b2701d)<br/>TEAMS_FREE (4fa4026d-ce74-4962-a151-8e96d57ea8e4)<br/>SHAREPOINTDESKLESS (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>TEAMS_FREE_SERVICE (bd6f2ac2-991a-49f9-b23c-18c96a02c228)<br/>WHITEBOARD_FIRSTLINE1 (36b29273-c6d0-477a-aca6-6fbe24f538e3) | EXCHANGE FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>MCO FREE FOR MICROSOFT TEAMS (FREE) (617d9209-3b90-4879-96e6-838c42b2701d)<br/>MICROSOFT TEAMS (FREE) (4fa4026d-ce74-4962-a151-8e96d57ea8e4)<br/>SHAREPOINT KIOSK (902b47e5-dcb2-4fdc-858b-c63a90a2bdb9)<br/>TEAMS FREE SERVICE (bd6f2ac2-991a-49f9-b23c-18c96a02c228)<br/>WHITEBOARD (FIRSTLINE) (36b29273-c6d0-477a-aca6-6fbe24f538e3) | | MICROSOFT TEAMS EXPLORATORY | TEAMS_EXPLORATORY | 710779e8-3d4a-4c88-adb9-386c958d1fdf | CDS_O365_P1 (bed136c6-b799-4462-824d-fc045d3a9d25)<br/>EXCHANGE_S_STANDARD (9aaf7827-d63c-4b61-89c3-182f06f82e5c)<br/>MYANALYTICS_P2 (33c4f319-9bdd-48d6-9c4d-410b750a4a5a)<br/>FORMS_PLAN_E1 (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>PROJECTWORKMANAGEMENT (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>MICROSOFT_SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>DESKLESS (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>STREAM_O365_E1 (743dd19e-1ce3-4c62-a3ad-49ba8f63a2f6)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>MCO_TEAMS_IW (42a3ec34-28ba-46b6-992f-db53a675ac5b)<br/>INTUNE_O365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>OFFICEMOBILE_SUBSCRIPTION (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>POWERAPPS_O365_P1 (92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c)<br/>FLOW_O365_P1 (0f9b09cb-62d1-4ff4-9129-43f4996f83f4)<br/>POWER_VIRTUAL_AGENTS_O365_P1 (0683001c-0492-4d59-9515-d9a6426b5813)<br/>SHAREPOINTSTANDARD (c7699d2e-19aa-44de-8edf-1736da088ca1)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>BPOS_S_TODO_1 (5e62787c-c316-451f-b873-1d05acd4d12c)<br/>WHITEBOARD_PLAN1 (b8afc642-032e-4de5-8c0a-507a7bba7e5d)<br/>YAMMER_ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653) | COMMON DATA SERVICE FOR TEAMS_P1 (bed136c6-b799-4462-824d-fc045d3a9d25)<br/>EXCHANGE ONLINE (PLAN 1) (9aaf7827-d63c-4b61-89c3-182f06f82e5c)<br/>INSIGHTS BY MYANALYTICS (33c4f319-9bdd-48d6-9c4d-410b750a4a5a)<br/>MICROSOFT FORMS (PLAN E1) (159f4cd6-e380-449f-a816-af1a9ef76344)<br/>MICROSOFT PLANNER (b737dad2-2f6c-4c65-90e3-ca563267e8b9)<br/>MICROSOFT SEARCH (94065c59-bc8e-4e8b-89e5-5138d471eaff)<br/>MICROSOFT STAFFHUB (8c7d2df8-86f0-4902-b2ed-a0458298f3b3)<br/>MICROSOFT STREAM FOR O365 E1 SKU (743dd19e-1ce3-4c62-a3ad-49ba8f63a2f6)<br/>MICROSOFT TEAMS (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>MICROSOFT TEAMS (42a3ec34-28ba-46b6-992f-db53a675ac5b)<br/>MOBILE DEVICE MANAGEMENT FOR OFFICE 365 (882e1d05-acd1-4ccb-8708-6ee03664b117)<br/>OFFICE FOR THE WEB (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>OFFICE MOBILE APPS FOR OFFICE 365 (c63d4d19-e8cb-460e-b37c-4d6c34603745)<br/>POWER APPS FOR OFFICE 365 (92f7a6f3-b89b-4bbd-8c30-809e6da5ad1c)<br/>POWER AUTOMATE FOR OFFICE 365 (0f9b09cb-62d1-4ff4-9129-43f4996f83f4)<br/>POWER VIRTUAL AGENTS FOR OFFICE 365 P1 (0683001c-0492-4d59-9515-d9a6426b5813)<br/>SHAREPOINT STANDARD (c7699d2e-19aa-44de-8edf-1736da088ca1)<br/>SWAY (a23b959c-7ce8-4e57-9140-b90eb88a9e97)<br/>TO-DO (PLAN 1) (5e62787c-c316-451f-b873-1d05acd4d12c)<br/>WHITEBOARD (PLAN 1) (b8afc642-032e-4de5-8c0a-507a7bba7e5d)<br/>YAMMER ENTERPRISE (7547a3fe-08ee-4ccb-b430-5077c5041653 | | Microsoft Teams Rooms Standard | MEETING_ROOM | 6070a4c8-34c6-4937-8dfb-39bbc6397a60 | AAD_PREMIUM (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>MCOMEETADV (3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40)<br/>MCOEV (4828c8ec-dc2e-4779-b502-87ac9ce28ab7)<br/>TEAMS1 (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>MCOSTANDARD (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>Teams_Room_Standard (92c6b761-01de-457a-9dd9-793a975238f7)<br/>WHITEBOARD_PLAN3 (4a51bca5-1eff-43f5-878c-177680f191af)<br/>INTUNE_A (c1ec4a95-1f05-45b3-a911-aa3fa01094f5) | Azure Active Directory Premium Plan 1 (41781fb2-bc02-4b7c-bd55-b576c07bb09d)<br/>Microsoft 365 Audio Conferencing (3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40)<br/>Microsoft 365 Phone System (4828c8ec-dc2e-4779-b502-87ac9ce28ab7)<br/>Microsoft Teams (57ff2da0-773e-42df-b2af-ffb7a2317929)<br/>Skype for Business Online (Plan 2) (0feaeb32-d00e-4d66-bd5a-43b5b83db82c)<br/>Teams Room Standard (92c6b761-01de-457a-9dd9-793a975238f7)<br/>Whiteboard (Plan 3) (4a51bca5-1eff-43f5-878c-177680f191af)<br/>Microsoft Intune (c1ec4a95-1f05-45b3-a911-aa3fa01094f5) | |
| active-directory | Frontline Worker Management | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/frontline-worker-management.md | |
| active-directory | Reference Connect Adsynctools | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/hybrid/reference-connect-adsynctools.md | Accept wildcard characters: False ``` #### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters).+ ## Set-ADSyncToolsTls12 ### SYNOPSIS Sets Client\Server TLS 1.2 settings for .NET Framework Accept pipeline input: False Accept wildcard characters: False ``` #### CommonParameters-This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters). +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters). ++## Get-ADSyncToolsDuplicateUsersSourceAnchor +### SYNOPSIS +Gets a list of all the objects with "Source anchor has changed" error. +### SYNTAX +``` +Get-ADSyncToolsDuplicateUsersSourceAnchor [-ADConnectorName] <Object> [<CommonParameters>] +``` +### DESCRIPTION +There are certain scenarios like M&A where Customers add a new forest to Azure AD Connect with duplicate user objects. +This causes multiple sync errors if the new connector precedence is higher for the newly joined users. This cmdlet will provide a list of all the objects with "Source anchor has changed" errors. ++### EXAMPLES +#### EXAMPLE 1 +``` +Get-ADSyncToolsDuplicateUsersSourceAnchor -ADConnectorName Contoso.com +``` +### PARAMETERS +#### -ADConnectorName +AD connector name for which user source anchors needs to be repaired +```yaml +Type: Object +Parameter Sets: (All) +Aliases: +Required: true +Position: 1 +Default value: +Accept pipeline input: True (ByPropertyName) +Accept wildcard characters: False +``` +#### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters). ++## Set-ADSyncToolsDuplicateUsersSourceAnchor +### SYNOPSIS +Fixes all the objects with "Source Anchor has changed" error. +### SYNTAX +``` +et-ADSyncToolsDuplicateUsersSourceAnchor [-DuplicateUserSourceAnchorInfo] <DuplicateUserSourceAnchorInfo> [-ActiveDirectoryCredential <PSCredential>] [-OverridePrompt <Boolean>] [<CommonParameters>] +``` +### DESCRIPTION +This cmdlet takes in the list of objects from Get-ADSyncToolsDuplicateUsersSourceAnchor as pipeline input. It then fixes the sync errors by updating the msDS-ConsistencyGuid attribute with the sourceAnchor/immutableID of the original object. +The cmdlet has an optional parameter - "Override prompt", which is False by default. If it is set to True, then the user will not be prompted when updating the msDS-ConsistencyGuid attribute. ++### EXAMPLES +#### EXAMPLE 1 +``` +Get-ADSyncToolsDuplicateUsersSourceAnchor -ADConnectorName Contoso.lab | Set-ADSyncToolsDuplicateUsersSourceAnchor +``` +#### EXAMPLE 2 +``` +Get-ADSyncToolsDuplicateUsersSourceAnchor -ADConnectorName Contoso.lab | Set-ADSyncToolsDuplicateUsersSourceAnchor -OverridePrompt $true +``` +### PARAMETERS +#### -DuplicateUserSourceAnchorInfo +User list for which the source anchor needs to be fixed +```yaml +Type: DuplicateUserSourceAnchorInfo +Parameter Sets: (All) +Aliases: +Required: True +Position: 1 +Default value: +Accept pipeline input: True (ByValue, ByPropertyName) +Accept wildcard characters: False +``` +#### -ActiveDirectoryCredential +AD EA/DA Admin Credentials, If not provided default credentials will be used +```yaml +Type: PSCredential +Parameter Sets: (All) +Aliases: +Required: False +Position: Named +Default value: +Accept pipeline input: False +Accept wildcard characters: False +``` +#### -OverridePrompt +```yaml +Type: Boolean +Parameter Sets: (All) +Aliases: +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` +#### CommonParameters +This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters). |
| active-directory | Protect Against Consent Phishing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/manage-apps/protect-against-consent-phishing.md | Title: Protecting against consent phishing description: Learn ways of mitigating against app-based consent phishing attacks using Azure AD. -+ |
| active-directory | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/managed-identities-azure-resources/overview.md | The following table shows the differences between the two types of managed ident For using Managed identities, you have should do the following: 1. Create a managed identity in Azure. You can choose between system-assigned managed identity or user-assigned managed identity. 2. In case of user-assigned managed identity, assign the managed identity to the "source" Azure Resource, such as an Azure Logic App or an Azure Web App.-3. Authorize the managed identity to have accees to the "target" service. +3. Authorize the managed identity to have access to the "target" service. 4. Use the managed identity to perform access. For this, you can use the Azure SDK with the Azure.Identity library. Some "source" resources offer connectors that know how to use Managed identities for the connections. In that case you simply use the identity as a feature of that "source" resource. |
| aks | Api Server Authorized Ip Ranges | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/aks/api-server-authorized-ip-ranges.md | Title: API server authorized IP ranges in Azure Kubernetes Service (AKS) description: Learn how to secure your cluster using an IP address range for access to the API server in Azure Kubernetes Service (AKS) Previously updated : 09/21/2020 Last updated : 06/20/2022 #Customer intent: As a cluster operator, I want to increase the security of my cluster by limiting access to the API server to only the IP addresses that I specify. Last updated 09/21/2020 In Kubernetes, the API server receives requests to perform actions in the cluster such as to create resources or scale the number of nodes. The API server is the central way to interact with and manage a cluster. To improve cluster security and minimize attacks, the API server should only be accessible from a limited set of IP address ranges. -This article shows you how to use API server authorized IP address ranges to limit which IP addresses and CIDRs can access control plane. +This article shows you how to use API server authorized IP address ranges, using the Azure CLI, to limit which IP addresses and CIDRs can access control plane. ## Before you begin -This article shows you how to create an AKS cluster using the Azure CLI. +- You need the Azure CLI version 2.0.76 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli]. -You need the Azure CLI version 2.0.76 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli]. +- To learn what IP addresses to include when integrating your AKS cluster with Azure DevOps, see the Azure DevOps [Allowed IP addresses and domain URLs][azure-devops-allowed-network-cfg] article. ### Limitations The API server Authorized IP ranges feature has the following limitations:-- On clusters created after API server authorized IP address ranges moved out of preview in October 2019, API server authorized IP address ranges are only supported on the *Standard* SKU load balancer. Existing clusters with the *Basic* SKU load balancer and API server authorized IP address ranges configured will continue work as is but cannot be migrated to a *Standard* SKU load balancer. Those existing clusters will also continue to work if their Kubernetes version or control plane are upgraded. API server authorized IP address ranges are not supported for private clusters.-- When using this feature with clusters that use [Public IP per Node](use-multiple-node-pools.md#assign-a-public-ip-per-node-for-your-node-pools), those node pools with public IP per node enabled must use public IP prefixes and those prefixes must be added as authorized ranges.++- On clusters created after API server authorized IP address ranges moved out of preview in October 2019, API server authorized IP address ranges are only supported on the *Standard* SKU load balancer. Existing clusters with the *Basic* SKU load balancer and API server authorized IP address ranges configured will continue work as is, but they cann't be migrated to a *Standard* SKU load balancer. Existing clusters will also continue to work if their Kubernetes version or control plane are upgraded. +- API server authorized IP address ranges aren't supported with private clusters. +- When using this feature with clusters that use [Public IP per Node](use-multiple-node-pools.md#assign-a-public-ip-per-node-for-your-node-pools), those node pools with public IP per node enabled must use public IP prefixes, and those prefixes must be added as authorized ranges. ## Overview of API server authorized IP ranges az aks create \ > > The upper limit for the number of IP ranges you can specify is 200. >-> The rules can take up to 2min to propagate. Please allow up to that time when testing the connection. +> The rules can take up to two minutes to propagate. Please allow up to that time when testing the connection. ### Specify the outbound IPs for the Standard SKU load balancer -When creating an AKS cluster, if you specify the outbound IP addresses or prefixes for the cluster, those addresses or prefixes are allowed as well. For example: +While creating an AKS cluster, if you specify the outbound IP addresses or prefixes for the cluster, they are allowed as well. For example: ```azurecli-interactive az aks create \ The above operations of adding, updating, finding, and disabling authorized IP r ## How to find my IP to include in `--api-server-authorized-ip-ranges`? -You must add your development machines, tooling or automation IP addresses to the AKS cluster list of approved IP ranges in order to access the API server from there. +You must add your development machines, tooling, or automation IP addresses to the AKS cluster list of approved IP ranges to access the API server from there. -Another option is to configure a jumpbox with the needed tooling inside a separate subnet in the Firewall's virtual network. This assumes your environment has a Firewall with the respective network, and you have added the Firewall IPs to authorized ranges. Similarly, if you have forced tunneling from the AKS subnet to the Firewall subnet, than having the jumpbox in the cluster subnet is fine too. +Another option is to configure a jumpbox with the necessary tooling inside a separate subnet in the firewall's virtual network. This assumes your environment has a firewall with the respective network, and you've added the firewall IPs to authorized ranges. Similarly, if you've forced tunneling from the AKS subnet to the firewall subnet, having the jumpbox in the cluster subnet is also okay. -Add another IP address to the approved ranges with the following command. +To add another IP address to the approved ranges, use the following commands. ```bash # Retrieve your IP address az aks update -g $RG -n $AKSNAME --api-server-authorized-ip-ranges $CURRENT_IP/3 ``` > [!NOTE]-> The above example appends the API server authorized IP ranges on the cluster. To disable authorized IP ranges, use az aks update and specify an empty range "". +> The above example appends the API server authorized IP ranges on the cluster. To disable authorized IP ranges, use `az aks update` and specify an empty range "". -Another option is to use the below command on Windows systems to get the public IPv4 address, or you can use the steps in [Find your IP address](https://support.microsoft.com/en-gb/help/4026518/windows-10-find-your-ip-address). +Another option is to use the following command on Windows systems to get the public IPv4 address, or you can follow the steps in [Find your IP address](https://support.microsoft.com/en-gb/help/4026518/windows-10-find-your-ip-address). ```azurepowershell-interactive Invoke-RestMethod http://ipinfo.io/json | Select -exp ip ``` -You can also find this address by searching "what is my IP address" in an internet browser. +You can also find this address by searching on *what is my IP address* in an internet browser. ## Next steps -In this article, you enabled API server authorized IP ranges. This approach is one part of how you can run a secure AKS cluster. --For more information, see [Security concepts for applications and clusters in AKS][concepts-security] and [Best practices for cluster security and upgrades in AKS][operator-best-practices-cluster-security]. +In this article, you enabled API server authorized IP ranges. This approach is one part of how you can securely run an AKS cluster. For more information, see [Security concepts for applications and clusters in AKS][concepts-security] and [Best practices for cluster security and upgrades in AKS][operator-best-practices-cluster-security]. <!-- LINKS - external --> [cni-networking]: https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md For more information, see [Security concepts for applications and clusters in AK [operator-best-practices-cluster-security]: operator-best-practices-cluster-security.md [route-tables]: ../virtual-network/manage-route-table.md [standard-sku-lb]: load-balancer-standard.md+[azure-devops-allowed-network-cfg]: /azure/devops/organizations/security/allow-list-ip-url |
| aks | Cluster Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/aks/cluster-configuration.md | Additionally not all VM images support Gen2, on AKS Gen2 VMs will use the new [A ## Ephemeral OS -By default, Azure automatically replicates the operating system disk for a virtual machine to Azure storage to avoid data loss should the VM need to be relocated to another host. However, since containers aren't designed to have local state persisted, this behavior offers limited value while providing some drawbacks, including slower node provisioning and higher read/write latency. +By default, Azure automatically replicates the operating system disk for a virtual machine to Azure storage to avoid data loss if the VM needs to be relocated to another host. However, since containers aren't designed to have local state persisted, this behavior offers limited value while providing some drawbacks, including slower node provisioning and higher read/write latency. By contrast, ephemeral OS disks are stored only on the host machine, just like a temporary disk. This provides lower read/write latency, along with faster node scaling and cluster upgrades. |
| aks | Use Azure Dedicated Hosts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/aks/use-azure-dedicated-hosts.md | az provider register --namespace Microsoft.ContainerService The following limitations apply when you integrate Azure Dedicated Host with Azure Kubernetes Service: * An existing agent pool can't be converted from non-ADH to ADH or ADH to non-ADH.-* It is not supported to update agent pool from host group A to host group B. +* It isn't supported to update agent pool from host group A to host group B. * Using ADH across subscriptions. ## Add a Dedicated Host Group to an AKS cluster -A host group is a resource that represents a collection of dedicated hosts. You create a host group in a region and an availability zone, and add hosts to it. When planning for high availability, there are additional options. You can use one or both of the following options with your dedicated hosts: +A host group is a resource that represents a collection of dedicated hosts. You create a host group in a region and an availability zone, and add hosts to it. When planning for high availability, there are more options. You can use one or both of the following options with your dedicated hosts: -* Span across multiple availability zones. In this case, you are required to have a host group in each of the zones you wish to use. +* Span across multiple availability zones. In this case, you're required to have a host group in each of the zones you wish to use. * Span across multiple fault domains, which are mapped to physical racks. -In either case, you need to provide the fault domain count for your host group. If you do not want to span fault domains in your group, use a fault domain count of 1. +In either case, you need to provide the fault domain count for your host group. If you don't want to span fault domains in your group, use a fault domain count of 1. You can also decide to use both availability zones and fault domains. Not all host SKUs are available in all regions, and availability zones. You can az vm list-skus -l eastus -r hostGroups/hosts -o table ``` +> [!NOTE] +> First, when using host group, the nodepool fault domain count is always the same as the host group fault domain count. In order to use cluster auto-scaling to work with ADH and AKS, please make sure your host group fault domain count and capacity is enough. +> Secondly, only change fault domain count from the default of 1 to any other number if you know what they are doing as a misconfiguration could lead to a unscalable configuration. + ## Create a Host Group -Now create a dedicated host in the host group. In addition to a name for the host, you are required to provide the SKU for the host. Host SKU captures the supported VM series as well as the hardware generation for your dedicated host. +Now create a dedicated host in the host group. In addition to a name for the host, you're required to provide the SKU for the host. Host SKU captures the supported VM series and the hardware generation for your dedicated host. For more information about the host SKUs and pricing, see [Azure Dedicated Host pricing](https://azure.microsoft.com/pricing/details/virtual-machines/dedicated-host/). -Use az vm host create to create a host. If you set a fault domain count for your host group, you will be asked to specify the fault domain for your host. +Use az vm host create to create a host. If you set a fault domain count for your host group, you'll be asked to specify the fault domain for your host. -In this example, we will use [az vm host group create][az-vm-host-group-create] to create a host group using both availability zones and fault domains. +In this example, we'll use [az vm host group create][az-vm-host-group-create] to create a host group using both availability zones and fault domains. ```azurecli-interactive az vm host group create \ az vm host group create \ ## Create a Dedicated Host -Now create a dedicated host in the host group. In addition to a name for the host, you are required to provide the SKU for the host. Host SKU captures the supported VM series as well as the hardware generation for your dedicated host. +Now create a dedicated host in the host group. In addition to a name for the host, you're required to provide the SKU for the host. Host SKU captures the supported VM series and the hardware generation for your dedicated host. -If you set a fault domain count for your host group, you will need to specify the fault domain for your host. +If you set a fault domain count for your host group, you'll need to specify the fault domain for your host. ```azurecli-interactive az vm host create \ |
| aks | Use System Pools | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/aks/use-system-pools.md | In this article, you learned how to create and manage system node pools in an AK <!-- INTERNAL LINKS --> [aks-taints]: use-multiple-node-pools.md#setting-nodepool-taints [aks-windows]: windows-container-cli.md-[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials -[az-aks-create]: /cli/azure/aks#az_aks_create +[az-aks-get-credentials]: /cli/azure/aks#az-aks-get-credentials +[az-aks-create]: /cli/azure/aks#az-aks-create [new-azakscluster]: /powershell/module/az.aks/new-azakscluster-[az-aks-nodepool-add]: /cli/azure/aks/nodepool#az_aks_nodepool_add -[az-aks-nodepool-list]: /cli/azure/aks/nodepool#az_aks_nodepool_list -[az-aks-nodepool-update]: /cli/azure/aks/nodepool#az_aks_nodepool_update -[az-aks-nodepool-upgrade]: /cli/azure/aks/nodepool#az_aks_nodepool_upgrade -[az-aks-nodepool-scale]: /cli/azure/aks/nodepool#az_aks_nodepool_scale -[az-aks-nodepool-delete]: /cli/azure/aks/nodepool#az_aks_nodepool_delete -[az-extension-add]: /cli/azure/extension#az_extension_add -[az-extension-update]: /cli/azure/extension#az_extension_update -[az-group-create]: /cli/azure/group#az_group_create -[az-group-delete]: /cli/azure/group#az_group_delete +[az-aks-nodepool-add]: /cli/azure/aks/nodepool#az-aks-nodepool-add +[az-aks-nodepool-list]: /cli/azure/aks/nodepool#az-aks-nodepool-list +[az-aks-nodepool-update]: /cli/azure/aks/nodepool#az-aks-nodepool-update +[az-aks-nodepool-upgrade]: /cli/azure/aks/nodepool#az-aks-nodepool-upgrade +[az-aks-nodepool-scale]: /cli/azure/aks/nodepool#az-aks-nodepool-scale +[az-aks-nodepool-delete]: /cli/azure/aks/nodepool#az-aks-nodepool-delete +[az-extension-add]: /cli/azure/extension#az-extension-add +[az-extension-update]: /cli/azure/extension#az-extension-update +[az-group-create]: /cli/azure/group#az-group-create +[az-group-delete]: /cli/azure/group#az-group-delete [remove-azresourcegroup]: /powershell/module/az.resources/remove-azresourcegroup-[az-group-deployment-create]: /cli/azure/group/deployment#az_group_deployment_create +[az-deployment-group-create]: /cli/azure/deployment/group#az-deployment-group-create [gpu-cluster]: gpu-cluster.md [install-azure-cli]: /cli/azure/install-azure-cli [install-azure-powershell]: /powershell/azure/install-az-ps |
| app-service | How To Zone Redundancy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/how-to-zone-redundancy.md | You can create a zone redundant App Service using the [Azure CLI](/cli/azure/ins To enable zone redundancy using the Azure CLI, include the `--zone-redundant` parameter when you create your App Service plan. You can also include the `--number-of-workers` parameter to specify capacity. If you don't specify a capacity, the platform defaults to three. Capacity should be set based on the workload requirement, but no less than three. A good rule of thumb to choose capacity is to ensure sufficient instances for the application such that losing one zone of instances leaves sufficient capacity to handle expected load. ```azurecli-az appservice plan create --resource-group MyResourceGroup --name MyPlan --zone-redundant --number-of-workers 6 +az appservice plan create --resource-group MyResourceGroup --name MyPlan --sku P1v2 --zone-redundant --number-of-workers 6 ``` > [!TIP] |
| application-gateway | Certificates For Backend Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/application-gateway/certificates-for-backend-authentication.md | In this article, you learn how to: ## Prerequisites -An existing backend certificate is required to generate the authentication certificates or trusted root certificates required for allowing backend instances with Application Gateway. The backend certificate can be the same as the TLS/SSL certificate or different for added security. Application Gateway doesn't provide you any mechanism to create or purchase an TLS/SSL certificate. For testing purposes, you can create a self-signed certificate but you shouldn't use it for production workloads. +An existing backend certificate is required to generate the authentication certificates or trusted root certificates required for allowing backend instances with Application Gateway. The backend certificate can be the same as the TLS/SSL certificate or different for added security. Application Gateway doesn't provide you any mechanism to create or purchase a TLS/SSL certificate. For testing purposes, you can create a self-signed certificate but you shouldn't use it for production workloads. ## Export authentication certificate (for v1 SKU) The following steps help you export the .cer file for your certificate: ## Next steps -Now you have the authentication certificate/trusted root certificate in Base-64 encoded X.509(.CER) format. You can add this to the application gateway to allow your backend servers for end to end TLS encryption. See [Configure end to end TLS by using Application Gateway with PowerShell](./application-gateway-end-to-end-ssl-powershell.md). +Now you have the authentication certificate/trusted root certificate in Base-64 encoded X.509(.CER) format. You can add this to the application gateway to allow your backend servers for end to end TLS encryption. See [Configure end to end TLS by using Application Gateway with PowerShell](./application-gateway-end-to-end-ssl-powershell.md). |
| applied-ai-services | Concept Model Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/applied-ai-services/form-recognizer/concept-model-overview.md | A composed model is created by taking a collection of custom models and assignin ## Model data extraction - | **Model ID** | **Text extraction** | **Language detection** | **Selection Marks** | **Tables** | **Paragraphs** | **Paragraph roles** | **Key-Value pairs** | **Fields** | - |:--|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:| +| **Model ID** | **Text extraction** | **Language detection** | **Selection Marks** | **Tables** | **Paragraphs** | **Paragraph roles** | **Key-Value pairs** | **Fields** | +|:--|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:| |🆕 [prebuilt-read](concept-read.md#data-extraction) | ✓ | ✓ | | | ✓ | | | | |🆕 [prebuilt-tax.us.w2](concept-w2.md#field-extraction) | ✓ | | ✓ | | ✓ | | | ✓ | |🆕 [prebuilt-document](concept-general-document.md#data-extraction)| ✓ | | ✓ | ✓ | ✓ | | ✓ | | |
| azure-arc | Quick Start Connect Vcenter To Arc Using Script | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/vmware-vsphere/quick-start-connect-vcenter-to-arc-using-script.md | Use the following instructions to run the script, depending on which operating s ### Windows -1. Open a PowerShell window and go to the folder where you've downloaded the PowerShell script. +1. Open a PowerShell window as an Administrator and go to the folder where you've downloaded the PowerShell script. ++> [!NOTE] +> On Windows workstations, the script must be run in PowerShell window and not in PowerShell Integrated Script Editor (ISE) as PowerShell ISE doesn't display the input prompts from Azure CLI commands. If the script is run on PowerShell ISE, it could appear as though the script is stuck while it is waiting for input. 2. Run the following command to allow the script to run, because it's an unsigned script. (If you close the session before you complete all the steps, run this command again for the new session.) |
| azure-functions | Recover Python Functions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/recover-python-functions.md | See [Enable remote build](#enable-remote-build) or [Build native dependencies](# #### The package is incompatible with the Python interpreter version -Go to `.python_packages/lib/python3.6/site-packages/<package-name>-<version>-dist-info` or `.python_packages/lib/site-packages/<package-name>-<version>-dist-info`. Using a text editor, open the METADATA file and check the **Classifiers:** section. If the section doesn't contains `Python :: 3`, `Python :: 3.6`, `Python :: 3.7`, or `Python :: 3.8`, this means the package version is either too old, or most likely, the package is already out of maintenance. +Go to `.python_packages/lib/python3.6/site-packages/<package-name>-<version>-dist-info` or `.python_packages/lib/site-packages/<package-name>-<version>-dist-info`. Using a text editor, open the METADATA file and check the **Classifiers:** section. If the section doesn't contains `Python :: 3`, `Python :: 3.6`, `Python :: 3.7`, `Python :: 3.8`, or `Python :: 3.9`, this means the package version is either too old, or most likely, the package is already out of maintenance. You can check the Python version of your function app from the [Azure portal](https://portal.azure.com). Navigate to your function app, choose **Resource explorer**, and select **Go**. Make sure that the latest version of both **docker** and [Azure Functions Core T #### Update your package to the latest version -Browse the latest package version in `https://pypi.org/project/<package-name>` and check the **Classifiers:** section. The package should be `OS Independent`, or compatible with `POSIX` or `POSIX :: Linux` in **Operating System**. Also, the Programming Language should contains `Python :: 3`, `Python :: 3.6`, `Python :: 3.7`, or `Python :: 3.8`. +Browse the latest package version in `https://pypi.org/project/<package-name>` and check the **Classifiers:** section. The package should be `OS Independent`, or compatible with `POSIX` or `POSIX :: Linux` in **Operating System**. Also, the Programming Language should contains `Python :: 3`, `Python :: 3.6`, `Python :: 3.7`, `Python :: 3.8`, or `Python :: 3.9`. If these are correct, you can update the package to the latest version by changing the line `<package-name>~=<latest-version>` in requirements.txt. The best practice is to check the import statement from each .py file in your pr First, we should take a look into the latest version of the package in `https://pypi.org/project/<package-name>`. Usually, this package has their own GitHub page, go to the **Issues** section on GitHub and search if your issue has been fixed. If so, update the package to the latest version. -Sometimes, the package may have been integrated into [Python Standard Library](https://docs.python.org/3/library/) (such as pathlib). If so, since we provide a certain Python distribution in Azure Functions (Python 3.6, Python 3.7, and Python 3.8), the package in your requirements.txt should be removed. +Sometimes, the package may have been integrated into [Python Standard Library](https://docs.python.org/3/library/) (such as pathlib). If so, since we provide a certain Python distribution in Azure Functions (Python 3.6, Python 3.7, Python 3.8, and Python 3.9), the package in your requirements.txt should be removed. However, if you're facing an issue that it has not been fixed and you're on a deadline. I encourage you to do some research and find a similar package for your project. Usually, the Python community will provide you with a wide variety of similar libraries that you can use. This error occurs when a Python function app fails to start with a proper Python This is most likely caused by a 32-bit Python interpreter is installed on your 64-bit operating system. -If you're running on an x64 operating system, please ensure your Python 3.6, 3.7, or 3.8 interpreter is also on 64-bit version. +If you're running on an x64 operating system, please ensure your Python 3.6, 3.7, 3.8, or 3.9 interpreter is also on 64-bit version. You can check your Python interpreter bitness by the following commands: If there's a mismatch between Python interpreter bitness and operating system ar #### The Python interpreter is not supported by Azure Functions Python Worker -The Azure Functions Python Worker only supports Python 3.6, 3.7, and 3.8. -Please check if your Python interpreter matches our expected version by `py --version` in Windows or `python3 --version` in Unix-like systems. Ensure the return result is Python 3.6.x, Python 3.7.x, or Python 3.8.x. +The Azure Functions Python Worker only supports Python 3.6, 3.7, 3.8, and 3.9. +Please check if your Python interpreter matches our expected version by `py --version` in Windows or `python3 --version` in Unix-like systems. Ensure the return result is Python 3.6.x, Python 3.7.x, Python 3.8.x, or Python 3.9.x. -If your Python interpreter version does not meet our expectation, please download the Python 3.6, 3.7, or 3.8 interpreter from [Python Software Foundation](https://www.python.org/downloads). +If your Python interpreter version does not meet our expectation, please download the Python 3.6, 3.7, 3.8, or 3.9 interpreter from [Python Software Foundation](https://www.python.org/downloads). |
| azure-monitor | Agent Data Sources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-data-sources.md | |
| azure-monitor | Agent Linux Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-linux-troubleshoot.md | |
| azure-monitor | Agent Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-linux.md | Title: Install Log Analytics agent on Linux computers description: This article describes how to connect Linux computers hosted in other clouds or on-premises to Azure Monitor with the Log Analytics agent for Linux. Last updated 03/31/2022+ |
| azure-monitor | Agent Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-manage.md | |
| azure-monitor | Agent Windows Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-windows-troubleshoot.md | Title: Troubleshoot issues with Log Analytics agent for Windows description: Describe the symptoms, causes, and resolution for the most common issues with the Log Analytics agent for Windows in Azure Monitor. Last updated 03/31/2022+ |
| azure-monitor | Agent Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agent-windows.md | Title: Install Log Analytics agent on Windows computers description: This article describes how to connect Windows computers hosted in other clouds or on-premises to Azure Monitor with the Log Analytics agent for Windows. Last updated 03/31/2022+ |
| azure-monitor | Agents Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/agents-overview.md | Title: Overview of the Azure monitoring agents| Microsoft Docs description: This article provides a detailed overview of the Azure agents available which support monitoring virtual machines hosted in Azure or hybrid environment. - Last updated 05/24/2022+ # Overview of Azure Monitor agents |
| azure-monitor | Azure Monitor Agent Data Collection Endpoint | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-data-collection-endpoint.md | |
| azure-monitor | Azure Monitor Agent Extension Versions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-extension-versions.md | |
| azure-monitor | Azure Monitor Agent Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-manage.md | |
| azure-monitor | Azure Monitor Agent Troubleshoot Linux Vm Rsyslog | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm-rsyslog.md | |
| azure-monitor | Azure Monitor Agent Troubleshoot Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm.md | |
| azure-monitor | Azure Monitor Agent Troubleshoot Windows Arc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-troubleshoot-windows-arc.md | |
| azure-monitor | Azure Monitor Agent Troubleshoot Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-troubleshoot-windows-vm.md | |
| azure-monitor | Azure Monitor Agent Windows Client | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/azure-monitor-agent-windows-client.md | |
| azure-monitor | Data Collection Rule Sample Agent | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-collection-rule-sample-agent.md | description: Sample data collection rule for Azure Monitor agent Last updated 02/15/2022 + |
| azure-monitor | Data Collection Text Log | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-collection-text-log.md | Title: Collect text and IIS logs with Azure Monitor agent (preview) description: Configure collection of filed-based text logs using a data collection rule on virtual machines with the Azure Monitor agent. Last updated 06/06/2022+ |
| azure-monitor | Data Sources Collectd | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-collectd.md | Title: Collect data from CollectD in Azure Monitor | Microsoft Docs description: CollectD is an open source Linux daemon that periodically collects data from applications and system level information. This article provides information on collecting data from CollectD in Azure Monitor. Last updated 03/31/2022+ |
| azure-monitor | Data Sources Custom Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-custom-logs.md | |
| azure-monitor | Data Sources Iis Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-iis-logs.md | Title: Collect IIS logs with Log Analytics agent in Azure Monitor description: Internet Information Services (IIS) stores user activity in log files that can be collected by Azure Monitor. This article describes how to configure collection of IIS logs and details of the records they create in Azure Monitor. Last updated 03/31/2022+ |
| azure-monitor | Data Sources Json | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-json.md | Title: Collecting custom JSON data sources with the Log Analytics agent for Linu description: Custom JSON data sources can be collected into Azure Monitor using the Log Analytics Agent for Linux. These custom data sources can be simple scripts returning JSON such as curl or one of FluentD's 300+ plugins. This article describes the configuration required for this data collection. Last updated 03/31/2022+ |
