+## Disable monitoring data collection

+To stop collecting logs to your Log Analytics workspace, delete the diagnostic settings you created. You'll continue to incur charges for retaining log data you've already collected into your workspace. If you no longer need the monitoring data you've collected, you can delete your Log Analytics workspace and the resource group you created for Azure Monitor. Deleting the Log Analytics workspace deletes all data in the workspace and prevents you from incurring additional data retention charges.

+## Delete Log Analytics workspace and resource group

+1. Sign in to the [Azure portal](https://portal.azure.com).

+1. Make sure you're using the directory that contains your *Azure AD* tenant:

+ 1. Select the **Directories + subscriptions** icon in the portal toolbar.

+ 1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD directory in the **Directory name** list, and then select **Switch** button next to it.

+1. Choose the resource group that contains the Log Analytics workspace. This example uses a resource group named _azure-ad-b2c-monitor_ and a Log Analytics workspace named `AzureAdB2C`.

+1. [Delete the Logs Analytics workspace](../azure-monitor/logs/delete-workspace.md#azure-portal).

+1. Select the **Delete** button to delete the resource group.

+|Tenant status | What to do |

+|-||

+| I've an existing tenant | You need to opt in to start using Go-Local add-on by using the steps in [Activate Go-Local ad-on](tutorial-create-tenant.md#activate-azure-ad-b2c-go-local-add-on). |

+| I'm creating a new tenant | You enable Go-Local add-on when you create your new Azure AD B2C tenant. Learn how to [create your Azure AD B2C](tutorial-create-tenant.md) tenant.|

+- If you want to reuse a tenant name that you previously tried to delete, but you see the error "Already in use by another directory" when you enter the domain name, you'll need to [follow these steps to fully delete the tenant](./faq.yml?tabs=app-reg-ga#how-do-i-delete-my-azure-ad-b2c-tenant-) before you try again. You require a role of at least *Subscription Administrator*. After deleting the tenant, you might also need to sign out and sign back in before you can reuse the domain name.

+ - For **Location**, select your country/region from the list. If the country/region you select has a [Go-Local add-on](data-residency.md#go-local-add-on) option, such as Japan or Australia, and you want to store your data exclusively within that country/region, select the **Store Azure AD Core Store data and Azure AD components and service data in the location selected above** checkbox. Go-Local add-on is a paid add-on whose charge is added to your Azure AD B2C Premium P1 or P2 licenses charges, see [Billing model](billing.md#about-go-local-add-on). You can't change the data residency region after you create your Azure AD B2C tenant.

+## Activate Azure AD B2C Go-Local add-on

+Azure AD B2C allows you to activate Go-Local add-on on an existing tenant as long as your tenant stores data in a country/region that has local data residence option. To opt-in to Go-Local add-on, use the following steps:

+1. Sign in to the [Azure portal](https://portal.azure.com/).

+1. Make sure you're using the directory that contains your Azure AD B2C tenant:

+ 1. In the Azure portal toolbar, select the **Directories + subscriptions** (:::image type="icon" source="./../active-directory/develop/media/common/portal-directory-subscription-filter.png" border="false":::) icon.

+

+ 1. On the **Portal settings | Directories + subscriptions** page, find your Azure AD B2C directory in the **Directory name** list, and then select the **Switch** button next to it.

+

+1. In the Azure portal, search for and select **Azure AD B2C**.

+1. On the tenant management page that appears, on the top of the page, select **Enable data residency** link.

+ :::image type="content" source="media/tutorial-create-tenant/opt-in-go-local-add-on.png" alt-text="Screenshot of opt in to Azure AD B2C Go-Local add-on in Azure portal.":::

+1. On the **Data residency** pane that appears, select the **Store my directory and Azure AD data in \<Country\>** checkbox, then select **Save** button.

+1. Close the **Data residency** pane.

+| [Authenticator Lite](how-to-mfa-authenticator-lite.md) | Enabled |

+>This is an important security enhancement for users authenticating via telecom transports. On June 26, the Microsoft managed value of this feature changed from ΓÇÿdisabledΓÇÖ to ΓÇÿenabledΓÇÖ. If you no longer wish for this feature to be enabled, move the state from 'default' toΓÇÿdisabledΓÇÖ or set users to include and exclude groups.

+- Your organization needs to enable Microsoft Authenticator (second factor) push notifications for some users or groups by using the modern Authentication methods policy. You can edit the Authentication methods policy by using the Azure portal or Microsoft Graph API.

+By default, Authenticator Lite is [Microsoft managed](concept-authentication-default-enablement.md#microsoft-managed-settings). On June 26, the Microsoft managed value of this feature changed from ΓÇÿdisabledΓÇÖ to ΓÇÿenabledΓÇÖ

+### Disabling Authenticator Lite in Azure portal UX

+To disable Authenticator Lite in the Azure portal, complete the following steps:

+ 2. On the Enable and Target tab, click Yes and All users to enable the Authenticator policy for everyone or add selected users and groups. Set the Authentication mode for these users/groups to Any or Push.

+ 3. On the Configure tab, for **Microsoft Authenticator on companion applications**, change Status to Disabled, and click Save.

+### Are users on the legacy policy eligible for Authenticator Lite?

+No, only those users configured for Authenticator app via the modern authentication methods policy are eligible for this experience. If your tenant is currently on the legacy policy and you are interested in this feature, please migrate your users to the modern auth policy.

+### Logs are showing additional conditional access evaluations

+The conditional access policies are evaluated each time a user opens their Outlook app, in order to determine whether the user is eligible to register for Authenticator Lite. These checks may appear in logs.

+>[!NOTE]

+>If both per-user MFA and Conditional Access policies are configured in the tenant, you will need to add trusted IPs to the Conditional Access policy and update the MFA service settings.

+Some environments have multiple identity management systems. On-premises identity managers like Oracle IAM and SiteMinder, require synchronization with AD for passwords. You can do this using a tool like the Password Change Notification Service (PCNS) with Microsoft Identity Manager (MIM). To find information on this more complex scenario, see the article [Deploy the MIM Password Change Notification Service on a domain controller](/microsoft-identity-manager/deploying-mim-password-change-notification-service-on-domain-controller).

+### Microsoft Admin Portals (preview)

+When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to application IDs of the following Microsoft administrative portals:

+- Microsoft 365 Admin Center

+- Exchange admin center

+- Azure portal

+- Microsoft Entra admin center

+- Security and Microsoft Purview compliance portal

+Other Microsoft admin portals will be added over time.

+> [!NOTE]

+> The Microsoft Admin Portals app applies to interactive sign-ins to the listed admin portals only. Sign-ins to the underlying resources or services like Microsoft Graph or Azure Resource Manager APIs are not covered by this application. Those resources are protected by the [Microsoft Azure Management](#microsoft-azure-management) app. This enables customers to move along the MFA adoption journey for admins without impacting automation that relies on APIs and PowerShell. When you are ready, Microsoft recommends using a [policy requiring administrators perform MFA always](howto-conditional-access-policy-admin-mfa.md) for comprehensive protection.

+Applying a Conditional Access policy to **All cloud apps** results in the policy being enforced for all tokens issued to web sites and services. This option includes applications that aren't individually targetable in Conditional Access policy, such as Azure Active Directory.

+> [!NOTE]

+> When applying a policy targeting user actions for register security information, if the user account is a guest from [Microsoft personal account (MSA)](../external-identities/microsoft-account.md), using the control 'Require multifactor authentication', will require the MSA user to register security information with the organization. If the guest user is from another provider such as [Google](../external-identities/google-federation.md), access will be blocked.

+description: Learn how to remove an application registered with the Microsoft identity platform.

+- Remove an application authored by you or your organization

+- Remove an application authored by another organization

+- One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+- An [application registered in your Azure AD tenant](quickstart-register-app.md)

+1. Sign in to the [Azure portal](https://portal.azure.com) and sign in using one of the roles listed in the prerequisites.

+1. Under **Manage**, select **App registrations** and select the application that you want to configure. Once you've selected the app, you see the application's **Overview** page.

+## Prerequisites

+## View your deleted applications

+To view your restorable applications:

+1. Sign in to the [Azure portal](https://portal.azure.com) and sign in using one of the roles listed in the prerequisites.

+1. Search and select **Azure Active Directory**, select **App registrations**, and then select the **Deleted applications** tab.

+When an app registration is deleted from the organization, the app is in a suspended state, and its configurations are preserved. When you restore an app registration, its configurations are also restored. However, if there were any organization-specific settings such as permission consents and user and group assignments for a certain organization stored in **Enterprise applications** for the application's home tenant, they're restored alongside the app registration.

+To restore an application:

+1. Go to the **Deleted applications** tab. Search for and select one of the applications deleted less than 30 days ago.

+1. Select **Restore app registration**.

+You can manually permanently delete an application from your organization. A permanently deleted application can't be restored by you, another administrator, or by Microsoft customer support. However, this doesn't permanently delete the corresponding service principal. The service principal can't be restored without having an active corresponding application, so the service principal can be manually deleted, which is also permanent. If no action is taken, the service principal will be permanently deleted 30 days after deleting the application.

+To permanently delete an application:

+1. Go to the **Deleted applications** tab. Search for and select one of the available applications.

+1. Select **Delete permanently**.

+1. Read the warning text and select **Yes**.

+Depending on your scenario, you may determine that your application's tokens should continue receiving unverified emails. While not recommended for most applications, you may disable the default behavior by setting the `removeUnverifiedEmailClaim` property in the [authenticationBehaviors object of the applications API in Microsoft Graph](/graph/applications-authenticationbehaviors).

+- For more information about optional claims, see the [optional claims reference](./optional-claims-reference.md)

+description: Learn how to serialize token cache using MSAL for Python

+In Microsoft Authentication Library (MSAL) for Python, an in-memory token cache that persists for the duration of the app session, is provided by default when you create an instance of [ClientApplication](/python/api/msal/msal.application.confidentialclientapplication).

+Serialization of the token cache, so that different sessions of your app can access it, isn't provided "out of the box." MSAL for Python can be used in app types that don't have access to the file system--such as Web apps. To have a persistent token cache in an app that uses MSAL for Python, you must provide custom token cache serialization.

+The strategies for serializing the token cache differ depending on whether you're writing a public client application (Desktop), or a confidential client application (web app, web API, or daemon app).

+Public client applications run on a user's device and manage tokens for a single user. In this case, you could serialize the entire cache into a file. Remember to provide file locking if your app, or another app, can access the cache concurrently. For a simple example of how to serialize a token cache to a file without locking, see the example in the [SerializableTokenCache](/python/api/msal/msal.token_cache.serializabletokencache) class reference documentation.

+When you've completed the tutorial, your application accepts sign-ins of personal Microsoft accounts (including outlook.com, live.com, and others) and work or school accounts from any company or organization that uses Azure Active Directory (Azure AD). This tutorial is applicable to both iOS and macOS apps. Some steps are different between the two platforms.

+>

+> - Create an iOS or macOS app project in _Xcode_

+> - Register the app in the Azure portal

+> - Add code to support user sign-in and sign-out

+> - Add code to call the Microsoft Graph API

+> - Test the app

+The app in this tutorial can sign in users and get data from Microsoft Graph on their behalf. This data is accessed via a protected API (Microsoft Graph API in this case) that requires authorization and is protected by the Microsoft identity platform.

+- Your app signs in the user either through a browser or the Microsoft Authenticator.

+- The end user accepts the permissions your application has requested.

+- Your app is issued an access token for the Microsoft Graph API.

+- The access token is included in the HTTP request to the web API.

+- Process the Microsoft Graph response.

+From a terminal window, in the same directory as the updated _Cartfile_, run the following command to have Carthage update the dependencies in your project.

+Next, we add your app registration to your code.

+The only value you modify is the value assigned to `kClientID` to be your [Application ID](./developer-glossary.md#application-client-id). This value is part of the MSAL Configuration data that you saved during the step at the beginning of this tutorial to register the application in the Azure portal.

+In this step, you'll register `CFBundleURLSchemes` so that the user can be redirected back to the app after sign in. By the way, `LSApplicationQueriesSchemes` also allows your app to make use of Microsoft Authenticator.

+Now create a UI that includes a button to call the Microsoft Graph API, another to sign out, and a text view to see some output by adding the following code to the `ViewController` class:

+- `acquireTokenSilently()` attempts to sign in a user and get tokens without user interaction as long as an account is present. `acquireTokenSilently()` require a valid `MSALAccount`, which can be retrieved by using one of MSAL's account enumeration APIs. This tutorial uses `applicationContext.getCurrentAccount(with: msalParameters, completionBlock: {})` to retrieve the current account.

+The following code snippet gets a token for the first time by creating an `MSALInteractiveTokenParameters` object and calling `acquireToken`. Next you add code that:

+- `.promptIfNecessary` (default) - The user is prompted only if necessary. The SSO experience is determined by the presence of cookies in the webview, and the account type. If multiple users are signed in, account selection experience is presented. _This is the default behavior_.

+| header key | value |

+| - | - |

+ - iOS: `com.microsoft.adalcache`

+ - macOS: `com.microsoft.identity.universalstorage`

+```swift

+This app is built for a single account scenario. MSAL also supports multi-account scenarios, but it requires more application work. You need to create UI to help users select which account they want to use for each action that requires tokens. Alternatively, your app can implement a heuristic to select which account to use by querying all accounts from MSAL. For example, see `accountsFromDeviceForParameters:completionBlock:` [API](<https://azuread.github.io/microsoft-authentication-library-for-objc/Classes/MSALPublicClientApplication.html#/c:objc(cs)MSALPublicClientApplication(im)accountsFromDeviceForParameters:completionBlock:>)

+> [!div class="nextstepaction"]

+## About Azure AD B2C

+If you're a new customer, you might be wondering which solution is a better fit, [Azure AD B2C](../../../active-directory-b2c/index.yml) or Microsoft Entra External ID (preview). Opt for the current Azure AD B2C product if:

+- You have an immediate need to deploy a production ready build for customer-facing apps.

+

+ > [!NOTE]

+ > Keep in mind that the next generation Microsoft Entra External ID platform represents the future of CIAM for Microsoft, and rapid innovation, new features and capabilities will be focused on this platform. By choosing the next generation platform from the start, you will receive the benefits of rapid innovation and a future-proof architecture.

+Opt for the next generation Microsoft Entra External ID platform if:

+- YouΓÇÖre starting fresh building identities into apps or you're in the early stages of product discovery.

+- The benefits of rapid innovation, new features and capabilities are a priority.

+1. Under **Applies to**, choose either **All &lt;organization&gt; users and groups** or **Select &lt;organization&gt; users and groups**. If you choose **Select &lt;organization&gt; users and groups**, perform these steps for each user or group you want to add:

+ > For our Microsoft Accounts example, we select **All Microsoft Accounts users and groups**.

+# Check execution user scope of a workflow

+# Lifecycle Workflows custom task extension

+> Creating a custom task extension and logic app through the Azure portal will automate most of these steps. For a guide on creating a custom task extension this way, see: [Trigger Logic Apps based on custom task extensions](trigger-custom-task.md).

+- **Configure the Azure Logic App so its compatible with Lifecycle workflows**: Configuring the consumption-based Azure Logic App so that it can be used with the custom task extension. For more information, see: [Configure a Logic App for Lifecycle Workflow use](configure-logic-app-lifecycle-workflows.md)

+### Send email to notify manager of user move

+When a user moves within your organization Lifecycle Workflows allow you to send an email to the users manager notifying them of the move. You're also able to customize the email that is sent to the user's manager.

+The Azure AD prerequisite to run the **Send email to notify manager of user move** task are:

+- A populated manager attribute for the user.

+- A populated manager's mail attribute for the user.

+For Microsoft Graph the parameters for the **Send email to notify manager of user move** task are as follows:

+|Parameter |Definition |

+|||

+|category | Mover |

+|displayName | Send email to notify manager of user move (Customizable by user) |

+|description | Send email to notify userΓÇÖs manager of user move (Customizable by user) |

+|taskDefinitionId | aab41899-9972-422a-9d97-f626014578b7 |

+```Example for usage within the workflow

+{

+ "category": "mover",

+ "continueOnError": true,

+ "displayName": "Send email to notify manager of user move",

+ "description": "Send email to notify userΓÇÖs manager of user move",

+ "isEnabled": true,

+ "taskDefinitionId": "aab41899-9972-422a-9d97-f626014578b7",

+ "arguments": [

+ {

+ "name": "cc",

+ "value": "b47471b9-af8f-4a5a-bfa2-b78e82398f6e, a7a23ce0-909b-40b9-82cf-95d31f0aaca2"

+ },

+ {

+ "name": "customSubject",

+ "value": "Reminder that {{userDisplayName}} has moved."

+ },

+ {

+ "name": "customBody",

+ "value": "Hello {{managerDisplayName}}. \nThis is a reminder that {{userDisplayName}} has moved roles in the organization."

+ },

+ {

+ "name": "locale",

+ "value": "en-us"

+ },

+ ]

+}

+```

+### Request user access package assignment

+Allows you to request an access package assignment for users. Access packages are bundles of resources, with specific access, that a user would need to accomplish tasks. For more information on access packages, see [What are access packages and what resources can I manage with them?](entitlement-management-overview.md#what-are-access-packages-and-what-resources-can-i-manage-with-them).

+You're able to customize the task name and task description for this task. You must also select an access package that is provided to the user, and the access package policy.

+For Microsoft Graph, the parameters for the **Request user access package assignment** task are as follows:

+|Parameter |Definition |

+|||

+|category | joiner |

+|displayName | Request user access package assignment (Customizable by user) |

+|description | Request user assignment to selected access package (Customizable by user) |

+|taskDefinitionId | c1ec1e76-f374-4375-aaa6-0bb6bd4c60be |

+|arguments | Argument contains two name parameter that is the "assignmentPolicyId", and "accessPackageId". |

+```Example for usage within the workflow

+{

+ "category": "joiner",

+ "description": "Request user assignment to selected access package",

+ "displayName": "Request user access package assignment",

+ "id": "c1ec1e76-f374-4375-aaa6-0bb6bd4c60be",

+ "parameters": [

+ {

+ "name": "assignmentPolicyId",

+ "values": [],

+ "valueType": "string"

+ },

+ {

+ "name": "accessPackageId",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ }

+```

+### Remove access package assignment for user

+Allows you to remove an access package assignment from users. Access packages are bundles of resources, with specific access, that a user would need to accomplish tasks. For more information on access packages, see [What are access packages and what resources can I manage with them?](entitlement-management-overview.md#what-are-access-packages-and-what-resources-can-i-manage-with-them).

+You're able to customize the task name and description for this task in the Azure portal. You must also select the access package which you want to unassign from users.