| azure-monitor | Data Sources Linux Applications | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-linux-applications.md | Title: Collect Linux application performance in Azure Monitor | Microsoft Docs description: This article provides details for configuring the Log Analytics agent for Linux to collect performance counters for MySQL and Apache HTTP Server. Last updated 03/31/2022+ |
| azure-monitor | Data Sources Syslog | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-syslog.md | Title: Collect Syslog data sources with Log Analytics agent in Azure Monitor description: Syslog is an event logging protocol that is common to Linux. This article describes how to configure collection of Syslog messages in Log Analytics and details of the records they create. Last updated 04/06/2022+ |
| azure-monitor | Data Sources Windows Events | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources-windows-events.md | Title: Collect Windows event log data sources with Log Analytics agent in Azure description: Describes how to configure the collection of Windows Event logs by Azure Monitor and details of the records they create. Last updated 04/06/2022+ |
| azure-monitor | Data Sources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/data-sources.md | |
| azure-monitor | Diagnostics Extension Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-logs.md | |
| azure-monitor | Diagnostics Extension Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-overview.md | Title: Azure Diagnostics extension overview description: Use Azure diagnostics for debugging, measuring performance, monitoring, traffic analysis in cloud services, virtual machines and service fabric Last updated 04/06/2022-ms.reviwer: dalek + |
| azure-monitor | Diagnostics Extension Schema Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-schema-windows.md | |
| azure-monitor | Diagnostics Extension Troubleshooting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-troubleshooting.md | Title: Troubleshooting Azure Diagnostics extension description: Troubleshoot problems when using Azure diagnostics in Azure Virtual Machines, Service Fabric, or Cloud Services. Last updated 03/31/2022+ |
| azure-monitor | Diagnostics Extension Versions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-versions.md | |
| azure-monitor | Diagnostics Extension Windows Install | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/diagnostics-extension-windows-install.md | Title: Install and configure Windows Azure diagnostics extension (WAD) description: Learn about installing and configuring the Windows diagnostics extension. Also, learn how a description of how the data is stored in and Azure Storage account. - Last updated 02/17/2020 ms.devlang: azurecli+ # Install and configure Windows Azure diagnostics extension (WAD) [Azure diagnostics extension](diagnostics-extension-overview.md) is an agent in Azure Monitor that collects monitoring data from the guest operating system and workloads of Azure virtual machines and other compute resources. This article provides details on installing and configuring the Windows diagnostics extension and a description of how the data is stored in and Azure Storage account. |
| azure-monitor | Gateway | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/gateway.md | Title: Connect computers by using the Log Analytics gateway | Microsoft Docs description: Connect your devices and Operations Manager-monitored computers by using the Log Analytics gateway to send data to the Azure Automation and Log Analytics service when they do not have internet access. Last updated 04/06/2022+ |
| azure-monitor | Log Analytics Agent | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/log-analytics-agent.md | |
| azure-monitor | Om Agents | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/om-agents.md | Title: Connect Operations Manager to Azure Monitor | Microsoft Docs description: To maintain your existing investment in System Center Operations Manager and use extended capabilities with Log Analytics, you can integrate Operations Manager with your workspace. Last updated 03/31/2022+ |
| azure-monitor | Resource Manager Agent | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/resource-manager-agent.md | |
| azure-monitor | Resource Manager Data Collection Rules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/agents/resource-manager-data-collection-rules.md | |
| azure-monitor | Alerts Action Rules | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-action-rules.md | Title: Alert processing rules for Azure Monitor alerts description: Understanding what alert processing rules in Azure Monitor are and how to configure and manage them. Last updated 2/23/2022+ |
| azure-monitor | Alerts Activity Log | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-activity-log.md | description: Create activity log alerts by using the Azure portal, an Azure Reso Last updated 2/23/2022+ |
| azure-monitor | Alerts Classic Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-classic-portal.md | |
| azure-monitor | Alerts Common Schema Definitions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-common-schema-definitions.md | description: Understanding the common alert schema definitions for Azure Monitor Last updated 07/20/2021+ # Common alert schema definitions |
| azure-monitor | Alerts Common Schema Integrations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-common-schema-integrations.md | Title: How to integrate the common alert schema with Logic Apps description: Learn how to create a logic app that leverages the common alert schema to handle all your alerts. Last updated 05/27/2019+ms.revewer: issahn |
| azure-monitor | Alerts Common Schema Test Action Definitions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-common-schema-test-action-definitions.md | description: Understanding the common alert schema definitions for Azure Monitor Last updated 01/14/2022+ms.revewer: issahn # Common alert schema definitions for Test Action Group (Preview) |
| azure-monitor | Alerts Common Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-common-schema.md | Title: Common alert schema for Azure Monitor alerts description: Understanding the common alert schema, why you should use it and how to enable it Last updated 03/14/2019+ # Common alert schema |
| azure-monitor | Alerts Log | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-log.md | You can also [create log alert rules using Azure Resource Manager templates](../ ||| |Number of violations|The number of violations that have to occur to trigger the alert.| |Evaluation period|The amount of time within which those violations have to occur. |- |Override query time range| Enter a value for this field if the alert evaluation period is different than the query time range.| + |Override query time range| Enter a value in this field if the alert evaluation period is different than the query time range.<br> The alert time range is limited to a maximum of two days. Even if the query contains an **ago** command with a time range of longer than 2 days, the 2 day maximum time range is applied. For example, even if the query text contains **ago(7d)**, the query only scans up to 2 days of data.<br> If the query requires more data than the alert evaluation, and there is no **ago** command in the query, you can change the time range manually.| :::image type="content" source="media/alerts-log/alerts-rule-preview-advanced-options.png" alt-text="Screenshot of the advanced options section of a new log alert rule."::: 1. The **Preview** chart shows query evaluations results over time. You can change the chart period or select different time series that resulted from unique alert splitting by dimensions. - :::image type="content" source="media/alerts-log/alerts-create-alert-rule-preview.png" alt-text="Screenshot of a preview of a new alert rule."::: + :::image type="content" source="media/alerts-log/alerts-create-alert-rule-preview.png" alt-text="Screenshot of a preview of a new alert rule."::: 1. From this point on, you can select the **Review + create** button at any time. 1. In the **Actions** tab, select or create the required [action groups](./action-groups.md). |
| azure-monitor | Alerts Manage Alerts Previous Version | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-manage-alerts-previous-version.md | |
| azure-monitor | Alerts Metric Logs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-metric-logs.md | |
| azure-monitor | Alerts Metric | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-metric.md | |
| azure-monitor | Alerts Non Common Schema Definitions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-non-common-schema-definitions.md | description: Understanding the non-common alert schema definitions for Azure Mon Last updated 01/25/2022+ # Non-common alert schema definitions for Test Action Group (Preview) |
| azure-monitor | Alerts Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-overview.md | |
| azure-monitor | Alerts Page | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-page.md | Title: View and manage your alert instances description: The alerts page summarizes all alert instances in all your Azure resources generated in the last 30 days. Last updated 2/23/2022--+ # View and manage your alert instances |
| azure-monitor | Alerts Resource Move | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-resource-move.md | |
| azure-monitor | Alerts Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-troubleshoot.md | |
| azure-monitor | Alerts Webhooks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/alerts-webhooks.md | |
| azure-monitor | Api Alerts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/api-alerts.md | Title: Using Log Analytics Alert REST API description: The Log Analytics Alert REST API allows you to create and manage alerts in Log Analytics, which is part of Log Analytics. This article provides details of the API and several examples for performing different operations. Last updated 2/23/2022+ |
| azure-monitor | It Service Management Connector Secure Webhook Connections | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/it-service-management-connector-secure-webhook-connections.md | Title: IT Service Management Connector - Secure Webhook in Azure Monitor description: This article shows you how to connect your ITSM products/services with Secure Webhook in Azure Monitor to centrally monitor and manage ITSM work items. Last updated 03/30/2022+ms. reviewer: nolavime |
| azure-monitor | Itsm Connector Secure Webhook Connections Azure Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsm-connector-secure-webhook-connections-azure-configuration.md | Title: IT Service Management Connector - Secure Webhook in Azure Monitor - Azure description: This article shows you how to configure Azure in order to connect your ITSM products/services with Secure Webhook in Azure Monitor to centrally monitor and manage ITSM work items. Last updated 04/28/2022-ms.reviwer: + |
| azure-monitor | Itsmc Connections Cherwell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-connections-cherwell.md | Title: Connect Cherwell with IT Service Management Connector description: This article provides information about how to Cherwell with the IT Service Management Connector (ITSMC) in Azure Monitor to centrally monitor and manage the ITSM work items. Last updated 2/23/2022-+ # Connect Cherwell with IT Service Management Connector |
| azure-monitor | Itsmc Connections Provance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-connections-provance.md | Title: Connect Provance with IT Service Management Connector description: This article provides information about how to Provance with the IT Service Management Connector (ITSMC) in Azure Monitor to centrally monitor and manage the ITSM work items. Last updated 2/23/2022+ |
| azure-monitor | Itsmc Connections Servicenow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-connections-servicenow.md | Title: Connect ServiceNow with IT Service Management Connector description: Learn how to connect ServiceNow with the IT Service Management Connector (ITSMC) in Azure Monitor to centrally monitor and manage ITSM work items. Last updated 2/23/2022+ |
| azure-monitor | Itsmc Connections | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-connections.md | Title: IT Service Management Connector in Azure Monitor description: This article provides information about how to connect your ITSM products or services with the IT Service Management Connector (ITSMC) in Azure Monitor to centrally monitor and manage the ITSM work items. Last updated 2/23/2022+ # Connect ITSM products/services with IT Service Management Connector |
| azure-monitor | Itsmc Connector Deletion | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-connector-deletion.md | description: This article provides an explanation of how to delete ITSM connecto Last updated 2/23/2022 + |
| azure-monitor | Itsmc Dashboard Errors | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-dashboard-errors.md | |
| azure-monitor | Itsmc Dashboard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-dashboard.md | |
| azure-monitor | Itsmc Definition | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-definition.md | description: This article provides an overview of IT Service Management Connecto Last updated 2/23/2022 + |
| azure-monitor | Itsmc Resync Servicenow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-resync-servicenow.md | |
| azure-monitor | Itsmc Secure Webhook Connections Bmc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-secure-webhook-connections-bmc.md | Title: IT Service Management Connector - Secure Webhook in Azure Monitor - Confi description: This article shows you how to connect your ITSM products/services with BMC on Secure Webhook in Azure Monitor. Last updated 03/30/2022+ |
| azure-monitor | Itsmc Secure Webhook Connections Servicenow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-secure-webhook-connections-servicenow.md | Title: IT Service Management Connector - Secure Webhook in Azure Monitor - Confi description: This article shows you how to connect your ITSM products/services with ServiceNow on Secure Webhook in Azure Monitor. Last updated 03/30/2022+ |
| azure-monitor | Itsmc Synced Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-synced-data.md | description: This article provides an overview of Data synced from your ITSM pro Last updated 2/23/2022 + |
| azure-monitor | Itsmc Troubleshoot Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/alerts/itsmc-troubleshoot-overview.md | |
| azure-monitor | Custom Fields | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/logs/custom-fields.md | Title: Custom fields in Azure Monitor (Preview) | Microsoft Docs description: The Custom Fields feature of Azure Monitor allows you to create your own searchable fields from records in a Log Analytics workspace that add to the properties of a collected record. This article describes the process to create a custom field and provides a detailed walkthrough with a sample event. --+++ Last updated 10/20/2021 The following section walks through a complete example of creating a custom fiel We enter the following query to return all events from Service Control Manager that have an Event ID of 7036 which is the event that indicates a service starting or stopping. - + -We then select and expand any record with event ID 7036. +We then right-click on any record with event ID 7036 and select **Extract fields from \`Event`**. - + -We define custom fields by clicking the ellipsis next to the top property. -- --The **Field Extraction Wizard** is opened, and the **EventLog** and **EventID** fields are selected in the **Main Example** column. This indicates that the custom field will be defined for events from the System log with an event ID of 7036. This is sufficient so we donΓÇÖt need to select any other fields. +The **Field Extraction Wizard** opens with the **EventLog** and **EventID** fields selected in the **Main Example** column. This indicates that the custom field will be defined for events from the System log with an event ID of 7036. This is sufficient so we donΓÇÖt need to select any other fields.  |
| azure-monitor | Quick Create Workspace | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/logs/quick-create-workspace.md | For more information about Azure Resource Manager templates, see [Azure Resource } } ```+ ## Troubleshooting |
| azure-monitor | Profiler Aspnetcore Linux | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/profiler/profiler-aspnetcore-linux.md | description: A conceptual overview and step-by-step tutorial on how to use Appli ms.devlang: csharp Previously updated : 02/23/2018 Last updated : 06/16/2022 # Profile ASP.NET Core Azure Linux web apps with Application Insights Profiler -This feature is currently in preview. - Find out how much time is spent in each method of your live web application when using [Application Insights](../app/app-insights-overview.md). Application Insights Profiler is now available for ASP.NET Core web apps that are hosted in Linux on Azure App Service. This guide provides step-by-step instructions on how the Profiler traces can be collected for ASP.NET Core Linux web apps. After you complete this walkthrough, your app can collect Profiler traces like the traces that are shown in the image. In this example, the Profiler trace indicates that a particular web request is slow because of time spent waiting. The *hot path* in the code that's slowing the app is marked by a flame icon. The **About** method in the **HomeController** section is slowing the web app because the method is calling the **Thread.Sleep** function. |
| azure-monitor | Profiler Containers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/profiler/profiler-containers.md | Title: Profile Azure Containers with Application Insights Profiler description: Enable Application Insights Profiler for Azure Containers. ms.contributor: charles.weininger Previously updated : 05/26/2022 Last updated : 06/16/2022 -* Add the reference to the NuGet package. +* Add the reference to the `Microsoft.ApplicationInsights.Profiler.AspNetCore` NuGet package. * Set the environment variables to enable it. In this article, you'll learn the various ways you can: In this article, you'll learn the various ways you can: } ``` +1. Add the NuGet package to collect the Profiler traces: ++ ```console + dotnet add package Microsoft.ApplicationInsights.Profiler.AspNetCore + ``` + 1. Enable Application Insights and Profiler in `Startup.cs`: ```csharp |
| azure-monitor | Usage Estimated Costs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/usage-estimated-costs.md | To limit the view to Azure Monitor charges, [create a filter](../cost-management - Log Analytics - Insight and Analytics +>[!NOTE] +>Usage for Azure Monitor Logs (Log Analytics) can be billed with the **Log Analytics** service (for Pay-as-you-go data ingestion and data retention), or with the **Azure Monitor** service (for Commitment Tiers, Basic Logs and Data Export) or with the **Insight and Analytics** service when using the legacy Per Node pricing tier. Except for a small set of legacy resources, Application Insights data ingestion and retention are billed as the **Log Analytics** service. + Other services such as Microsoft Defender for Cloud and Microsoft Sentinel also bill their usage against Log Analytics workspace resources, so you might want to add them to your filter. See [Common cost analysis uses](../cost-management-billing/costs/cost-analysis-common-uses.md) for information on how to use this view.  |
| azure-portal | Azure Portal Dashboards Create Programmatically | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-portal/azure-portal-dashboards-create-programmatically.md | Once you've configured your template, deploy it using any of the following metho - [REST APIs](/rest/api/resources/deployments) - [PowerShell](../azure-resource-manager/templates/deploy-powershell.md)-- [Azure CLI](/cli/azure/group/deployment#az-group-deployment-create)+- [Azure CLI](/cli/azure/deployment/group#az-deployment-group-create) - [The Azure portal template deployment page](https://portal.azure.com/#create/Microsoft.Template) Next you'll see two versions of our example dashboard JSON. The first is the version that we exported from the portal that was already bound to a resource. The second is the template version that can be programmatically bound to any virtual machine and deployed using Azure Resource Manager. |
| azure-resource-manager | Deploy To Tenant | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/bicep/deploy-to-tenant.md | The following template assigns a role at the tenant scope. ```bicep targetScope = 'tenant' -@description('principalId if the user that will be given contributor access to the resourceGroup') +@description('principalId of the user that will be given contributor access to the resourceGroup') param principalId string @description('roleDefinition for the assignment - default is owner') |
| azure-resource-manager | Azure Subscription Service Limits | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/management/azure-subscription-service-limits.md | For more information, see [Functions Hosting plans comparison](../../azure-funct [!INCLUDE [container-service-limits](../../../includes/container-service-limits.md)] +## Azure Load Testing limits ++For Azure Load Testing limits, see [Service limits in Azure Load Testing](../../load-testing/resource-limits-quotas-capacity.md). + ## Azure Machine Learning limits The latest values for Azure Machine Learning Compute quotas can be found in the [Azure Machine Learning quota page](../../machine-learning/how-to-manage-quotas.md) |
| azure-resource-manager | Enable Debug Logging | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-resource-manager/troubleshooting/enable-debug-logging.md | Title: Enable debug logging -description: Describes how to enable debug logging to troubleshoot Azure resources deployed with Azure Resource Manager templates (ARM templates) or Bicep files. +description: Describes how to enable debug logging to troubleshoot Azure resources deployed with Bicep files or Azure Resource Manager templates (ARM templates). tags: top-support-issue Previously updated : 11/05/2021 Last updated : 06/20/2022 # Enable debug logging -To troubleshoot a deployment error, it helps to gather more information. Use Azure PowerShell to enable debug logging. You can get data about a deployment's request and response to learn the cause of the problem. Debug logging works with Azure Resource Manager templates (ARM templates) and Bicep files. +To troubleshoot a deployment error, enable debug logging to get more information. Debug logging works for deployments using Bicep files or Azure Resource Manager templates (ARM templates). You can get data about a deployment's request and response to learn the cause of a problem. -## Get debug information +> [!WARNING] +> Debug logging can expose secrets like passwords or `listKeys`. Only enable debug logging when you need to troubleshoot a deployment error. ++## Set up debug logging ++Use Azure PowerShell to enable debug logging and view the results with Azure PowerShell or Azure CLI. # [PowerShell](#tab/azure-powershell) -Use [New-AzResourceGroupDeployment](/powershell/module/az.resources/new-azresourcegroupdeployment) to set the `DeploymentDebugLogLevel` parameter to `All`, `ResponseContent`, or `RequestContent`. When debug logging is enabled, a warning is displayed that secrets like passwords or `listKeys` can be logged by commands like [Get-AzResourceGroupDeploymentOperation](/powershell/module/az.resources/get-azresourcegroupdeploymentoperation). +For a resource group deployment, use [New-AzResourceGroupDeployment](/powershell/module/az.resources/new-azresourcegroupdeployment) to set the `DeploymentDebugLogLevel` parameter to `All`, `ResponseContent`, or `RequestContent`. ++When debug logging is enabled, a warning is displayed that secrets like passwords or `listKeys` can be logged and displayed when you get deployment operations with commands like `Get-AzResourceGroupDeploymentOperation`. + ```azurepowershell New-AzResourceGroupDeployment ` -Name exampledeployment ` -ResourceGroupName examplegroup `- -TemplateFile azuredeploy.json ` + -TemplateFile main.bicep ` -DeploymentDebugLogLevel All ``` -The output shows the debug logging: +The output shows the debug logging level. ```Output DeploymentDebugLogLevel : RequestContent, ResponseContent ``` -To view all the properties for deployment operations: +The `DeploymentDebugLogLevel` parameter is available for other deployment scopes: subscription, management group, and tenant. ++- [New-AzDeployment](/powershell/module/az.resources/new-azdeployment) +- [New-AzManagementGroupDeployment](/powershell/module/az.resources/new-azmanagementgroupdeployment) +- [New-AzTenantDeployment](/powershell/module/az.resources/new-aztenantdeployment) ++# [Azure CLI](#tab/azure-cli) ++You can't enable debug logging with Azure CLI but you can get debug logging data using the `request` and `response` properties. ++++++## Get debug information ++After debug logging is enabled, you can get more information from the deployment operations. ++# [PowerShell](#tab/azure-powershell) ++For a resource group deployment, use [Get-AzResourceGroupDeploymentOperation](/powershell/module/az.resources/get-azresourcegroupdeploymentoperation) to get deployment operations. ```azurepowershell Get-AzResourceGroupDeploymentOperation ` You can specify a property, like `StatusMessage` or `StatusCode` to filter the o -ResourceGroupName examplegroup).StatusMessage ``` +For more information, see the documentation for deployment operation scopes: subscription, management group, and tenant. ++- [Get-AzDeploymentOperation](/powershell/module/az.resources/get-azdeploymentoperation) +- [Get-AzManagementGroupDeploymentOperation](/powershell/module/az.resources/get-azmanagementgroupdeploymentoperation) +- [Get-AzTenantDeploymentOperation](/powershell/module/az.resources/get-aztenantdeploymentoperation) + # [Azure CLI](#tab/azure-cli) -You can't enable debug logging with Azure CLI but you can retrieve debug logging data. +For a resource group deployment, use [az deployment operation group list](/cli/azure/deployment/operation/group#az-deployment-operation-group-list) to get deployment operations. -Get the deployment operations with the [az deployment operation group list](/cli/azure/deployment/operation/group#az-deployment-operation-group-list) command: ```azurecli az deployment operation group list \ az deployment operation group list \ --name exampledeployment ``` -Get the request content with the following command: +Use a query to get the `request` property's content. ```azurecli az deployment operation group list \ az deployment operation group list \ --query [].properties.request ``` -Get the response content with the following command: +Use a query to get the `response` property's content. ```azurecli az deployment operation group list \ az deployment operation group list \ --query [].properties.response ``` +For more information, see the documentation for deployment operation scopes: subscription, management group, and tenant. ++- [az deployment operation sub list](/cli/azure/deployment/operation/sub#az-deployment-operation-sub-list) +- [az deployment operation mg list](/cli/azure/deployment/operation/mg#az-deployment-operation-mg-list) +- [az deployment operation tenant list](/cli/azure/deployment/operation/tenant#az-deployment-operation-tenant-list) +++++## Remove debug deployment history ++When you're finished debugging, you can remove deployment history to prevent anyone who has access from seeing sensitive information that might have been logged. If you used multiple deployment names during debugging, run the command for each deployment name. ++# [PowerShell](#tab/azure-powershell) ++To remove deployment history for a resource group deployment, use [Remove-AzResourceGroupDeployment](/powershell/module/az.resources/remove-azresourcegroupdeployment). ++```azurepowershell +Remove-AzResourceGroupDeployment -ResourceGroupName examplegroup -Name exampledeployment +``` ++The command returns `True` when it's successful. ++For more information about deployment history, see the documentation for the deployment scopes: subscription, management group, and tenant. ++- [Remove-AzDeployment](/powershell/module/az.resources/remove-azdeployment) +- [Remove-AzManagementGroupDeployment](/powershell/module/az.resources/remove-azmanagementgroupdeployment) +- [Remove-AzTenantDeployment](/powershell/module/az.resources/remove-aztenantdeployment) +++# [Azure CLI](#tab/azure-cli) ++To remove deployment history for a resource group deployment, use [az deployment group delete](/cli/azure/deployment/group#az-deployment-group-delete). ++```azurecli +az deployment group delete --resource-group examplegroup --name exampledeployment +``` ++For more information, see the documentation for deployment scopes: subscription, management group, and tenant. ++- [az deployment sub delete](/cli/azure/deployment/sub#az-deployment-sub-delete) +- [az deployment mg delete](/cli/azure/deployment/mg#az-deployment-mg-delete) +- [az deployment tenant delete](/cli/azure/deployment/tenant#az-deployment-tenant-delete) ++ ## Nested template -To log debug information for a [nested](../templates/linked-templates.md#nested-template) ARM template, use the [Microsoft.Resources/deployments](/azure/templates/microsoft.resources/deployments) `debugSetting` element. +To log debug information for a [nested](../templates/linked-templates.md#nested-template) ARM template, use the [Microsoft.Resources/deployments](/azure/templates/microsoft.resources/deployments) `debugSetting` property. ```json { To log debug information for a [nested](../templates/linked-templates.md#nested- } ``` -Bicep uses [modules](../bicep/modules.md) rather than `Microsoft.Resources/deployments`. With modules, you can reuse your code to deploy a Bicep file from another Bicep file. +Bicep uses [modules](../bicep/modules.md) rather than nested templates. ## Next steps |
| azure-signalr | Signalr Reference Data Plane Rest Api | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-signalr/signalr-reference-data-plane-rest-api.md | + + Title: Azure SignalR service data plane REST API reference +description: Describes the REST APIs Azure SignalR service supports to manage the connections and send messages to them. ++++ Last updated : 06/09/2022+++# Azure SignalR service data plane REST API reference ++> [!NOTE] +> +> Azure SignalR Service only supports using REST API to manage clients connected using ASP.NET Core SignalR. Clients connected using ASP.NET SignalR use a different data protocol that is not currently supported. ++On top of the classical client-server pattern, Azure SignalR Service provides a set of REST APIs so that you can easily integrate real-time functionality into your server-less architecture. ++<a name="serverless"></a> ++## Typical Server-less Architecture with Azure Functions ++The following diagram shows a typical server-less architecture using Azure SignalR Service with Azure Functions. +++- `negotiate` function returns a negotiation response and redirects all clients to SignalR Service. +- `broadcast` function calls SignalR Service's REST API. Then SignalR Service will broadcast the message to all connected clients. ++In a server-less architecture, clients still have persistent connections to the SignalR Service. +Since there's no application server to handle traffic, clients are in `LISTEN` mode, which means they can only receive messages but can't send messages. +SignalR Service will disconnect any client that sends messages because it's an invalid operation. ++You can find a complete sample of using SignalR Service with Azure Functions at [here](https://github.com/aspnet/AzureSignalR-samples/tree/master/samples/RealtimeSignIn). ++## API ++The following table shows all versions of REST API we have for now. You can also find the swagger file for each version of REST API. ++API Version | Status | Port | Doc | Spec +|||| +`1.0` | Latest | Standard | [Doc](./swagger/signalr-data-plane-rest-v1.md) | [swagger](https://github.com/Azure/azure-signalr/blob/dev/docs/swagger/v1.json) +`1.0-preview` | Obsolete | Standard | [Doc](./swagger/signalr-data-plane-rest-v1-preview.md) | [swagger](https://github.com/Azure/azure-signalr/blob/dev/docs/swagger/v1-preview.json) ++The latest available APIs are listed as following. +++| API | Path | +| - | - | +| [Broadcast a message to all clients connected to target hub.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-connected-to-target-hub) | `POST /api/v1/hubs/{hub}` | +| [Broadcast a message to all clients belong to the target user.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-belong-to-the-target-user) | `POST /api/v1/hubs/{hub}/users/{id}` | +| [Send message to the specific connection.](./swagger/signalr-data-plane-rest-v1.md#send-message-to-the-specific-connection) | `POST /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Check if the connection with the given connectionId exists](./swagger/signalr-data-plane-rest-v1.md#check-if-the-connection-with-the-given-connectionid-exists) | `GET /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Close the client connection](./swagger/signalr-data-plane-rest-v1.md#close-the-client-connection) | `DELETE /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Broadcast a message to all clients within the target group.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-within-the-target-group) | `POST /api/v1/hubs/{hub}/groups/{group}` | +| [Check if there are any client connections inside the given group](./swagger/signalr-data-plane-rest-v1.md#check-if-there-are-any-client-connections-inside-the-given-group) | `GET /api/v1/hubs/{hub}/groups/{group}` | +| [Check if there are any client connections connected for the given user](./swagger/signalr-data-plane-rest-v1.md#check-if-there-are-any-client-connections-connected-for-the-given-user) | `GET /api/v1/hubs/{hub}/users/{user}` | +| [Add a connection to the target group.](./swagger/signalr-data-plane-rest-v1.md#add-a-connection-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` | +| [Remove a connection from the target group.](./swagger/signalr-data-plane-rest-v1.md#remove-a-connection-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` | +| [Check whether a user exists in the target group.](./swagger/signalr-data-plane-rest-v1.md#check-whether-a-user-exists-in-the-target-group) | `GET /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Add a user to the target group.](./swagger/signalr-data-plane-rest-v1.md#add-a-user-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Remove a user from the target group.](./swagger/signalr-data-plane-rest-v1.md#remove-a-user-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Remove a user from all groups.](./swagger/signalr-data-plane-rest-v1.md#remove-a-user-from-all-groups) | `DELETE /api/v1/hubs/{hub}/users/{user}/groups` | ++## Using REST API ++### Authenticate via Azure SignalR Service AccessKey ++In each HTTP request, an authorization header with a [JSON Web Token (JWT)](https://en.wikipedia.org/wiki/JSON_Web_Token) is required to authenticate with SignalR Service. ++#### Signing Algorithm and Signature ++`HS256`, namely HMAC-SHA256, is used as the signing algorithm. ++Use the `AccessKey` in Azure SignalR Service instance's connection string to sign the generated JWT token. ++#### Claims ++The following claims are required to be included in the JWT token. ++Claim Type | Is Required | Description +|| +`aud` | true | Needs to be the same as your HTTP request url, trailing slash and query parameters not included. For example, a broadcast request's audience should look like: `https://example.service.signalr.net/api/v1/hubs/myhub`. +`exp` | true | Epoch time when this token expires. ++### Authenticate via Azure Active Directory Token (Azure AD Token) ++Similar to authenticating using `AccessKey`, when authenticating using Azure AD Token, a [JSON Web Token (JWT)](https://en.wikipedia.org/wiki/JSON_Web_Token) is also required to authenticate the HTTP request. ++The difference is, in this scenario the JWT Token is generated by Azure Active Directory. ++[Learn how to generate Azure AD Tokens](/azure/active-directory/develop/reference-v2-libraries) ++You could also use **Role Based Access Control (RBAC)** to authorize the request from your client/server to SignalR Service. ++[Learn how to configure Role-based access control roles for your resource](/azure/azure-signalr/authorize-access-azure-active-directory) ++### Implement Negotiate Endpoint ++As shown in the [architecture section](#serverless), you should implement a `negotiate` function that returns a redirect negotiation response so that client can connect to the service. +A typical negotiation response looks as follows: ++```json +{ + "url":"https://<service_name>.service.signalr.net/client/?hub=<hub_name>", + "accessToken":"<a typical JWT token>" +} +``` ++The `accessToken` is generated using the same algorithm described in [authentication section](#authenticate-via-azure-signalr-service-accesskey). The only difference is the `aud` claim should be same as `url`. ++You should host your negotiate API in `https://<hub_url>/negotiate` so you can still use SignalR client to connect to the hub url. ++Read more about redirecting client to Azure SignalR Service at [here](./signalr-concept-internals.md#client-connections). ++### User-related REST API ++In order to call user-related REST API, each of your clients should identify itself to SignalR Service. +Otherwise SignalR Service can't find target connections from a given user ID. ++Client identification can be achieved by including a `nameid` claim in each client's JWT token when they're connecting to SignalR Service. +Then SignalR Service will use the value of `nameid` claim as the user ID of each client connection. ++### Sample ++You can find a complete console app to demonstrate how to manually build a REST API HTTP request in SignalR Service [here](https://github.com/aspnet/AzureSignalR-samples/tree/master/samples/Serverless). ++You can also use [Microsoft.Azure.SignalR.Management](<https://www.nuget.org/packages/Microsoft.Azure.SignalR.Management>) to publish messages to SignalR Service using the similar interfaces of `IHubContext`. Samples can be found [here](<https://github.com/aspnet/AzureSignalR-samples/tree/master/samples/Management>). For more information, see [How to use Management SDK](https://github.com/Azure/azure-signalr/blob/dev/docs/management-sdk-guide.md). +++## Limitation ++Currently, we have the following limitation for REST API requests: ++* Header size is a maximum of 16 KB. +* Body size is a maximum of 1 MB. ++If you want to send message larger than 1 MB, use the Management SDK with `persistent` mode. |
| azure-signalr | Signalr Data Plane Rest V1 Preview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-signalr/swagger/signalr-data-plane-rest-v1-preview.md | + + Title: Azure SignalR service data plane REST API reference - v1-preview +description: Describes REST APIs version v1-preview Azure SignalR service supports to manage the connections and send messages to them. ++++ Last updated : 06/09/2022+++# Azure SignalR Service data plane REST API - v1-preview ++This article contains the obsoleted v1-preview version REST APIs for Azure SignalR Service data plane. Please use the [latest version](./signalr-data-plane-rest-v1.md) instead. ++## Available APIs ++| API | Path | +| - | - | +| [post /api/v1-preview/hub/{hub}/user/{id}](#post-apiv1-previewhubhubuserid) | `POST /api/v1-preview/hub/{hub}/user/{id}` | +| [post /api/v1-preview/hub/{hub}/users/{userList}](#post-apiv1-previewhubhubusersuserlist) | `POST /api/v1-preview/hub/{hub}/users/{userList}` | +| [post /api/v1-preview/hub/{hub}](#post-apiv1-previewhubhub) | `POST /api/v1-preview/hub/{hub}` | +| [post /api/v1-preview/hub/{hub}/group/{group}](#post-apiv1-previewhubhubgroupgroup) | `POST /api/v1-preview/hub/{hub}/group/{group}` | +| [post /api/v1-preview/hub/{hub}/groups/{groupList}](#post-apiv1-previewhubhubgroupsgrouplist) | `POST /api/v1-preview/hub/{hub}/groups/{groupList}` | ++### post /api/v1-preview/hub/{hub}/user/{id} ++`POST /api/v1-preview/hub/{hub}/user/{id}` +##### Description: ++Send a message to a single user. ++##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which should start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| id | path | Target user Id. | Yes | string | +| message | body | | Yes | [Message](#message) | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Accepted | ++### post /api/v1-preview/hub/{hub}/users/{userList} ++`POST /api/v1-preview/hub/{hub}/users/{userList}` +##### Description: ++Send a message to multiple users. ++##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which should start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| userList | path | Comma-separated list of user Ids. | Yes | string | +| message | body | | Yes | [Message](#message) | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Accepted | ++### post /api/v1-preview/hub/{hub} ++`POST /api/v1-preview/hub/{hub}` +##### Description: ++Broadcast a message to all clients connected to target hub. ++##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which should start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| message | body | | Yes | [Message](#message) | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Accepted | ++### post /api/v1-preview/hub/{hub}/group/{group} ++`POST /api/v1-preview/hub/{hub}/group/{group}` +##### Description: ++Broadcast a message to all clients within the target group. ++##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and contain only alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, which must start with alphabetic characters and contain only alpha-numeric characters or underscore. | Yes | string | +| message | body | | Yes | [Message](#message) | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Accepted | ++### post /api/v1-preview/hub/{hub}/groups/{groupList} ++`POST /api/v1-preview/hub/{hub}/groups/{groupList}` +##### Description: ++Broadcast a message to all clients within the target groups. ++##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| groupList | path | Comma-separated list of group names. Each group name must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| message | body | | Yes | [Message](#message) | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Accepted | ++### Models +++#### Message ++Method invocation message. ++| Name | Type | Description | Required | +| - | - | -- | -- | +| target | string | Target method name. | No | +| arguments | [ object ] | Target method arguments. | No | |
| azure-signalr | Signalr Data Plane Rest V1 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-signalr/swagger/signalr-data-plane-rest-v1.md | + + Title: Azure SignalR service data plane REST API reference - v1 +description: Describes the REST APIs version v1 Azure SignalR service supports to manage the connections and send messages to them. ++++ Last updated : 06/09/2022+++# Azure SignalR Service data plane REST API - v1 ++This article contains the v1 version REST APIs for Azure SignalR Service data plane. ++## Available APIs ++| API | Path | +| - | - | +| [Broadcast a message to all clients connected to target hub.](#broadcast-a-message-to-all-clients-connected-to-target-hub) | `POST /api/v1/hubs/{hub}` | +| [Broadcast a message to all clients belong to the target user.](#broadcast-a-message-to-all-clients-belong-to-the-target-user) | `POST /api/v1/hubs/{hub}/users/{id}` | +| [Send message to the specific connection.](#send-message-to-the-specific-connection) | `POST /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Check if the connection with the given connectionId exists](#check-if-the-connection-with-the-given-connectionid-exists) | `GET /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Close the client connection](#close-the-client-connection) | `DELETE /api/v1/hubs/{hub}/connections/{connectionId}` | +| [Broadcast a message to all clients within the target group.](#broadcast-a-message-to-all-clients-within-the-target-group) | `POST /api/v1/hubs/{hub}/groups/{group}` | +| [Check if there are any client connections inside the given group](#check-if-there-are-any-client-connections-inside-the-given-group) | `GET /api/v1/hubs/{hub}/groups/{group}` | +| [Check if there are any client connections connected for the given user](#check-if-there-are-any-client-connections-connected-for-the-given-user) | `GET /api/v1/hubs/{hub}/users/{user}` | +| [Add a connection to the target group.](#add-a-connection-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` | +| [Remove a connection from the target group.](#remove-a-connection-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` | +| [Check whether a user exists in the target group.](#check-whether-a-user-exists-in-the-target-group) | `GET /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Add a user to the target group.](#add-a-user-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Remove a user from the target group.](#remove-a-user-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/users/{user}` | +| [Remove a user from all groups.](#remove-a-user-from-all-groups) | `DELETE /api/v1/hubs/{hub}/users/{user}/groups` | ++### Broadcast a message to all clients connected to target hub. ++`POST /api/v1/hubs/{hub}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| excluded | query | Excluded connection Ids | No | [ string ] | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Broadcast a message to all clients belong to the target user. ++`POST /api/v1/hubs/{hub}/users/{id}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| id | path | The user Id. | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Send message to the specific connection. ++`POST /api/v1/hubs/{hub}/connections/{connectionId}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| connectionId | path | The connection Id. | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Check if the connection with the given connectionId exists ++`GET /api/v1/hubs/{hub}/connections/{connectionId}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | | Yes | string | +| connectionId | path | | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Close the client connection ++`DELETE /api/v1/hubs/{hub}/connections/{connectionId}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | | Yes | string | +| connectionId | path | | Yes | string | +| reason | query | | No | string | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Broadcast a message to all clients within the target group. ++`POST /api/v1/hubs/{hub}/groups/{group}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| excluded | query | Excluded connection Ids | No | [ string ] | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Check if there are any client connections inside the given group ++`GET /api/v1/hubs/{hub}/groups/{group}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | | Yes | string | +| group | path | | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Check if there are any client connections connected for the given user ++`GET /api/v1/hubs/{hub}/users/{user}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | | Yes | string | +| user | path | | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Add a connection to the target group. ++`PUT /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| connectionId | path | Target connection Id | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Remove a connection from the target group. ++`DELETE /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| connectionId | path | Target connection Id | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Check whether a user exists in the target group. ++`GET /api/v1/hubs/{hub}/groups/{group}/users/{user}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| user | path | Target user Id | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | Success | +| 400 | Bad Request | +| 404 | Not Found | ++### Add a user to the target group. ++`PUT /api/v1/hubs/{hub}/groups/{group}/users/{user}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| user | path | Target user Id | Yes | string | +| ttl | query | Specifies the seconds that the user exists in the group. If not set, the user lives in the group for at most 1 year. Note that when ttl is not set, the service preserves 100 user-group relationships per user and old user-group relationship are overwritten by newly added ones. | No | integer | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Remove a user from the target group. ++`DELETE /api/v1/hubs/{hub}/groups/{group}/users/{user}` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| group | path | Target group name, whose length must be greater than 0 and less than 1025. | Yes | string | +| user | path | Target user Id | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 202 | Success | +| 400 | Bad Request | ++### Remove a user from all groups. ++`DELETE /api/v1/hubs/{hub}/users/{user}/groups` +##### Parameters ++| Name | Located in | Description | Required | Schema | +| - | - | -- | -- | - | +| hub | path | Target hub name, which must start with alphabetic characters and only contain alpha-numeric characters or underscore. | Yes | string | +| user | path | Target user Id | Yes | string | ++##### Responses ++| Code | Description | +| - | -- | +| 200 | The user is deleted | +| 202 | The delete request is accepted and the service is handling the request in the background | +| 400 | Bad Request | ++### Models +++#### PayloadMessage ++| Name | Type | Description | Required | +| - | - | -- | -- | +| Target | string | | No | +| Arguments | [ object ] | | No | |
| azure-video-indexer | Limited Access Features | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-video-indexer/limited-access-features.md | + + Title: Limited Access features of Azure Video Indexer +description: This article talks about the limited access features of Azure Video Indexer. + Last updated : 06/17/2022++++# Limited Access features of Azure Video Indexer ++Our vision is to empower developers and organizations to leverage AI to transform society in positive ways. We encourage responsible AI practices to protect the rights and safety of individuals. Microsoft facial recognition services are Limited Access in order to help prevent the misuse of the services in accordance with our [AI Principles](https://www.microsoft.com/ai/responsible-ai?SilentAuth=1&wa=wsignin1.0&activetab=pivot1%3aprimaryr6) and [facial recognition](https://blogs.microsoft.com/on-the-issues/2018/12/17/six-principles-to-guide-microsofts-facial-recognition-work/) principles. The Face Identify and Celebrity Recognition operations in Azure Video Indexer are Limited Access features that require registration. ++Since the announcement on June 11th, 2020, Azure face recognition services are strictly prohibited for use by or for U.S. police departments. ++## Application process ++Limited Access features of Azure Video Indexer are only available to customers managed by Microsoft, and only for use cases selected at the time of registration. Other Azure Video Indexer features do not require registration to use. ++Customers and partners who wish to use Limited Access features of Azure Video Indexer are required to [submit an intake form](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR7en2Ais5pxKtso_Pz4b1_xUQjA5SkYzNDM4TkcwQzNEOE1NVEdKUUlRRCQlQCN0PWcu). Access is subject to MicrosoftΓÇÖs sole discretion based on eligibility criteria and a vetting process. Microsoft may require customers and partners to reverify this information periodically. ++The Azure Video Indexer service is made available to customers and partners under the terms governing their subscription to Microsoft Azure Services (including the [Service Specific Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftAzure/MCA#ServiceSpecificTerms)). Please review these terms carefully as they contain important conditions and obligations governing your use of Azure Video Indexer. ++## Help and support ++FAQ about Limited Access can be found [here](https://aka.ms/limitedaccesscogservices). ++If you need help with Azure Video Indexer, find support [here](/azure/cognitive-services/cognitive-services-support-options.md). ++[Report Abuse](https://msrc.microsoft.com/report/abuse) of Azure Video Indexer. ++## Next steps ++Learn more about the legal terms that apply to this service [here](https://azure.microsoft.com/support/legal/). ++ |
| azure-web-pubsub | Quickstart Live Demo | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-web-pubsub/quickstart-live-demo.md | Last updated 11/08/2021 # Quickstart: Connect to the Azure Web PubSub instance from the browser -This quickstart shows you how to get started easily with a [Pub/Sub live demo](https://azure.github.io/azure-webpubsub/demos/clientpubsub.html). +This quickstart shows you how to get started easily with a [Pub/Sub live demo](https://aka.ms/awps/quicktry). [!INCLUDE [quickstarts-free-trial-note](../../includes/quickstarts-free-trial-note.md)] |
| cloud-services-extended-support | Deploy Prerequisite | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cloud-services-extended-support/deploy-prerequisite.md | Remove old diagnostics settings for each role in the Service Configuration (.csc > Changes in service definition file (.csdef) requires the package file (.cspkg) to be generated again. Please build and repackage your .cspkg post making the following changes in the .csdef file to get the latest settings for your cloud service ### 1) Virtual Machine sizes-The following sizes are deprecated in Azure Resource Manager. However, if you want to continue to use them update the `vmsize` name with the associated Azure Resource Manager naming convention. +The sizes listed in the left column below are deprecated in Azure Resource Manager. However, if you want to continue to use them update the `vmsize` name with the associated Azure Resource Manager naming convention. | Previous size name | Updated size name | ||| |
| cognitive-services | Getting Started Build A Classifier | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Custom-Vision-Service/getting-started-build-a-classifier.md | Title: "Quickstart: Build an image classifier model with the Custom Vision portal" + Title: "Quickstart: Build an image classification model with the Custom Vision portal" description: In this quickstart, you'll learn how to use the Custom Vision web portal to create, train, and test an image classification model. -# Quickstart: Build an image classifier model with the Custom Vision web portal +# Quickstart: Build an image classification model with the Custom Vision portal -In this quickstart, you'll learn how to use the Custom Vision web portal to create an image classifier model. Once you build a model, you can test it with new images and eventually integrate it into your own image recognition app. +In this quickstart, you'll learn how to use the Custom Vision web portal to create an image classification model. Once you build a model, you can test it with new images and eventually integrate it into your own image recognition app. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/cognitive-services/) before you begin. ## Prerequisites -- A set of images with which to train your classifier. You can use the set of [sample images](https://github.com/Azure-Samples/cognitive-services-sample-data-files/tree/master/CustomVision/ImageClassification/Images) on GitHub. Or, you can choose your own images using the tips below.+- A set of images with which to train your classification model. You can use the set of [sample images](https://github.com/Azure-Samples/cognitive-services-sample-data-files/tree/master/CustomVision/ImageClassification/Images) on GitHub. Or, you can choose your own images using the tips below. - A [supported web browser](overview.md#supported-browsers-for-custom-vision-web-portal) In your web browser, navigate to the [Custom Vision web page](https://customvisi 1. Select __Classification__ under __Project Types__. Then, under __Classification Types__, choose either **Multilabel** or **Multiclass**, depending on your use case. Multilabel classification applies any number of your tags to an image (zero or more), while multiclass classification sorts images into single categories (every image you submit will be sorted into the most likely tag). You'll be able to change the classification type later if you want to. -1. Next, select one of the available domains. Each domain optimizes the classifier for specific types of images, as described in the following table. You can change the domain later if you wish. +1. Next, select one of the available domains. Each domain optimizes the model for specific types of images, as described in the following table. You can change the domain later if you wish. |Domain|Purpose| ||| |
| cognitive-services | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Custom-Vision-Service/overview.md | keywords: image recognition, image identifier, image recognition app, custom vis # What is Custom Vision? -Azure Custom Vision is an image recognition service that lets you build, deploy, and improve your own image identifier models. An image identifier applies labels to images, according to their detected visual characteristics. Each label represents a classification or object. Unlike the [Computer Vision](../computer-vision/overview.md) service, Custom Vision allows you to specify your own labels and train custom models to detect them. +Azure Custom Vision is an image recognition service that lets you build, deploy, and improve your own image identifier models. An image identifier applies labels to images, according to their visual characteristics. Each label represents a classification or object. Unlike the [Computer Vision](../computer-vision/overview.md) service, Custom Vision allows you to specify your own labels and train custom models to detect them. + This documentation contains the following types of articles: * The [quickstarts](./getting-started-build-a-classifier.md) are step-by-step instructions that let you make calls to the service and get results in a short period of time. For a more structured approach, follow a Microsoft Learn module for Custom Visio ## What it does -The Custom Vision service uses a machine learning algorithm to analyze images. You, the developer, submit groups of images that have and don't have the characteristics in question. You label the images yourself with your own custom labels (tags) at the time of submission. Then the algorithm trains to this data and calculates its own accuracy by testing itself on those same images. Once you've trained the algorithm, you can test, retrain, and eventually use it in your image recognition app to [classify images](getting-started-build-a-classifier.md). You can also [export the model](export-your-model.md) itself for offline use. +The Custom Vision service uses a machine learning algorithm to analyze images. You submit groups of images that have and don't have the characteristics in question. You label the images yourself with your own custom labels (tags) at the time of submission. Then the algorithm trains to this data and calculates its own accuracy by testing itself on the same images. Once you've trained the model, you can test, retrain, and eventually use it in your image recognition app to [classify images](getting-started-build-a-classifier.md) or [detect objects](get-started-build-detector.md). You can also [export the model](export-your-model.md) itself for offline use. ### Classification and object detection Custom Vision primarily doesn't replicate data out of the specified region, exce ## Next steps -Follow the [Build a classifier](getting-started-build-a-classifier.md) quickstart to get started using Custom Vision on the web portal, or complete an [SDK quickstart](quickstarts/image-classification.md) to implement the basic scenarios in code. +Follow the [Build a classifier](getting-started-build-a-classifier.md) quickstart to get started using Custom Vision on the web portal, or complete an [SDK quickstart](quickstarts/image-classification.md) to implement the basic scenarios with code. |
| cognitive-services | How To Audio Content Creation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Speech-Service/how-to-audio-content-creation.md | -As of November 2021, you have easy access to more than 270 neural voices across 119 different languages. These voices include state-of-the-art prebuilt neural voices and your custom neural voice, if you've built one. +You have easy access to a broad portfolio of [languages and voices](language-support.md#text-to-speech). These voices include state-of-the-art prebuilt neural voices and your custom neural voice, if you've built one. To learn more, view the [Audio Content Creation tutorial video](https://youtu.be/ygApYuOOG6w). It takes a few moments to deploy your new Speech resource. After the deployment ### Step 3: Sign in to Audio Content Creation with your Azure account and Speech resource -1. After you get the Azure account and the Speech resource, you can sign in to the [Audio Content Creation tool](https://aka.ms/audiocontentcreation) by selecting **Get started**. --1. The home page lists all the products under Speech Studio. To start, select **Audio Content Creation**. -- The **Welcome to Speech Studio** page opens. +1. After you get the Azure account and the Speech resource, sign in to [Speech Studio](https://aka.ms/speechstudio/), and then select **Audio Content Creation**. 1. Select the Azure subscription and the Speech resource you want to work with, and then select **Use resource**. It takes a few moments to deploy your new Speech resource. After the deployment If you have a user role for a certain Azure subscription, you might not have permissions to create a new Speech resource. To get access, contact your admin. - To modify your Speech resource at any time, select **Settings** at the top of the page. + To switch your Speech resource at any time, select **Settings** at the top of the page. To switch directories, select **Settings** or go to your profile. Each step in the preceding diagram is described here: 1. Choose the Speech resource you want to work with. -1. [Create an audio tuning file](#create-an-audio-tuning-file) by using plain text or SSML scripts. Type or upload your content in to Audio Content Creation. +1. [Create an audio tuning file](#create-an-audio-tuning-file) by using plain text or SSML scripts. Enter or upload your content into Audio Content Creation. 1. Choose the voice and the language for your script content. Audio Content Creation includes all of the [Microsoft text-to-speech voices](language-support.md#text-to-speech). You can use prebuilt neural voices or a custom neural voice. > [!NOTE] You can get your content into the Audio Content Creation tool in either of two w * **Option 1** - 1. Select **New** > **File** to create a new audio tuning file. + 1. Select **New** > **Text file** to create a new audio tuning file. - 1. Type or paste your content into the editing window. The allowable number of characters for each file is 20,000 or fewer. If your script contains more than 20,000 characters, you can use Option 2 to automatically split your content into multiple files. + 1. Enter or paste your content into the editing window. The allowable number of characters for each file is 20,000 or fewer. If your script contains more than 20,000 characters, you can use Option 2 to automatically split your content into multiple files. + 1. Select **Save**. * **Option 2** - 1. Select **Upload** to import one or more text files. Both plain text and SSML are supported. + 1. Select **Upload** > **Text file** to import one or more text files. Both plain text and SSML are supported. If your script file is more than 20,000 characters, split the content by paragraphs, by characters, or by regular expressions. After you've reviewed your audio output and are satisfied with your tuning and a 1. Select **Export** to create an audio creation task. - We recommend **Export to Audio Library**, because this option supports the long audio output and the full audio output experience. You can also download the audio to your local disk directly, but only the first 10 minutes are available. -+ We recommend **Export to Audio library** to easily store, find, and search audio output in the cloud. You can better integrate with your applications through Azure blob storage. You can also download the audio to your local disk directly. + 1. Choose the output format for your tuned audio. The **supported audio formats and sample rates** are listed in the following table: | Format | 8 kHz sample rate | 16 kHz sample rate | 24 kHz sample rate | 48 kHz sample rate | After you've reviewed your audio output and are satisfied with your tuning and a | mp3 | N/A | audio-16khz-128kbitrate-mono-mp3 | audio-24khz-160kbitrate-mono-mp3 |audio-48khz-192kbitrate-mono-mp3 | -1. To view the status of the task, select the **Export task** tab. +1. To view the status of the task, select the **Task list** tab. If the task fails, see the detailed information page for a full report. -1. When the task is complete, your audio is available for download on the **Audio Library** pane. +1. When the task is complete, your audio is available for download on the **Audio library** pane. ++1. Select the file you want to download and **Download**. -1. Select **Download**. Now you're ready to use your custom tuned audio in your apps or products. + Now you're ready to use your custom tuned audio in your apps or products. ## Add or remove Audio Content Creation users |
| cognitive-services | Long Audio Api | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Speech-Service/long-audio-api.md | When preparing your text file, make sure it: * For plain text, each paragraph is separated by hitting **Enter/Return**. See [plain text input example](https://github.com/Azure-Samples/Cognitive-Speech-TTS/blob/master/CustomVoice-API-Samples/Java/en-US.txt). * For SSML text, each SSML piece is considered a paragraph. Separate SSML pieces by different paragraphs. See [SSML text input example](https://github.com/Azure-Samples/Cognitive-Speech-TTS/blob/master/CustomVoice-API-Samples/Java/SSMLTextInputSample.txt). +> [!NOTE] +> When using SSML text, be sure to use the [supported SSML elements](speech-synthesis-markup.md?tabs=csharp#supported-ssml-elements) except the `audio` and `mstts:backgroundaudio` elements. The `audio` and `mstts:backgroundaudio` elements are not supported by Long Audio API. The `audio` element will be ignored without any error message. The `mstts:backgroundaudio` element will cause the systhesis task failure. If your synthesis task fails, download the audio result (.zip file) and check the error report with suffix name "err.txt" within the zip file for details. + ## Sample code The rest of this page focuses on Python, but sample code for the Long Audio API is available on GitHub for the following programming languages: |
| cognitive-services | Speech Studio Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Speech-Service/speech-studio-overview.md | In Speech Studio, the following Speech service features are available as project * [Pronunciation assessment](https://aka.ms/speechstudio/pronunciationassessment): Evaluate speech pronunciation and give speakers feedback on the accuracy and fluency of spoken audio. Speech Studio provides a sandbox for testing this feature quickly, without code. To use the feature with the Speech SDK in your applications, see the [Pronunciation assessment](how-to-pronunciation-assessment.md) article. -* [Voice Gallery](https://aka.ms/speechstudio/voicegallery): Build apps and services that speak naturally. Choose from more than 170 voices in over 70 languages and variants. Bring your scenarios to life with highly expressive and human-like neural voices. +* [Voice Gallery](https://aka.ms/speechstudio/voicegallery): Build apps and services that speak naturally. Choose from a broad portfolio of [languages, voices, and variants](language-support.md#prebuilt-neural-voices). Bring your scenarios to life with highly expressive and human-like neural voices. * [Custom Voice](https://aka.ms/speechstudio/customvoice): Create custom, one-of-a-kind voices for text-to-speech. You supply audio files and create matching transcriptions in Speech Studio, and then use the custom voices in your applications. To create and use custom voices via endpoints, see [Create and use your voice model](how-to-custom-voice-create-voice.md). |
| cognitive-services | Speech Synthesis Markup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/Speech-Service/speech-synthesis-markup.md | Any audio included in the SSML document must meet these requirements: * The combined total time for all text and audio files in a single response can't exceed 600 seconds. * The audio must not contain any customer-specific or other sensitive information. +> [!NOTE] +> The 'audio' element is not supported by the Long Audio API. + **Syntax** ```xml If the background audio provided is shorter than the text-to-speech or the fade Only one background audio file is allowed per SSML document. You can intersperse `audio` tags within the `voice` element to add more audio to your SSML document. +> [!NOTE] +> The `mstts:backgroundaudio` element is not supported by the Long Audio API. + **Syntax** ```xml |
| cognitive-services | Cognitive Services Container Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/cognitive-services-container-support.md | Azure Cognitive Services containers provide the following set of Docker containe |--|--|--| | [Speech Service API][sp-containers-stt] | **Speech-to-text** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-custom-speech-to-text)) | Transcribes continuous real-time speech into text. | Generally available. <br> This container can also [run in disconnected environments](containers/disconnected-containers.md). | | [Speech Service API][sp-containers-cstt] | **Custom Speech-to-text** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-custom-speech-to-text)) | Transcribes continuous real-time speech into text using a custom model. | Generally available |-| [Speech Service API][sp-containers-tts] | **Text-to-speech** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-text-to-speech)) | Converts text to natural-sounding speech. | Generally available | -| [Speech Service API][sp-containers-ctts] | **Custom Text-to-speech** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-custom-text-to-speech)) | Converts text to natural-sounding speech using a custom model. | Gated preview | | [Speech Service API][sp-containers-ntts] | **Neural Text-to-speech** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-neural-text-to-speech)) | Converts text to natural-sounding speech using deep neural network technology, allowing for more natural synthesized speech. | Generally available. <br> container can also [run in disconnected environments](containers/disconnected-containers.md). | | [Speech Service API][sp-containers-lid] | **Speech language detection** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-speechservices-language-detection)) | Determines the language of spoken audio. | Gated preview | |
| cognitive-services | Migrate Qnamaker To Question Answering | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cognitive-services/language-service/question-answering/how-to/migrate-qnamaker-to-question-answering.md | Following are the broad migration phases to consider: Additional links which can help you are given below: - [Authoring portal](https://language.cognitive.azure.com/home) - [API](authoring.md)-- [SDK](https://docs.microsoft.com/dotnet/api/microsoft.azure.cognitiveservices.knowledge.qnamaker)+- [SDK](/dotnet/api/microsoft.azure.cognitiveservices.knowledge.qnamaker) - Bot SDK: For bots to use custom question answering, use the [Bot.Builder.AI.QnA](https://www.nuget.org/packages/Microsoft.Bot.Builder.AI.QnA/) SDK ΓÇô We recommend customers to continue to use this for their Bot integrations. Here are some sample usages of the same in the botΓÇÖs code: [Sample 1](https://github.com/microsoft/BotBuilder-Samples/tree/main/samples/csharp_dotnetcore/48.customQABot-all-features) [Sample 2](https://github.com/microsoft/BotBuilder-Samples/tree/main/samples/csharp_dotnetcore/12.customQABot) ## Common migration scenarios Here are [detailed steps on migration scenario 2](https://github.com/Azure/azure Learn more about the [pre-built API](../../../QnAMaker/How-To/using-prebuilt-api.md) -Learn more about the [Question Answering Get Answers REST API](https://docs.microsoft.com/rest/api/cognitiveservices/questionanswering/question-answering/get-answers) +Learn more about the [Question Answering Get Answers REST API](/rest/api/cognitiveservices/questionanswering/question-answering/get-answers) ## Migration steps |
| container-registry | Zone Redundancy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/container-registry/zone-redundancy.md | Copy the following contents to a new file and save it using a filename such as ` } ``` -Run the following [az deployment group create](/cli/azure/group/deployment#az-group-deployment-create) command to create the registry using the preceding template file. Where indicated, provide: +Run the following [az deployment group create](/cli/azure/deployment/group#az-deployment-group-create) command to create the registry using the preceding template file. Where indicated, provide: * a unique registry name, or deploy the template without parameters and it will create a unique name for you * a location for the replica that supports availability zones, such as *westus2* |
| cosmos-db | Migrate Continuous Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/migrate-continuous-backup.md | Replace it with the following JSON object: Next deploy the template by using Azure PowerShell or CLI. The following example shows how to deploy the template with a CLI command: ```azurecli-az group deployment create -g <ResourceGroup> --template-file <ProvisionTemplateFilePath> +az deployment group create -g <ResourceGroup> --template-file <ProvisionTemplateFilePath> ``` ## What to expect during and after migration? |
| cosmos-db | Provision Account Continuous Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/provision-account-continuous-backup.md | You can use Azure Resource Manager templates to deploy an Azure Cosmos DB accoun Next, deploy the template by using Azure PowerShell or CLI. The following example shows how to deploy the template with a CLI command: ```azurecli-interactive-az group deployment create -g <ResourceGroup> --template-file <ProvisionTemplateFilePath> +az deployment group create -g <ResourceGroup> --template-file <ProvisionTemplateFilePath> ``` ## Next steps |
| cosmos-db | Restore Account Continuous Backup | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cosmos-db/restore-account-continuous-backup.md | Use the following ARM template to restore an account for the Azure Cosmos DB SQL Next, deploy the template by using Azure PowerShell or Azure CLI. The following example shows how to deploy the template with an Azure CLI command: ```azurecli-interactive-az group deployment create -g <ResourceGroup> --template-file <RestoreTemplateFilePath> +az deployment group create -g <ResourceGroup> --template-file <RestoreTemplateFilePath> ``` ## Next steps |
| cost-management-billing | Exchange And Refund Azure Reservations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/reservations/exchange-and-refund-azure-reservations.md | Azure has the following policies for cancellations, exchanges, and refunds. **Refund policies** - We're currently not charging an early termination fee, but in the future there might be a 12% early termination fee for cancellations.-- The total canceled commitment can't exceed 50,000 USD in a 12-month rolling window for a billing profile or single enrollment. For example, for a three-year reservation that's 100 USD per month and it's refunded in the 18th month, the canceled commitment is 1,800 USD. After the refund, your new available limit for refund will be 48,200 USD. In 365 days from the refund, the 48,200 USD limit will be increased by 1,800 USD and your new pool will be 50,000 USD. Any other reservation cancellation for the billing profile or EA enrollment will deplete the same pool, and the same replenishment logic will apply.+- The total canceled commitment can't exceed 50,000 USD in a 12-month rolling window for a billing profile or single enrollment. For example, for a three-year reservation (36 months) that's 100 USD per month and it's refunded in the 12th month, the canceled commitment is 2,400 USD (for the remaining 24 months). After the refund, your new available limit for refund will be 47,600 USD (50,000-2,400). In 365 days from the refund, the 47,600 USD limit will be increased by 2,400 USD and your new pool will be 50,000 USD. Any other reservation cancellation for the billing profile or EA enrollment will deplete the same pool, and the same replenishment logic will apply. - Azure won't process any refund that will exceed the 50,000 USD limit in a 12-month window for a billing profile or EA enrollment. - Refunds that result from an exchange don't count against the refund limit. - Refunds are calculated based on the lowest price of either your purchase price or the current price of the reservation. |
| data-factory | Concepts Data Flow Performance Sources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/concepts-data-flow-performance-sources.md | You can read from Azure SQL Database using a table or a SQL query. If you are ex ## Azure Synapse Analytics sources -When using Azure Synapse Analytics, a setting called **Enable staging** exists in the source options. This allows the service to read from Synapse using ```Staging```, which greatly improves read performance by using the [Synapse COPY statement](/sql/t-sql/statements/copy-into-transact-sql) command for the most performant bulk loading capability. Enabling ```Staging``` requires you to specify an Azure Blob Storage or Azure Data Lake Storage gen2 staging location in the data flow activity settings. +When using Azure Synapse Analytics, a setting called **Enable staging** exists in the source options. This allows the service to read from Synapse using ```Staging``` which greatly improves read performance by using the most performant bulk loading capability such as CETAS and COPY command. Enabling ```Staging``` requires you to specify an Azure Blob Storage or Azure Data Lake Storage gen2 staging location in the data flow activity settings. :::image type="content" source="media/data-flow/enable-staging.png" alt-text="Enable staging"::: |