+For Microsoft Graph, the parameters for the **Remove access package assignment for user** task are as follows:

+|Parameter |Definition |

+|||

+|category | leaver |

+|displayName | Remove access package assignment for user (Customizable by user) |

+|description | Remove user assignment of selected access package (Customizable by user) |

+|taskDefinitionId | 4a0b64f2-c7ec-46ba-b117-18f262946c50 |

+|arguments | Argument contains a name parameter that is the "accessPackageId". |

+```Example for usage within the workflow

+{

+ "category": "leaver",

+ "description": "Remove user assignment of selected access package",

+ "displayName": "Remove access package assignment for user",

+ "id": "4a0b64f2-c7ec-46ba-b117-18f262946c50",

+ "parameters": [

+ {

+ "name": "accessPackageId",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+}

+```

+### Remove all access package assignments for user

+Allows you to remove all access package assignments from users. Access packages are bundles of resources, with specific access, that a user would need to accomplish tasks. For more information on access packages, see [What are access packages and what resources can I manage with them?](entitlement-management-overview.md#what-are-access-packages-and-what-resources-can-i-manage-with-them).

+You're able to customize the task name and description for this task in the Azure portal.

+For Microsoft Graph, the parameters for the **Remove all access package assignments for user** task are as follows:

+|Parameter |Definition |

+|||

+|category | leaver |

+|displayName | Remove all access package assignments for user (Customizable by user) |

+|description | Remove all access packages assigned to the user (Customizable by user) |

+|taskDefinitionId | 42ae2956-193d-4f39-be06-691b8ac4fa1d |

+```Example for usage within the workflow

+{

+ "category": "leaver",

+ "description": "Remove all access packages assigned to the user",

+ "displayName": "Remove all access package assignments for user",

+ "id": "42ae2956-193d-4f39-be06-691b8ac4fa1d",

+ "parameters": []

+}

+```

+### Cancel all pending access package assignment requests for user

+Allows you to remove all access package assignments from users. Access packages are bundles of resources, with specific access, that a user would need to accomplish tasks. For more information on access packages, see [What are access packages and what resources can I manage with them?](entitlement-management-overview.md#what-are-access-packages-and-what-resources-can-i-manage-with-them).

+You're able to customize the task name and description for this task in the Azure portal.

+For Microsoft Graph, the parameters for the **Cancel all pending access package assignment requests for user** task are as follows:

+|Parameter |Definition |

+|||

+|category | leaver |

+|displayName | Cancel pending access package assignment requests for user (Customizable by user) |

+|description | Cancel all pending access packages assignment requests for the user (Customizable by user) |

+|taskDefinitionId | 498770d9-bab7-4e4c-b73d-5ded82a1d0b3 |

+```Example for usage within the workflow

+{

+ "category": "leaver",

+ "description": "Cancel all pending access packages assignment requests for the user",

+ "displayName": "Cancel pending access package assignment requests for user",

+ "id": "498770d9-bab7-4e4c-b73d-5ded82a1d0b3",

+ "parameters": []

+}

+```

+### Send email to manager before user's last day

+### Send email on user's last day

+### Send email to user's manager after their last day

+ Title: Lifecycle Workflows templates and categories

+# Lifecycle Workflows templates and categories

+Lifecycle Workflows allows you to automate the lifecycle management process for your organization by creating workflows that contain both built-in tasks, and custom task extensions. These workflows, and the tasks within them, all fall into categories based on the Joiner-Mover-Leaver(JML) model of lifecycle management. To make this process even more efficient, Lifecycle Workflows also provide you with templates, which you can use to accelerate the set up, creation, and configuration of common lifecycle management processes. You can create workflows based on these templates as is, or you can customize them even further to match the requirements for users within your organization. In this article you get the complete list of workflow templates, common template parameters, default template parameters for specific templates, and the list of compatible tasks for each template. For full task definitions, see [Lifecycle Workflow tasks and definitions](lifecycle-workflow-tasks.md).

+## Lifecycle Workflows built-in templates

+- [Real-time employee change](lifecycle-workflow-templates.md#real-time-employee-change)

+|Parameter |Description |Customizable |

+|Parameter |Description |Customizable |

+|Parameter |Description |Customizable |

+### Real-time employee change

+The **Real-time employee change** template is designed to configure tasks that are completed immediately when an employee changes roles.

+The default specific parameters for the **Real-time employee termination** template are as follows:

+|Parameter |Description |Customizable |

+||||

+|Category | Mover | ❌ |

+|Trigger Type | On-demand | ❌ |

+|Tasks | **Run a Custom Task Extension** | ✔️ |

+> [!NOTE]

+> As this template is designed to run on-demand, no execution condition is present.

+|Parameter |Description |Customizable |

+|Parameter |Description |Customizable |

+|Parameter |Description |Customizable |

+|Parameter |Description |Customizable |

+In this topic, we go through how the default configuration behaves in certain topologies. We go through the configuration and the Synchronization Rules Editor can be used to look at the configuration.

+* A disabled account contributes userPrincipalName and sourceAnchor, unless it's a linked mailbox, if there's no active account to be found.

+* An account with a linked mailbox will never be used for userPrincipalName and sourceAnchor. It's assumed that an active account will be found later.

+> [!NOTE]

+> Keep in mind that when you add a user from another forest to the group, there is an anchor created in the Active Directory where the groups exists inside a specific OU. This anchor is a Foreign security principal and is stored inside the OU ΓÇÿForeignSecurityPrincipalsΓÇÖ. If you don't synchronize this OU the users where removed from the group membership.

+>

+>

+Having contacts representing a user in a different forest is common after a merger & acquisition where a GALSync solution is bridging two or more Exchange forests. The contact object is always joining from the connector space to the metaverse using the mail attribute. If there's already a contact object or user object with the same mail address, the objects are joined together. This is configured in the rule **In from AD ΓÇô Contact Join**. There is also a rule named **In from AD ΓÇô Contact Common** with an attribute flow to the metaverse attribute **sourceObjectType** with the constant **Contact**. This rule has low precedence so if any user object is joined to the same metaverse object, then the rule **In from AD ΓÇô User Common** will contribute the value User to this attribute. With this rule, this attribute has the value Contact if no user has been joined and the value User if at least one user has been found.

+For example, in a GALSync topology we find contact objects for everyone in the second forest when we import the first forest. This stages new contact objects in the Azure AD Connector. When we later import and synchronize the second forest, we find the real users and join them to the existing metaverse objects. We will then delete the contact object in Azure AD and create a new user object instead.

+If you have a topology where users are represented as contacts, make sure you select to match users on the mail attribute in the installation guide. If you select another option, then you have an order-dependent configuration. Contact objects will always join on the mail attribute, but user objects will only join on the mail attribute if this option was selected in the installation guide. You could then end up with two different objects in the metaverse with the same mail attribute if the contact object was imported before the user object. During export to Azure AD, an error is shown. This behavior is by design and would indicate bad data or that the topology was not correctly identified during the installation.

+The assumption is that if a disabled user account is found, then we won't find another active account later and the object is provisioned to Azure AD with the userPrincipalName and sourceAnchor found. In case another active account join to the same metaverse object, then its userPrincipalName and sourceAnchor will be used.

+ * Azure AD Connect support all mainstream supported SQL Server versions up to SQL Server 2019 running on Windows. Please refer to the [SQL Server lifecycle article](/lifecycle/products/?products=sql-server) to verify the support status of your SQL Server version. SQL Server 2012 is no longer supported. Azure SQL Database *isn't supported* as a database. This includes both Azure SQL Database and Azure SQL Managed Instance.

+When you delete and enterprise application, it's held in a suspended state in the recycle bin for 30 days. During the 30 days, you can [Restore the application](restore-application.md). Deleted items are automatically hard deleted after the 30-day period. For more information on frequently asked questions about deletion and recovery of applications, see [Deleting and recovering applications FAQs](delete-recover-faq.yml).

+1. In the left menu, select **Enterprise applications**. The **All applications** pane opens and displays a list of the applications in your Azure AD tenant. Search for and select the application that you want to delete. In this article, we use the **Azure AD SAML Toolkit 1** as an example.

+2. Record the ID of the enterprise app you want to delete.

+3. Delete the enterprise application.

+In this article, you learn how to restore a soft deleted enterprise application in your Azure Active Directory (Azure AD) tenant. Soft deleted enterprise applications can be restored from the recycle bin within the first 30 days after their deletion. After the 30-day window, the enterprise application is permanently deleted and can't be restored.

+>If you deleted an [application registration](../develop/howto-remove-app.md) in its home tenant through app registrations in the Azure portal, the enterprise application, which is its corresponding service principal also got deleted. If you restore the deleted application registration through the Azure portal, its corresponding service principal, is also restored. You'll therefore be able to recover the service principal's previous configurations, except its previous policies such as conditional access policies, which aren't restored.

+Take the following steps to recover a recently deleted enterprise application. For more information on frequently asked questions about deletion and recovery of applications, see [Deleting and recovering applications FAQs](delete-recover-faq.yml).

+- IT admins can also manually [restore](/azure/active-directory/fundamentals/active-directory-users-restore) the user directly in the target tenant.

+All custom roles | | | | | :heavy_check_mark: | :heavy_check_mark:

+All custom roles | | | :heavy_check_mark: | :heavy_check_mark:

+description: Learn how to use Planned Maintenance in Azure Kubernetes Service (AKS) for cluster weekly releases.

+This article assumes you have an existing AKS cluster. If you need an AKS cluster, you can create one using [Azure CLI][aks-quickstart-cli], [Azure PowerShell][aks-quickstart-powershell], or [Azure portal][aks-quickstart-portal].

+- Currently, performing maintenance operations are considered *best-effort only* and aren't guaranteed to occur within a specified window.

+- Updates can't be blocked for more than seven days.

+## Available pre-created public maintenance configurations

+- **For weekdays**: (Monday, Tuesday, Wednesday, Thursday), from 10 pm to 6 am the next morning.

+- **For weekends**: (Friday, Saturday, Sunday), from 10 pm to 6 am the next morning.

+The following pre-created public maintenance configurations are available on the weekday and weekend schedules. For weekend schedules, replace `weekday` with `weekend`.

+1. Find the public maintenance configuration ID using the [`az maintenance public-configuration show`][az-maintenance-public-configuration-show] command.

+ ```azurecli-interactive

+ az maintenance public-configuration show --resource-name "aks-mrp-cfg-weekday_utc8"

+ ```

+ > [!NOTE]

+ > You may be prompted to install the `maintenance` extension.

+ Your output should look like the following example output. Make sure you take note of the `id` field.

+ ```json

+ {

+ "duration": "08:00",

+ "expirationDateTime": null,

+ "extensionProperties": {

+ "maintenanceSubScope": "AKS"

+ },

+ "id": "/subscriptions/0159df5c-b605-45a9-9876-36e17d5286e0/providers/Microsoft.Maintenance/publicMaintenanceConfigurations/aks-mrp-cfg-weekday_utc8",

+ "installPatches": null,

+ "location": "westus2",

+ "maintenanceScope": "Resource",

+ "name": "aks-mrp-cfg-weekday_utc8",

+ "namespace": "Microsoft.Maintenance",

+ "recurEvery": "Week Monday,Tuesday,Wednesday,Thursday",

+ "startDateTime": "2022-08-01 22:00",

+ "systemData": null,

+ "tags": {},

+ "timeZone": "China Standard Time",

+ "type": "Microsoft.Maintenance/publicMaintenanceConfigurations",

+ "visibility": "Public"

+ }

+ ```

+2. Assign the public maintenance configuration to your AKS cluster using the [`az maintenance assignment create`][az-maintenance-assignment-create] command and specify the ID from the previous step for the `--maintenance-configuration-id` parameter.

+ ```azurecli-interactive

+ az maintenance assignment create --maintenance-configuration-id "/subscriptions/0159df5c-b605-45a9-9876-36e17d5286e0/providers/Microsoft.Maintenance/publicMaintenanceConfigurations/aks-mrp-cfg-weekday_utc8" --name assignmentName --provider-name "Microsoft.ContainerService" --resource-group myResourceGroup --resource-name myAKSCluster --resource-type "managedClusters"

+ ```

+- List all maintenance windows in an existing cluster using the [`az maintenance assignment list`][az-maintenance-assignment-list] command.

+ ```azurecli-interactive

+ az maintenance assignment list --provider-name "Microsoft.ContainerService" --resource-group myResourceGroup --resource-name myAKSCluster --resource-type "managedClusters"

+ ```

+## Remove a public maintenance configuration from an AKS cluster

+- Remove a public maintenance configuration from a cluster using the [`az maintenance assignment delete`][az-maintenance-assignment-delete] command.

+ ```azurecli-interactive

+ az maintenance assignment delete --name assignmentName --provider-name "Microsoft.ContainerService" --resource-group myResourceGroup --resource-name myAKSCluster --resource-type "managedClusters"

+ ```

+[planned-maintenance]: ./planned-maintenance.md

+[az-maintenance-public-configuration-show]: /cli/azure/maintenance/public-configuration#az-maintenance-public-configuration-show

+[az-maintenance-assignment-create]: /cli/azure/maintenance/assignment#az-maintenance-assignment-create

+[az-maintenance-assignment-list]: /cli/azure/maintenance/assignment#az-maintenance-assignment-list

+[az-maintenance-assignment-delete]: /cli/azure/maintenance/assignment#az-maintenance-assignment-delete

+> [!NOTE]

+> The Docker Bridge address field is no longer in use.

+You can deploy your AKS clusters in a dual-stack mode when using [kubenet][kubenet] networking and a dual-stack Azure virtual network. In this configuration, nodes receive both an IPv4 and IPv6 address from the Azure virtual network subnet. Pods receive both an IPv4 and IPv6 address from a logically different address space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network. The source IP address of the traffic is NAT'd to the node's primary IP address of the same family (IPv4 to IPv4 and IPv6 to IPv6).

+* Azure route tables have a **hard limit of 400 routes per table**.

+ * Each node in a dual-stack cluster requires two routes, one for each IP address family, so **dual-stack clusters are limited to 200 nodes**.

+* Dual-stack networking is required for the Azure virtual network and the pod CIDR.

+ * Single stack IPv6-only isn't supported for node or pod IP addresses. Services can be provisioned on IPv4 or IPv6.

+* The following features are **not supported on dual-stack kubenet**:

+ * [Azure network policies](use-network-policies.md#create-an-aks-cluster-and-enable-network-policy)

+ * [Calico network policies](use-network-policies.md#create-an-aks-cluster-and-enable-network-policy)

+ * [NAT Gateway][nat-gateway]

+ * [Virtual nodes add-on](virtual-nodes.md#network-requirements)

+ * [Windows node pools](./windows-faq.md)

+Kubernetes v1.23 brings stable upstream support for [IPv4/IPv6 dual-stack][kubernetes-dual-stack] clusters, including pod and service networking. Nodes and pods are always assigned both an IPv4 and an IPv6 address, while services can be dual-stack or single-stack on either address family.

+* If using a managed virtual network, a dual-stack virtual network configuration.

+* IPv4 and IPv6 node and pod addresses.

+* Outbound rules for both IPv4 and IPv6 traffic.

+* Load balancer setup for IPv4 and IPv6 services.

+The following attributes are provided to support dual-stack clusters:

+* **`--ip-families`**: Takes a comma-separated list of IP families to enable on the cluster.

+ * Only `ipv4` or `ipv4,ipv6` are supported.

+* **`--pod-cidrs`**: Takes a comma-separated list of CIDR notation IP ranges to assign pod IPs from.

+ * If no values are supplied, the default value `10.244.0.0/16,fd12:3456:789a::/64` is used.

+* **`--service-cidrs`**: Takes a comma-separated list of CIDR notation IP ranges to assign service IPs from.

+ * If no values are supplied, the default value `10.0.0.0/16,fd12:3456:789a:1::/108` is used.

+## Deploy a dual-stack AKS cluster

+1. Create an Azure resource group for the cluster using the [`az group create`][az-group-create] command.

+ az group create -l <region> -n <resourceGroupName>

+2. Create a dual-stack AKS cluster using the [`az aks create`][az-aks-create] command with the `--ip-families` parameter set to `ipv4,ipv6`.

+ az aks create -l <region> -g <resourceGroupName> -n <clusterName> --ip-families ipv4,ipv6

+ ```

+3. Once the cluster is created, get the cluster admin credentials using the [`az aks get-credentials`][az-aks-get-credentials] command.

+ ```azurecli-interactive

+ az aks get-credentials -g <resourceGroupName> -n <clusterName>

+1. Create the ARM template and pass `["IPv4", "IPv6"]` to the `ipFamilies` parameter to the `networkProfile` object.

+ ```json

+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",

+ "contentVersion": "1.0.0.0",

+ "parameters": {

+ "clusterName": {

+ "type": "string",

+ "defaultValue": "aksdualstack"

+ },

+ "location": {

+ "type": "string",

+ "defaultValue": "[resourceGroup().location]"

+ },

+ "kubernetesVersion": {

+ "type": "string",

+ "defaultValue": "1.22.2"

+ },

+ "nodeCount": {

+ "type": "int",

+ "defaultValue": 3

+ },

+ "nodeSize": {

+ "type": "string",

+ "defaultValue": "Standard_B2ms"

+ }

+ "resources": [

+ {

+ "type": "Microsoft.ContainerService/managedClusters",

+ "apiVersion": "2021-10-01",

+ "name": "[parameters('clusterName')]",

+ "location": "[parameters('location')]",

+ "identity": {

+ "type": "SystemAssigned"

+ },

+ "properties": {

+ "agentPoolProfiles": [

+ {

+ "name": "nodepool1",

+ "count": "[parameters('nodeCount')]",

+ "mode": "System",

+ "vmSize": "[parameters('nodeSize')]"

+ }

+ ],

+ "dnsPrefix": "[parameters('clusterName')]",

+ "kubernetesVersion": "[parameters('kubernetesVersion')]",

+ "networkProfile": {

+ "ipFamilies": [

+ "IPv4",

+ "IPv6"

+ ]

+ }

+ ]

+ ```

+2. Once the cluster is created, get the cluster admin credentials using the [`az aks get-credentials`][az-aks-get-credentials] command.

+ ```azurecli-interactive

+ az aks get-credentials -g <resourceGroupName> -n <clusterName>

+ ```

+> [!NOTE]

+> For more information on deploying ARM templates, see the [Azure Resource Manager documentation][deploy-arm-template].