| data-factory | Connector Rest | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-rest.md | The following properties are supported for the REST linked service: | type | The **type** property must be set to **RestService**. | Yes | | url | The base URL of the REST service. | Yes | | enableServerCertificateValidation | Whether to validate server-side TLS/SSL certificate when connecting to the endpoint. | No<br /> (the default is **true**) |-| authenticationType | Type of authentication used to connect to the REST service. Allowed values are **Anonymous**, **Basic**, **AadServicePrincipal**, and **ManagedServiceIdentity**. User-based OAuth isn't supported. You can additionally configure authentication headers in `authHeader` property. Refer to corresponding sections below on more properties and examples respectively.| Yes | +| authenticationType | Type of authentication used to connect to the REST service. Allowed values are **Anonymous**, **Basic**, **AadServicePrincipal**, **OAuth2ClientCredential**, and **ManagedServiceIdentity**. You can additionally configure authentication headers in `authHeader` property. Refer to corresponding sections below on more properties and examples respectively.| Yes | | authHeaders | Additional HTTP request headers for authentication.<br/> For example, to use API key authentication, you can select authentication type as ΓÇ£AnonymousΓÇ¥ and specify API key in the header. | No | | connectVia | The [Integration Runtime](concepts-integration-runtime.md) to use to connect to the data store. Learn more from [Prerequisites](#prerequisites) section. If not specified, this property uses the default Azure Integration Runtime. |No | +For different authentication types, see the corresponding sections for details. +- [Basic authentication](#use-basic-authentication) +- [AAD service principal authentication](#use-aad-service-principal-authentication) +- [OAuth2 Client Credential authentication](#use-oauth2-client-credential-authentication) +- [User-assigned managed identity authentication](#use-user-assigned-managed-identity-authentication) +- [Anonymous authentication](#using-authentication-headers) + ### Use basic authentication Set the **authenticationType** property to **Basic**. In addition to the generic properties that are described in the preceding section, specify the following properties: Set the **authenticationType** property to **AadServicePrincipal**. In addition | aadResourceId | Specify the AAD resource you are requesting for authorization, for example, `https://management.core.windows.net`.| Yes | | azureCloudType | For service principal authentication, specify the type of Azure cloud environment to which your AAD application is registered. <br/> Allowed values are **AzurePublic**, **AzureChina**, **AzureUsGovernment**, and **AzureGermany**. By default, the data factory's cloud environment is used. | No | -**Example** +**Example** ```json { Set the **authenticationType** property to **AadServicePrincipal**. In addition } } ```+### Use OAuth2 Client Credential authentication ++Set the **authenticationType** property to **OAuth2ClientCredential**. In addition to the generic properties that are described in the preceding section, specify the following properties: ++| Property | Description | Required | +|: |: |: | +| tokenEndpoint| The token endpoint of the authorization server to acquire the access token. | Yes | +| clientId | The client ID associated with your application. | Yes | +| clientSecret| The client secret associated with your application. Mark this field as a **SecureString** type to store it securely in Data Factory. You can also [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). | Yes | +| scope | The scope of the access required. It describes what kind of access will be requested. | No | +| resource | The target service or resource to which the access will be requested. | No | ++**Example** ++```json +{ + "name": "RESTLinkedService", + "properties": { + "type": "RestService", + "typeProperties": { + "url": "<REST endpoint e.g. https://www.example.com/>", + "enableServerCertificateValidation": true, + "authenticationType": "OAuth2ClientCredential", + "clientId": "<client ID>", + "clientSecret": { + "type": "SecureString", + "value": "<client secret>" + }, + "tokenEndpoint": "<token endpoint>", + "scope": "<scope>", + "resource": "<resource>" + } + } +} +``` ### Use user-assigned managed identity authentication Set the **authenticationType** property to **ManagedServiceIdentity**. In addition to the generic properties that are described in the preceding section, specify the following properties: The pagination rule syntax is the same as in Example 8 and should be set as belo :::image type="content" source="media/connector-rest/pagination-rule-example-9.png" alt-text="Screenshot showing setting the pagination rule for Example 9."::: --## Use OAuth -This section describes how to use a solution template to copy data from REST connector into Azure Data Lake Storage in JSON format using OAuth. --### About the solution template --The template contains two activities: -- **Web** activity retrieves the bearer token and then pass it to subsequent Copy activity as authorization.-- **Copy** activity copies data from REST to Azure Data Lake Storage.--The template defines two parameters: -- **SinkContainer** is the root folder path where the data is copied to in your Azure Data Lake Storage. -- **SinkDirectory** is the directory path under the root where the data is copied to in your Azure Data Lake Storage. --### How to use this solution template --1. Go to the **Copy from REST or HTTP using OAuth** template. Create a new connection for Source Connection. - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/source-connection.png" alt-text="Create new connections"::: -- Below are key steps for new linked service (REST) settings: - - 1. Under **Base URL**, specify the url parameter for your own source REST service. - 2. For **Authentication type**, choose *Anonymous*. - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/new-rest-connection.png" alt-text="New REST connection"::: --2. Create a new connection for Destination Connection. - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/destination-connection.png" alt-text="New Gen2 connection"::: --3. Select **Use this template**. - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/use-this-template.png" alt-text="Use this template"::: --4. You would see the pipeline created as shown in the following example: - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/pipeline.png" alt-text="Screenshot shows the pipeline created from the template."::: --5. Select **Web** activity. In **Settings**, specify the corresponding **URL**, **Method**, **Headers**, and **Body** to retrieve OAuth bearer token from the login API of the service that you want to copy data from. The placeholder in the template showcases a sample of Azure Active Directory (AAD) OAuth. Note AAD authentication is natively supported by REST connector, here is just an example for OAuth flow. -- | Property | Description | - |: |: | - | URL |Specify the url to retrieve OAuth bearer token from. for example, in the sample here it's https://login.microsoftonline.com/microsoft.onmicrosoft.com/oauth2/token | - | Method | The HTTP method. Allowed values are **Post** and **Get**. | - | Headers | Header is user-defined, which references one header name in the HTTP request. | - | Body | The body for the HTTP request. | -- :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/web-settings.png" alt-text="Pipeline"::: --6. In **Copy data** activity, select *Source* tab, you could see that the bearer token (access_token) retrieved from previous step would be passed to Copy data activity as **Authorization** under Additional headers. Confirm settings for following properties before starting a pipeline run. -- | Property | Description | - |: |: | - | Request method | The HTTP method. Allowed values are **Get** (default) and **Post**. | - | Additional headers | Additional HTTP request headers.| -- :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/copy-data-settings.png" alt-text="Copy source Authentication"::: --7. Select **Debug**, enter the **Parameters**, and then select **Finish**. - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/pipeline-run.png" alt-text="Pipeline run"::: --8. When the pipeline run completes successfully, you would see the result similar to the following example: - :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/run-result.png" alt-text="Pipeline run result"::: --9. Click the "Output" icon of WebActivity in **Actions** column, you would see the access_token returned by the service. -- :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/token-output.png" alt-text="Token output"::: --10. Click the "Input" icon of CopyActivity in **Actions** column, you would see the access_token retrieved by WebActivity is passed to CopyActivity for authentication. -- :::image type="content" source="media/solution-template-copy-from-rest-or-http-using-oauth/token-input.png" alt-text="Token input"::: - - >[!CAUTION] - >To avoid token being logged in plain text, enable "Secure output" in Web activity and "Secure input" in Copy activity. -- ## Export JSON response as-is You can use this REST connector to export REST API JSON response as-is to various file-based stores. To achieve such schema-agnostic copy, skip the "structure" (also called *schema*) section in dataset and schema mapping in copy activity. |
| data-factory | Connector Snowflake | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/connector-snowflake.md | This Snowflake connector is supported for the following activities: - [Copy activity](copy-activity-overview.md) with a [supported source/sink matrix](copy-activity-overview.md) table - [Mapping data flow](concepts-data-flow-overview.md) - [Lookup activity](control-flow-lookup-activity.md)+- [Script activity](transform-data-using-script.md) For the Copy activity, this Snowflake connector supports the following functions: For the Copy activity, this Snowflake connector supports the following functions - Copy data to Snowflake that takes advantage of Snowflake's [COPY into [table]](https://docs.snowflake.com/en/sql-reference/sql/copy-into-table.html) command to achieve the best performance. It supports Snowflake on Azure. - If a proxy is required to connect to Snowflake from a self-hosted Integration Runtime, you must configure the environment variables for HTTP_PROXY and HTTPS_PROXY on the Integration Runtime host. +## Prerequisites ++If your data store is located inside an on-premises network, an Azure virtual network, or Amazon Virtual Private Cloud, you need to configure a [self-hosted integration runtime](create-self-hosted-integration-runtime.md) to connect to it. Make sure to add the IP addresses that the self-hosted integration runtime uses to the allowed list. ++If your data store is a managed cloud data service, you can use the Azure Integration Runtime. If the access is restricted to IPs that are approved in the firewall rules, you can add [Azure Integration Runtime IPs](azure-integration-runtime-ip-addresses.md) to the allowed list. ++For more information about the network security mechanisms and options supported by Data Factory, see [Data access strategies](data-access-strategies.md). + ## Get started [!INCLUDE [data-factory-v2-connector-get-started](includes/data-factory-v2-connector-get-started.md)] When your sink data store or format is not natively compatible with the Snowflak To use this feature, create an [Azure Blob storage linked service](connector-azure-blob-storage.md#linked-service-properties) that refers to the Azure storage account as the interim staging. Then specify the `enableStaging` and `stagingSettings` properties in the Copy activity. > [!NOTE]-> The staging Azure Blob storage linked service must use shared access signature authentication, as required by the Snowflake COPY command. +> The staging Azure Blob storage linked service must use shared access signature authentication, as required by the Snowflake COPY command. Make sure you grant proper access permission to Snowflake in the staging Azure Blob storage. To learn more about this, see this [article](https://docs.snowflake.com/en/user-guide/data-load-azure-config.html#option-2-generating-a-sas-token). **Example:** |
| data-factory | Data Access Strategies | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/data-access-strategies.md | This should work in many scenarios, and we do understand that a unique Static IP ## Data access strategies through Azure Data Factory -* **[Private Link](../private-link/private-link-overview.md)** - You can create an Azure Integration Runtime within Azure Data Factory Managed Virtual Network and it will leverage private endpoints to securely connect to supported data stores. Traffic between Managed Virtual Network and data sources travels the Microsoft backbone network and are not exposure to public network. +* **[Private Link](../private-link/private-link-overview.md)** - You can create an Azure Integration Runtime within Azure Data Factory Managed Virtual Network and it will leverage private endpoints to securely connect to supported data stores. Traffic between Managed Virtual Network and data sources travels the Microsoft backbone network and is not exposed to the public network. * **[Trusted Service](../storage/common/storage-network-security.md#exceptions)** - Azure Storage (Blob, ADLS Gen2) supports firewall configuration that enables select trusted Azure platform services to access the storage account securely. Trusted Services enforces Managed Identity authentication, which ensures no other data factory can connect to this storage unless approved to do so using it's managed identity. You can find more details in **[this blog](https://techcommunity.microsoft.com/t5/azure-data-factory/data-factory-is-now-a-trusted-service-in-azure-storage-and-azure/ba-p/964993)**. Hence, this is extremely secure and recommended. * **Unique Static IP** - You will need to set up a self-hosted integration runtime to get a Static IP for Data Factory connectors. This mechanism ensures you can block access from all other IP addresses. * **[Static IP range](./azure-integration-runtime-ip-addresses.md)** - You can use Azure Integration Runtime's IP addresses to allow list it in your storage (say S3, Salesforce, etc.). It certainly restricts IP addresses that can connect to the data stores but also relies on Authentication/ Authorization rules. |
| defender-for-cloud | Alerts Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/alerts-reference.md | description: This article lists the security alerts visible in Microsoft Defende Previously updated : 03/30/2022 Last updated : 06/20/2022 # Security alerts - a reference guide -This article lists the security alerts you might get from Microsoft Defender for Cloud and any Microsoft Defender plans you've enabled. The alerts shown in your environment depend on the resources and services you're protecting, as well as your customized configuration. +This article lists the security alerts you might get from Microsoft Defender for Cloud and any Microsoft Defender plans you've enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration. At the bottom of this page, there's a table describing the Microsoft Defender for Cloud kill chain aligned with version 9 of the [MITRE ATT&CK matrix](https://attack.mitre.org/versions/v9/). Microsoft Defender for Containers provides security alerts on the cluster level -## <a name="alerts-azurecosmos"></a>Alerts for Azure Cosmos DB (Preview) +## <a name="alerts-azurecosmos"></a>Alerts for Azure Cosmos DB [Further details and notes](concept-defender-for-cosmos.md) | Alert (alert type)| Description | MITRE tactics<br>([Learn more](#intentions)) | Severity | |--|--|:-:|--|-| **PREVIEW - Access from a Tor exit node** <br> (CosmosDB_TorAnomaly) | This Azure Cosmos DB account was successfully accessed from an IP address known to be an active exit node of Tor, an anonymizing proxy. Authenticated access from a Tor exit node is a likely indication that a threat actor is trying to hide their identity. | Initial Access | High/Medium | -| **PREVIEW - Access from a suspicious IP**<br>(CosmosDB_SuspiciousIp) | This Azure Cosmos DB account was successfully accessed from an IP address that was identified as a threat by Microsoft Threat Intelligence. | Initial Access | Medium | -| **PREVIEW - Access from an unusual location**<br>(CosmosDB_GeoAnomaly) | This Azure Cosmos DB account was accessed from a location considered unfamiliar, based on the usual access pattern. <br><br> Either a threat actor has gained access to the account, or a legitimate user has connected from a new or unusual geographic location | Initial Access | Low | -| **PREVIEW - Unusual volume of data extracted**<br>(CosmosDB_DataExfiltrationAnomaly) | An unusually large volume of data has been extracted from this Azure Cosmos DB account. This might indicate that a threat actor exfiltrated data. | Exfiltration | Medium | -| **PREVIEW - Extraction of Azure Cosmos DB accounts keys via a potentially malicious script**<br>(CosmosDB_SuspiciousListKeys.MaliciousScript) | A PowerShell script was run in your subscription and performed a suspicious pattern of key-listing operations to get the keys of Azure Cosmos DB accounts in your subscription. Threat actors use automated scripts, like Microburst, to list keys and find Azure Cosmos DB accounts they can access. <br><br> This operation might indicate that an identity in your organization was breached, and that the threat actor is trying to compromise Azure Cosmos DB accounts in your environment for malicious intentions. <br><br> Alternatively, a malicious insider could be trying to access sensitive data and perform lateral movement. | Collection | High | -| **PREVIEW - SQL injection: potential data exfiltration**<br>(CosmosDB_SqlInjection.DataExfiltration) | A suspicious SQL statement was used to query a container in this Azure Cosmos DB account. <br><br> The injected statement might have succeeded in exfiltrating data that the threat actor isnΓÇÖt authorized to access. <br><br> Due to the structure and capabilities of Azure Cosmos DB queries, many known SQL injection attacks on Azure Cosmos DB accounts cannot work. However, the variation used in this attack may work and threat actors can exfiltrate data. | Exfiltration | Medium | -| **PREVIEW - SQL injection: fuzzing attempt**<br>(CosmosDB_SqlInjection.FailedFuzzingAttempt) | A suspicious SQL statement was used to query a container in this Azure Cosmos DB account. <br><br> Like other well-known SQL injection attacks, this attack wonΓÇÖt succeed in compromising the Azure Cosmos DB account. <br><br> Nevertheless, itΓÇÖs an indication that a threat actor is trying to attack the resources in this account, and your application may be compromised. <br><br> Some SQL injection attacks can succeed and be used to exfiltrate data. This means that if the attacker continues performing SQL injection attempts, they may be able to compromise your Azure Cosmos DB account and exfiltrate data. <br><br> You can prevent this threat by using parameterized queries. | Pre-attack | Low | +| **Access from a Tor exit node** <br> (CosmosDB_TorAnomaly) | This Azure Cosmos DB account was successfully accessed from an IP address known to be an active exit node of Tor, an anonymizing proxy. Authenticated access from a Tor exit node is a likely indication that a threat actor is trying to hide their identity. | Initial Access | High/Medium | +| **Access from a suspicious IP**<br>(CosmosDB_SuspiciousIp) | This Azure Cosmos DB account was successfully accessed from an IP address that was identified as a threat by Microsoft Threat Intelligence. | Initial Access | Medium | +| **Access from an unusual location**<br>(CosmosDB_GeoAnomaly) | This Azure Cosmos DB account was accessed from a location considered unfamiliar, based on the usual access pattern. <br><br> Either a threat actor has gained access to the account, or a legitimate user has connected from a new or unusual geographic location | Initial Access | Low | +| **Unusual volume of data extracted**<br>(CosmosDB_DataExfiltrationAnomaly) | An unusually large volume of data has been extracted from this Azure Cosmos DB account. This might indicate that a threat actor exfiltrated data. | Exfiltration | Medium | +| **Extraction of Azure Cosmos DB accounts keys via a potentially malicious script**<br>(CosmosDB_SuspiciousListKeys.MaliciousScript) | A PowerShell script was run in your subscription and performed a suspicious pattern of key-listing operations to get the keys of Azure Cosmos DB accounts in your subscription. Threat actors use automated scripts, like Microburst, to list keys and find Azure Cosmos DB accounts they can access. <br><br> This operation might indicate that an identity in your organization was breached, and that the threat actor is trying to compromise Azure Cosmos DB accounts in your environment for malicious intentions. <br><br> Alternatively, a malicious insider could be trying to access sensitive data and perform lateral movement. | Collection | High | +| **SQL injection: potential data exfiltration**<br>(CosmosDB_SqlInjection.DataExfiltration) | A suspicious SQL statement was used to query a container in this Azure Cosmos DB account. <br><br> The injected statement might have succeeded in exfiltrating data that the threat actor isnΓÇÖt authorized to access. <br><br> Due to the structure and capabilities of Azure Cosmos DB queries, many known SQL injection attacks on Azure Cosmos DB accounts cannot work. However, the variation used in this attack may work and threat actors can exfiltrate data. | Exfiltration | Medium | +| **SQL injection: fuzzing attempt**<br>(CosmosDB_SqlInjection.FailedFuzzingAttempt) | A suspicious SQL statement was used to query a container in this Azure Cosmos DB account. <br><br> Like other well-known SQL injection attacks, this attack wonΓÇÖt succeed in compromising the Azure Cosmos DB account. <br><br> Nevertheless, itΓÇÖs an indication that a threat actor is trying to attack the resources in this account, and your application may be compromised. <br><br> Some SQL injection attacks can succeed and be used to exfiltrate data. This means that if the attacker continues performing SQL injection attempts, they may be able to compromise your Azure Cosmos DB account and exfiltrate data. <br><br> You can prevent this threat by using parameterized queries. | Pre-attack | Low | |
| defender-for-cloud | Continuous Export | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/continuous-export.md | Title: Continuous export can send Microsoft Defender for Cloud's alerts and recommendations to Log Analytics workspaces or Azure Event Hubs description: Learn how to configure continuous export of security alerts and recommendations to Log Analytics workspaces or Azure Event Hubs -- Previously updated : 12/09/2021 Last updated : 06/19/2022 # Continuously export Microsoft Defender for Cloud data The steps below are necessary whether you're setting up a continuous export to L 1. From the "Export target" area, choose where you'd like the data saved. Data can be saved in a target on a different subscription (for example on a Central Event Hub instance or a central Log Analytics workspace). 1. Select **Save**. +> [!NOTE] +> Log analytics supports records that are only up to 32KB in size. When the data limit is reached, you will see an alert telling you that the `Data limit has been exceeded`. + ### [**Use the REST API**](#tab/rest-api) ### Configure continuous export using the REST API |
| defender-for-cloud | Defender For Cloud Introduction | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-cloud-introduction.md | The **Defender plans** of Microsoft Defender for Cloud offer comprehensive defen - [Microsoft Defender for Resource Manager](defender-for-resource-manager-introduction.md) - [Microsoft Defender for DNS](defender-for-dns-introduction.md) - [Microsoft Defender for open-source relational databases](defender-for-databases-introduction.md)-- [Microsoft Defender for Azure Cosmos DB (Preview)](concept-defender-for-cosmos.md)+- [Microsoft Defender for Azure Cosmos DB](concept-defender-for-cosmos.md) Use the advanced protection tiles in the [workload protections dashboard](workload-protections-dashboard.md) to monitor and configure each of these protections. |
| defender-for-cloud | Defender For Containers Introduction | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/defender-for-containers-introduction.md | No, AKS is a managed service, and manipulation of the IaaS resources isn't suppo ## Learn More -You can check out the following blogs: +Learn more about Defender for Containers: -- [How to demonstrate the new containers features in Microsoft Defender for Cloud](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-to-demonstrate-the-new-containers-features-in-microsoft/ba-p/3281172) - [Introducing Microsoft Defender for Containers](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/introducing-microsoft-defender-for-containers/ba-p/2952317)+- [Demonstrating Microsoft Defender for Cloud](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-to-demonstrate-the-new-containers-features-in-microsoft/ba-p/3281172) +- The release state of Defender for Containers is broken down by two dimensions: environment and feature. So, for example: + - **Kubernetes data plane recommendations** for AKS clusters are GA + - **Kubernetes data plane recommendations** for EKS clusters are preview ++ To view the status of the full matrix of features and environments, see [Microsoft Defender for Containers feature availability](supported-machines-endpoint-solutions-clouds-containers.md). ## Next steps |
| defender-for-cloud | Other Threat Protections | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/other-threat-protections.md | Some network configurations restrict Defender for Cloud from generating alerts o For a list of the Azure network layer alerts, see the [Reference table of alerts](alerts-reference.md#alerts-azurenetlayer). -## Threat protection for Azure Cosmos DB (Preview)<a name="cosmos-db"></a> +## Threat protection for Azure Cosmos DB<a name="cosmos-db"></a> The Azure Cosmos DB alerts are generated by unusual and potentially harmful attempts to access or exploit Azure Cosmos DB accounts. For more information, see: -- [Advanced threat protection for Azure Cosmos DB (Preview)](../cosmos-db/cosmos-db-advanced-threat-protection.md)-- [The list of threat protection alerts for Azure Cosmos DB (Preview)](alerts-reference.md#alerts-azurecosmos)+- [Advanced threat protection for Azure Cosmos DB](../cosmos-db/cosmos-db-advanced-threat-protection.md) +- [The list of threat protection alerts for Azure Cosmos DB](alerts-reference.md#alerts-azurecosmos) ## Display recommendations in Microsoft Defender for Cloud Apps <a name="azure-mcas"></a> |
| defender-for-cloud | Quickstart Enable Database Protections | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/quickstart-enable-database-protections.md | Title: Enable database protection for your subscription description: Learn how to enable Microsoft Defender for Cloud for all of your database types for your entire subscription. Previously updated : 03/21/2022 Last updated : 06/19/2022 # Quickstart: Microsoft Defender for Cloud database protection -This article explains how to enable Microsoft Defender for Cloud's database (DB) protection for all database types that exist on your subscription. +This article explains how to enable Microsoft Defender for Cloud's database (DB) protection for the most common database types that exist on your subscription. Workload protections are provided through the Microsoft Defender plans that are specific to the types of resources in your subscriptions. In this article, you learned how to enable Microsoft Defender for Cloud for all - [Microsoft Defender for Azure SQL databases](defender-for-sql-introduction.md) - [Microsoft Defender for open-source relational databases](defender-for-databases-introduction.md)-- [Microsoft Defender for Azure Cosmos DB (Preview)](concept-defender-for-cosmos.md)+- [Microsoft Defender for Azure Cosmos DB](concept-defender-for-cosmos.md) - [Microsoft Defender for SQL servers on machines](defender-for-sql-usage.md) |
| defender-for-cloud | Quickstart Onboard Aws | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/quickstart-onboard-aws.md | Title: Connect your AWS account to Microsoft Defender for Cloud description: Defend your AWS resources with Microsoft Defender for Cloud Previously updated : 06/15/2022 Last updated : 06/19/2022 zone_pivot_groups: connect-aws-accounts You can learn more from the product manager about Microsoft Defender for Cloud's > [!NOTE] > To enable the Azure Arc auto-provisioning, you'll need an **Owner** permission on the relevant Azure subscription. - - If you want to manually install Azure Arc on your existing and future EC2 instances, use the [EC2 instances should be connected to Azure Arc](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/231dee23-84db-44d2-bd9d-c32fbcfb42a3) recommendation to identify instances that do not have Azure Arc installed. + - If you want to manually install Azure Arc on your existing and future EC2 instances, use the [EC2 instances should be connected to Azure Arc](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/231dee23-84db-44d2-bd9d-c32fbcfb42a3) recommendation to identify instances that don't have Azure Arc installed. - Additional extensions should be enabled on the Arc-connected machines. - Microsoft Defender for Endpoint If you have any existing connectors created with the classic cloud connectors ex - (Optional) Select **Configure**, to edit the configuration as required. -1. By default the **Containers** plan is set to **On**. This is necessary to have Defender for Containers protect your AWS EKS clusters. Ensure you have fulfilled the [network requirements](./defender-for-containers-enable.md?pivots=defender-for-container-eks&source=docs&tabs=aks-deploy-portal%2ck8s-deploy-asc%2ck8s-verify-asc%2ck8s-remove-arc%2caks-removeprofile-api#network-requirements) for the Defender for Containers plan. +1. By default the **Containers** plan is set to **On**. This is necessary to have Defender for Containers protect your AWS EKS clusters. Ensure you've fulfilled the [network requirements](./defender-for-containers-enable.md?pivots=defender-for-container-eks&source=docs&tabs=aks-deploy-portal%2ck8s-deploy-asc%2ck8s-verify-asc%2ck8s-remove-arc%2caks-removeprofile-api#network-requirements) for the Defender for Containers plan. > [!Note] > Azure Arc-enabled Kubernetes, the Defender Arc extension, and the Azure Policy Arc extension should be installed. Use the dedicated Defender for Cloud recommendations to deploy the extensions (and Arc, if necessary) as explained in [Protect Amazon Elastic Kubernetes Service clusters](defender-for-containers-enable.md?tabs=defender-for-container-eks). If you have any existing connectors created with the classic cloud connectors ex 1. Download the CloudFormation template. -1. Using the downloaded CloudFormation template, create the stack in AWS as instructed on screen. If you are onboarding a management account, you'll need to run the CloudFormation template both as Stack and as StackSet. Connectors will be created for the member accounts up to 24 hours after the onboarding. +1. Using the downloaded CloudFormation template, create the stack in AWS as instructed on screen. If you're onboarding a management account, you'll need to run the CloudFormation template both as Stack and as StackSet. Connectors will be created for the member accounts up to 24 hours after the onboarding. 1. Select **Next: Review and generate**. For other operating systems, the SSM Agent should be installed manually using th - [Install SSM Agent for a hybrid environment (Windows)](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-managed-win.html) - [Install SSM Agent for a hybrid environment (Linux)](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-install-managed-linux.html) +### For the CSPM plan, what IAM permissions are needed to discover AWS resources? ++The following IAM permissions are needed to discover AWS resources: ++| DataCollector | AWS Permissions | +|--|--| +| API Gateway | apigateway:GET | +| Application Auto Scaling | application-autoscaling:Describe* | +| Auto scaling | autoscaling-plans:Describe* <br> autoscaling:Describe* | +| Certificate manager | acm-pca:Describe* <br> acm-pca:List* <br> acm:Describe* <br>acm:List* | +| CloudFormation | cloudformation:Describe* <br> cloudformation:List* | +| CloudFront | cloudfront:DescribeFunction <br> cloudfront:GetDistribution <br> cloudfront:GetDistributionConfig <br>cloudfront:List* | +| CloudTrail | cloudtrail:Describe* <br> cloudtrail:GetEventSelectors <br> cloudtrail:List* <br> cloudtrail:LookupEvents | +| CloudWatch | cloudwatch:Describe* <br> cloudwatch:List* | +| CloudWatch logs | logs:DescribeLogGroups <br> logs:DescribeMetricFilters | +| CodeBuild | codebuild:DescribeCodeCoverages <br> codebuild:DescribeTestCases <br> codebuild:List* | +| Config Service | config:Describe* <br> config:List* | +| DMS ΓÇô database migration service | dms:Describe* <br> dms:List* | +| DAX | dax:Describe* | +| DynamoDB | dynamodb:Describe* <br> dynamodb:List* | +| Ec2 | ec2:Describe* <br> ec2:GetEbsEncryptionByDefault | +| ECR | ecr:Describe* <br> ecr:List* | +| ECS | ecs:Describe* <br> ecs:List* | +| EFS | elasticfilesystem:Describe* | +| EKS | eks:Describe* <br> eks:List* | +| Elastic Beanstalk | elasticbeanstalk:Describe* <br> elasticbeanstalk:List* | +| ELB ΓÇô elastic load balancing (v1/2) | elasticloadbalancing:Describe* | +| Elastic search | es:Describe* <br> es:List* | +| EMR ΓÇô elastic map reduce | elasticmapreduce:Describe* <br> elasticmapreduce:GetBlockPublicAccessConfiguration <br> elasticmapreduce:List* <br> elasticmapreduce:View* | +| GuardDute | guardduty:DescribeOrganizationConfiguration <br> guardduty:DescribePublishingDestination <br> guardduty:List* | +| IAM | iam:Generate* <br> iam:Get* <br> iam:List*<br> iam:Simulate* | +| KMS | kms:Describe* <br> kms:List* | +| LAMDBA | lambda:GetPolicy <br> lambda:List* | +| Network firewall | network-firewall:DescribeFirewall <br> network-firewall:DescribeFirewallPolicy <br> network-firewall:DescribeLoggingConfiguration <br> network-firewall:DescribeResourcePolicy <br> network-firewall:DescribeRuleGroup <br> network-firewall:DescribeRuleGroupMetadata <br> network-firewall:ListFirewallPolicies <br> network-firewall:ListFirewalls <br> network-firewall:ListRuleGroups <br> network-firewall:ListTagsForResource | +| RDS | rds:Describe* <br> rds:List* | +| RedShift | redshift:Describe* | +| S3 and S3Control | s3:DescribeJob <br> s3:GetEncryptionConfiguration <br> s3:GetBucketPublicAccessBlock <br> s3:GetBucketTagging <br> s3:GetBucketLogging <br> s3:GetBucketAcl <br> s3:GetBucketLocation <br> s3:GetBucketPolicy <br> s3:GetReplicationConfiguration <br> s3:GetAccountPublicAccessBlock <br> s3:GetObjectAcl <br> s3:GetObjectTagging <br> s3:List* | +| SageMaker | sagemaker:Describe* <br> sagemaker:GetSearchSuggestions <br> sagemaker:List* <br> sagemaker:Search | +| Secret manager | secrets +| Simple notification service ΓÇô SNS | sns:Check* <br> sns:List* | +| SSM | ssm:Describe* <br> ssm:List* | +| SQS | sqs:List* <br> sqs:Receive* | +| STS | sts:GetCallerIdentity | +| WAF | waf-regional:Get* <br> waf-regional:List* <br> waf:List* <br> wafv2:CheckCapacity <br> wafv2:Describe* <br> wafv2:List* | + ## Learn more You can check out the following blogs: You can check out the following blogs: Connecting your AWS account is part of the multicloud experience available in Microsoft Defender for Cloud. For related information, see the following page: - [Security recommendations for AWS resources - a reference guide](recommendations-reference-aws.md).-- [Connect your GCP projects to Microsoft Defender for Cloud](quickstart-onboard-gcp.md)+- [Connect your GCP projects to Microsoft Defender for Cloud](quickstart-onboard-gcp.md) |
| defender-for-cloud | Release Notes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-cloud/release-notes.md | Title: Release notes for Microsoft Defender for Cloud description: A description of what's new and changed in Microsoft Defender for Cloud Previously updated : 06/16/2022 Last updated : 06/20/2022 # What's new in Microsoft Defender for Cloud? Updates in June include: - [Filter security alerts by IP address](#filter-security-alerts-by-ip-address) - [General availability (GA) of Defender for SQL on machines for AWS and GCP environments](#general-availability-ga-of-defender-for-sql-on-machines-for-aws-and-gcp-environments) - [Alerts by resource group](#alerts-by-resource-group)+- [General availability (GA) for Microsoft Defender for Azure Cosmos DB](#general-availability-ga-for-microsoft-defender-for-azure-cosmos-db) ### Drive implementation of security recommendations to enhance your security posture In many cases of attacks, you want to track alerts based on the IP address of th The database protection capabilities provided by Microsoft Defender for Cloud, has added support for your SQL servers that are hosted in either AWS or GCP environments. -Using Defender for SQL, enterprises can now protect their entire database estate, hosted in Azure, AWS, GCP and on-premises machines. +Defender for SQL, enterprises can now protect their entire database estate, hosted in Azure, AWS, GCP and on-premises machines. Microsoft Defender for SQL provides a unified multicloud experience to view security recommendations, security alerts and vulnerability assessment findings for both the SQL server and the underlining Windows OS. -Using the multicloud onboarding experience, you can enable and enforce databases protection for SQL servers running on AWS EC2, RDS Custom for SQL Server and GCP compute engine. After enabling either of these plans, all supported resources that exist within the subscription are protected. Future resources created on the same subscription will also be protected. +Using the multicloud onboarding experience, you can enable and enforce databases protection for SQL servers running on AWS EC2, RDS Custom for SQL Server and GCP compute engine. Once you've enabled either of these plans, all supported resources that exist within the subscription are protected. Future resources created on the same subscription will also be protected. Learn how to protect and connect your [AWS environment](quickstart-onboard-aws.md) and your [GCP organization](quickstart-onboard-gcp.md) with Microsoft Defender for Cloud. The ability to filter, sort and group by resource group has been added to the Se A resource group column has been added to the alerts grid. A new filter has been added which allows you to view all of the alerts for specific resource groups. A new filter has been added which allows you to view all of the alerts for speci You can now also group your alerts by resource group to view all of your alerts for each of your resource groups. ++### General availability (GA) for Microsoft Defender for Azure Cosmos DB ++Microsoft Defender for Azure Cosmos DB is now generally available (GA) and supports SQL (core) API account types. ++This new release to GA is a part of the Microsoft Defender for Cloud database protection suite, which includes different types of SQL databases, and MariaDB. Microsoft Defender for Azure Cosmos DB is an Azure native layer of security that detects attempts to exploit databases in your Azure Cosmos DB accounts. ++By enabling this plan, you'll be alerted to potential SQL injections, known bad actors, suspicious access patterns, and potential explorations of your database through compromised identities, or malicious insiders. ++When potentially malicious activities are detected, security alerts are generated. These alerts provide details of suspicious activity along with the relevant investigation steps, remediation actions, and security recommendations. ++Microsoft Defender for Azure Cosmos DB continuously analyzes the telemetry stream generated by the Azure Cosmos DB services and crosses them with Microsoft Threat Intelligence and behavioral models to detect any suspicious activity. Defender for Azure Cosmos DB doesn't access the Azure Cosmos DB account data and doesn't have any effect on your database's performance. ++Learn more about [Microsoft Defender for Azure Cosmos DB](concept-defender-for-cosmos.md). ++With the addition of support for Azure Cosmos DB, Defender for Cloud now provides one of the most comprehensive workload protection offerings for cloud-based databases. Security teams and database owners can now have a centralized experience to manage their database security of their environments. ++Learn how to [enable database protection](quickstart-enable-database-protections.md) for your databases today. ## May 2022 Updates in the UI include a reflection of the selected pricing tier and the requ ### Changes to vulnerability assessment -Defender for Containers now displays vulnerabilities that have medium and low severities that are not patchable. +Defender for Containers now displays vulnerabilities that have medium and low severities that aren't patchable. As part of this update, vulnerabilities that have medium and low severities are now shown, whether or not patches are available. This update provides maximum visibility, but still allows you to filter out undesired vulnerabilities by using the provided Disable rule. In addition, Defender for Cloud also begins gradual support for the [Defender fo ### Relocation of custom recommendations -Custom recommendations are those created by users and have no impact on the secure score. The custom recommendations can now be found under the All recommendations tab. +Custom recommendations are those created by users and have no effect on the secure score. The custom recommendations can now be found under the All recommendations tab. Use the new "recommendation type" filter, to locate custom recommendations. The recommendation `Azure Cache for Redis should reside within a virtual network ### New alert variant for Microsoft Defender for Storage (preview) to detect exposure of sensitive data -Microsoft Defender for Storage's alerts notify you when threat actors attempt to scan and expose, successfully or not, misconfigured, publicly open storage containers to try to exfiltrate sensitive information. +Microsoft Defender for Storage's alerts notifies you when threat actors attempt to scan and expose, successfully or not, misconfigured, publicly open storage containers to try to exfiltrate sensitive information. To allow for faster triaging and response time, when exfiltration of potentially sensitive data may have occurred, we've released a new variation to the existing `Publicly accessible storage containers have been exposed` alert. As organizations move away from using management certificates to manage their su |Recommendation |Description |Severity | ||||-| Service principals should be used to protect your subscriptions instead of Management Certificates | Management certificates allow anyone who authenticates with them to manage the subscription(s) they are associated with. To manage subscriptions more securely, using service principals with Resource Manager is recommended to limit the blast radius in the case of a certificate compromise. It also automates resource management. <br />(Related policy: [Service principals should be used to protect your subscriptions instead of management certificates](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f6646a0bd-e110-40ca-bb97-84fcee63c414)) |Medium | +| Service principals should be used to protect your subscriptions instead of Management Certificates | Management certificates allow anyone who authenticates with them to manage the subscription(s) they're associated with. To manage subscriptions more securely, using service principals with Resource Manager is recommended to limit the blast radius in the case of a certificate compromise. It also automates resource management. <br />(Related policy: [Service principals should be used to protect your subscriptions instead of management certificates](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f6646a0bd-e110-40ca-bb97-84fcee63c414)) |Medium | Learn more: - [Cloud Services (classic) deployment model is retiring on 31 August 2024](https://azure.microsoft.com/updates/cloud-services-retirement-announcement/) - [Overview of Azure Cloud Services (classic)](../cloud-services/cloud-services-choose-me.md)-- [Workflow of Windows Azure classic VM Architecture - including RDFE workflow basics](../cloud-services/cloud-services-workflow-process.md)+- [Workflow of Microsoft Azure classic VM Architecture - including RDFE workflow basics](../cloud-services/cloud-services-workflow-process.md) ### Legacy implementation of ISO 27001 replaced with new ISO 27001:2013 initiative The following recommendations are deprecated: ### Deprecated Microsoft Defender for IoT device alerts -All Microsoft Defenders for IoT device alerts are no longer visible in Microsoft Defender for Cloud. These alerts are still available on Microsoft Defender for IoT's Alert page, and in Microsoft Sentinel. +All of Microsoft's Defender for IoT device alerts are no longer visible in Microsoft Defender for Cloud. These alerts are still available on Microsoft Defender for IoT's Alert page, and in Microsoft Sentinel. ### Posture management and threat protection for AWS and GCP released for general availability (GA) |
| defender-for-iot | Concept Agent Based Security Alerts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-iot/device-builders/concept-agent-based-security-alerts.md | For more information, see [customizable alerts](concept-customizable-security-al | Suspicious compilation detected | Medium | Defender-IoT-micro-agent | Suspicious compilation detected. Malicious actors often compile exploits on a compromised machine to escalate privileges. | Review with the user that ran the command if this was legitimate activity that you expect to see on the device. If not, escalate the alert to the information security team. | IoT_SuspiciousCompilation | | Suspicious file download followed by file run activity | Medium | Defender-IoT-micro-agent | Analysis of host data detected a file that was downloaded and run in the same command. This technique is commonly used by malicious actors to get infected files onto victim machines. | Review with the user that ran the command if this was legitimate activity that you expect to see on the device. If not, escalate the alert to the information security team. | IoT_DownloadFileThenRun | | Suspicious IP address communication | Medium | Defender-IoT-micro-agent | Communication with a suspicious IP address detected. | Verify if the connection is legitimate. Consider blocking communication with the suspicious IP. | IoT_TiConnection |+| Malicious Domain Name Request | Medium | Defender-IoT-micro-agent | Suspicious network activity was detected. This activity may be associated with an attack exploiting a method used by known malware. | Disconnect the source from the network. Perform incident response. | IoT_MaliciousNameQueriesDetection | ### Low severity |
| defender-for-iot | How To Install Micro Agent For Edge | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/defender-for-iot/device-builders/how-to-install-micro-agent-for-edge.md | This article explains how to install, and authenticate the Defender micro agent ## Next steps > [!div class="nextstepaction"]-> [Building the Defender micro agent from source code](quickstart-building-the-defender-micro-agent-from-source.md) +> [Configure Microsoft Defender for IoT agent-based solution](tutorial-configure-agent-based-solution.md) |
| dns | Tutorial Alias Pip | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dns/tutorial-alias-pip.md | Create a Windows Server 2019 virtual machine. | **Administrator account** | | | Username | Enter a username. | | Password | Enter a password. |- | Confirm password | Reenter password. | + | Confirm password | Reenter the password. | | **Inbound port rules** | | | Public inbound ports | Select **None**. | Install IIS web server on **Web-01**. 1. Open *Web-01.rdp*, and select **Connect**. 1. Enter the username and password entered during virtual machine creation. 1. On the **Server Manager** dashboard, select **Manage** then **Add Roles and Features**.-1. Select **Server Roles** or select **Next** three times. On the **Server Roles** page, select **Web Server (IIS)**. +1. Select **Server Roles** or select **Next** three times. On the **Server Roles** screen, select **Web Server (IIS)**. 1. Select **Add Features**, and then select **Next**. - :::image type="content" source="./media/tutorial-alias-pip/iis-web-server-installation.png" alt-text="Screenshot of Add Roles and Features Wizard in Windows Server 2019 showing how to add the I I S Web Server."::: + :::image type="content" source="./media/tutorial-alias-pip/iis-web-server-installation.png" alt-text="Screenshot of Add Roles and Features Wizard in Windows Server 2019 showing how to install the I I S Web Server by adding Web Server role."::: 1. Select **Confirmation** or select **Next** three times, and then select **Install**. The installation process takes a few minutes to finish. 1. After the installation finishes, select **Close**. 1. Open a web browser. Browse to **localhost** to verify that the default IIS web page appears. - :::image type="content" source="./media/tutorial-alias-pip/iis-web-server.png" alt-text="Screenshot of Internet Explorer showing the I I S Web Server Welcome page."::: + :::image type="content" source="./media/tutorial-alias-pip/iis-web-server.png" alt-text="Screenshot of Internet Explorer showing the I I S Web Server default web page."::: ## Create an alias record Create an alias record that points to the public IP address. 1. In the Azure portal, enter *virtual machine* in the search box at the top of the portal, and then select **Virtual machines** from the search results. 1. Select the **Web-01** virtual machine. Note the public IP address in the **Overview** page.-1. From a web browser, browse to `web01.contoso.com`, which is the fully qualified domain name of the **Web-01** virtual machine. You now see the IIS welcome web page. +1. From a web browser, browse to `web01.contoso.com`, which is the fully qualified domain name of the **Web-01** virtual machine. You now see the IIS default web page. 1. Close the web browser. 1. Stop the **Web-01** virtual machine, and then restart it. 1. After the virtual machine restarts, note the new public IP address for the virtual machine. |
| dns | Tutorial Alias Tm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/dns/tutorial-alias-tm.md | Create two Windows Server 2019 virtual machines. | **Administrator account** | | | Username | Enter a username. | | Password | Enter a password. |- | Confirm password | Reenter password. | + | Confirm password | Reenter the password. | | **Inbound port rules** | | | Public inbound ports | Select **None**. | Install IIS on both **Web-01** and **Web-02** virtual machines. 1. Open *Web-01.rdp* file, and select **Connect**. 1. Enter the username and password entered during virtual machine creation. 1. On the **Server Manager** dashboard, select **Manage** then **Add Roles and Features**.-1. Select **Server Roles** or select **Next** three times. On the **Server Roles** page, select **Web Server (IIS)**. +1. Select **Server Roles** or select **Next** three times. On the **Server Roles** screen, select **Web Server (IIS)**. 1. Select **Add Features**, and then select **Next**. - :::image type="content" source="./media/tutorial-alias-tm/iis-web-server-installation.png" alt-text="Screenshot of Add Roles and Features Wizard in Windows Server 2019 showing how to add the I I S Web Server."::: + :::image type="content" source="./media/tutorial-alias-tm/iis-web-server-installation.png" alt-text="Screenshot of Add Roles and Features Wizard in Windows Server 2019 showing how to install the I I S Web Server by adding the Web Server role."::: 1. Select **Confirmation** or select **Next** three times, and then select **Install**. The installation process takes a few minutes to finish. 1. After the installation finishes, select **Close**.-1. Go to *C:\inetpub\wwwroot* and open *iisstart.htm* with Notepad or any editor of your choice. -1. Replace all the text in the file with `Hello World from Web-01` and save the *.htm* file. -1. Open a web browser. Browse to **localhost** to verify that the default IIS welcome page appears. +1. Go to *C:\inetpub\wwwroot* and open *iisstart.htm* with Notepad or any editor of your choice to edit the default IIS web page. +1. Replace all the text in the file with `Hello World from Web-01` and save the changes to *iisstart.htm*. +1. Open a web browser. Browse to **localhost** to verify that the default IIS web page appears. :::image type="content" source="./media/tutorial-alias-tm/iis-on-web-01-vm-in-web-browser.png" alt-text="Screenshot of Internet Explorer showing the I I S Web Server default page of first virtual machine."::: -1. Repeat previous steps to install IIS web server on **Web-02** virtual machine. Enter `Hello World from Web-02` in *iisstart.htm*. +1. Repeat previous steps to install IIS web server on **Web-02** virtual machine. Use `Hello World from Web-02` to replace all the text in *iisstart.htm*. ### Add a DNS label In this tutorial, you learned how to create an alias record to use your apex dom - Learn more about [alias records](dns-alias.md). - Learn more about [zones and records](dns-zones-records.md).-- Learn more about [Traffic Manager routing methods](../traffic-manager/traffic-manager-routing-methods.md).+- Learn more about [Traffic Manager routing methods](../traffic-manager/traffic-manager-routing-methods.md). |
| expressroute | Expressroute Locations Providers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/expressroute/expressroute-locations-providers.md | The following table shows connectivity locations and the service providers for e ### Global commercial Azure | **Location** | **Address** | **Zone** | **Local Azure regions** | **ER Direct** | **Service providers** | | | | | | | |-| **Abu Dhabi** | Etisalat KDC | 3 | n/a | Supported | | +| **Abu Dhabi** | Etisalat KDC | 3 | UAE Central | Supported | | | **Amsterdam** | [Equinix AM5](https://www.equinix.com/locations/europe-colocation/netherlands-colocation/amsterdam-data-centers/am5/) | 1 | West Europe | Supported | Aryaka Networks, AT&T NetBond, British Telecom, Colt, Equinix, euNetworks, GÉANT, InterCloud, Interxion, KPN, IX Reach, Level 3 Communications, Megaport, NTT Communications, Orange, Tata Communications, Telefonica, Telenor, Telia Carrier, Verizon, Zayo | | **Amsterdam2** | [Interxion AMS8](https://www.interxion.com/Locations/amsterdam/schiphol/) | 1 | West Europe | Supported| BICS, British Telecom, CenturyLink Cloud Connect, Colt, DE-CIX, Equinix, euNetworks, GÉANT, Interxion, NL-IX, NOS, NTT Global DataCenters EMEA, Orange, Vodafone | | **Atlanta** | [Equinix AT2](https://www.equinix.com/locations/americas-colocation/united-states-colocation/atlanta-data-centers/at2/) | 1 | n/a | Supported | Equinix, Megaport | The following table shows connectivity locations and the service providers for e | **Dallas** | [Equinix DA3](https://www.equinix.com/locations/americas-colocation/united-states-colocation/dallas-data-centers/da3/) | 1 | n/a | Supported | Aryaka Networks, AT&T NetBond, Cologix, Cox Business Cloud Port, Equinix, Intercloud, Internet2, Level 3 Communications, Megaport, Neutrona Networks, Orange, PacketFabric, Telmex Uninet, Telia Carrier, Transtelco, Verizon, Zayo| | **Denver** | [CoreSite DE1](https://www.coresite.com/data-centers/locations/denver/de1) | 1 | West Central US | Supported | CoreSite, Megaport, PacketFabric, Zayo | | **Doha2** | [Ooredoo](https://www.ooredoo.qa/portal/OoredooQatar/b2b-data-centre) | 3 | Qatar Central | Supported | |-| **Dubai** | [PCCS](https://www.pacificcontrols.net/cloudservices/https://docsupdatetracker.net/index.html) | 3 | UAE North | n/a | Etisalat UAE | +| **Dubai** | [PCCS](https://www.pacificcontrols.net/cloudservices/https://docsupdatetracker.net/index.html) | 3 | UAE North | Supported | Etisalat UAE | | **Dubai2** | [du datamena](http://datamena.com/solutions/data-centre) | 3 | UAE North | n/a | DE-CIX, du datamena, Equinix, GBI, Megaport, Orange, Orixcom | | **Dublin** | [Equinix DB3](https://www.equinix.com/locations/europe-colocation/ireland-colocation/dublin-data-centers/db3/) | 1 | North Europe | Supported | CenturyLink Cloud Connect, Colt, eir, Equinix, GEANT, euNetworks, Interxion, Megaport, Zayo| | **Dublin2** | [Interxion DUB2](https://www.interxion.com/locations/europe/dublin) | 1 | North Europe | Supported | Interxion | The following table shows connectivity locations and the service providers for e | **Singapore** | [Equinix SG1](https://www.equinix.com/data-centers/asia-pacific-colocation/singapore-colocation/singapore-data-center/sg1) | 2 | Southeast Asia | Supported | Aryaka Networks, AT&T NetBond, British Telecom, China Mobile International, Epsilon Global Communications, Equinix, InterCloud, Level 3 Communications, Megaport, NTT Communications, Orange, SingTel, Tata Communications, Telstra Corporation, Verizon, Vodafone | | **Singapore2** | [Global Switch Tai Seng](https://www.globalswitch.com/locations/singapore-data-centres/) | 2 | Southeast Asia | Supported | CenturyLink Cloud Connect, China Unicom Global, Colt, DE-CIX, Epsilon Global Communications, Equinix, Megaport, PCCW Global Limited, SingTel, Telehouse - KDDI | | **Stavanger** | [Green Mountain DC1](https://greenmountain.no/dc1-stavanger/) | 1 | Norway West | Supported |GlobalConnect, Megaport |-| **Stockholm** | [Equinix SK1](https://www.equinix.com/locations/europe-colocation/sweden-colocation/stockholm-data-centers/sk1/) | 1 | n/a | Supported | Equinix, Megaport, Telia Carrier | +| **Stockholm** | [Equinix SK1](https://www.equinix.com/locations/europe-colocation/sweden-colocation/stockholm-data-centers/sk1/) | 1 | Sweden Central | Supported | Equinix, Interxion, Megaport, Telia Carrier | | **Sydney** | [Equinix SY2](https://www.equinix.com/locations/asia-colocation/australia-colocation/sydney-data-centers/sy2/) | 2 | Australia East | Supported | AARNet, AT&T NetBond, British Telecom, Devoli, Equinix, Kordia, Megaport, NEXTDC, NTT Communications, Optus, Orange, Spark NZ, Telstra Corporation, TPG Telecom, Verizon, Vocus Group NZ | | **Sydney2** | [NextDC S1](https://www.nextdc.com/data-centres/s1-sydney-data-centre) | 2 | Australia East | Supported | Megaport, NextDC | | **Taipei** | Chief Telecom | 2 | n/a | Supported | Chief Telecom, Chunghwa Telecom, FarEasTone | | **Tokyo** | [Equinix TY4](https://www.equinix.com/locations/asia-colocation/japan-colocation/tokyo-data-centers/ty4/) | 2 | Japan East | n/a | Aryaka Networks, AT&T NetBond, BBIX, British Telecom, CenturyLink Cloud Connect, Colt, Equinix, Intercloud, Internet Initiative Japan Inc. - IIJ, Megaport, NTT Communications, NTT EAST, Orange, Softbank, Telehouse - KDDI, Verizon </br></br> **We are currently unable to support new ExpressRoute circuits in Tokyo. Please create new circuits in Tokyo2 or Osaka.* | | **Tokyo2** | [AT TOKYO](https://www.attokyo.com/) | 2 | Japan East | Supported | AT TOKYO, China Unicom Global, Colt, Fibrenoire, IX Reach, Megaport, PCCW Global Limited, Tokai Communications |+| **Tokyo3** | [NEC](https://www.nec.com/en/global/solutions/cloud/inzai_datacenter.html) | 2 | Japan East | Supported | | | **Toronto** | [Cologix TOR1](https://www.cologix.com/data-centers/toronto/tor1/) | 1 | Canada Central | Supported | AT&T NetBond, Bell Canada, CenturyLink Cloud Connect, Cologix, Equinix, IX Reach Megaport, Telus, Verizon, Zayo | | **Toronto2** | [Allied REIT](https://www.alliedreit.com/property/905-king-st-w/) | 1 | Canada Central | Supported | | | **Vancouver** | [Cologix VAN1](https://www.cologix.com/data-centers/vancouver/van1/) | 1 | n/a | Supported | Bell Canada, Cologix, Megaport, Telus, Zayo | |
| frontdoor | Troubleshoot Cross Origin Resources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/frontdoor/standard-premium/troubleshoot-cross-origin-resources.md | -> This documentation is for Azure Front Door Standard/Premium (Preview). Looking for information on Azure Front Door? View [here](../front-door-overview.md). +> This documentation is for Azure Front Door Standard/Premium. Looking for information on Azure Front Door? View [here](../front-door-overview.md). ## What is CORS? CORS (Cross Origin Resource Sharing) is an HTTP feature that enables a web application running under one domain to access resources in another domain. To reduce the possibility of cross-site scripting attacks, all modern web browsers implement a security restriction known as [same-origin policy](https://www.w3.org/Security/wiki/Same_Origin_Policy). This prevents a web page from calling APIs in a different domain. CORS provides a secure way to allow one origin (the origin domain) to call APIs in another origin. -> [!IMPORTANT] -> Azure Front Door Standard/Premium (Preview) is currently in public preview. -> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. -> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). - ## How it works There are two types of CORS requests, *simple requests* and *complex requests.* |
| governance | Create Management Group Javascript | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/management-groups/create-management-group-javascript.md | wherever JavaScript can be used, including [bash on Windows 10](/windows/wsl/ins 1. Add a reference to the Azure authentication library. ```bash- npm install @azure/ms-rest-nodeauth + npm install @azure/identity ``` > [!NOTE]- > Verify in _package.json_ `@azure/arm-managementgroups` is version **1.1.0** or higher and - > `@azure/ms-rest-nodeauth` is version **3.0.5** or higher. + > Verify in _package.json_ `@azure/arm-managementgroups` is version **2.0.1** or higher and + > `@azure/identity` is version **2.0.4** or higher. ## Create the management group 1. Create a new file named _index.js_ and enter the following code. ```javascript- const argv = require("yargs").argv; - const authenticator = require("@azure/ms-rest-nodeauth"); - const managementGroups = require("@azure/arm-managementgroups"); -- if (argv.groupID && argv.displayName) { - const createMG = async () => { - const credentials = await authenticator.interactiveLogin(); - const client = new managementGroups.ManagementGroupsAPI(credentials); - const result = await client.managementGroups.createOrUpdate( - groupId: argv.groupID, - { - displayName: argv.displayName - } - ); - console.log(result); - }; -- createMG(); + const argv = require("yargs").argv; + const { InteractiveBrowserCredential } = require("@azure/identity"); + const { ManagementGroupsAPI } = require("@azure/arm-managementgroups"); ++ if (argv.groupID && argv.displayName) { + const createMG = async () => { + const credentials = new InteractiveBrowserCredential(); + const client = new ManagementGroupsAPI(credentials); + const result = await client.managementGroups.beginCreateOrUpdateAndWait( + argv.groupID, + { + displayName: argv.displayName + } + ); + console.log(result); + }; ++ createMG(); } ``` The result of creating the management group is output to the console. If you wish to remove the installed libraries from your application, run the following command. ```bash-npm uninstall @azure/arm-managementgroups @azure/ms-rest-nodeauth yargs +npm uninstall @azure/arm-managementgroups @azure/identity yargs ``` ## Next steps |
| governance | Policy As Code Github | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/policy/tutorials/policy-as-code-github.md | Title: "Tutorial: Implement Azure Policy as Code with GitHub" -description: In this tutorial, you implement an Azure Policy as Code workflow with export, GitHub actions, and GitHub workflows +description: In this tutorial, you implement an Azure Policy as Code workflow with export, GitHub Actions, and GitHub workflows Last updated 06/07/2022 lifecycle process. These tasks include: > [!div class="checklist"] > - Export policy definitions and assignments to GitHub > - Push policy objects updated in GitHub to Azure-> - Trigger a compliance scan from the GitHub action +> - Trigger a compliance scan from the GitHub Actions If you would like to assign a policy to identify the current compliance state of your existing resources, the quickstart articles explain how to do so. To export a policy definition from Azure portal, follow these steps: 1. Select the **Sign in with GitHub** button. If you haven't yet authenticated with GitHub to authorize Azure Policy to export the resource, review the access the- [GitHub Action](https://github.com/features/actions) needs in the new window that opens and + [GitHub Actions](https://github.com/features/actions) needs in the new window that opens and select **Authorize AzureGitHubActions** to continue with the export process. Once complete, the new window self-closes. repository and _root level folder_: 1. The workflow also adds details in Azure Policy objects `properties.metadata` for you to track. - :::image type="content" source="../media/policy-as-code-github/updated-definition-metadata.png" alt-text="Screenshot of the Azure Policy definition in Azure portal updated with metadata specific to the GitHub action."::: + :::image type="content" source="../media/policy-as-code-github/updated-definition-metadata.png" alt-text="Screenshot of the Azure Policy definition in Azure portal updated with metadata specific to the GitHub Actions."::: -### Trigger compliance scans using GitHub action +### Trigger compliance scans using GitHub Actions Using the [Azure Policy Compliance Scan action](https://github.com/marketplace/actions/azure-policy-compliance-scan) In this tutorial, you successfully accomplished the following tasks: > [!div class="checklist"] > - Exported policy definitions and assignments to GitHub > - Pushed policy objects updated in GitHub to Azure-> - Triggered a compliance scan from the GitHub action +> - Triggered a compliance scan from the GitHub Actions ## Next steps |
| governance | Query Language | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/concepts/query-language.md | Title: Understand the query language description: Describes Resource Graph tables and the available Kusto data types, operators, and functions usable with Azure Resource Graph. Previously updated : 09/03/2021 Last updated : 06/15/2022 ++ # Understanding the Azure Resource Graph query language query language used by Resource Graph, start with the This article covers the language components supported by Resource Graph: -- [Resource Graph tables](#resource-graph-tables)-- [Resource Graph custom language elements](#resource-graph-custom-language-elements)-- [Supported KQL language elements](#supported-kql-language-elements)-- [Scope of the query](#query-scope)-- [Escape characters](#escape-characters)+- [Understanding the Azure Resource Graph query language](#understanding-the-azure-resource-graph-query-language) + - [Resource Graph tables](#resource-graph-tables) + - [Extended properties (preview)](#extended-properties-preview) + - [Resource Graph custom language elements](#resource-graph-custom-language-elements) + - [Shared query syntax (preview)](#shared-query-syntax-preview) + - [Supported KQL language elements](#supported-kql-language-elements) + - [Supported tabular/top level operators](#supported-tabulartop-level-operators) + - [Query scope](#query-scope) + - [Escape characters](#escape-characters) + - [Next steps](#next-steps) ## Resource Graph tables Resources > When limiting the `join` results with `project`, the property used by `join` to relate the two > tables, _subscriptionId_ in the above example, must be included in `project`. -## <a name="extended-properties"></a>Extended properties (preview) +## Extended properties (preview) As a _preview_ feature, some of the resource types in Resource Graph have additional type-related properties available to query beyond the properties provided by Azure Resource Manager. This set of Resources ## Resource Graph custom language elements -### <a name="shared-query-syntax"></a>Shared query syntax (preview) +### Shared query syntax (preview) As a preview feature, a [shared query](../tutorials/create-share-query.md) can be accessed directly in a Resource Graph query. This scenario makes it possible to create standard queries as shared Group' with ID 'myMG'. } ``` +The `AuthorizationScopeFilter` parameter enables you to list Azure Policy assignments inherited from upper scopes. The `AuthorizationScopeFilter` parameter accepts the following values: ++- **AtScopeAndBelow** (default if not specified): Returns policy assignments for the given scope and all child scopes +- **AtScopeAndAbove**: Returns policy assignments for the given scope and all parent scopes, but not child scopes +- **AtScopeAboveAndBelow**: Returns policy assignments for the given scope, all parent scopes and all child scopes +- **AtScopeExact**: Returns policy assignments only for the given scope; no parent or child scopes are included ++> [!NOTE] +> To use the `AuthorizationScope` parameter, be sure to reference the **2021-06-01-preview** API version in your requests. ++Example: Get all policy assignments at the **myMG** management group and Tenant Root (parent) scopes. ++- REST API URI ++ ```http + POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2021-06-01-preview + ``` ++- Request Body Sample ++ ```json + { + "authorizationScopeFilter": "AtScopeAndAbove", + "query": "PolicyResources | where type =~ 'Microsoft.Authorization/PolicyAssignments'", + "managementGroups": ["myMG"] + } + ``` ++Example: Get all policy assignments at the **mySubscriptionId** subscription, management group, and Tenant Root scopes. ++- REST API URI ++ ```http + POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2021-06-01-preview + ``` +- Request Body Sample ++ ```json + { + "authorizationScopeFilter": "AtScopeAndAbove", + "query": "PolicyResources | where type =~ 'Microsoft.Authorization/PolicyAssignments'", + "subscriptions": ["mySubscriptionId"] + } + ``` + ## Escape characters Some property names, such as those that include a `.` or `$`, must be wrapped or escaped in the |
| governance | Get Resource Changes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/how-to/get-resource-changes.md | Title: Get resource changes description: Understand how to find when a resource was changed and query the list of resource configuration changes at scale Previously updated : 03/08/2022 Last updated : 06/16/2022 # Get resource changes Monitor. > Resource configuration changes is for Azure Resource Manager properties. For tracking changes inside > a virtual machine, see Azure Automation's > [Change tracking](../../../automation/change-tracking/overview.md) or Azure Policy's-> [Guest Configuration for VMs](../../policy/concepts/guest-configuration.md). +> [Guest Configuration for VMs](../../policy/concepts/guest-configuration.md). To view examples of how to query Guest Configuration resources in Resource Graph, view [Azure Resource Graph queries by category - Azure Policy Guest Configuration](../samples/samples-by-category.md#azure-policy-guest-configuration). > [!IMPORTANT]-> Resource configuration changes only supports changes to resource types from the [Resources table](..//reference/supported-tables-resources.md#resources) in Resource Graph. This does not yet include changes to the resource container resources, such as Subscriptions and Resource groups. Changes are queryable for fourteen days. +> Resource configuration changes only supports changes to resource types from the [Resources table](..//reference/supported-tables-resources.md#resources) in Resource Graph. This does not yet include changes to the resource container resources, such as Subscriptions and Resource groups. Changes are queryable for fourteen days. For longer retention, you can [integrate your Resource Graph query with Azure Logic Apps](../tutorials/logic-app-calling-arg.md) and export query result to any of the Azure data stores (e.g., Log Analytics) for your desired retention. ## Find detected change events and view change details |
| governance | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/overview.md | Title: Overview of Azure Resource Graph description: Understand how the Azure Resource Graph service enables complex querying of resources at scale across subscriptions and tenants. Previously updated : 08/17/2021 Last updated : 06/15/2022 ++ # What is Azure Resource Graph? With Azure Resource Graph, you can: > [!NOTE] > As a _preview_ feature, some `type` objects have additional non-Resource Manager properties > available. For more information, see-> [Extended properties (preview)](./concepts/query-language.md#extended-properties). +> [Extended properties (preview)](./concepts/query-language.md#extended-properties-preview). ## How Resource Graph is kept current |
| governance | Advanced | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/samples/advanced.md | Title: Advanced query samples description: Use Azure Resource Graph to run some advanced queries, including working with columns, listing tags used, and matching resources with regular expressions. Previously updated : 10/01/2021 Last updated : 06/15/2022 ++ # Advanced Resource Graph query samples Search-AzGraph -Query "Resources | where type =~ 'microsoft.network/networkinter ## <a name="vm-powerstate"></a>Summarize virtual machine by the power states extended property -This query uses the [extended properties](../concepts/query-language.md#extended-properties) on +This query uses the [extended properties](../concepts/query-language.md#extended-properties-preview) on virtual machines to summarize by power states. ```kusto |
| governance | Create Share Query | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/tutorials/create-share-query.md | Title: "Tutorial: Manage queries in the Azure portal" description: In this tutorial, you create a Resource Graph Query and share the new query with others in the Azure portal. Previously updated : 08/17/2021 Last updated : 06/15/2022 ++ # Tutorial: Create and share an Azure Resource Graph query in the Azure portal Resources ## Run a shared query A Resource Graph shared query can be run with the `{{shared-query-uri}}` syntax (preview). For more-information, see [Shared query syntax](../concepts/query-language.md#shared-query-syntax). +information, see [Shared query syntax](../concepts/query-language.md#shared-query-syntax-preview). ## Delete a Shared query |
| hpc-cache | Hpc Cache Prerequisites | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hpc-cache/hpc-cache-prerequisites.md | description: Prerequisites for using Azure HPC Cache Previously updated : 05/16/2022 Last updated : 06/15/2022 These network-related prerequisites need to be set up before you can use your ca The Azure HPC Cache needs a dedicated subnet with these qualities: * The subnet must have at least 64 IP addresses available.+* Communication inside the subnet must be unrestricted. If you use a network security group for the cache subnet, make sure that it permits all services between internal IP addresses. * The subnet can't host any other VMs, even for related services like client machines. * If you use multiple Azure HPC Cache instances, each one needs its own subnet. |
| load-balancer | Ipv6 Configure Template Json | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/basic/ipv6-configure-template-json.md | |
| load-balancer | Ipv6 Add To Existing Vnet Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/ipv6-add-to-existing-vnet-cli.md | |
| load-balancer | Ipv6 Add To Existing Vnet Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/ipv6-add-to-existing-vnet-powershell.md | |
| load-balancer | Ipv6 Configure Standard Load Balancer Template Json | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/ipv6-configure-standard-load-balancer-template-json.md | |
| load-balancer | Ipv6 Dual Stack Standard Internal Load Balancer Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/ipv6-dual-stack-standard-internal-load-balancer-powershell.md | |
| load-balancer | Load Balancer Common Deployment Errors | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/load-balancer-common-deployment-errors.md | description: Describes how to resolve common errors when you deploy Azure Load B documentationcenter: na tags: top-support-issue-+ Last updated 11/22/2021-+ # Troubleshoot common Azure deployment errors with Azure Load Balancer |
| load-balancer | Load Balancer Insights | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/load-balancer-insights.md | Title: Insights for Azure Load Balancer description: Use the load balancer insights to achieve rapid fault localization and informed design decisions documentationcenter: na-+ na Last updated 10/27/2020-+ # Using Insights to monitor and configure your Azure Load Balancer |
| load-balancer | Load Balancer Standard Virtual Machine Scale Sets | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/load-balancer-standard-virtual-machine-scale-sets.md | |
| load-balancer | Quickstart Load Balancer Standard Internal Bicep | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/quickstart-load-balancer-standard-internal-bicep.md | Title: 'Quickstart: Create an internal Azure load balancer using Bicep' description: This quickstart shows how to create an internal Azure load balancer using Bicep. -+ -+ Last updated 04/29/2022 |
| load-balancer | Troubleshoot Rhc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/troubleshoot-rhc.md | Title: Troubleshoot Azure Load Balancer resource health, frontend, and backend a description: Use the available metrics to diagnose your degraded or unavailable Azure Standard Load Balancer. documentationcenter: na-+ na Last updated 08/14/2020-+ # Troubleshoot resource health, and inbound availability issues |
| load-balancer | Update Load Balancer With Vm Scale Set | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/update-load-balancer-with-vm-scale-set.md | Title: Update or delete an existing load balancer used by virtual machine scale sets-+ description: With this how-to article, get started with Azure Standard Load Balancer and virtual machine scale sets. documentationcenter: na-+ na Last updated 12/29/2020-+ # Update or delete a load balancer used by virtual machine scale sets |
| load-balancer | Upgrade Basicinternal Standard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/upgrade-basicInternal-standard.md | Title: Upgrade from Basic Internal to Standard Internal - Azure Load Balancer description: This article shows you how to upgrade Azure Internal Load Balancer from Basic SKU to Standard SKU -+ Last updated 08/07/2020-+ # Upgrade Azure Internal Load Balancer- No Outbound Connection Required |
| load-balancer | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-balancer/whats-new.md | Title: What's new in Azure Load Balancer description: Learn what's new with Azure Load Balancer, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes. -+ Last updated 11/17/2021-+ # What's new in Azure Load Balancer? |
| load-testing | How To High Scale Load | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-testing/how-to-high-scale-load.md | In this section, you configure the scaling settings of your load test. 1. Select **Apply** to modify the test and use the new configuration when you rerun it. -## Service quotas and limits --All Azure services set default limits and quotas for resources and features. The following table describes the maximum limits for Azure Load Testing. --|Resource |Limit | -||| -|Maximum concurrent engine instances that can be utilized per region per subscription | 100 | -|Maximum concurrent test runs per region per subscription | 25 | --You can increase the default limits and quotas by requesting the increase through an [Azure support request](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest). --1. Select **create a support ticket**. --1. Provide a summary of your issue. --1. Select **Issue type** as *Technical*. --1. Select your subscription. Then, select **Service Type** as *Azure Load Testing - Preview*. --1. Select **Problem type** as *Test Execution*. --1. Select **Problem subtype** as *Provisioning stalls or fails*. - ## Next steps - For more information about comparing test results, see [Compare multiple test results](./how-to-compare-multiple-test-runs.md).- - To learn about performance test automation, see [Configure automated performance testing](./tutorial-cicd-azure-pipelines.md).+- More information about [service limits and quotas in Azure Load Testing](./resource-limits-quotas-capacity.md). |
| load-testing | Resource Limits Quotas Capacity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/load-testing/resource-limits-quotas-capacity.md | + + Title: Service limits ++description: 'Service limits used for capacity planning and configuring high-scale load tests in Azure Load Testing.' +++++ Last updated : 06/20/2022+++# Service limits in Azure Load Testing Preview ++This section lists basic quotas and limits for Azure Load Testing Preview. ++> [!IMPORTANT] +> Azure Load Testing is currently in preview. For legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability, see the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). ++## Limits ++|Resource |Limit | +||| +|Maximum concurrent engine instances that can be utilized per region per subscription | 100 | +|Maximum concurrent test runs per region per subscription | 25 | ++## Increase quotas ++You can increase the default limits and quotas by requesting the increase through an [Azure support request](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest). ++1. Select **create a support ticket**. ++1. Provide a summary of your issue. ++1. Select **Issue type** as *Technical*. ++1. Select your subscription. Then, select **Service Type** as *Azure Load Testing - Preview*. ++1. Select **Problem type** as *Test Execution*. ++1. Select **Problem subtype** as *Provisioning stalls or fails*. ++## Next steps ++- Learn how to [set up a high-scale load test](./how-to-high-scale-load.md). +- Learn how to [configure automated performance testing](./tutorial-cicd-azure-pipelines.md). |