+1. Create the Bicep template and pass `["IPv4", "IPv6"]` to the `ipFamilies` parameter to the `networkProfile` object.

+ ```bicep

+ param clusterName string = 'aksdualstack'

+ param location string = resourceGroup().location

+ param kubernetesVersion string = '1.22.2'

+ param nodeCount int = 3

+ param nodeSize string = 'Standard_B2ms'

+ resource aksCluster 'Microsoft.ContainerService/managedClusters@2021-10-01' = {

+ name: clusterName

+ location: location

+ identity: {

+ type: 'SystemAssigned'

+ }

+ properties: {

+ agentPoolProfiles: [

+ {

+ name: 'nodepool1'

+ count: nodeCount

+ mode: 'System'

+ vmSize: nodeSize

+ }

+ ]

+ dnsPrefix: clusterName

+ kubernetesVersion: kubernetesVersion

+ networkProfile: {

+ ipFamilies: [

+ 'IPv4'

+ 'IPv6'

+ ]

+ }

+ ```

+2. Once the cluster is created, get the cluster admin credentials using the [`az aks get-credentials`][az-aks-get-credentials] command.

+ ```azurecli-interactive

+ az aks get-credentials -g <resourceGroupName> -n <clusterName>

+ ```

+> [!NOTE]

+> For more information on deploying Bicep templates, see the [Bicep template documentation][deploy-bicep-template].

+## Inspect the nodes to see both IP families

+* Once the cluster is provisioned, confirm the nodes are provisioned with dual-stack networking using the `kubectl get nodes` command.

+ ```bash-interactive

+ kubectl get nodes -o=custom-columns="NAME:.metadata.name,ADDRESSES:.status.addresses[?(@.type=='InternalIP')].address,PODCIDRS:.spec.podCIDRs[*]"

+ ```

+ The output from the `kubectl get nodes` command shows the nodes have addresses and pod IP assignment space from both IPv4 and IPv6.

+ ```output

+ NAME ADDRESSES PODCIDRS

+ aks-nodepool1-14508455-vmss000000 10.240.0.4,2001:1234:5678:9abc::4 10.244.0.0/24,fd12:3456:789a::/80

+ aks-nodepool1-14508455-vmss000001 10.240.0.5,2001:1234:5678:9abc::5 10.244.1.0/24,fd12:3456:789a:0:1::/80

+ aks-nodepool1-14508455-vmss000002 10.240.0.6,2001:1234:5678:9abc::6 10.244.2.0/24,fd12:3456:789a:0:2::/80

+ ```

+Once the cluster has been created, you can deploy your workloads. This article walks you through an example workload deployment of an NGINX web server.

+### Deploy an NGINX web server

+# [kubectl](#tab/kubectl)

+1. Create an NGINX web server using the `kubectl create deployment nginx` command.

+ ```bash-interactive

+ kubectl create deployment nginx --image=nginx:latest --replicas=3

+ ```

+2. View the pod resources using the `kubectl get pods` command.

+ ```bash-interactive

+ kubectl get pods -o custom-columns="NAME:.metadata.name,IPs:.status.podIPs[*].ip,NODE:.spec.nodeName,READY:.status.conditions[?(@.type=='Ready')].status"

+ ```

+ The output shows the pods have both IPv4 and IPv6 addresses. The pods don't show IP addresses until they're ready.

+ ```output

+ NAME IPs NODE READY

+ nginx-55649fd747-9cr7h 10.244.2.2,fd12:3456:789a:0:2::2 aks-nodepool1-14508455-vmss000002 True

+ nginx-55649fd747-p5lr9 10.244.0.7,fd12:3456:789a::7 aks-nodepool1-14508455-vmss000000 True

+ nginx-55649fd747-r2rqh 10.244.1.2,fd12:3456:789a:0:1::2 aks-nodepool1-14508455-vmss000001 True

+ ```

+1. Create an NGINX web server using the following YAML manifest.

+ ```yml

+ apiVersion: apps/v1

+ kind: Deployment

+ name: nginx

+ replicas: 3

+ selector:

+ matchLabels:

+ app: nginx

+ template:

+ metadata:

+ labels:

+ app: nginx

+ spec:

+ containers:

+ - image: nginx:latest

+ name: nginx

+ ```

+2. View the pod resources using the `kubectl get pods` command.

+ ```bash-interactive

+ kubectl get pods -o custom-columns="NAME:.metadata.name,IPs:.status.podIPs[*].ip,NODE:.spec.nodeName,READY:.status.conditions[?(@.type=='Ready')].status"

+ ```

+ The output shows the pods have both IPv4 and IPv6 addresses. The pods don't show IP addresses until they're ready.

+ ```output

+ NAME IPs NODE READY

+ nginx-55649fd747-9cr7h 10.244.2.2,fd12:3456:789a:0:2::2 aks-nodepool1-14508455-vmss000002 True

+ nginx-55649fd747-p5lr9 10.244.0.7,fd12:3456:789a::7 aks-nodepool1-14508455-vmss000000 True

+ nginx-55649fd747-r2rqh 10.244.1.2,fd12:3456:789a:0:1::2 aks-nodepool1-14508455-vmss000001 True

+ ```

+## Expose the workload via a `LoadBalancer` type service

+> There are currently **two limitations** pertaining to IPv6 services in AKS. These are both preview limitations and work is underway to remove them.

+>

+> 1. Azure Load Balancer sends health probes to IPv6 destinations from a link-local address. In Azure Linux node pools, this traffic can't be routed to a pod, so traffic flowing to IPv6 services deployed with `externalTrafficPolicy: Cluster` fail. IPv6 services must be deployed with `externalTrafficPolicy: Local`, which causes `kube-proxy` to respond to the probe on the node.

+> 2. Only the first IP address for a service will be provisioned to the load balancer, so a dual-stack service only receives a public IP for its first-listed IP family. To provide a dual-stack service for a single deployment, please create two services targeting the same selector, one for IPv4 and one for IPv6.

+# [kubectl](#tab/kubectl)

+1. Expose the NGINX deployment using the `kubectl expose deployment nginx` command.

+ ```bash-interactive

+ kubectl expose deployment nginx --name=nginx-ipv4 --port=80 --type=LoadBalancer'

+ kubectl expose deployment nginx --name=nginx-ipv6 --port=80 --type=LoadBalancer --overrides='{"spec":{"ipFamilies": ["IPv6"]}}'

+ ```

+ You receive an output that shows the services have been exposed.

+ ```output

+ service/nginx-ipv4 exposed

+ service/nginx-ipv6 exposed

+ ```

+2. Once the deployment is exposed and the `LoadBalancer` services are fully provisioned, get the IP addresses of the services using the `kubectl get services` command.

+ ```bash-interactive

+ kubectl get services

+ ```

+ ```output

+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

+ nginx-ipv4 LoadBalancer 10.0.88.78 20.46.24.24 80:30652/TCP 97s

+ nginx-ipv6 LoadBalancer fd12:3456:789a:1::981a 2603:1030:8:5::2d 80:32002/TCP 63s

+ ```

+3. Verify functionality via a command-line web request from an IPv6 capable host. Azure Cloud Shell isn't IPv6 capable.

+ ```bash-interactive

+ SERVICE_IP=$(kubectl get services nginx-ipv6 -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

+ curl -s "http://[${SERVICE_IP}]" | head -n5

+ ```

+ ```html

+ <!DOCTYPE html>

+ <html>

+ <head>

+ <title>Welcome to nginx!</title>

+ <style>

+ ```

+1. Expose the NGINX deployment using the following YAML manifest.

+ ```yml

+

+ apiVersion: v1

+ kind: Service

+ metadata:

+ labels:

+ app: nginx

+ name: nginx-ipv4

+ spec:

+ externalTrafficPolicy: Cluster

+ ports:

+ - port: 80

+ protocol: TCP

+ targetPort: 80

+ selector:

+ app: nginx

+ type: LoadBalancer

+

+ apiVersion: v1

+ kind: Service

+ metadata:

+ labels:

+ app: nginx

+ name: nginx-ipv6

+ spec:

+ externalTrafficPolicy: Cluster

+ ipFamilies:

+ - IPv6

+ ports:

+ - port: 80

+ protocol: TCP

+ targetPort: 80

+ selector:

+ app: nginx

+ type: LoadBalancer

+ ```

+2. Once the deployment is exposed and the `LoadBalancer` services are fully provisioned, get the IP addresses of the services using the `kubectl get services` command.

+ ```bash-interactive

+ kubectl get services

+ ```

+ ```output

+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

+ nginx-ipv4 LoadBalancer 10.0.88.78 20.46.24.24 80:30652/TCP 97s

+ nginx-ipv6 LoadBalancer fd12:3456:789a:1::981a 2603:1030:8:5::2d 80:32002/TCP 63s

+ ```

+3. Verify functionality via a command-line web request from an IPv6 capable host. Azure Cloud Shell isn't IPv6 capable.

+ ```bash-interactive

+ SERVICE_IP=$(kubectl get services nginx-ipv6 -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

+ curl -s "http://[${SERVICE_IP}]" | head -n5

+ ```

+ ```html

+ <!DOCTYPE html>

+ <html>

+ <head>

+ <title>Welcome to nginx!</title>

+ <style>

+ ```

+[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials

+[dapr-msi]: https://docs.dapr.io/developing-applications/integrations/azure/azure-authentication

+> HA is enabled by default. Disabling it requires deletion and recreation of the extension.