| logic-apps | Create Managed Service Identity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/logic-apps/create-managed-service-identity.md | The following table lists the operations where you can use either the system-ass | Operation type | Supported operations | |-|-| | Built-in | - Azure API Management <br>- Azure App Services <br>- Azure Functions <br>- HTTP <br>- HTTP + Webhook <p>**Note**: HTTP operations can authenticate connections to Azure Storage accounts behind Azure firewalls with the system-assigned identity. However, they don't support the user-assigned managed identity for authenticating the same connections. |-| Managed connector (**Preview**) | Single-authentication: <br>- Azure Automation <br>- Azure Event Grid <br>- Azure Key Vault <br>- Azure Resource Manager <br>- HTTP with Azure AD <p>Multi-authentication: <br>- Azure Blob Storage <br>- Azure Event Hubs <br>- Azure Service Bus <br>- SQL Server | +| Managed connector | Single-authentication: <br>- Azure Automation <br>- Azure Event Grid <br>- Azure Key Vault <br>- Azure Resource Manager <br>- HTTP with Azure AD <p>Multi-authentication: <br>- Azure Blob Storage <br>- Azure Event Hubs <br>- Azure Service Bus <br>- SQL Server | ||| ### [Standard](#tab/standard) The following table lists the operations where you can use both the system-assig | Operation type | Supported operations | |-|-| | Built-in | - HTTP <br>- HTTP + Webhook <p>**Note**: HTTP operations can authenticate connections to Azure Storage accounts behind Azure firewalls with the system-assigned identity. |-| Managed connector (**Preview**) | Single-authentication: <br>- Azure Automation <br>- Azure Event Grid <br>- Azure Key Vault <br>- Azure Resource Manager <br>- HTTP with Azure AD <p>Multi-authentication: <br>- Azure Blob Storage <br>- Azure Event Hubs <br>- Azure Service Bus <br>- SQL Server | +| Managed connector | Single-authentication: <br>- Azure Automation <br>- Azure Event Grid <br>- Azure Key Vault <br>- Azure Resource Manager <br>- HTTP with Azure AD <p>Multi-authentication: <br>- Azure Blob Storage <br>- Azure Event Hubs <br>- Azure Service Bus <br>- SQL Server | ||| On a **Logic App (Standard)** resource, the system-assigned identity is automati ## Enable system-assigned identity in an ARM template -To automate creating and deploying Azure resources such as logic apps, you can use an [ARM template](logic-apps-azure-resource-manager-templates-overview.md). To enable the system-assigned managed identity for your logic app resource in the template, add the `identity` object and the `type` child property to the logic app's resource definition in the template, for example: +To automate creating and deploying logic app resources, you can use an [ARM template](logic-apps-azure-resource-manager-templates-overview.md). To enable the system-assigned managed identity for your logic app resource in the template, add the `identity` object and the `type` child property to the logic app's resource definition in the template, for example: ### [Consumption](#tab/consumption) Before you can enable the user-assigned identity on your **Logic App (Consumptio ## Create user-assigned identity in an ARM template -To automate creating and deploying Azure resources such as logic apps, you can use an [ARM template](logic-apps-azure-resource-manager-templates-overview.md), which support [user-assigned identities for authentication](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-arm.md). +To automate creating and deploying logic app resources, you can use an [ARM template](logic-apps-azure-resource-manager-templates-overview.md). These templates support [user-assigned identities for authentication](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-arm.md). In your template's `resources` section, your logic app's resource definition requires these items: If your template also includes the managed identity's resource definition, you c } ``` -When the logic app resource is created, the `identity` object has the following additional properties: +When the template creates a logic app resource, the `identity` object includes the following properties: ```json "identity": { To use a managed identity for authentication, some Azure resources, such as Azur 1. Skip the optional **Application** step, select **Next**, and finish creating the access policy. -In the next section about using a managed identity to authenticate access for a trigger or action, the example continues with the steps from an earlier section where you set up access for a managed identity using RBAC and doesn't use Azure Key Vault as the example. However, the general steps to use a managed identity for authentication are the same. +The next section discusses using a managed identity to authenticate access for a trigger or action. The example continues with the steps from an earlier section where you set up access for a managed identity using RBAC and doesn't use Azure Key Vault as the example. However, the general steps to use a managed identity for authentication are the same. <a name="authenticate-access-with-identity"></a> These steps show how to use the managed identity with a trigger or action throug For more information, review [Example: Authenticate built-in trigger or action with a managed identity](#authenticate-built-in-managed-identity). - * **Managed connector operations that support managed identity authentication** (preview) + * **Managed connector operations that support managed identity authentication** - 1. On the tenant selection page, select **Connect with managed identity (preview)**, for example: + 1. On the tenant selection page, select **Connect with managed identity**, for example:  These steps show how to use the managed identity with a trigger or action throug For more information, review [Example: Authenticate built-in trigger or action with a managed identity](#authenticate-built-in-managed-identity). - * **Managed connector operations that support managed identity authentication** (preview) + * **Managed connector operations that support managed identity authentication** - 1. On the tenant selection page, select **Connect with managed identity (preview)**, for example: + 1. On the tenant selection page, select **Connect with managed identity**, for example:  The built-in HTTP trigger or action can use the system-assigned identity that yo | **Method** | Yes | The HTTP method that's used by the operation that you want to run | | **URI** | Yes | The endpoint URL for accessing the target Azure resource or entity. The URI syntax usually includes the [resource ID](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication) for the Azure resource or service. | | **Headers** | No | Any header values that you need or want to include in the outgoing request, such as the content type |-| **Queries** | No | Any query parameters that you need or want to include in the request, such as the parameter for a specific operation or the API version for the operation that you want to run | +| **Queries** | No | Any query parameters that you need or want to include in the request. For example, query parameters for a specific operation or for the API version of the operation that you want to run. | | **Authentication** | Yes | The authentication type to use for authenticating access to the target resource or entity | |||| The following example shows a sample HTTP action with all the previously describ 1. On some triggers and actions, the **Audience** property also appears for you to set the target resource ID. Set the **Audience** property to the [resource ID for the target resource or service](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication). Otherwise, by default, the **Audience** property uses the `https://management.azure.com/` resource ID, which is the resource ID for Azure Resource Manager. - For example, if you want to authenticate access to a [Key Vault resource in the global Azure cloud](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-key-vault), you must set the **Audience** property to *exactly* the following resource ID: `https://vault.azure.net`. Note that this specific resource ID *doesn't* have any trailing slashes. In fact, including a trailing slash might produce either a `400 Bad Request` error or a `401 Unauthorized` error. + For example, if you want to authenticate access to a [Key Vault resource in the global Azure cloud](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-key-vault), you must set the **Audience** property to *exactly* the following resource ID: `https://vault.azure.net`. This specific resource ID *doesn't* have any trailing slashes. In fact, including a trailing slash might produce either a `400 Bad Request` error or a `401 Unauthorized` error. > [!IMPORTANT] > Make sure that the target resource ID *exactly matches* the value that Azure Active Directory (AD) expects, The following example shows a sample HTTP action with all the previously describ 1. On some triggers and actions, the **Audience** property also appears for you to set the target resource ID. Set the **Audience** property to the [resource ID for the target resource or service](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication). Otherwise, by default, the **Audience** property uses the `https://management.azure.com/` resource ID, which is the resource ID for Azure Resource Manager. - For example, if you want to authenticate access to a [Key Vault resource in the global Azure cloud](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-key-vault), you must set the **Audience** property to *exactly* the following resource ID: `https://vault.azure.net`. Note that this specific resource ID *doesn't* have any trailing slashes. In fact, including a trailing slash might produce either a `400 Bad Request` error or a `401 Unauthorized` error. + For example, if you want to authenticate access to a [Key Vault resource in the global Azure cloud](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-key-vault), you must set the **Audience** property to *exactly* the following resource ID: `https://vault.azure.net`. This specific resource ID *doesn't* have any trailing slashes. In fact, including a trailing slash might produce either a `400 Bad Request` error or a `401 Unauthorized` error. > [!IMPORTANT] > Make sure that the target resource ID *exactly matches* the value that Azure Active Directory (AD) expects, The following example shows a sample HTTP action with all the previously describ ## Example: Authenticate managed connector trigger or action with a managed identity -The Azure Resource Manager managed connector has an action, **Read a resource**, that can use the managed identity that you enable on your logic app resource. This example shows how to use the system-assigned managed identity. +The Azure Resource Manager managed connector has an action named **Read a resource**, which can use the managed identity that you enable on your logic app resource. This example shows how to use the system-assigned managed identity. ### [Consumption](#tab/consumption) -1. After you add the action to your workflow and select your Azure AD tenant, select **Connect with managed identity (preview)**. +1. After you add the action to your workflow and select your Azure AD tenant, select **Connect with managed identity**.  The Azure Resource Manager managed connector has an action, **Read a resource**, ### [Standard](#tab/standard) -1. After you add the action to your workflow, on the action's **Create Connection** pane, select your Azure AD tenant, and then select **Connect with managed identity (preview)**. +1. After you add the action to your workflow, on the action's **Create Connection** pane, select your Azure AD tenant, and then select **Connect with managed identity**.  This example shows the underlying connection resource definition for an Azure Bl "parameterValueSet":{ "name": "managedIdentityAuth", "values": {}+ } }-}, +} ``` ### [Standard](#tab/standard) This example shows the underlying connection resource definition for an Azure Bl The following examples apply to Standard logic apps and show how the underlying connector resource definition differs between a single-authentication connector, such as Azure Automation, and a multi-authentication connector, such as Azure Blob Storage. #### Single-authentication- + This example shows the underlying connection resource definition for an Azure Automation action in a Standard logic app that uses a managed identity where the definition includes the following attributes: * The `apiVersion` property is set to `2016-06-01`. * The `kind` property is set to `V2` for a Standard logic app. * The `parameterValueType` property is set to `Alternative`.- + ```json { "type": "Microsoft.Web/connections", This example shows the underlying connection resource definition for an Azure Bl "parameterValueSet":{ "name": "managedIdentityAuth", "values": {}+ } }-}, +} ``` Following this `Microsoft.Web/connections` resource definition, make sure that you add an access policy that specifies a resource definition for each API connection and provide the following information: In your Standard logic app **connections.json** file, which stores information a } ``` -* Mapped to connection #1, the first `authentication` section is the authentication used for communicating with the internal token store. In the past, this section was always set to `ManagedServiceIdentity` for an app that deploys to Azure and had no configurable options. +* The first `authentication` section maps to connection #1. This section describes the authentication used for communicating with the internal token store. In the past, this section was always set to `ManagedServiceIdentity` for an app that deploys to Azure and had no configurable options. -* Mapped to connection #2, the second `authentication` section is the authentication used for communicating with the target resource can vary, based on the authentication type that you select for that connection. +* The second `authentication` section maps to connection #2. This section describes the authentication used for communicating with the target resource can vary, based on the authentication type that you select for that connection. ### Why change the authentication for the token store? When you disable the managed identity on your logic app resource, you remove the > logic app's workflow won't work at runtime, even if you immediately enable the identity again. > This behavior happens because disabling the identity deletes the object ID. Each time that you > enable the identity, Azure generates the identity with a different and unique object ID. To resolve -> this problem, you have to recreate the connections so that they use the current object ID for the +> this problem, you need to recreate the connections so that they use the current object ID for the > current system-assigned identity. > > Try to avoid disabling the system-assigned identity as much as possible. If you want to remove |
| machine-learning | Quickstart Create Resources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/machine-learning/quickstart-create-resources.md | Review the parts of the studio on the left-hand navigation bar: * The **Author** section of the studio contains multiple ways to get started in creating machine learning models. You can: * **Notebooks** section allows you to create Jupyter Notebooks, copy sample notebooks, and run notebooks and Python scripts.- * **Automated ML** steps you though created a machine learning model without writing code. + * **Automated ML** steps you through creating a machine learning model without writing code. * **Designer** gives you a drag-and-drop way to build models using prebuilt components. * The **Assets** section of the studio helps you keep track of the assets you create as you run your jobs. If you have a new workspace, there's nothing in any of these sections yet. |
| marketplace | Downloads Dashboard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/marketplace/downloads-dashboard.md | description: Learn how to access download requests for your marketplace offers. --++ Last updated 09/27/2021 |
| mysql | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/mysql/flexible-server/overview.md | One advantage of running your workload in Azure is its global reach. The flexibl | North Europe | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | Norway East | :heavy_check_mark: | :heavy_check_mark: | :x: | :x: | | South Africa North | :heavy_check_mark: | :heavy_check_mark: | :x: | :x: |-| South Central US | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | +| South Central US | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | Southeast Asia | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | | Switzerland North | :heavy_check_mark: | :heavy_check_mark: | :x: | :heavy_check_mark: | | UAE North | :heavy_check_mark: | :heavy_check_mark: | :x: | :x: | |
| postgresql | Concepts High Availability | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/flexible-server/concepts-high-availability.md | High availability configuration enables automatic failover capability with zero ## High availability architecture -Azure Database for PostgreSQL Flexible server supports two high availability deployment models. One is zone-redundant HA and the other is same-zone HA. In both deployment models, when the application performs writes or commits, using PostgreSQL streaming replication, transaction logs (write-ahead logs a.k.a WAL) are written to the local disk and also replicated in *synchronous* mode to the standby replica. Once the logs are persisted on the standby replica, the application is acknowledged of the writes or commits. The standby server will be in recovery mode which keeps applying the logs, but the primary server does not wait for the apply to complete. +Azure Database for PostgreSQL Flexible server supports two high availability deployment models. One is zone-redundant HA and the other is same-zone HA. In both deployment models, when the application performs writes or commits, using PostgreSQL streaming replication, transaction logs (write-ahead logs a.k.a WAL) are written to the local disk and also replicated in *synchronous* mode to the standby replica. Once the logs are persisted on the standby replica, the application is acknowledged of the writes or commits. The standby server will be in recovery mode which keeps applying the logs, but the primary server doesn't wait for the apply to complete at the standby server. ### Zone-redundant high availability -This high availability deployment enables Flexible server to be highly available across availability zones. You can choose the region, availability zones for the primary and standby servers. The standby replica server is provisioned in the chosen availability zone in the same region with similar compute, storage, and network configuration as the primary server. Data files and transaction log files (write-ahead logs a.k.a WAL) are stored on locally redundant storage within each availability zone, which automatically stores as **three** data copies. This provides physical isolation of the entire stack between primary and standby servers. +This high availability deployment enables Flexible server to be highly available across availability zones. You can choose the region, availability zones for the primary and standby servers. The standby replica server is provisioned in the chosen availability zone in the same region with similar compute, storage, and network configuration as the primary server. Data files and transaction log files (write-ahead logs a.k.a WAL) are stored on locally redundant storage (LRS) within each availability zone, which automatically stores **three** data copies. This provides physical isolation of the entire stack between primary and standby servers. >[!NOTE] > Not all regions support availability zone to deploy zone-redundant high availability. See this [Azure regions](./overview.md#azure-regions) list. This model of high availability deployment enables Flexible server to be highly Automatic backups are performed periodically from the primary database server, while the transaction logs are continuously archived to the backup storage from the standby replica. If the region supports availability zones, then backup data is stored on zone-redundant storage (ZRS). In regions that doesn't support availability zones, backup data is stored on local redundant storage (LRS). :::image type="content" source="./media/business-continuity/concepts-same-zone-high-availability-architecture.png" alt-text="Same-zone high availability"::: +## Components and workflow ++### Transaction completion ++Application transaction triggered writes and commits are first logged to the WAL on the primary server. It is then streamed to the standby server using Postgres streaming protocol. Once the logs are persisted on the standby server storage, the primary server is acknowledged of write completion. Only then and the application is confirmed of the writes. This additional round-trip adds more latency to your application. The percentage of impact depends on the application. This acknowledgement process does not wait for the logs to be applied at the standby server. The standby server is permanently in recovery mode until it is promoted. ++### Health check ++Flexible server has a health monitoring in place that checks for the primary and standby health periodically. If that detects primary server is not reachable after multiple pings, it makes the decision to initiate an automatic failover or not. The algorithm is based on multiple data points to avoid any false positive situation. ++### Failover modes ++There are two failover modes. ++ 1. With [**planned failovers**](#failover-processplanned-downtimes) (example: During maintenance window) where the failover is triggered with a known state in which the primary connections are drained, a clean shutdown is performed before the replication is severed. You can also use this to bring the primary server back to your preferred AZ. + + 2. With [**unplanned failover**](#failover-processunplanned-downtimes) (example: Primary server node crash), the primary is immediately fenced and hence any in-flight transactions are lost and to be retried by the application. ++In both the failover modes, once the replication is severed, the standby server runs the recovery before being promoted as a primary, and opened for read/write. With automatic DNS entries updated with the new primary server endpoint, applications can connect to the server using the same server endpoint. A new standby server is established in the background and that donΓÇÖt block your application connectivity. ++### Downtime ++In all cases, you must observe any downtime from your application/client side. Your application will be able to reconnect after a failover as soon as the DNS is updated. We take care of a few more aspects including LSN comparisons between primary and standby before fencing the writes. But with unplanned failovers, the time taken for the standby can be longer than 2 minutes in some cases due to the volume of logs to recover before opening for read/write. + ## HA status The health of primary and standby servers are continuously monitored and appropriate actions are taken to remediate issues including triggering a failover to the standby server. The high availability statuses are listed below: Flexible server provides two methods for you to perform on-demand failover to th You can use this feature to simulate an unplanned outage scenario while running your production workload and observe your application downtime. Alternatively, in rare case where your primary server becomes unresponsive for whatever reason, you may use this feature. -This feature brings the primary server down and initiates the failover workflow in which the standby promote operation is performed. Once the standby completes the recovery process till the last committed data, it is promoted to be the primary server. DNS records are updated and your application can connect to the promoted primary server. Your application can continue to write to the primary while a new standby server is established in the background and that does not impact the uptime. +This feature brings the primary server down and initiates the failover workflow in which the standby promote operation is performed. Once the standby completes the recovery process till the last committed data, it is promoted to be the primary server. DNS records are updated and your application can connect to the promoted primary server. Your application can continue to write to the primary while a new standby server is established in the background and that doesn't impact the uptime. The following are the steps during forced-failover: Flexible servers that are configured with high availability, log data is replica * Configuring customer initiated management tasks cannot be scheduled during managed maintenance window. -* Planned events such as scale compute and scale storage happens in the standby first and then on the primary server. Currently the server does not fail over for these planned operations. +* Planned events such as scale compute and scale storage happens in the standby first and then on the primary server. Currently the server doesn't fail over for these planned operations. * If logical decoding or logical replication is configured with a HA configured flexible server, in the event of a failover to the standby server, the logical replication slots are not copied over to the standby server. Here are some failure scenarios that require user action to recover: If you choose same zone HA, then you can only choose the primary server. If you choose zone redundant HA, then you can choose both primary and standby AZs. * **Is zone redundant HA available in all regions?** <br>- Zone-redundant HA is available in regions that support multiple AZs in the region. For the latest region support, please see [this documentation](overview.md#azure-regions). We are continuously adding more regions and enabling multiple AZs. Note that same-zone HA is available in all regions. + Zone-redundant HA is available in regions that support multiple AZs in the region. For the latest region support, please see [this documentation](overview.md#azure-regions). We are continuously adding more regions and enabling multiple AZs. Same-zone HA is available in all supported regions. * **Can I deploy both zone redundant HA and same zone HA at the same time?** <br> No. You can deploy only one of those options. |
| postgresql | How To Migrate Single To Flexible Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/postgresql/migrate/how-to-migrate-single-to-flexible-cli.md | This quick start article shows you how to use Single to Flexible Server migratio ### Setup Azure CLI 1. Install the latest Azure CLI for your corresponding operating system from the [Azure CLI install page](/cli/azure/install-azure-cli)-2. In case Azure CLI is already installed, check the version by issuing **az version** command. The version should be **2.28.0 or above** to use the migration CLI commands. If not, update your Azure CLI using this [link](/cli/azure/update-azure-cli.md). -3. Once you have the right Azure CLI version, run the **az login** command. A browser page is opened with Azure sign-in page to authenticate. Provide your Azure credentials to do a successful authentication. For other ways to sign with Azure CLI, visit this [link](/cli/azure/authenticate-azure-cli.md). +2. In case Azure CLI is already installed, check the version by issuing **az version** command. The version should be **2.28.0 or above** to use the migration CLI commands. If not, update your Azure CLI using this [link](/cli/azure/update-azure-cli). +3. Once you have the right Azure CLI version, run the **az login** command. A browser page is opened with Azure sign-in page to authenticate. Provide your Azure credentials to do a successful authentication. For other ways to sign with Azure CLI, visit this [link](/cli/azure/authenticate-azure-cli). ```bash az login |
| security | Feature Availability | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/security/fundamentals/feature-availability.md | The following table displays the current Defender for Cloud feature availability | <li> [Microsoft Defender for Key Vault](../../defender-for-cloud/defender-for-key-vault-introduction.md) | GA | Not Available | | <li> [Microsoft Defender for Resource Manager](../../defender-for-cloud/defender-for-resource-manager-introduction.md) | GA | GA | | <li> [Microsoft Defender for Storage](../../defender-for-cloud/defender-for-storage-introduction.md) <sup>[6](#footnote6)</sup> | GA | GA |-| <li> [Threat protection for Cosmos DB](../../defender-for-cloud/other-threat-protections.md#threat-protection-for-azure-cosmos-db-preview) | Public Preview | Not Available | +| <li> [Threat protection for Cosmos DB](../../defender-for-cloud/other-threat-protections.md#threat-protection-for-azure-cosmos-db) | GA | Not Available | | <li> [Kubernetes workload protection](../../defender-for-cloud/kubernetes-workload-protections.md) | GA | GA | | <li> [Bi-directional alert synchronization with Microsoft Sentinel](../../sentinel/connect-azure-security-center.md) | Public Preview | Public Preview | | **Microsoft Defender for servers features** <sup>[7](#footnote7)</sup> | | | |
| sentinel | Data Connectors Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/data-connectors-reference.md | Before setting up the new Azure Activity log connector, you must disconnect the | **Recommended diagnostics** | DDoSProtectionNotifications<br>DDoSMitigationFlowLogs<br>DDoSMitigationReports | | **Supported by** | Microsoft | +> [!NOTE] +> The **Status** for Azure DDoS Protection Data Connector changes to **Connected** only when the protected resources are under a DDoS attack. ## Azure Defender |
| sentinel | Network Normalization Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/network-normalization-schema.md | The following list mentions fields that have specific guidelines for Network Ses | **EventResult** | Mandatory | Enumerated | If the source device does not provide an event result, **EventResult** should be based on the value of [DvcAction](#dvcaction). If [DvcAction](#dvcaction) is `Deny`, `Drop`, `Drop ICMP`, `Reset`, `Reset Source`, or `Reset Destination`<br>, **EventResult** should be `Failure`. Otherwise, **EventResult** should be `Success`. | | **EventSchema** | Mandatory | String | The name of the schema documented here is `NetworkSession`. | | **EventSchemaVersion** | Mandatory | String | The version of the schema. The version of the schema documented here is `0.2.3`. |-| <a name="dvcaction"></a>**DvcAction** | Optional | Enumerated | The action taken on the network session. Supported values are:<br>- `Allow`<br>- `Deny`<br>- `Drop`<br>- `Drop ICMP`<br>- `Reset`<br>- `Reset Source`<br>- `Reset Destination`<br>- `Encrypt`<br>- `Decrypt`<br>- `VPNroute`<br><br>**Note**: The value might be provided in the source record by using different terms, which should be normalized to these values. The original value should be stored in the [DvcOriginalAction](normalization-common-fields.md#dvcoriginalaction) field.<br><br>Example: `drop` | +| <a name="dvcaction"></a>**DvcAction** | Recommended | Enumerated | The action taken on the network session. Supported values are:<br>- `Allow`<br>- `Deny`<br>- `Drop`<br>- `Drop ICMP`<br>- `Reset`<br>- `Reset Source`<br>- `Reset Destination`<br>- `Encrypt`<br>- `Decrypt`<br>- `VPNroute`<br><br>**Note**: The value might be provided in the source record by using different terms, which should be normalized to these values. The original value should be stored in the [DvcOriginalAction](normalization-common-fields.md#dvcoriginalaction) field.<br><br>Example: `drop` | | **EventSeverity** | Optional | Enumerated | If the source device does not provide an event severity, **EventSeverity** should be based on the value of [DvcAction](#dvcaction). If [DvcAction](#dvcaction) is `Deny`, `Drop`, `Drop ICMP`, `Reset`, `Reset Source`, or `Reset Destination`<br>, **EventSeverity** should be `Low`. Otherwise, **EventSeverity** should be `Informational`. | | **DvcInterface** | | | The DvcInterface field should alias either the [DvcInboundInterface](#dvcinboundinterface) or the [DvcOutboundInterface](#dvcoutboundinterface) fields. | | **Dvc** fields| | | For Network Session events, device fields refer to the system reporting the Network Session event. | |
| sentinel | Normalization Common Fields | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/normalization-common-fields.md | The role of the device fields is different for different schemas and event types | <a name="dvczone"></a>**DvcZone** | Optional | String | The network on which the event occurred or which reported the event, depending on the schema. The zone is defined by the reporting device.<br><br>Example: `Dmz` | | <a name="dvcos"></a>**DvcOs** | Optional | String | The operating system running on the device on which the event occurred or which reported the event. <br><br>Example: `Windows` | | <a name="dvcosversion"></a>**DvcOsVersion** | Optional | String | The version of the operating system on the device on which the event occurred or which reported the event. <br><br>Example: `10` |-| <a name="dvcaction"></a>**DvcAction** | Optional | String | For reporting security systems, the action taken by the system, if applicable. <br><br>Example: `Blocked` | +| <a name="dvcaction"></a>**DvcAction** | Recommended | String | For reporting security systems, the action taken by the system, if applicable. <br><br>Example: `Blocked` | | <a name="dvcoriginalaction"></a>**DvcOriginalAction** | Optional | String | The original [DvcAction](#dvcaction) as provided by the reporting device. | | <a name="dvcinterface"></a>**DvcInterface** | Optional | String | The network interface on which data was captured. This field is typically relevant to network related activity which is captured by an intermediate or tap device. | | <a name="dvcsubscription"></a>**DvcSubscriptionId** | Optional | String | The cloud platform subscription ID the device belongs to. **DvcSubscriptionId** map to a subscription ID on Azure and to an account ID on AWS. | |
| sentinel | Ueba Enrichments | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/ueba-enrichments.md | The following table describes the enrichments featured in the **UsersInsights** | **Account display name**<br>*(AccountDisplayName)* | The account display name of the user. | Admin, Hayden Cook | | **Account domain**<br>*(AccountDomain)* | The account domain name of the user. | | | **Account object ID**<br>*(AccountObjectID)* | The account object ID of the user. | a58df659-5cab-446c-9dd0-5a3af20ce1c2 |-| **Blast radius**<br>*(BlastRadius)* | The blast radius is calculated based on several factors: the position of the user in the org tree, and the user's Azure Active Directory roles and permissions. | Low, Medium, High | +| **Blast radius**<br>*(BlastRadius)* | The blast radius is calculated based on several factors: the position of the user in the org tree, and the user's Azure Active Directory roles and permissions. User must have *Manager* property populated in Azure Active Directory for *BlastRadius* to be calculated. | Low, Medium, High | | **Is dormant account**<br>*(IsDormantAccount)* | The account has not been used for the past 180 days. | True, False | | **Is local admin**<br>*(IsLocalAdmin)* | The account has local administrator privileges. | True, False | | **Is new account**<br>*(IsNewAccount)* | The account was created within the past 30 days. | True, False | |
| sentinel | Web Normalization Schema | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/web-normalization-schema.md | For more information about normalization in Microsoft Sentinel, see [Normalizati ## Schema overview -The Web Session normalization schema represents any HTTP network session, and is specifically suitable to provide support for common source types, including: +The Web Session normalization schema represents any HTTP network session, and is suitable to provide support for common source types, including: - Web servers - Web proxies The following filtering parameters are available: |-|--|-| | **starttime** | datetime | Filter only Web sessions that **started** at or after this time. | | **endtime** | datetime | Filter only Web sessions that **started** running at or before this time. |-| **srcipaddr_has_any_prefix** | dynamic | Filter only Web sessions for which the [source IP address field](network-normalization-schema.md#srcipaddr) prefix is in one of the listed values. Note that the list of values can include IP addresses as well as IP address prefixes. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.| +| **srcipaddr_has_any_prefix** | dynamic | Filter only Web sessions for which the [source IP address field](network-normalization-schema.md#srcipaddr) prefix is in one of the listed values. The list of values can include IP addresses and IP address prefixes. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.| | **ipaddr_has_any_prefix** | dynamic | Filter only network sessions for which the [destination IP address field](network-normalization-schema.md#dstipaddr) or [source IP address field](network-normalization-schema.md#srcipaddr) prefix is in one of the listed values. Prefixes should end with a `.`, for example: `10.0.`. The length of the list is limited to 10,000 items.<br><br>The field [ASimMatchingIpAddr](normalization-common-fields.md#asimmatchingipaddr) is set with the one of the values `SrcIpAddr`, `DstIpAddr`, or `Both` to reflect the matching fields or fields. |-| **url_has_any** | dynamic | Filter only Web sessions for which the [URL field](#url) has any of the values listed. If specified, and the session is not a web session, no result will be returned. The length of the list is limited to 10,000 items.| +| **url_has_any** | dynamic | Filter only Web sessions for which the [URL field](#url) has any of the values listed. The parser may ignore the schema of the URL passed as a parameter, if the source does not report it. If specified, and the session is not a web session, no result will be returned. The length of the list is limited to 10,000 items.| | **httpuseragent_has_any** | dynamic | Filter only web sessions for which the [user agent field](#httpuseragent) has any of the values listed. If specified, and the session is not a web session, no result will be returned. The length of the list is limited to 10,000 items. | | **eventresultdetails_in** | dynamic | Filter only web sessions for which the HTTP status code, stored in the [EventResultDetails](#eventresultdetails) field, is any of the values listed. | | **eventresult** | string | Filter only network sessions with a specific **EventResult** value. | The following list mentions fields that have specific guidelines for Web Session | Field | Class | Type | Description | ||-||--| | **EventType** | Mandatory | Enumerated | Describes the operation reported by the record and should be set to `HTTPsession`. |-| **EventResult** | Mandatory | Enumerated | Describes the event result, normalized to one of the following values: <br> - `Success` <br> - `Partial` <br> - `Failure` <br> - `NA` (not applicable) <br><br>For an HTTP session, `Success` is defined as a status code lower than `400`, and `Failure` is defined as a status code higher than `400`. For a list of HTTP status codes refer to [W3 Org](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html).<br><br>The source may provide only a value for the [EventResultDetails](#eventresultdetails) field, which must be analyzed to get the **EventResult** value. | +| **EventResult** | Mandatory | Enumerated | Describes the event result, normalized to one of the following values: <br> - `Success` <br> - `Partial` <br> - `Failure` <br> - `NA` (not applicable) <br><br>For an HTTP session, `Success` is defined as a status code lower than `400`, and `Failure` is defined as a status code higher than `400`. For a list of HTTP status codes, refer to [W3 Org](https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html).<br><br>The source may provide only a value for the [EventResultDetails](#eventresultdetails) field, which must be analyzed to get the **EventResult** value. | | <a name="eventresultdetails"></a>**EventResultDetails** | Mandatory | String | For HTTP sessions, the value should be the HTTP status code. <br><br>**Note**: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the **EventOriginalResultDetails** field.| | **EventSchema** | Mandatory | String | The name of the schema documented here is `WebSession`. | | **EventSchemaVersion** | Mandatory | String | The version of the schema. The version of the schema documented here is `0.2.3` | The following ASIM Network Session schema fields have specific guidelines when u ### <a name="Intermediary"></a>Intermediary device fields -Web Session events are commonly reported by intermediate devices which terminate the HTTP connection from the client and initiate a new connection, acting as a proxy, with the server. To represent the intermediate device, use the [ASIM Network Session schema](network-normalization-schema.md) [Intermediary device fields](network-normalization-schema.md#Intermediary) +Web Session events are commonly reported by intermediate devices that terminate the HTTP connection from the client and initiate a new connection, acting as a proxy, with the server. To represent the intermediate device, use the [ASIM Network Session schema](network-normalization-schema.md) [Intermediary device fields](network-normalization-schema.md#Intermediary) ### <a name="http-session-fields"></a>HTTP session fields The following are additional fields that are specific to web sessions: | **HttpVersion** | Optional | String | The HTTP Request Version.<br><br>Example: `2.0` | | **HttpRequestMethod** | Recommended | Enumerated | The HTTP Method. The values are as defined in [RFC 7231](https://datatracker.ietf.org/doc/html/rfc7231#section-4) and [RFC 5789](https://datatracker.ietf.org/doc/html/rfc5789#section-2), and include `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE`, and `PATCH`.<br><br>Example: `GET` | | **HttpStatusCode** | Alias | | The HTTP Status Code. Alias to [EventResultDetails](#eventresultdetails). |-| <a name="httpcontenttype"></a>**HttpContentType** | Optional | String | The HTTP Response content type header. <br><br>**Note**: The **HttpContentType** field may include both the content format and additional parameters, such as the encoding used to get the actual format.<br><br> Example: `text/html; charset=ISO-8859-4` | +| <a name="httpcontenttype"></a>**HttpContentType** | Optional | String | The HTTP Response content type header. <br><br>**Note**: The **HttpContentType** field may include both the content format and extra parameters, such as the encoding used to get the actual format.<br><br> Example: `text/html; charset=ISO-8859-4` | | **HttpContentFormat** | Optional | String | The content format part of the [HttpContentType](#httpcontenttype) <br><br> Example: `text/html` | | **HttpReferrer** | Optional | String | The HTTP referrer header.<br><br>**Note**: ASIM, in sync with OSSEM, uses the correct spelling for *referrer*, and not the original HTTP header spelling.<br><br>Example: `https://developer.mozilla.org/docs` | | <a name="httpuseragent"></a>**HttpUserAgent** | Optional | String | The HTTP user agent header.<br><br>Example:<br> `Mozilla/5.0` (Windows NT 10.0; WOW64)<br>`AppleWebKit/537.36` (KHTML, like Gecko)<br>`Chrome/83.0.4103.97 Safari/537.36` | If the event is reported by one of the endpoints of the web session, it may incl ### Schema updates -The Web Session schema relies on the Network Session schema. Therefore, [Network Session schema updates](network-normalization-schema.md#schema-updates) apply to the Web Session schema as well. The WebSession schema version has been updated to reflect this. +The Web Session schema relies on the Network Session schema. Therefore, [Network Session schema updates](network-normalization-schema.md#schema-updates) apply to the Web Session schema as well. The WebSession schema version has been updated to reflect this dependancy. ## Next steps |