+### [Portal](#tab/azure-portal)

+Verify the deployment navigating to the cluster you recently installed the extension on, then navigate to "Extensions + Applications", where you'll see the extension status:

+ :::image type="content" source="./media/deploy-marketplace/verify-inline.png" lightbox="./media/deploy-marketplace/verify.png" alt-text="The Azure portal page for the A K S cluster is shown. 'Extensions + Applications' is selected, and the deployed extension is listed.":::

+### [Azure CLI](#tab/azure-cli)

+You can view the extension instance from the cluster by using the following command:

+```azurecli-interactive

+az k8s-extension show --name <extension-name> --cluster-name <clusterName> --resource-group <resourceGroupName> --cluster-type managedClusters

+```

+### [Azure CLI](#tab/azure-cli)

+```azurecli-interactive

+az k8s-extension delete --name <extension-name> --cluster-name <clusterName> --resource-group <resourceGroupName> --cluster-type managedClusters

+```

+- Learn more about [deploying a Kubernetes application programmatically using Azure CLI](/azure/aks/deploy-application-az-cli)

+[selinux-labels]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#selinuxoptions-v1-core

+When you don't use standard load balancer (SLB) architecture, you must establish explicit egress. You must deploy your AKS cluster into an existing virtual network with a subnet that has been previously configured. This architecture requires explicitly sending egress traffic to an appliance like a firewall, gateway, or proxy, so a public IP assigned to the standard load balancer or appliance can handle the Network Address Translation (NAT).

+* A managed NAT gateway resource cannot be used across multiple availability zones. When you deploy a managed NAT gateway instance, it is deployed to "no zone". No zone NAT gateway resources are deployed to a single availability zone for you by Azure. For more information on non-zonal deployment model, see [non-zonal NAT gateway](/azure/nat-gateway/nat-availability-zones#non-zonal).

+ > Zonal configuration for your NAT gateway resource can be done with user-assigned NAT gateway resources. See [Create an AKS cluster with a user-assigned NAT gateway](#create-an-aks-cluster-with-a-user-assigned-nat-gateway] for more details.

+ Title: Install the Open Service Mesh (OSM) add-on using Azure CLI

+description: Use Azure CLI to install the Open Service Mesh (OSM) add-on on an Azure Kubernetes Service (AKS) cluster.

+# Install the Open Service Mesh (OSM) add-on using Azure CLI

+This article shows you how to install the Open Service Mesh (OSM) add-on on an Azure Kubernetes Service (AKS) cluster. The OSM add-on installs the OSM mesh on your cluster. The OSM mesh is a service mesh that provides traffic management, policy enforcement, and telemetry collection for your applications. For more information about the OSM mesh, see [Open Service Mesh](https://openservicemesh.io/).

+> Based on the version of Kubernetes your cluster runs, the OSM add-on installs a different version of OSM:

+>

+> - If your cluster runs a Kubernetes version *1.24.0 or greater*, the OSM add-on installs OSM version *1.2.5*.

+> - If your cluster runs a Kubernetes version *between 1.23.5 and 1.24.0*, the OSM add-on installs OSM version *1.1.3*.

+> - If your cluster runs a Kubernetes version *below 1.23.5*, the OSM add-on installs OSM version *1.0.0*.

+- An Azure subscription. If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free).

+- [Azure CLI installed](/cli/azure/install-azure-cli).

+1. If you don't have one already, create an Azure resource group using the [`az group create`][az-group-create] command.

+ ```azurecli-interactive

+ az group create --name myResourceGroup --location eastus

+ ```

+2. Create a new AKS cluster with the OSM add-on installed using the [`az aks create`][az-aks-create] command and specify `open-service-mesh` for the `--enable-addons` parameter.

+ ```azurecli-interactive

+ az aks create \

+ --resource-group myResourceGroup \

+ --name myAKSCluster \

+ --enable-addons open-service-mesh

+ ```

+>

+> When installing on an existing clusters, use the [`az aks enable-addons`][az-aks-enable-addons] command. The following code shows an example:

+>

+> ```azurecli-interactive

+> az aks enable-addons \

+> --resource-group myResourceGroup \

+> --name myAKSCluster \

+> --addons open-service-mesh

+> ```

+- Get the credentials for your AKS cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.

+ ```azurecli-interactive

+ az aks get-credentials --resource-group myResourceGroup --name myAKSCluster

+ ```

+## Verify the OSM add-on is installed on your cluster

+- Verify the OSM add-on is installed on your cluster using the [`az aks show`][az-aks-show] command with and specify `'addonProfiles.openServiceMesh.enabled'` for the `--query` parameter. In the output, under `addonProfiles`, the `enabled` value should show as `true` for `openServiceMesh`.

+ ```azurecli-interactive

+ az aks show --resource-group myResourceGroup --name myAKSCluster --query 'addonProfiles.openServiceMesh.enabled'

+ ```

+## Verify the OSM mesh is running on your cluster

+1. Verify the version, status, and configuration of the OSM mesh running on your cluster using the `kubectl get deployment` command and display the image version of the *osm-controller* deployment.

+ ```azurecli-interactive

+ kubectl get deployment -n kube-system osm-controller -o=jsonpath='{$.spec.template.spec.containers[:1].image}'

+ ```

+ The following example output shows version *0.11.1* of the OSM mesh:

+ ```output

+ mcr.microsoft.com/oss/openservicemesh/osm-controller:v0.11.1

+ ```

+2. Verify the status of the OSM components running on your cluster using the following `kubectl` commands to show the status of the `app.kubernetes.io/name=openservicemesh.io` deployments, pods, and services.

+ ```azurecli-interactive

+ kubectl get deployments -n kube-system --selector app.kubernetes.io/name=openservicemesh.io

+ kubectl get pods -n kube-system --selector app.kubernetes.io/name=openservicemesh.io

+ kubectl get services -n kube-system --selector app.kubernetes.io/name=openservicemesh.io

+ ```

+ > [!IMPORTANT]

+ > If any pods have a status other than `Running`, such as `Pending`, your cluster might not have enough resources to run OSM. Review the sizing for your cluster, such as the number of nodes and the virtual machine's SKU, before continuing to use OSM on your cluster.

+3. Verify the configuration of your OSM mesh using the `kubectl get meshconfig` command.

+ ```azurecli-interactive

+ kubectl get meshconfig osm-mesh-config -n kube-system -o yaml

+ ```

+ The following example output shows the configuration of an OSM mesh:

+ ```yaml

+ apiVersion: config.openservicemesh.io/v1alpha1

+ kind: MeshConfig

+ metadata:

+ creationTimestamp: "0000-00-00A00:00:00A"

+ generation: 1

+ name: osm-mesh-config

+ namespace: kube-system

+ resourceVersion: "2494"

+ uid: 6c4d67f3-c241-4aeb-bf4f-b029b08faa31

+ spec:

+ certificate:

+ serviceCertValidityDuration: 24h

+ featureFlags:

+ enableEgressPolicy: true

+ enableMulticlusterMode: false

+ enableWASMStats: true

+ observability:

+ enableDebugServer: true

+ osmLogLevel: info

+ tracing:

+ address: jaeger.osm-system.svc.cluster.local

+ enable: false

+ endpoint: /api/v2/spans

+ port: 9411

+ sidecar:

+ configResyncInterval: 0s

+ enablePrivilegedInitContainer: false

+ envoyImage: mcr.microsoft.com/oss/envoyproxy/envoy:v1.18.3

+ initContainerImage: mcr.microsoft.com/oss/openservicemesh/init:v0.9.1

+ logLevel: error

+ maxDataPlaneConnections: 0

+ resources: {}

+ traffic:

+ enableEgress: true

+ enablePermissiveTrafficPolicyMode: true

+ inboundExternalAuthorization:

+ enable: false

+ failureModeAllow: false

+ statPrefix: inboundExtAuthz

+ timeout: 1s

+ useHTTPSIngress: false

+ ```

+ The example output shows `enablePermissiveTrafficPolicyMode: true`, which means OSM has permissive traffic policy mode enabled. With this mode enabled in your OSM mesh:

+ - The [SMI][smi] traffic policy enforcement is bypassed.

+ - OSM automatically discovers services that are a part of the service mesh.

+ - OSM creates traffic policy rules on each Envoy proxy sidecar to be able to communicate with these services.

+- When you no longer need the cluster, you can delete it using the [`az group delete`][az-group-delete] command, which removes the resource group, the cluster, and all related resources.

+ ```azurecli-interactive

+ az group delete --name myResourceGroup --yes --no-wait

+ ```

+> [!NOTE]

+> Alternatively, you can uninstall the OSM add-on and the related resources from your cluster. For more information, see [Uninstall the Open Service Mesh add-on from your AKS cluster][osm-uninstall].

+This article showed you how to install the OSM add-on on an AKS cluster and verify it's installed and running. With the OSM add-on installed on your cluster, you can [deploy a sample application][osm-deploy-sample-app] or [onboard an existing application][osm-onboard-app] to work with your OSM mesh.

+<!-- LINKS -->

+[az-group-create]: /cli/azure/group#az_group_create

+[az-aks-create]: /cli/azure/aks#az_aks_create

+[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials

+[az-aks-show]: /cli/azure/aks#az_aks_show

+[az-group-delete]: /cli/azure/group#az_group_delete

+[az-aks-enable-addons]: /cli/azure/aks#az_aks_enable_addons

+ Title: Troubleshoot the Open Service Mesh (OSM) add-on for Azure Kubernetes Service (AKS)

+description: How to troubleshoot the Open Service Mesh (OSM) add-on for Azure Kubernetes Service (AKS).

+# Troubleshoot the Open Service Mesh (OSM) add-on for Azure Kubernetes Service (AKS)

+When you deploy the Open Service Mesh (OSM) add-on for Azure Kubernetes Service (AKS), you may experience problems associated with the service mesh configuration. The article explores common troubleshooting errors and how to resolve them.