| service-bus-messaging | Jms Developer Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/jms-developer-guide.md | Selectors can be utilized when creating any of the below consumers - * Unshared non-durable subscription * Queue browser +## AMQP disposition and Service Bus operation mapping ++Here's how an AMQP disposition translates to a Service Bus operation: ++```Output +ACCEPTED = 1; -> Complete() +REJECTED = 2; -> DeadLetter() +RELEASED = 3; (just unlock the message in service bus, will then get redelivered) +MODIFIED_FAILED = 4; -> Abandon() which increases delivery count +MODIFIED_FAILED_UNDELIVERABLE = 5; -> Defer() +``` ## Summary |
| service-bus-messaging | Monitor Service Bus Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/monitor-service-bus-reference.md | The following management operations are captured in operational logs: ## Runtime audit logs-Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive messages) in Service Bus. +Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus. > [!NOTE] > Runtime audit logs are currently available only in the **premium** tier. |
| service-bus-messaging | Service Bus Sas | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-bus-messaging/service-bus-sas.md | A namespace or entity policy can hold up to 12 Shared Access Authorization rules An authorization rule is assigned a *Primary Key* and a *Secondary Key*. These keys are cryptographically strong keys. Don't lose them or leak them - they'll always be available in the [Azure portal][Azure portal]. You can use either of the generated keys, and you can regenerate them at any time. If you regenerate or change a key in the policy, all previously issued tokens based on that key become instantly invalid. However, ongoing connections created based on such tokens will continue to work until the token expires. -When you create a Service Bus namespace, a policy rule named **RootManageSharedAccessKey** is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative **root** account and don't use it in your application. You can create more policy rules in the **Configure** tab for the namespace in the portal, via PowerShell or Azure CLI. +When you create a Service Bus namespace, a policy rule named **RootManageSharedAccessKey** is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative **root** account and don't use it in your application. You can create more policy rules in the **Configure** tab for the namespace in the portal, via PowerShell or Azure CLI. ++It is recommended that you periodically regenerate the keys used in the [SharedAccessAuthorizationRule](/dotnet/api/microsoft.servicebus.messaging.sharedaccessauthorizationrule) object. The primary and secondary key slots exist so that you can rotate keys gradually. If your application generally uses the primary key, you can copy the primary key into the secondary key slot, and only then regenerate the primary key. The new primary key value can then be configured into the client applications, which have continued access using the old primary key in the secondary slot. Once all clients are updated, you can regenerate the secondary key to finally retire the old primary key. ++If you know or suspect that a key is compromised and you have to revoke the keys, you can regenerate both the [PrimaryKey](/dotnet/api/microsoft.servicebus.messaging.sharedaccessauthorizationrule) and the [SecondaryKey](/dotnet/api/microsoft.servicebus.messaging.sharedaccessauthorizationrule) of a [SharedAccessAuthorizationRule](/dotnet/api/microsoft.servicebus.messaging.sharedaccessauthorizationrule), replacing them with new keys. This procedure invalidates all tokens signed with the old keys. ## Best practices when using SAS When you use shared access signatures in your applications, you need to be aware of two potential risks: |
| service-connector | How To Integrate Web Pubsub | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-connector/how-to-integrate-web-pubsub.md | + + Title: Integrate Azure Web PubSub with service connector +description: Integrate Azure Web PubSub into your application with Service Connector ++++ Last updated : 06/16/2022+++# Integrate Azure Web PubSub with service connector ++This page shows all the supported compute services, clients, and authentication types to connect services to Azure Web PubSub instances, using Service Connector. This page also shows the default environment variable names and application properties needed to create service connections. You might still be able to connect to an Azure Web PubSub instance using other programming languages, without using Service Connector. Learn more about the [service connector environment variable naming conventions](concept-service-connector-internals.md). ++## Supported compute services ++- Azure App Service +- Azure Container Apps +- Azure Spring Cloud ++## Supported authentication types and clients ++| Client type | System-assigned managed identity | User-assigned managed identity | Secret/connection string | Service principal | +|-|::|::|::|::| +| .NET |  |  |  |  | +| Java |  |  |  |  | +| Node.js |  |  |  |  | +| Python |  |  |  |  | ++## Default environment variable names or application properties ++Use the environment variable names and application properties listed below to connect an Azure service to Web PubSub using .NET, Java, Node.js, or Python. For each example below, replace the placeholder texts `<name>`, `<client-id>`, `<client-secret`, `<access-key>`, and `<tenant-id>` with your resource name, client ID, client secret, access-key, and tenant ID. ++### System-assigned managed identity ++| Default environment variable name | Description | Sample value | +| | | - | +| AZURE_WEBPUBSUB_HOST | Azure Web PubSub host | `<name>.webpubsub.azure.com` | ++### User-assigned managed identity ++| Default environment variable name | Description | Sample value | +| | | | +| AZURE_WEBPUBSUB_HOST | Azure Web PubSub host | `<name>.webpubsub.azure.com` | +| AZURE_WEBPUBSUB_CLIENTID | Azure Web PubSub client ID | `<client-id>` | ++### Secret/connection string ++> [!div class="mx-tdBreakAll"] +> | Default environment variable name | Description | Sample value | +> | | --| -| +> | AZURE_WEBPUBSUB_CONNECTIONSTRING | Azure Web PubSub connection string | `Endpoint=https://<name>.webpubsub.azure.com;AccessKey=<access-key>;Version=1.0;` | ++### Service principal ++| Default environment variable name | Description | Sample value | +| | -| --| +| AZURE_WEBPUBSUB_HOST | Azure Web PubSub host | `<name>.webpubsub.azure.com` | +| AZURE_WEBPUBSUB_CLIENTID | Azure Web PubSub client ID | `<client-id>` | +| AZURE_WEBPUBSUB_CLIENTSECRET | Azure Web PubSub client secret | `<client-secret>` | +| AZURE_WEBPUBSUB_TENANTID | Azure Web PubSub tenant ID | `<tenant-id>` | ++## Next steps ++Read the article listed below to learn more about Service Connector. ++> [!div class="nextstepaction"] +> [Learn about Service Connector concepts](./concept-service-connector-internals.md) |
| service-fabric | Service Fabric How To Debug Windows Containers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-fabric/service-fabric-how-to-debug-windows-containers.md | description: Learn how to debug Windows containers in Azure Service Fabric using Last updated 02/14/2019- # How to: Debug Windows containers in Azure Service Fabric using Visual Studio 2019 |
| service-fabric | Service Fabric Tutorial Deploy App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/service-fabric/service-fabric-tutorial-deploy-app.md | Title: Deploy a Service Fabric app to a cluster in Azure description: Learn how to deploy an existing application to a newly created Azure Service Fabric cluster from Visual Studio.- Last updated 07/22/2019- # Tutorial: Deploy a Service Fabric application to a cluster in Azure |
| synapse-analytics | Develop Tables External Tables | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/sql/develop-tables-external-tables.md | The key differences between Hadoop and native external tables are presented in t | Supported formats | Delimited/CSV, Parquet, ORC, Hive RC, and RC | Serverless SQL pool: Delimited/CSV, Parquet, and [Delta Lake](query-delta-lake-format.md)<br/>Dedicated SQL pool: Parquet (preview) | | [Folder partition elimination](#folder-partition-elimination) | No | Only for partitioned tables synchronized from Apache Spark pools in Synapse workspace to serverless SQL pools | | [File elimination](#file-elimination) (predicate pushdown) | No | Yes in serverless SQL pool. For the string pushdown, you need to use `Latin1_General_100_BIN2_UTF8` collation on the `VARCHAR` columns to enable pushdown. |-| Custom format for location | Yes | Yes, using wildcards like `/year=*/month=*/day=*` | -| Recursive folder scan | No | Only in serverless SQL pools when specified `/**` at the end of the location path | +| Custom format for location | No | Yes, using wildcards like `/year=*/month=*/day=*` | +| Recursive folder scan | Yes | Only in serverless SQL pools when specified `/**` at the end of the location path | | Storage authentication | Storage Access Key(SAK), AAD passthrough, Managed identity, Custom application Azure AD identity | [Shared Access Signature(SAS)](develop-storage-files-storage-access-control.md?tabs=shared-access-signature), [AAD passthrough](develop-storage-files-storage-access-control.md?tabs=user-identity), [Managed identity](develop-storage-files-storage-access-control.md?tabs=managed-identity), [Custom application Azure AD identity](develop-storage-files-storage-access-control.md?tabs=service-principal). | > [!NOTE] The external table is now created, for future exploration of the content of this ## Next steps -See the [CETAS](develop-tables-cetas.md) article for how to save query results to an external table in Azure Storage. Or you can start querying [Apache Spark for Azure Synapse external tables](develop-storage-files-spark-tables.md). +See the [CETAS](develop-tables-cetas.md) article for how to save query results to an external table in Azure Storage. Or you can start querying [Apache Spark for Azure Synapse external tables](develop-storage-files-spark-tables.md). |
| synapse-analytics | Whats New Archive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/whats-new-archive.md | Last updated 05/20/2022 This article describes previous month updates to Azure Synapse Analytics. For the most current month's release, check out [Azure Synapse Analytics latest updates](whats-new.md). Each update links to the Azure Synapse Analytics blog and an article that provides more information. +## Apr 2022 update ++The following updates are new to Azure Synapse Analytics this month. ++### SQL ++* Cross-subscription restore for Azure Synapse SQL is now generally available. Previously, it took many undocumented steps to restore a dedicated SQL pool to another subscription. Now, with the PowerShell Az.Sql module 3.8 update, the Restore-AzSqlDatabase cmdlet can be used for cross-subscription restore. To learn more, see [Restore a dedicated SQL pool (formerly SQL DW) to a different subscription](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-april-update-2022/ba-p/3280185). ++* It is now possible to recover a SQL pool from a dropped server or workspace. With the PowerShell Restore cmdlets in Az.Sql and Az.Synapse modules, you can now restore from a deleted server or workspace without filing a support ticket. For more information, read [Synapse workspace SQL pools](./backuprestore/restore-sql-pool-from-deleted-workspace.md) or [standalone SQL pools (formerly SQL DW)](./sql-data-warehouse/sql-data-warehouse-restore-from-deleted-server.md), depending on your scenario. ++### Synapse database templates and database designer ++* Based on popular customer feedback, we've made significant improvements to our exploration experience when creating a lake database using an industry template. To learn more, read [Quickstart: Create a new Lake database leveraging database templates](./database-designer/quick-start-create-lake-database.md). ++* We've added the option to clone a lake database. This unlocks additional opportunities to manage new versions of databases or support schemas that evolve in discrete steps. You can quickly clone a database using the action menu available on the lake database. To learn more, read [How-to: Clone a lake database](./database-designer/clone-lake-database.md). ++* You can now use wildcards to specify custom folder hierarchies. Lake databases sit on top of data that is in the lake and this data can live in nested folders that donΓÇÖt fit into clean partition patterns. Previously, querying lake databases required that your data exists in a simple directory structure that you could browse using the folder icon without the ability to manually specify directory structure or use wildcard characters. To learn more, read [How-to: Modify a datalake](./database-designer/modify-lake-database.md). ++### Apache Spark for Synapse ++* We are excited to announce the preview availability of Apache SparkΓäó 3.2 on Synapse Analytics. This new version incorporates user-requested enhancements and resolves 1,700+ Jira tickets. Please review the [official release notes](https://spark.apache.org/releases/spark-release-3-2-0.html) for the complete list of fixes and features and review the [migration guidelines between Spark 3.1 and 3.2](https://spark.apache.org/docs/latest/sql-migration-guide.html#upgrading-from-spark-sql-31-to-32) to assess potential changes to your applications. For more details, read [Apache Spark version support and Azure Synapse Runtime for Apache Spark 3.2](./spark/apache-spark-version-support.md). ++* Assigning parameters dynamically based on variables, metadata, or specifying Pipeline specific parameters has been one of your top feature requests. Now, with the release of parameterization for the Spark job definition activity, you can do just that. For more details, read [Transform data using Apache Spark job definition](quickstart-transform-data-using-spark-job-definition.md#settings-tab). ++* We often receive customer requests to access the snapshot of the Notebook when there is a Pipeline Notebook run failure or there is a long-running Notebook job. With the release of the Synapse Notebook snapshot feature, you can now view the snapshot of the Notebook activity run with the original Notebook code, the cell output, and the input parameters. You can also access the snapshot of the referenced Notebook from the referencing Notebook cell output if you refer to other Notebooks through Spark utils. To learn more, read [Transform data by running a Synapse notebook](synapse-notebook-activity.md?tabs=classical#see-notebook-activity-run-history) and [Introduction to Microsoft Spark utilities](./spark/microsoft-spark-utilities.md?pivots=programming-language-scala#reference-a-notebook-1). ++### Security ++* The Synapse Monitoring Operator RBAC role is now generally available. Since the GA of Synapse, customers have asked for a fine-grained RBAC (role-based access control) role that allows a user persona to monitor the execution of Synapse Pipelines and Spark applications without having the ability to run or cancel the execution of these applications. Now, customers can assign the Synapse Monitoring Operator role to such monitoring personas. This allows organizations to stay compliant while having flexibility in the delegation of tasks to individuals or teams. Learn more by reading [Synapse RBAC Roles](security/synapse-workspace-synapse-rbac-roles.md). +### Data integration ++* Microsoft has added Dataverse as a source and sink connector to Synapse Data Flows so that you can now build low-code data transformation ETL jobs in Synapse directly accessing your Dataverse environment. For more details on how to use this new connector, read [Mapping data flow properties](../data-factory/connector-dynamics-crm-office-365.md#mapping-data-flow-properties). ++* We heard from you that a 1-minute timeout for Web activity was not long enough, especially in cases of synchronous APIs. Now, with the response timeout property 'httpRequestTimeout', you can define timeout for the HTTP request up to 10 minutes. Learn more by reading [Web activity response timeout improvements](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/web-activity-response-timeout-improvement/ba-p/3260307). + +### Developer experience ++* Previously, if you wanted to reference a notebook in another notebook, you could only reference published or committed content. Now, when using %run notebooks, you can enable ΓÇÿunpublished notebook referenceΓÇÖ which will allow you to reference unpublished notebooks. When enabled, notebook run will fetch the current contents in the notebook web cache, meaning the changes in your notebook editor can be referenced immediately by other notebooks without having to be published (Live mode) or committed (Git mode). To learn more, read [Reference unpublished notebook](spark/apache-spark-development-using-notebooks.md#reference-unpublished-notebook). + ## Mar 2022 update The following updates are new to Azure Synapse Analytics this month. |
| synapse-analytics | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/synapse-analytics/whats-new.md | This article lists updates to Azure Synapse Analytics that are published in Apri The following updates are new to Azure Synapse Analytics this month. +## General ++**Get connected with the new Azure Synapse Influencer program!** [Join a community of Azure Synapse Influencers](https://aka.ms/synapseinfluencers) who are helping each other achieve more with cloud analytics! The Azure Synapse Influencer program recognizes Azure Synapse Analytics users and advocates who actively support the community by sharing Synapse-related content, announcements, and product news via social media. + ## SQL -* Cross-subscription restore for Azure Synapse SQL is now generally available. Previously, it took many undocumented steps to restore a dedicated SQL pool to another subscription. Now, with the PowerShell Az.Sql module 3.8 update, the Restore-AzSqlDatabase cmdlet can be used for cross-subscription restore. To learn more, see [Restore a dedicated SQL pool (formerly SQL DW) to a different subscription](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-april-update-2022/ba-p/3280185). +* **Data Warehouse Migration guide for Dedicated SQL Pools in Azure Synapse Analytics** - With the benefits that cloud migration offers, we hear that you often look for steps, processes, or guidelines to follow for quick and easy migrations from existing data warehouse environments. We just released a set of [Data Warehouse migration guides](/azure/synapse-analytics/migration-guides/) to make your transition to dedicated SQL Pools in Azure Synapse Analytics easier. -* It is now possible to recover a SQL pool from a dropped server or workspace. With the PowerShell Restore cmdlets in Az.Sql and Az.Synapse modules, you can now restore from a deleted server or workspace without filing a support ticket. For more information, read [Synapse workspace SQL pools](./backuprestore/restore-sql-pool-from-deleted-workspace.md) or [standalone SQL pools (formerly SQL DW)](./sql-data-warehouse/sql-data-warehouse-restore-from-deleted-server.md), depending on your scenario. +* **Automatic character column length calculation** - It's no longer necessary to define character column lengths! Serverless SQL pools let you query files in the data lake without knowing the schema upfront. The best practice was to specify the lengths of character columns to get optimal performance. Not anymore! With this new feature, you can get optimal query performance without having to define the schema. The serverless SQL pool will calculate the average column length for each inferred character column or character column defined as larger than 100 bytes. The schema will stay the same, while the serverless SQL pool will use the calculated average column lengths internally. It will also automatically calculate the cardinality estimation in case there was no previously created statistic. -## Synapse database templates and database designer +## Apache Spark for Synapse -* Based on popular customer feedback, we've made significant improvements to our exploration experience when creating a lake database using an industry template. To learn more, read [Quickstart: Create a new Lake database leveraging database templates](./database-designer/quick-start-create-lake-database.md). +* **Azure Synapse Dedicated SQL Pool Connector for Apache Spark Now Available in Python** - Previously, the Azure Synapse Dedicated SQL Pool connector was only available using Scala. Now, it can be used with Python on Spark 3. The only difference between the Scala and Python implementations is the optional Scala callback handle, which allows you to receive post-write metrics. -* We've added the option to clone a lake database. This unlocks additional opportunities to manage new versions of databases or support schemas that evolve in discrete steps. You can quickly clone a database using the action menu available on the lake database. To learn more, read [How-to: Clone a lake database](./database-designer/clone-lake-database.md). + The following are now supported in Python on Spark 3: -* You can now use wildcards to specify custom folder hierarchies. Lake databases sit on top of data that is in the lake and this data can live in nested folders that don’t fit into clean partition patterns. Previously, querying lake databases required that your data exists in a simple directory structure that you could browse using the folder icon without the ability to manually specify directory structure or use wildcard characters. To learn more, read [How-to: Modify a datalake](./database-designer/modify-lake-database.md). + * Read using Azure Active Directory (AD) Authentication or Basic Authentication + * Write to Internal Table using Azure AD Authentication or Basic Authentication + * Write to External Table using Azure AD Authentication or Basic Authentication -## Apache Spark for Synapse + To learn more about the connector in Python, read [Azure Synapse Dedicated SQL Pool Connector for Apache Spark](./spark/synapse-spark-sql-pool-import-export.md). -* We are excited to announce the preview availability of Apache Spark™ 3.2 on Synapse Analytics. This new version incorporates user-requested enhancements and resolves 1,700+ Jira tickets. Please review the [official release notes](https://spark.apache.org/releases/spark-release-3-2-0.html) for the complete list of fixes and features and review the [migration guidelines between Spark 3.1 and 3.2](https://spark.apache.org/docs/latest/sql-migration-guide.html#upgrading-from-spark-sql-31-to-32) to assess potential changes to your applications. For more details, read [Apache Spark version support and Azure Synapse Runtime for Apache Spark 3.2](./spark/apache-spark-version-support.md). +* **Manage Azure Synapse Apache Spark configuration** - Apache Spark configuration management is always a challenging task because Spark has hundreds of properties. It is also challenging for you to know the optimal value for Spark configurations. With the new Spark configuration management feature, you can create a standalone Spark configuration artifact with auto-suggestions and built-in validation rules. The Spark configuration artifact allows you to share your Spark configuration within and across Azure Synapse workspaces. You can also easily associate your Spark configuration with a Spark pool, a Notebook, and a Spark job definition for reuse and minimize the need to copy the Spark configuration in multiple places. To learn more about the new Spark configuration management feature, read [Manage Apache Spark configuration](./spark/apache-spark-azure-create-spark-configuration.md). -* Assigning parameters dynamically based on variables, metadata, or specifying Pipeline specific parameters has been one of your top feature requests. Now, with the release of parameterization for the Spark job definition activity, you can do just that. For more details, read [Transform data using Apache Spark job definition](quickstart-transform-data-using-spark-job-definition.md#settings-tab). +## Synapse Data Explorer -* We often receive customer requests to access the snapshot of the Notebook when there is a Pipeline Notebook run failure or there is a long-running Notebook job. With the release of the Synapse Notebook snapshot feature, you can now view the snapshot of the Notebook activity run with the original Notebook code, the cell output, and the input parameters. You can also access the snapshot of the referenced Notebook from the referencing Notebook cell output if you refer to other Notebooks through Spark utils. To learn more, read [Transform data by running a Synapse notebook](synapse-notebook-activity.md?tabs=classical#see-notebook-activity-run-history) and [Introduction to Microsoft Spark utilities](./spark/microsoft-spark-utilities.md?pivots=programming-language-scala#reference-a-notebook-1). +* **Synapse Data Explorer live query in Excel** - Using the new Data Explorer web experience Open in Excel feature, you can now provide access to live results of your query by sharing the connected Excel Workbook with colleagues and team members.  You can open the live query in an Excel Workbook and refresh it directly from Excel to get the most up to date query results. To learn more about Excel live query, read [Open live query in Excel](https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/open-live-kusto-query-in-excel/ba-p/3198500). -## Security +* **Use Managed Identities for External SQL Server Tables** - One of the key benefits of Azure Synapse is the ability to bring together data integration, enterprise data warehousing, and big data analytics. With Managed Identity support, Synapse Data Explorer table definition is now simpler and more secure. You can now use managed identities instead of entering in your credentials. + + An external SQL table is a schema entity that references data stored outside the Synapse Data Explorer database. Using the Create and alter SQL Server external tables command, External SQL tables can easily be added to the Synapse Data Explorer database schema. -* The Synapse Monitoring Operator RBAC role is now generally available. Since the GA of Synapse, customers have asked for a fine-grained RBAC (role-based access control) role that allows a user persona to monitor the execution of Synapse Pipelines and Spark applications without having the ability to run or cancel the execution of these applications. Now, customers can assign the Synapse Monitoring Operator role to such monitoring personas. This allows organizations to stay compliant while having flexibility in the delegation of tasks to individuals or teams. Learn more by reading [Synapse RBAC Roles](security/synapse-workspace-synapse-rbac-roles.md). -## Data integration + To learn more about managed identities, read [Managed identities overview](/azure/data-explorer/managed-identities-overview). -* Microsoft has added Dataverse as a source and sink connector to Synapse Data Flows so that you can now build low-code data transformation ETL jobs in Synapse directly accessing your Dataverse environment. For more details on how to use this new connector, read [Mapping data flow properties](../data-factory/connector-dynamics-crm-office-365.md#mapping-data-flow-properties). + To learn more about external tables, read [Create and alter SQL Server external tables](/azure/data-explorer/kusto/management/external-sql-tables). -* We heard from you that a 1-minute timeout for Web activity was not long enough, especially in cases of synchronous APIs. Now, with the response timeout property 'httpRequestTimeout', you can define timeout for the HTTP request up to 10 minutes. Learn more by reading [Web activity response timeout improvements](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/web-activity-response-timeout-improvement/ba-p/3260307). +* **New KQL Learn module (2 out of 3) is live!** - The power of Kusto Query Language (KQL) is its simplicity to query structured, semi-structured, and unstructured data together. To make it easier for you to learn KQL, we are releasing Learn modules. Previously, we released [Write your first query with Kusto Query Language](/learn/modules/write-first-query-kusto-query-language/). New this month is [Gain insights from your data by using Kusto Query Language](/learn/modules/gain-insights-data-kusto-query-language/). -## Developer experience + KQL is the query language used to query Synapse Data Explorer big data. KQL has a fast-growing user community, with hundreds of thousands of developers, data engineers, data analysts, and students. ++ Check out the newest [KQL Learn Model](/learn/modules/gain-insights-data-kusto-query-language/) and see for yourself how easy it is to become a KQL master. ++ To learn more about KQL, read [Kusto Query Language (KQL) overview](/azure/data-explorer/kusto/query/). ++* **Azure Synapse Data Explorer connector for Microsoft Power Automate, Logic Apps, and Power Apps [Generally Available]** - The Azure Data Explorer connector for Power Automate enables you to orchestrate and schedule flows, send notifications, and alerts, as part of a scheduled or triggered task. To learn more, read [Azure Data Explorer connector for Microsoft Power Automate](/azure/data-explorer/flow) and [Usage examples for Azure Data Explorer connector to Power Automate](/azure/data-explorer/flow-usage). ++* **Dynamic events routing from event hub to multiple databases** - Routing events from Event Hub/IOT Hub/Event Grid is an activity commonly performed by Azure Data Explorer (ADX) users. Previously, you could route events only to a single database per defined connection. If you wanted to route the events to multiple databases, you needed to create multiple ADX cluster connections. ++ To simplify the experience, we now support routing events data to multiple databases hosted in a single ADX cluster. To learn more about dynamic routing, read [Ingest from event hub](/azure/data-explorer/ingest-data-event-hub-overview#events-routing). ++* **Configure a database using a KQL inline script as part of JSON ARM deployment template** - Previously, Azure Data Explorer supported running a Kusto Query Language (KQL) script to configure your database during Azure Resource Management (ARM) template deployment. Now, this can be done using an inline script provided inline as a parameter to a JSON ARM template. To learn more about using a KQL inline script, read [Configure a database using a Kusto Query Language script](/azure/data-explorer/database-script). ++## Data Integration ++* **Export pipeline monitoring as a CSV** - The ability to export pipeline monitoring to CSV has been added after receiving many community requests for the feature. Simply filter the Pipeline runs screen to the data you want and click ‘Export to CSV’. To learn more about exporting pipeline monitoring and other monitoring improvements, read [Azure Data Factory monitoring improvements](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/adf-monitoring-improvements/ba-p/3295531). ++* **Incremental data loading made easy for Synapse and Azure Database for PostgreSQL and MySQL** - In a data integration solution, incrementally loading data after an initial full data load is a widely used scenario. Automatic incremental source data loading is now natively available for Synapse SQL and Azure Database for PostgreSQL and MySQL. With a simple click, users can “enable incremental extract” and only inserted or updated rows will be read by the pipeline. To learn more about incremental data loading, read [Incrementally copy data from a source data store to a destination data store](../data-factory/tutorial-incremental-copy-overview.md). ++* **User-Defined Functions for Mapping Data Flows [Public Preview]** - We hear you that you can find yourself doing the same string manipulation, math calculations, or other complex logic several times. Now, with the new user-defined function feature, you can create customized expressions that can be reused across multiple mapping data flows. User-defined functions will be grouped in libraries to help developers group common sets of functions. Once you’ve created a data flow library, you can add in your user-defined functions. You can even add in multiple arguments to make your function more reusable. To learn more about user-defined functions, read [User defined functions in mapping data flows](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/introducing-user-defined-functions-preview-for-mapping-data/ba-p/3414628). ++* **Assert Error Handling** - Error handling has now been added to sinks following an assert transformation. Assert transformations enable you to build custom rules for data quality and data validation. You can now choose whether to output the failed rows to the selected sink or to a separate file. To learn more about error handling, read [Assert data transformation in mapping data flow](../data-factory/data-flow-assert.md). ++* **Mapping data flows projection editing** - New UI updates have been made to source projection editing in mapping data flows. You can now update source projection column names and column types with the click of a button. To learn more about source projection editing, read [Source transformation in mapping data flow](../data-factory/data-flow-source.md). ++## Synapse Link ++**Azure Synapse Link for SQL [Public Preview]** - At Microsoft Build 2022, we announced the Public Preview availability of Azure Synapse Link for SQL, for both SQL Server 2022 and Azure SQL Database. Data-driven, quality insights are critical for companies to stay competitive. The speed to achieve those insights can make all the difference. The costly and time-consuming nature of traditional ETL and ELT pipelines is no longer enough. With this release, you can now take advantage of low- and no-code, near real-time data replication from your SQL-based operational stores into Azure Synapse Analytics. This makes it easier to run BI reporting on operational data in near real-time, with minimal impact on your operational store. To learn more, read [Announcing the Public Preview of Azure Synapse Link for SQL](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/announcing-the-public-preview-of-azure-synapse-link-for-sql/ba-p/3372986) and watch our YouTube video. ++> [!VIDEO https://www.youtube.com/embed/pgusZy34-Ek] -* Previously, if you wanted to reference a notebook in another notebook, you could only reference published or committed content. Now, when using %run notebooks, you can enable ‘unpublished notebook reference’ which will allow you to reference unpublished notebooks. When enabled, notebook run will fetch the current contents in the notebook web cache, meaning the changes in your notebook editor can be referenced immediately by other notebooks without having to be published (Live mode) or committed (Git mode). To learn more, read [Reference unpublished notebook](spark/apache-spark-development-using-notebooks.md#reference-unpublished-notebook). ## Next steps -[Get started with Azure Synapse Analytics](get-started.md) +[Get started with Azure Synapse Analytics](get-started.md) |
| virtual-desktop | Agent Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/agent-overview.md | This article will give you a brief overview of the agent installation and update The Azure Virtual Desktop agent is initially installed in one of two ways. If you provision virtual machines (VMs) in the Azure portal and Azure Marketplace, the agent and agent bootloader are automatically installed. If you provision VMs using PowerShell, you must manually download the agent and agent bootloader .msi files when [creating a Azure Virtual Desktop host pool with PowerShell](create-host-pools-powershell.md#register-the-virtual-machines-to-the-azure-virtual-desktop-host-pool). Once the agent is installed, it installs the Azure Virtual Desktop side-by-side stack and Geneva Monitoring agent. The side-by-side stack component is required for users to securely establish reverse server-to-client connections. The Geneva Monitoring agent monitors the health of the agent. All three of these components are essential for end-to-end user connectivity to function properly. >[!IMPORTANT]->To successfully install the Azure Virtual Desktop agent, side-by-side stack, and Geneva Monitoring agent, you must unblock all the URLs listed in the [Required URL list](safe-url-list.md#virtual-machines). Unblocking these URLs is required to use the Azure Virtual Desktop service. +>To successfully install the Azure Virtual Desktop agent, side-by-side stack, and Geneva Monitoring agent, you must unblock all the URLs listed in the [Required URL list](safe-url-list.md#session-host-virtual-machines). Unblocking these URLs is required to use the Azure Virtual Desktop service. ## Agent update process The agent update normally lasts 2-3 minutes on a new VM and shouldn't cause your Now that you have a better understanding of the Azure Virtual Desktop agent, here are some resources that might help you: - If you're experiencing agent or connectivity-related issues, check out the [Azure Virtual Desktop Agent issues troubleshooting guide](troubleshoot-agent.md).-- To schedule agent updates, see the [Scheduled Agent Updates (preview) document](scheduled-agent-updates.md).+- To schedule agent updates, see the [Scheduled Agent Updates (preview) document](scheduled-agent-updates.md). - To set up diagnostics for this feature, see the [Scheduled Agent Updates Diagnostics guide](agent-updates-diagnostics.md). - To find information about the latest and previous agent versions, see the [Agent Updates version notes](whats-new-agent.md). |
| virtual-desktop | Required Url Check Tool | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/required-url-check-tool.md | + + Title: Use the Required URL Check tool for Azure Virtual Desktop +description: The Required URL Check tool enables you to check your session host virtual machines can access the required URLs to ensure Azure Virtual Desktop works as intended. ++ Last updated : 06/20/2022+++++# Required URL Check tool ++In order to deploy and make Azure Virtual Desktop available to your users, you must allow specific URLs that your session host virtual machines (VMs) can access them anytime. You can find the list of URLs in [Required URL list](safe-url-list.md). The Required URL Check tool will validate these URLs and show whether your session host VMs can access them. If not, then the tool will list the inaccessible URLs so you can unblock them and then retest, if needed. ++> [!NOTE] +> - You can only use the Required URL Check tool for deployments in the Azure public cloud, it does not check access for sovereign clouds. +> - The Required URL Check tool can't verify URLs that wildcard entries are unblocked, only specific entries within those wildcards, so make sure the wildcard entries are unblocked first. ++## Prerequisites ++You need the following things to use the Required URL Check tool: ++- Your session host VM must have a .NET 4.6.2 framework +- RDAgent version 1.0.2944.400 or higher +- The `WVDAgentUrlTool.exe` file must be in the same folder as the `WVDAgentUrlTool.config` file ++## Use the Required URL Check tool ++To use the Required URL Check tool: ++1. Open a command prompt as an administrator on one of your session host VMs. ++1. Run the following command to change the directory to the same folder as the current build agent (RDAgent_1.0.2944.1200 in this example): ++ ```console + cd "C:\Program Files\Microsoft RDInfra\RDAgent_1.0.2944.1200" + ``` ++1. Run the following command: ++ ```console + WVDAgentUrlTool.exe + ``` + +1. Once you run the file, you'll see a list of accessible and inaccessible URLs. ++ For example, the following screenshot shows a scenario where you'd need to unblock two required non-wildcard URLs: ++ > [!div class="mx-imgBorder"] + >  + + Here's what the output should look like once you've unblocked all required non-wildcard URLs: ++ > [!div class="mx-imgBorder"] + >  ++1. You can repeat these steps on your other session host VMs, particularly if they are in a different Azure region or use a different virtual network. |