+## Verifying and troubleshooting OSM components

+### Check OSM Controller deployment, pod, and service

+* Check the OSM Controller deployment, pod, and service health using the `kubectl get deployment,pod,service` command.

+ ```azurecli-interactive

+ kubectl get deployment,pod,service -n kube-system --selector app=osm-controller

+ ```

+ A healthy OSM controller gives an output similar to the following example output:

+ ```output

+ NAME READY UP-TO-DATE AVAILABLE AGE

+ deployment.apps/osm-controller 2/2 2 2 3m4s

+ NAME READY STATUS RESTARTS AGE

+ pod/osm-controller-65bd8c445c-zszp4 1/1 Running 0 2m

+ pod/osm-controller-65bd8c445c-xqhmk 1/1 Running 0 16s

+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

+ service/osm-controller ClusterIP 10.96.185.178 <none> 15128/TCP,9092/TCP,9091/TCP 3m4s

+ service/osm-validator ClusterIP 10.96.11.78 <none> 9093/TCP 3m4s

+ ```

+ > [!NOTE]

+ > For the `osm-controller` services, the CLUSTER-IP is different. The service NAME and PORT(S) must be the same as the example output.

+### Check OSM Injector deployment, pod, and service

+* Check the OSM Injector deployment, pod, and service health using the `kubectl get deployment,pod,service` command.

+ ```azurecli-interactive

+ kubectl get deployment,pod,service -n kube-system --selector app=osm-injector

+ ```

+ A healthy OSM Injector gives an output similar to the following example output:

+ ```output

+ NAME READY UP-TO-DATE AVAILABLE AGE

+ deployment.apps/osm-injector 2/2 2 2 4m37s

+ NAME READY STATUS RESTARTS AGE

+ pod/osm-injector-5c49bd8d7c-b6cx6 1/1 Running 0 4m21s

+ pod/osm-injector-5c49bd8d7c-dx587 1/1 Running 0 4m37s

+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

+ service/osm-injector ClusterIP 10.96.236.108 <none> 9090/TCP 4m37s

+ ```

+### Check OSM Bootstrap deployment, pod, and service

+* Check the OSM Bootstrap deployment, pod, and service health using the `kubectl get deployment,pod,service` command.

+ ```azurecli-interactive

+ kubectl get deployment,pod,service -n kube-system --selector app=osm-bootstrap

+ ```

+ A healthy OSM Bootstrap gives an output similar to the following example output:

+ ```output

+ NAME READY UP-TO-DATE AVAILABLE AGE

+ deployment.apps/osm-bootstrap 1/1 1 1 5m25s

+ NAME READY STATUS RESTARTS AGE

+ pod/osm-bootstrap-594ffc6cb7-jc7bs 1/1 Running 0 5m25s

+ NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

+ service/osm-bootstrap ClusterIP 10.96.250.208 <none> 9443/TCP,9095/TCP 5m25s

+ ```

+### Check validating and mutating webhooks

+1. Check the OSM Validating Webhook using the `kubectl get ValidatingWebhookConfiguration` command.

+ ```azurecli-interactive

+ kubectl get ValidatingWebhookConfiguration --selector app=osm-controller

+ ```

+ A healthy OSM Validating Webhook gives an output similar to the following example output:

+ ```output

+ NAME WEBHOOKS AGE

+ aks-osm-validator-mesh-osm 1 81m

+ ```

+2. Check the OSM Mutating Webhook using the `kubectl get MutatingWebhookConfiguration` command.

+ ```azurecli-interactive

+ kubectl get MutatingWebhookConfiguration --selector app=osm-injector

+ ```

+ A healthy OSM Mutating Webhook gives an output similar to the following example output:

+ ```output

+ NAME WEBHOOKS AGE

+ aks-osm-webhook-osm 1 102m

+ ```

+### Check for the service and CA bundle of the Validating Webhook

+* Check for the service and CA bundle of the OSM Validating Webhook using the `kubectl get ValidatingWebhookConfiguration` command with `aks-osm-validator-mesh-osm` and `jq '.webhooks[0].clientConfig.service'`.

+ ```azurecli-interactive

+ kubectl get ValidatingWebhookConfiguration aks-osm-validator-mesh-osm -o json | jq '.webhooks[0].clientConfig.service'

+ ```

+ A well-configured Validating Webhook configuration looks like the following example JSON output:

+ ```json

+ {

+ "name": "osm-config-validator",

+ "namespace": "kube-system",

+ "path": "/validate-webhook",

+ "port": 9093

+ }

+ ```

+### Check for the service and CA bundle of the Mutating webhook

+* Check for the service and CA bundle of the OSM Mutating Webhook using the `kubectl get ValidatingWebhookConfiguration` command with `aks-osm-validator-mesh-osm` and `jq '.webhooks[0].clientConfig.service'`.

+ ```azurecli-interactive

+ kubectl get MutatingWebhookConfiguration aks-osm-webhook-osm -o json | jq '.webhooks[0].clientConfig.service'

+ ```

+ A well-configured Mutating Webhook configuration looks like the following example JSON output:

+ ```json

+ {

+ "name": "osm-injector",

+ "namespace": "kube-system",

+ "path": "/mutate-pod-creation",

+ "port": 9090

+ }

+ ```

+1. Check the OSM MeshConfig resource exists using the `kubectl get meshconfig` command.

+ ```azurecli-interactive

+ kubectl get meshconfig osm-mesh-config -n kube-system

+ ```

+2. Check the contents of the OSM MeshConfig resource using the `kubectl get meshconfig` command with `-o yaml`.

+ ```azurecli-interactive

+ kubectl get meshconfig osm-mesh-config -n kube-system -o yaml

+ ```

+ ```output

+ apiVersion: config.openservicemesh.io/v1alpha1

+ kind: MeshConfig

+ metadata:

+ creationTimestamp: "0000-00-00A00:00:00A"

+ generation: 1

+ name: osm-mesh-config

+ namespace: kube-system

+ resourceVersion: "2494"

+ uid: 6c4d67f3-c241-4aeb-bf4f-b029b08faa31

+ spec:

+ certificate:

+ serviceCertValidityDuration: 24h

+ featureFlags:

+ enableEgressPolicy: true

+ enableMulticlusterMode: false

+ enableWASMStats: true

+ observability:

+ enableDebugServer: true

+ osmLogLevel: info

+ tracing:

+ address: jaeger.kube-system.svc.cluster.local

+ enable: false

+ endpoint: /api/v2/spans

+ port: 9411

+ sidecar:

+ configResyncInterval: 0s

+ enablePrivilegedInitContainer: false

+ envoyImage: mcr.microsoft.com/oss/envoyproxy/envoy:v1.18.3

+ initContainerImage: mcr.microsoft.com/oss/openservicemesh/init:v0.9.1

+ logLevel: error

+ maxDataPlaneConnections: 0

+ resources: {}

+ traffic:

+ enableEgress: true

+ enablePermissiveTrafficPolicyMode: true

+ inboundExternalAuthorization:

+ enable: false

+ failureModeAllow: false

+ statPrefix: inboundExtAuthz

+ timeout: 1s

+ useHTTPSIngress: false

+ ```

+#### `osm-mesh-config` resource values

+### Check namespaces

+> The `kube-system` namespace never participates in a service mesh and is never labeled and/or annotated with the following key/values.

+The `osm namespace add` command allows you to join namespaces to a given service mesh. When you want a K8s namespace to be part of the mesh, it must have the following annotation and label.

+1. View the annotations using the `kubectl get namespace` command with `jq '.metadata.annotations'`.

+ ```azurecli-interactive

+ kubectl get namespace bookbuyer -o json | jq '.metadata.annotations'

+ ```

+ You must see the following annotation in the output:

+ ```output

+ {

+ "openservicemesh.io/sidecar-injection": "enabled"

+ }

+ ```

+2. View the labels using the `kubectl get namespaces` command with `jq '.metadata.labels'`.

+ ```azurecli-interactive

+ kubectl get namespace bookbuyer -o json | jq '.metadata.labels'

+ ```

+ You must see the following label in the output:

+ ```output

+ {

+ "openservicemesh.io/monitored-by": "osm"

+ }

+ ```

+If a namespace doesn't have the `"openservicemesh.io/sidecar-injection": "enabled"` annotation or the `"openservicemesh.io/monitored-by": "osm"` label, the OSM Injector doesn't add Envoy sidecars.