| virtual-desktop | Safe Url List | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/safe-url-list.md | Title: Azure Virtual Desktop required URL list - Azure + Title: Required URLs for Azure Virtual Desktop description: A list of URLs you must unblock to ensure your Azure Virtual Desktop deployment works as intended. -# Required URL list +# Required URLs for Azure Virtual Desktop -In order to deploy and use Azure Virtual Desktop, you must unblock certain URLs so your virtual machines (VMs) can access them anytime. This article lists the required URLs you need to unblock in order for Azure Virtual Desktop to function properly. +In order to deploy and make Azure Virtual Desktop available to your users, you must allow specific URLs that your session host virtual machines (VMs) can access them anytime. Users also need to be able to connect to certain URLs to access their Azure Virtual Desktop resources. This article lists the required URLs you need to allow for your session hosts and users. Azure Virtual Desktop doesn't support deployments that block the URLs listed in this article. ->[!IMPORTANT] ->Azure Virtual Desktop doesn't support deployments that block the URLs listed in this article. +You can validate that your session host VMs can connect to these URLs by following the steps to run the [Required URL Check tool](required-url-check-tool.md). The Required URL Check tool will validate each URL and show whether your session host VMs can access them. You can only use for deployments in the Azure public cloud, it does not check access for sovereign clouds. -## Required URL Check tool +## Session host virtual machines -The Required URL Check tool will validate URLs and display whether the URLs the virtual machine needs to function are accessible. If not, then the tool will list the inaccessible URLs so you can unblock them, if needed. +Below is the list of URLs your session host VMs need to access for Azure Virtual Desktop. Select the relevant tab based on which cloud you're using. -It's important to keep the following things in mind: +# [Azure cloud](#tab/azure) -- You can only use the Required URL Check tool for deployments in commercial clouds.-- The Required URL Check tool can't check URLs with wildcards so make sure you unblock those URLs first.--### Requirements --You need the following things to use the Required URL Check tool: --- Your VM must have a .NET 4.6.2 framework-- RDAgent version 1.0.2944.400 or higher-- The WVDAgentUrlTool.exe file must be in the same folder as the WVDAgentUrlTool.config file--### How to use the Required URL Check tool --To use the Required URL Check tool: --1. Open a command prompt as an administrator on your VM. -2. Run the following command to change the directory to the same folder as the current build agent (RDAgent_1.0.2944.1200 in this example): -- ```console - cd C:\Program Files\Microsoft RDInfra\RDAgent_1.0.2944.1200 - ``` +| Address | Outbound TCP port | Purpose | Service Tag | +||||| +| `*.wvd.microsoft.com` | 443 | Service traffic | WindowsVirtualDesktop | +| `*.prod.warm.ingest.monitor.core.windows.net` | 443 | Agent traffic | AzureMonitor | +| `catalogartifact.azureedge.net` | 443 | Azure Marketplace | AzureFrontDoor.Frontend | +| `kms.core.windows.net` | 1688 | Windows activation | Internet | +| `mrsglobalsteus2prod.blob.core.windows.net` | 443 | Agent and SXS stack updates | AzureCloud | +| `wvdportalstorageblob.blob.core.windows.net` | 443 | Azure portal support | AzureCloud | +| `169.254.169.254` | 80 | [Azure Instance Metadata service endpoint](../virtual-machines/windows/instance-metadata-service.md) | N/A | +| `168.63.129.16` | 80 | [Session host health monitoring](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) | N/A | +| `oneocsp.microsoft.com` | 80 | Certificates | N/A | +| `www.microsoft.com` | 80 | Certificates | N/A | -3. Run the following command: +> [!IMPORTANT] +> We have finished transitioning the URLs we use for Agent traffic. We no longer support the URLs below. To avoid your session host VMs from showing *Needs Assistance* related to this, please allow `\*.prod.warm.ingest.monitor.core.windows.net` if you have not already. Please remove these URLs if you have previously explicitly allowed them: +> +> | Address | Outbound TCP port | Purpose | Service Tag | +> |--|--|--|--| +> | `gcs.prod.monitoring.core.windows.net` | 443 | Agent traffic | AzureCloud | +> | `production.diagnostics.monitoring.core.windows.net` | 443 | Agent traffic | AzureCloud | +> | `*xt.blob.core.windows.net` | 443 | Agent traffic | AzureCloud | +> | `*eh.servicebus.windows.net` | 443 | Agent traffic | AzureCloud | +> | `*xt.table.core.windows.net` | 443 | Agent traffic | AzureCloud | +> | `*xt.queue.core.windows.net` | 443 | Agent traffic | AzureCloud | ++The following table lists optional URLs that your session host virtual machines might also need to access for other ++| Address | Outbound TCP port | Purpose | +|--|--|--| +| `login.microsoftonline.com` | 443 | Authentication to Microsoft Online Services | +| `login.windows.net` | 443 | Sign in to Microsoft Online Services and Microsoft 365 | +| `*.events.data.microsoft.com` | 443 | Telemetry Service | +| `www.msftconnecttest.com` | 443 | Detects if the OS is connected to the internet | +| `*.prod.do.dsp.mp.microsoft.com` | 443 | Windows Update | +| `*.sfx.ms` | 443 | Updates for OneDrive client software | +| `*.digicert.com` | 443 | Certificate revocation check | +| `*.azure-dns.com` | 443 | Azure DNS resolution | +| `*.azure-dns.net` | 443 | Azure DNS resolution | ++# [Azure for US Government](#tab/azure-for-us-government) ++| Address | Outbound TCP port | Purpose | Service Tag | +|--|--|--|--| +| `*.wvd.azure.us` | 443 | Service traffic | WindowsVirtualDesktop | +| `*.prod.warm.ingest.monitor.core.usgovcloudapi.net` | 443 | Agent traffic | AzureMonitor | +| `kms.core.usgovcloudapi.net` | 1688 | Windows activation | Internet | +| `mrsglobalstugviffx.blob.core.usgovcloudapi.net` | 443 | Agent and SXS stack updates | AzureCloud | +| `wvdportalstorageblob.blob.core.usgovcloudapi.net` | 443 | Azure portal support | AzureCloud | +| `169.254.169.254` | 80 | [Azure Instance Metadata service endpoint](../virtual-machines/windows/instance-metadata-service.md) | N/A | +| `168.63.129.16` | 80 | [Session host health monitoring](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) | N/A | +| `ocsp.msocsp.com` | 80 | Certificates | N/A | - ```console - WVDAgentUrlTool.exe - ``` - -4. Once you run the file, you'll see a list of accessible and inaccessible URLs. +> [!IMPORTANT] +> We have finished transitioning the URLs we use for Agent traffic. We no longer support the URLs below. To avoid your session host VMs from showing *Needs Assistance* related to this, please allow `\*.prod.warm.ingest.monitor.core.usgovcloudapi.net`, if you have not already. Please remove these URLs if you have previously explicitly allowed them: +> +> | Address | Outbound TCP port | Purpose | Service Tag | +> |--|--|--|--| +> | `gcs.monitoring.core.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | +> | `monitoring.core.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | +> | `fairfax.warmpath.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | +> | `*xt.blob.core.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | +> | `*.servicebus.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | +> | `*xt.table.core.usgovcloudapi.net` | 443 | Agent traffic | AzureCloud | ++The following table lists optional URLs that your session host virtual machines might also need to access for other ++| Address | Outbound TCP port | Purpose | +|--|--|--| +| `login.microsoftonline.us` | 443 | Authentication to Microsoft Online Services and Microsoft 365 | +| `*.events.data.microsoft.com` | 443 | Telemetry Service | +| `www.msftconnecttest.com` | 443 | Detects if the OS is connected to the internet | +| `*.prod.do.dsp.mp.microsoft.com` | 443 | Windows Update | +| `oneclient.sfx.ms` | 443 | Updates for OneDrive client software | +| `*.digicert.com` | 443 | Certificate revocation check | +| `*.azure-dns.com` | 443 | Azure DNS resolution | +| `*.azure-dns.net` | 443 | Azure DNS resolution | - For example, the following screenshot shows a scenario where you'd need to unblock two required non-wildcard URLs: + - > [!div class="mx-imgBorder"] - >  - - Here's what the output should look like once you've unblocked all required non-wildcard URLs: +> [!TIP] +> You must use the wildcard character (\*) for URLs involving service traffic. If you prefer not to use this for agent-related traffic, here's how to find those specific URLs to use without specifying wildcards: +> +> 1. Ensure your session host virtual machines are registered to a host pool. +> 1. Open **Event viewer**, then go to **Windows logs** > **Application** > **WVD-Agent** and look for event ID **3701**. +> 1. Unblock the URLs that you find under event ID 3701. The URLs under event ID 3701 are region-specific. You'll need to repeat this process with the relevant URLs for each Azure region you want to deploy your session host virtual machines in. - > [!div class="mx-imgBorder"] - >  +This list doesn't include URLs for other services like Azure Active Directory or Office 365. Azure Active Directory URLs can be found under ID 56, 59 and 125 in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online). -## Virtual machines +### Service tags and FQDN tags -You'll need to make sure that the Azure virtual machines you create for Azure Virtual Desktop have access to the URLs in one of the following sections based on which cloud you're using. +A [virtual network service tag](../virtual-network/service-tags-overview.md) represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. Service tags can be used in both Network Security Group ([NSG](../virtual-network/network-security-groups-overview.md)) and [Azure Firewall](../firewall/service-tags.md) rules to restrict outbound network access. Service tags can be also used in User Defined Route ([UDR](../virtual-network/virtual-networks-udr-overview.md#user-defined)) to customize traffic routing behavior. -### Azure public cloud +Azure Firewall supports Azure Virtual Desktop as a [FQDN tag](../firewall/fqdn-tags.md). For more information, see [Use Azure Firewall to protect Azure Virtual Desktop deployments](../firewall/protect-azure-virtual-desktop.md). -The Azure virtual machines you create for Azure Virtual Desktop must have access to the following URLs in the Azure public cloud: +We recommend you use FQDN tags or service tags instead of URLs to prevent service issues. The listed URLs and tags only correspond to Azure Virtual Desktop sites and resources. They don't include URLs for other services like Azure Active Directory. For other services, see [Available service tags](../virtual-network/service-tags-overview.md#available-service-tags). -|Address|Outbound TCP port|Purpose|Service Tag| -||||| -|*.wvd.microsoft.com|443|Service traffic|WindowsVirtualDesktop| -|*.prod.warm.ingest.monitor.core.windows.net|443|Agent traffic|AzureMonitor| -|catalogartifact.azureedge.net|443|Azure Marketplace|AzureFrontDoor.Frontend| -|kms.core.windows.net|1688|Windows activation|Internet| -|mrsglobalsteus2prod.blob.core.windows.net|443|Agent and SXS stack updates|AzureCloud| -|wvdportalstorageblob.blob.core.windows.net|443|Azure portal support|AzureCloud| -| 169.254.169.254 | 80 | [Azure Instance Metadata service endpoint](../virtual-machines/windows/instance-metadata-service.md) | N/A | -| 168.63.129.16 | 80 | [Session host health monitoring](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) | N/A | -| oneocsp.microsoft.com | 443 | Certificates | N/A | -| microsoft.com | 443 | Certificates | N/A | --A [Service Tag](../virtual-network/service-tags-overview.md) represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. Service Tags can be used in both Network Security Group ([NSG](../virtual-network/network-security-groups-overview.md)) and [Azure Firewall](../firewall/service-tags.md) rules to restrict outbound network access. Service Tags can be also used in User Defined Route ([UDR](../virtual-network/virtual-networks-udr-overview.md#user-defined)) to customize traffic routing behavior. -->[!TIP] ->Azure Virtual Desktop supports the FQDN tag. For more information, see [Use Azure Firewall to protect Azure Virtual Desktop deployments](../firewall/protect-azure-virtual-desktop.md). -> ->We recommend you use FQDN tags or service tags instead of URLs to prevent service issues. The listed URLs and tags only correspond to Azure Virtual Desktop sites and resources. They don't include URLs for other services like Azure Active Directory. +Azure Virtual Desktop currently doesn't have a list of IP address ranges that you can unblock to allow network traffic. We only support unblocking specific URLs. If you're using a Next Generation Firewall (NGFW), you'll need to use a dynamic list specifically made for Azure IPs to make sure you can connect. -> [!IMPORTANT] -> We are currently transitioning the URLs we use for Agent traffic. We still support the URLs below, however we encourage you to switch to ***.prod.warm.ingest.monitor.core.windows.net** as soon as possible. -> -> |Address|Outbound TCP port|Purpose|Service Tag| -> ||||| -> |gcs.prod.monitoring.core.windows.net|443|Agent traffic|AzureCloud| -> |production.diagnostics.monitoring.core.windows.net|443|Agent traffic|AzureCloud| -> |*xt.blob.core.windows.net|443|Agent traffic|AzureCloud| -> |*eh.servicebus.windows.net|443|Agent traffic|AzureCloud| -> |*xt.table.core.windows.net|443|Agent traffic|AzureCloud| -> |*xt.queue.core.windows.net|443|Agent traffic|AzureCloud| +## Remote Desktop clients -### Azure Government cloud +Any [Remote Desktop clients](user-documentation/connect-windows-7-10.md?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json) you use to connect to Azure Virtual Desktop must have access to the URLs below. Select the relevant tab based on which cloud you're using. Opening these URLs is essential for a reliable client experience. Blocking access to these URLs is unsupported and will affect service functionality. -The Azure virtual machines you create for Azure Virtual Desktop must have access to the following URLs in the Azure Government cloud: +# [Azure cloud](#tab/azure) -|Address|Outbound TCP port|Purpose|Service Tag| -||||| -|*.wvd.azure.us|443|Service traffic|WindowsVirtualDesktop| -|*.prod.warm.ingest.monitor.core.usgovcloudapi.net|443|Agent traffic|AzureMonitor| -|kms.core.usgovcloudapi.net|1688|Windows activation|Internet| -|mrsglobalstugviffx.blob.core.usgovcloudapi.net|443|Agent and SXS stack updates|AzureCloud| -|wvdportalstorageblob.blob.core.usgovcloudapi.net|443|Azure portal support|AzureCloud| -| 169.254.169.254 | 80 | [Azure Instance Metadata service endpoint](../virtual-machines/windows/instance-metadata-service.md) | N/A | -| 168.63.129.16 | 80 | [Session host health monitoring](../virtual-network/network-security-groups-overview.md#azure-platform-considerations) | N/A | -| ocsp.msocsp.com | 443 | Certificates | N/A | +| Address | Outbound TCP port | Purpose | Client(s) | +|--|--|--|--| +| `\*.wvd.microsoft.com` | 443 | Service traffic | All | +| `\*.servicebus.windows.net` | 443 | Troubleshooting data | All | +| `go.microsoft.com` | 443 | Microsoft FWLinks | All | +| `aka.ms` | 443 | Microsoft URL shortener | All | +| `docs.microsoft.com` | 443 | Documentation | All | +| `privacy.microsoft.com` | 443 | Privacy statement | All | +| `query.prod.cms.rt.microsoft.com` | 443 | Client updates | Windows Desktop | -> [!IMPORTANT] -> We are currently transitioning the URLs we use for Agent traffic. We still support the URLs below, however we encourage you to switch to ***.prod.warm.ingest.monitor.core.usgovcloudapi.net** as soon as possible. -> -> |Address|Outbound TCP port|Purpose|Service Tag| -> ||||| -> |gcs.monitoring.core.usgovcloudapi.net|443|Agent traffic|AzureCloud| -> |monitoring.core.usgovcloudapi.net|443|Agent traffic|AzureCloud| -> |fairfax.warmpath.usgovcloudapi.net|443|Agent traffic|AzureCloud| -> |*xt.blob.core.usgovcloudapi.net|443|Agent traffic|AzureCloud| -> |*.servicebus.usgovcloudapi.net|443|Agent traffic|AzureCloud| -> |*xt.table.core.usgovcloudapi.net|443|Agent traffic|AzureCloud| --The following table lists optional URLs that your Azure virtual machines can have access to: --|Address|Outbound TCP port|Purpose|Azure Gov| -||||| -|*.microsoftonline.com|443|Authentication to Microsoft Online Services|login.microsoftonline.us| -|*.events.data.microsoft.com|443|Telemetry Service|None| -|www.msftconnecttest.com|443|Detects if the OS is connected to the internet|None| -|*.prod.do.dsp.mp.microsoft.com|443|Windows Update|None| -|login.windows.net|443|Sign in to Microsoft Online Services, Microsoft 365|login.microsoftonline.us| -|*.sfx.ms|443|Updates for OneDrive client software|oneclient.sfx.ms| -|*.digicert.com|443|Certificate revocation check|None| -|*.azure-dns.com|443|Azure DNS resolution|None| -|*.azure-dns.net|443|Azure DNS resolution|None| -->[!NOTE] ->Azure Virtual Desktop currently doesn't have a list of IP address ranges that you can unblock to allow network traffic. We only support unblocking specific URLs at this time. -> ->If you're using a Next Generation Firewall (NGFW), you'll need to use a dynamic list specifically made for Azure IPs to make sure you can connect. -> ->For a list of safe Office-related URLs, including required Azure Active Directory-related URLs, see [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges). -> ->You must use the wildcard character (*) for URLs involving service traffic. If you prefer to not use * for agent-related traffic, here's how to find the URLs without wildcards: -> ->1. Register your virtual machines to the Azure Virtual Desktop host pool. ->2. Open **Event viewer**, then go to **Windows logs** > **Application** > **WVD-Agent** and look for Event ID 3701. ->3. Unblock the URLs that you find under Event ID 3701. The URLs under Event ID 3701 are region-specific. You'll need to repeat the unblocking process with the relevant URLs for each region you want to deploy your virtual machines in. +# [Azure for US Government](#tab/azure-for-us-government) -## Remote Desktop clients +| Address | Outbound TCP port | Purpose | Client(s) | +|--|--|--|--| +| `\*.wvd.microsoft.us` | 443 | Service traffic | All | +| `\*.servicebus.usgovcloudapi.net` | 443 | Troubleshooting data | All | +| `go.microsoft.com` | 443 | Microsoft FWLinks | All | +| `aka.ms` | 443 | Microsoft URL shortener | All | +| `docs.microsoft.com` | 443 | Documentation | All | +| `privacy.microsoft.com` | 443 | Privacy statement | All | +| `query.prod.cms.rt.microsoft.com` | 443 | Client updates | Windows Desktop | -Any Remote Desktop clients you use must have access to the following URLs: --|Address|Outbound TCP port|Purpose|Client(s)|Azure Gov| -|||||| -|*.wvd.microsoft.com|443|Service traffic|All|*.wvd.microsoft.us| -|*.servicebus.windows.net|443|Troubleshooting data|All|*.servicebus.usgovcloudapi.net| -|go.microsoft.com|443|Microsoft FWLinks|All|None| -|aka.ms|443|Microsoft URL shortener|All|None| -|docs.microsoft.com|443|Documentation|All|None| -|privacy.microsoft.com|443|Privacy statement|All|None| -|query.prod.cms.rt.microsoft.com|443|Client updates|Windows Desktop|None| + ->[!IMPORTANT] ->Opening these URLs is essential for a reliable client experience. Blocking access to these URLs is unsupported and will affect service functionality. -> ->These URLs only correspond to client sites and resources. This list doesn't include URLs for other services like Azure Active Directory. Azure Active Directory URLs can be found under ID 56, 59 and 125 on the [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online). +These URLs only correspond to client sites and resources. This list doesn't include URLs for other services like Azure Active Directory or Office 365. Azure Active Directory URLs can be found under IDs 56, 59 and 125 in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online). |
| virtual-desktop | Set Up Golden Image | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/set-up-golden-image.md | Generalize the VM by running [sysprep](../virtual-machines/generalize.md). After you've completed sysprep and shut down your machine in the Azure portal, open the **VM** tab and select the **Capture** button to save the image for later use. When you capture a VM, you can either add the image to a shared image gallery or capture it as a managed image. The [Shared Image Gallery](../virtual-machines/shared-image-galleries.md) lets you add features and use existing images in other deployments. Images from a Shared Image Gallery are highly-available, ensure easy versioning, and you can deploy them at scale. However, if you have a simpler deployment, you may want to use a standalone managed image instead. > [!IMPORTANT]-> We recommend using Shared Image Gallery images for production environments because of their enhanced capabilities, such as replication and image versioning. +> We recommend using Azure Compute Gallery images for production environments because of their enhanced capabilities, such as replication and image versioning. When you create a capture, you'll need to delete the VM afterwards, as you'll no longer be able to use it after the capture process is finished. Don't try to capture the same VM twice, even if there's an issue with the capture. Instead, create a new VM from your latest snapshot, then run sysprep again. Once you've finished the capture process, you can use your image to create your session hosts. To find the image, open the **Host pool** tab, choose **Gallery**, then select all images. Next, select **My items** and look for your managed images under **My images**. Your image definitions should appear under the shared items section. ## Other recommendations |
| virtual-desktop | Linux Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/user-documentation/linux-overview.md | The following partners have approved Azure Virtual Desktop clients. |HP |[HP client documentation](https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=c07051097)|[HP support](https://support.hp.com/us-en/products/workstations-thin-clients)| |IGEL |[IGEL client documentation](https://www.igel.com/igel-solution-family/)|[IGEL support](https://www.igel.com/support/)| |NComputing |[NComputing client documentation](https://www.ncomputing.com/microsoft)|[NComputing support](https://www.ncomputing.com/support/support-options)|-|Stratodesk |[Stratodesk client documentation](https://www.stratodesk.com/kb/Microsoft_Windows_Virtual_Desktop_(WVD))|[Stratodesk support](https://www.stratodesk.com/support/)| +|Stratodesk |[Stratodesk client documentation](https://kb.stratodesk.com/microsoft-windows-virtual-desktop-wvd)|[Stratodesk support](https://www.stratodesk.com/support/)| ## Next steps |
| virtual-desktop | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/whats-new.md | You can now configure Start VM on Connect (preview) in the Azure portal. With th ### Required URL Check tool -The Azure Virtual Desktop agent, version 1.0.2944.400 includes a tool that validates URLs and displays whether the virtual machine can access the URLs it needs to function. If any required URLs are accessible, the tool will list them so you can unblock them, if needed. Learn more at our [Safe URL list](safe-url-list.md#required-url-check-tool). +The Azure Virtual Desktop agent, version 1.0.2944.400 includes a tool that validates URLs and displays whether the virtual machine can access the URLs it needs to function. If any required URLs are accessible, the tool will list them so you can unblock them, if needed. Learn more at [Required URL Check tool](required-url-check-tool.md). ### Updates to the Azure portal UI for Azure Virtual Desktop |
| virtual-machines | Capacity Reservation Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/capacity-reservation-overview.md | From this example accumulation of Minutes Not Available, here is the calculation ## Pricing and billing -Capacity Reservations are priced at the same rate as the underlying VM size. For example, if you create a reservation for quantity 10 for D2s_v3 VM then you will start getting billed for ten D2s_v3 VMs, even if the reservation is not being used. +Capacity Reservations are priced at the same rate as the underlying VM size. For example, if you create a reservation for ten D2s_v3 VMs then you will start getting billed for ten D2s_v3 VMs, even if the reservation is not being used. If you then deploy a D2s_v3 VM and specify reservation property, the Capacity Reservation gets used. Once in use, you will only pay for the VM and nothing extra for the Capacity Reservation. LetΓÇÖs say you deploy six D2s_v3 VMs against the previously mentioned Capacity Reservation. You will see a bill for six D2s_v3 VMs and four unused Capacity Reservation, both charged at the same rate as a D2s_v3 VM. In the previous image, the VM Reserved Instance discount is applied to VM 0, whi Create a Capacity Reservation and start reserving Compute capacity in an Azure region or an Availability Zone. > [!div class="nextstepaction"]-> [Create a Capacity Reservation](capacity-reservation-create.md) +> [Create a Capacity Reservation](capacity-reservation-create.md) |
| virtual-machines | Dedicated Host General Purpose Skus | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/dedicated-host-general-purpose-skus.md | The following packing configuration outlines the max packing of uniform VMs you ## Dsv3 ### Dsv3-Type1 +> [!NOTE] +> **The Dsv3-Type1 will be retired on March 31, 2023**. Refer to the [dedicated host retirement guide](dedicated-host-retirement.md) to learn more. + The Dsv3-Type1 is a Dedicated Host SKU utilizing the Intel® Broadwell (2.3 GHz Xeon® E5-2673 v4) processor. It offers 40 physical cores, 64 vCPUs, and 256 GiB of RAM. The Dsv3-Type1 runs [Dsv3-series](dv3-dsv3-series.md#dsv3-series) VMs. The following packing configuration outlines the max packing of uniform VMs you can put onto a Dsv3-Type1 host. You can also mix multiple VM sizes on the Dsv3-Type1. The following are sample c ### Dsv3-Type2 +> [!NOTE] +> **The Dsv3-Type2 will be retired on March 31, 2023**. Refer to the [dedicated host retirement guide](dedicated-host-retirement.md) to learn more. + The Dsv3-Type2 is a Dedicated Host SKU utilizing the Intel® Skylake (2.1 GHz Xeon® Platinum 8171M) processor. It offers 48 physical cores, 76 vCPUs, and 504 GiB of RAM. The Dsv3-Type2 runs [Dsv3-series](dv3-dsv3-series.md#dsv3-series) VMs. The following packing configuration outlines the max packing of uniform VMs you can put onto a Dsv3-Type2 host. |
| virtual-machines | Dedicated Host Memory Optimized Skus | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/dedicated-host-memory-optimized-skus.md | The following packing configuration outlines the max packing of uniform VMs you ## Esv3 ### Esv3-Type1 +> [!NOTE] +> **The Esv3-Type1 will be retired on March 31, 2023**. Refer to the [dedicated host retirement guide](dedicated-host-retirement.md) to learn more. + The Esv3-Type1 is a Dedicated Host SKU utilizing the Intel® Broadwell (2.3 GHz Xeon® E5-2673 v4) processor. It offers 40 physical cores, 64 vCPUs, and 448 GiB of RAM. The Esv3-Type1 runs [Esv3-series](ev3-esv3-series.md#ev3-series) VMs. The following packing configuration outlines the max packing of uniform VMs you can put onto an Esv3-Type1 host. The following packing configuration outlines the max packing of uniform VMs you ### Esv3-Type2 +> [!NOTE] +> **The Esv3-Type2 will be retired on March 31, 2023**. Refer to the [dedicated host retirement guide](dedicated-host-retirement.md) to learn more. + The Esv3-Type2 is a Dedicated Host SKU utilizing the Intel® Skylake (Xeon® 8171M) processor. It offers 48 physical cores, 76 vCPUs, and 504 GiB of RAM. The Esv3-Type2 runs [Esv3-series](ev3-esv3-series.md#ev3-series) VMs. The following packing configuration outlines the max packing of uniform VMs you can put onto an Esv3-Type2 host. |
| virtual-machines | Dedicated Hosts How To | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/dedicated-hosts-how-to.md | az vm host group create \ --platform-fault-domain-count 2 ``` -Add the `--automatic-placement true` parameter to have your VMs and scale set instances automatically placed on hosts, within a host group. For more information, see [Manual vs. automatic placement ](dedicated-hosts.md#manual-vs-automatic-placement). +Add the `--automatic-placement true` parameter to have your VMs and scale set instances automatically placed on hosts, within a host group. For more information, see [Manual vs. automatic placement](dedicated-hosts.md#manual-vs-automatic-placement). **Other examples** $hostGroup = New-AzHostGroup ` ``` -Add the `-SupportAutomaticPlacement true` parameter to have your VMs and scale set instances automatically placed on hosts, within a host group. For more information, see [Manual vs. automatic placement ](dedicated-hosts.md#manual-vs-automatic-placement). +Add the `-SupportAutomaticPlacement true` parameter to have your VMs and scale set instances automatically placed on hosts, within a host group. For more information, see [Manual vs. automatic placement ](dedicated-hosts.md#manual-vs-automatic-placement). |
| virtual-machines | Disks Pools Deploy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/disks-pools-deploy.md | For your disk pool to work with your client machines, you must delegate a subnet 1. Go to the virtual networks pane in the Azure portal and select the virtual network to use for the disk pool. 1. Select **Subnets** from the virtual network pane and select **+Subnet**. 1. Create a new subnet by completing the following required fields in the **Add subnet** pane:- - Subnet delegation: Select Microsoft.StoragePool + - Subnet delegation: Select Microsoft.StoragePool/diskPools For more information on subnet delegation, see [Add or remove a subnet delegation](../virtual-network/manage-subnet-delegation.md). |
| virtual-machines | Agent Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/extensions/agent-windows.md | To boot a VM you must have the PA installed on the VM, however the WinGA does no If you do not have the Agents installed, you cannot use some Azure services, such as Azure Backup or Azure Security. These services require an extension to be installed. If you have deployed a VM without the WinGA, you can install the latest version of the agent later. ### Manual installation-The Windows VM agent can be manually installed with a Windows installer package. Manual installation may be necessary when you create a custom VM image that is deployed to Azure. To manually install the Windows VM Agent, [download the VM Agent installer](https://go.microsoft.com/fwlink/?LinkID=394789). You can also search a specific version in the [GitHub Windows IaaS VM Agent releases](https://github.com/Azure/WindowsVMAgent/releases). The VM Agent is supported on Windows Server 2008 (64 bit) and later. +The Windows VM agent can be manually installed with a Windows installer package. Manual installation may be necessary when you create a custom VM image that is deployed to Azure. To manually install the Windows VM Agent, [download the VM Agent installer](https://github.com/Azure/WindowsVMAgent) and select the latest release. You can also search a specific version in the [GitHub Windows IaaS VM Agent releases](https://github.com/Azure/WindowsVMAgent/releases). The VM Agent is supported on Windows Server 2008 (64 bit) and later. > [!NOTE] > It is important to update the AllowExtensionOperations option after manually installing the VMAgent on a VM that was deployed from image without ProvisionVMAgent enable. |
| virtual-network | Quick Create Portal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/quick-create-portal.md | Sign in to the [Azure portal](https://portal.azure.com). 1. Select **Create a resource** in the upper left-hand corner of the portal. -2. In the search box, enter **Virtual Network**. Select **Virtual Network** in the search results. -3. In the **Virtual Network** page, select **Create**. +1. In the search box, enter **Virtual Network**. Select **Virtual Network** in the search results. -4. In **Create virtual network**, enter or select this information in the **Basics** tab: +1. In the **Virtual Network** page, select **Create**. ++1. In **Create virtual network**, enter or select this information in the **Basics** tab: | Setting | Value | | - | -- | Sign in to the [Azure portal](https://portal.azure.com). | Name | Enter **myVNet**. | | Region | Select **(US) East US**. | - :::image type="content" source="./media/quick-create-portal/create-virtual-network.png" alt-text="Create virtual network Azure portal" border="true"::: -5. Select the **IP Addresses** tab, or select the **Next: IP Addresses** button at the bottom of the page. + :::image type="content" source="./media/quick-create-portal/example-basics-tab.png" alt-text="Screenshot of creating a virtual network in Azure portal." border="true"::: ++ -6. In **IPv4 address space**, select the existing address space and change it to **10.1.0.0/16**. -7. Select **+ Add subnet**, then enter **MySubnet** for **Subnet name** and **10.1.0.0/24** for **Subnet address range**. +1. Select the **IP Addresses** tab, or select the **Next: IP Addresses** button at the bottom of the page and enter in the following information then select **Add**: ++ | Setting | Value | + |--|-| + | IPv4 address space | Enter **10.1.0.0/16**. | + | **Add subnet** | + | Subnet name | Enter **MySubnet**. | + | Subnet address range | Enter **10.1.0.0/24**. | + | Select **Add**. | | + -8. Select **Add**. + :::image type="content" source="./media/quick-create-portal/example-ip-address-tab.png" alt-text="Screenshot of editing ip address tab for virtual network." border="true"::: -9. Select the **Security** tab, or select the **Next: Security** button at the bottom of the page. +1. Select the **Security** tab, or select the **Next: Security** button at the bottom of the page. -10. Under **BastionHost**, select **Enable**. Enter this information: +1. Under **BastionHost**, select **Enable**. Enter this information: | Setting | Value | |--|-| Sign in to the [Azure portal](https://portal.azure.com). | AzureBastionSubnet address space | Enter **10.1.1.0/24** | | Public IP Address | Select **Create new**. </br> For **Name**, enter **myBastionIP**. </br> Select **OK**. | -11. Select the **Review + create** tab or select the **Review + create** button. -12. Select **Create**. + :::image type="content" source="./media/quick-create-portal/example-security-tab.png" alt-text="Screenshot of editing security tab for virtual network." border="true"::: ++++1. Select the **Review + create** tab or select the **Review + create** button. ++1. Select **Create**. ++ ## Create virtual machines Create two VMs in the virtual network: 1. On the upper-left side of the portal, select **Create a resource** > **Compute** > **Virtual machine**. -2. In **Create a virtual machine**, type or select the values in the **Basics** tab: +1. In **Create a virtual machine**, type or select the values in the **Basics** tab: - | Setting | Value | + | Setting | Value | |--|-| | **Project Details** | | | Subscription | Select your Azure subscription | Create two VMs in the virtual network: | Virtual machine name | Enter **myVM1** | | Region | Select **(US) East US** | | Availability Options | Select **No infrastructure redundancy required** |- | Image | Select **Windows Server 2019 Datacenter** | + | Image | Select **Windows Server 2019 Datacenter - Gen2** | | Azure Spot instance | Select **No** | | Size | Choose VM size or take default setting | | **Administrator account** | | Create two VMs in the virtual network: | Confirm password | Reenter password | | **Inbound port rules** | | | Public inbound ports | Select **None**. |- | + + + :::image type="content" source="./media/quick-create-portal/azure-virtual-machine-basic-settings.png" alt-text="screenshot of creating basic settings for virtual machine." border="true"::: + -3. Select the **Networking** tab, or select **Next: Disks**, then **Next: Networking**. +1. Select the **Networking** tab, or select **Next: Disks**, then **Next: Networking**. -4. In the Networking tab, select or enter: +1. In the Networking tab, select or enter: | Setting | Value | |-|-| Create two VMs in the virtual network: | NIC network security group | Select **Basic**| | Public inbound ports network | Select **None**. | -5. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page. +1. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page. -6. Review the settings, and then select **Create**. +1. Review the settings, and then select **Create**. ### Create the second VM 1. On the upper-left side of the portal, select **Create a resource** > **Compute** > **Virtual machine**. -2. In **Create a virtual machine**, type or select the values in the **Basics** tab: +1. In **Create a virtual machine**, type or select the values in the **Basics** tab: | Setting | Value | |--|-| Create two VMs in the virtual network: | Virtual machine name | Enter **myVM2** | | Region | Select **(US) East US** | | Availability Options | Select **No infrastructure redundancy required** |- | Image | Select **Windows Server 2019 Datacenter** | + | Image | Select **Windows Server 2019 Datacenter - Gen2** | | Azure Spot instance | Select **No** | | Size | Choose VM size or take default setting | | **Administrator account** | | Create two VMs in the virtual network: | Confirm password | Reenter password | | **Inbound port rules** | | | Public inbound ports | Select **None**. |- | + -3. Select the **Networking** tab, or select **Next: Disks**, then **Next: Networking**. +1. Select the **Networking** tab, or select **Next: Disks**, then **Next: Networking**. -4. In the Networking tab, select or enter: +1. In the Networking tab, select or enter: | Setting | Value | |-|-| Create two VMs in the virtual network: | NIC network security group | Select **Basic**| | Public inbound ports network | Select **None**. | -5. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page. +1. Select the **Review + create** tab, or select the blue **Review + create** button at the bottom of the page. -6. Review the settings, and then select **Create**. +1. Review the settings, and then select **Create**. [!INCLUDE [ephemeral-ip-note.md](../../includes/ephemeral-ip-note.md)] Create two VMs in the virtual network: 1. Go to the [Azure portal](https://portal.azure.com) to manage your private VM. Search for and select **Virtual machines**. -2. Pick the name of your private virtual machine **myVM1**. +1. Pick the name of your private virtual machine **myVM1**. -3. In the VM menu bar, select **Connect**, then select **Bastion**. +1. In the VM menu bar, select **Connect**, then select **Bastion**. - :::image type="content" source="./media/quick-create-portal/connect-to-virtual-machine.png" alt-text="Connect to myVM1 with Azure Bastion" border="true"::: + :::image type="content" source="./media/quick-create-portal/connect-to-virtual-machine.png" alt-text="Screenshot of connecting to myVM1 with Azure Bastion." border="true"::: -4. In the **Connect** page, select the blue **Use Bastion** button. +1. In the **Connect** page, select the blue **Use Bastion** button. -5. In the **Bastion** page, enter the username and password you created for the virtual machine previously. +1. In the **Bastion** page, enter the username and password you created for the virtual machine previously. -6. Select **Connect**. +1. Select **Connect**. ++For more information about Azure Bastion, see [Azure Bastion](~/articles/bastion/bastion-overview.md). ## Communicate between VMs 1. In the Bastion connection of **myVM1**, open PowerShell. -2. Enter `ping myVM2`. +1. Enter `ping myVM2`. You'll get a reply message like this: Create two VMs in the virtual network: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), ``` - The ping fails, because it uses the Internet Control Message Protocol (ICMP). By default, ICMP isn't allowed through your Windows firewall. + The ping fails, because it uses the Internet Control Message Protocol (ICMP). By default, ICMP isn't allowed through your Windows firewall. 1. To allow **myVM2** to ping **myVM1** in a later step, enter this command: Create two VMs in the virtual network: That command lets ICMP inbound through the Windows firewall. -3. Close the Bastion connection to **myVM1**. --4. Complete the steps in [Connect to myVM1](#connect-to-myvm1), but connect to **myVM2**. +1. Close the bastion connection to **myVM1**. +1. Complete the steps in [Connect to myVM1](#connect-to-myvm1), but connect to **myVM2**. -5. Open PowerShell on **myVM2**, enter `ping myVM1`. +1. Open PowerShell on **myVM2**, enter `ping myvm1`. You'll receive a successful reply message like this: Create two VMs in the virtual network: Minimum = 1ms, Maximum = 1ms, Average = 1ms ``` -7. Close the bastion connection to **myVM2**. +1. Close the bastion connection to **myVM2**. ## Clean up resources When you're done using the virtual network and the VMs, delete the resource grou To learn more about virtual network settings, see [Create, change, or delete a virtual network](manage-virtual-network.md). To learn more about types of VM network communications, see [Filter network traffic](tutorial-filter-network-traffic.md).+++ |