+> After `osm namespace add` is called, only **new** pods are injected with an Envoy sidecar. Existing pods must be restarted with `kubectl rollout restart deployment ...`

+### Verify OSM CRDs

+1. Check the cluster has the required CRDs using the `kubectl get crds` command.

+ ```azurecli-interactive

+ kubectl get crds

+ ```

+ The following CRDs must be installed on the cluster:

+ * egresses.policy.openservicemesh.io

+ * httproutegroups.specs.smi-spec.io

+ * ingressbackends.policy.openservicemesh.io

+ * meshconfigs.config.openservicemesh.io

+ * multiclusterservices.config.openservicemesh.io

+ * tcproutes.specs.smi-spec.io

+ * trafficsplits.split.smi-spec.io

+ * traffictargets.access.smi-spec.io

+2. Get the versions of the SMI CRDs installed using the `osm mesh list` command.

+ ```azurecli-interactive

+ osm mesh list

+ ```

+ Your output should look similar to the following example output:

+ ```output

+ MESH NAME MESH NAMESPACE VERSION ADDED NAMESPACES

+ osm kube-system v0.11.1

+ MESH NAME MESH NAMESPACE SMI SUPPORTED

+ osm kube-system HTTPRouteGroup:v1alpha4,TCPRoute:v1alpha4,TrafficSplit:v1alpha2,TrafficTarget:v1alpha3

+ To list the OSM controller pods for a mesh, please run the following command passing in the mesh's namespace

+ kubectl get pods -n <osm-mesh-namespace> -l app=osm-controller

+ ```

+ OSM Controller v0.11.1 requires the following versions:

+ * traffictargets.access.smi-spec.io - [v1alpha3](https://github.com/servicemeshinterface/smi-spec/blob/v0.6.0/apis/traffic-access/v1alpha3/traffic-access.md)

+ * httproutegroups.specs.smi-spec.io - [v1alpha4](https://github.com/servicemeshinterface/smi-spec/blob/v0.6.0/apis/traffic-specs/v1alpha4/traffic-specs.md#httproutegroup)

+ * tcproutes.specs.smi-spec.io - [v1alpha4](https://github.com/servicemeshinterface/smi-spec/blob/v0.6.0/apis/traffic-specs/v1alpha4/traffic-specs.md#tcproute)

+ * udproutes.specs.smi-spec.io - Not supported

+ * trafficsplits.split.smi-spec.io - [v1alpha2](https://github.com/servicemeshinterface/smi-spec/blob/v0.6.0/apis/traffic-split/v1alpha2/traffic-split.md)

+ * \*.metrics.smi-spec.io - [v1alpha1](https://github.com/servicemeshinterface/smi-spec/blob/v0.6.0/apis/traffic-metrics/v1alpha1/traffic-metrics.md)

+For more information on how OSM issues and manages certificates to Envoy proxies running on application pods, see the [OSM certificates guide](https://docs.openservicemesh.io/docs/guides/certificates/).

+When you create a new pod in a namespace monitored by the add-on, OSM injects an [Envoy proxy sidecar](https://docs.openservicemesh.io/docs/guides/app_onboarding/sidecar_injection/) in that pod. For more information on how to update the Envoy version, see the [OSM upgrade guide](https://docs.openservicemesh.io/docs/getting_started/).

+description: Learn the cluster operator best practices for how to manage and secure container images in Azure Kubernetes Service (AKS).

+Container and container image security is a major priority when developing and running applications in Azure Kubernetes Service (AKS). Containers with outdated base images or unpatched application runtimes introduce security risks and possible attack vectors. You can minimize these risks by integrating and running scan and remediation tools in your containers at build and runtime. The earlier you catch the vulnerability or outdated base image, the more secure your application is.

+In this article, *"containers"* refers to both the container images stored in a container registry and running containers.

+>

+* You can read the best practices for [cluster security][best-practices-cluster-security] and [pod security][best-practices-pod-security].

+* You can use [Container security in Defender for Cloud][security-center-containers] to help scan your containers for vulnerabilities. [Azure Container Registry integration][security-center-acr] with Defender for Cloud helps protect your images and registry from vulnerabilities.

+## Secure the images and runtime

+> **Best practice guidance**

+> * Scan your container images for vulnerabilities.

+> * Only deploy validated images.

+> * Regularly update the base images and application runtime.

+> * Redeploy workloads in the AKS cluster.

+When adopting container-based workloads, you want to verify the security of images and runtime used to build your own applications. To help avoid introducing security vulnerabilities into your deployments, you can use the following best practices:

+* Include in your deployment workflow a process to scan container images using tools, such as [Twistlock][twistlock] or [Aqua][aqua].

+> **Best practice guidance**

+Each time a base image is updated, you should also update any downstream container images. Integrate this build process into validation and deployment pipelines such as [Azure Pipelines][azure-pipelines] or Jenkins. These pipelines ensure your applications continue to run on the updated based images. Once your application container images are validated, you can then update AKS deployments to run the latest secure images.

+This article focused on how to secure your containers. To implement some of these areas, see the following article:

+## Update an existing AKS cluster

+You can update an AKS cluster using the [az aks update][az aks update] command with the `--enable-oidc-issuer` and the `--enable-workload-identity` parameter to use the OIDC Issuer and enable workload identity. The following example updates a cluster named *myAKSCluster*:

+```azurecli-interactive

+az aks update -g "${RESOURCE_GROUP}" -n myAKSCluster --enable-oidc-issuer --enable-workload-identity

+```

+## Retrieve the OIDC Issuer URL

+[az aks update]: /cli/azure/aks#az-aks-update

+* You need access to the certificate and the password for management in an Azure key vault or upload to the API Management service. The certificate must be in either CER or PFX format. Self-signed certificates are allowed.

+ > [!NOTE]

+ > If you only wish to use the certificate to authenticate the client with API Management, you can upload a CER file.

+The `validate-azure-ad-token` policy enforces the existence and validity of a JSON web token (JWT) that was provided by the Azure Active Directory service for a specified set of principals in the directory. The JWT can be extracted from a specified HTTP header, query parameter, or value provided using a policy expression or context variable.

+To operate properly, the API Management service needs outbound connectivity on port 443 to the following endpoints associated with its cloud-based API Management instance:

+| Norway West | ✅ | | ✅ |

+| Poland Central | ✅ | | |

+> You can create private and public listeners with the same port number (Preview feature). However, be aware of any Network Security Group (NSG) associated with the application gateway subnet. Depending on your NSG's configuration, you may need an allow-inbound rule with **Destination IP addresses** as your application gateway's Public and Private frontend IPs. When using the same port, your application gateway changes the "Destination" of the inbound flow to the frontend IPs of your gateway.

+> - Destination: Public and Private frontend IPs of your application gateway.

+> - Destination Port: (as per configured listeners)

+> **Outbound Rule**:

+> - (no specific requirement)

+In order to configure mutual authentication with the client, or client authentication, Application Gateway requires a trusted client CA certificate chain to be uploaded to the gateway. If you have multiple certificate chains, you need to create the chains separately and upload them as different files on the Application Gateway. In this article, you learn how to export a trusted client CA certificate chain that you can use in your client authentication configuration on your gateway.

+Trusted client CA certificate is required to allow client authentication on Application Gateway. In this example, we use a TLS/SSL certificate for the client certificate, export its public key and then export the CA certificates from the public key to get the trusted client CA certificates. We then concatenate all the client CA certificates into one trusted client CA certificate chain.

+ :::image type="content" source="./media/certificates-for-backend-authentication/export.png" alt-text="Screenshot shows the Certificate Manager with Certificates selected and a contextual menu with All tasks, then Export selected.":::

+1. In the Wizard, click **Next**.

+ :::image type="content" source="./media/certificates-for-backend-authentication/exportwizard.png" alt-text="Screenshot of export certificate.":::

+1. Select **No, do not export the private key**, and then click **Next**.

+ :::image type="content" source="./media/certificates-for-backend-authentication/notprivatekey.png" alt-text="Screenshot of do not export the private key.":::

+1. On the **Export File Format** page, select **Base-64 encoded X.509 (.CER).**, and then click **Next**.

+ :::image type="content" source="./media/certificates-for-backend-authentication/base64.png" alt-text="Screenshot of Base-64 encoded.":::

+1. For **File to Export**, **Browse** to the location to which you want to export the certificate. For **File name**, name the certificate file. Then, click **Next**.

+ :::image type="content" source="./media/certificates-for-backend-authentication/browse.png" alt-text="Screenshot shows the Certificate Export Wizard where you specify a file to export.":::

+1. Click **Finish** to export the certificate.

+

+ :::image type="content" source="./media/certificates-for-backend-authentication/finish-screen.png" alt-text="Screenshot shows the Certificate Export Wizard after you complete the file export.":::

+1. Your certificate is successfully exported.

+ :::image type="content" source="./media/certificates-for-backend-authentication/success.png" alt-text="Screenshot shows the Certificate Export Wizard with a success message.":::

+ The exported certificate looks similar to this:

+ :::image type="content" source="./media/certificates-for-backend-authentication/exported.png" alt-text="Screenshot shows a certificate symbol.":::

+Now that you've exported your public certificate, you'll now export the CA certificate(s) from your public certificate. If you only have a root CA, you'll only need to export that certificate. However, if you have 1+ intermediate CAs, you need to export each of those as well.

+ :::image type="content" source="./media/certificates-for-backend-authentication/openAuthcert.png" alt-text="Screenshot of Open authorization certificate.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/general.png" alt-text="Screenshot of about certificate.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/cert-details.png" alt-text="Screenshot of certificate details.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/root-cert.png" alt-text="Screenshot of certificate path.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/root-cert-details.png" alt-text="Screenshot of certificate info.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/root-cert-copy-to-file.png" alt-text="Screenshot of copy root certificate.":::

+1. At this point, you've extracted the details of the root CA certificate from the public certificate. You see the **Certificate Export Wizard**. Follow steps 2-7 from the previous section ([Export public certificate](./mutual-authentication-certificate-management.md#export-public-certificate)) to complete the Certificate Export Wizard.

+ :::image type="content" source="./media/mutual-authentication-certificate-management/intermediate-cert.png" alt-text="Screenshot of intermediate certificate.":::

+ :::image type="content" source="./media/mutual-authentication-certificate-management/combined-cert.png" alt-text="Screenshot of combined certificate.":::

+> [!CAUTION]

+> When you use an application gateway in a different resource group, the managed identity created **_ingressapplicationgateway-{AKSNAME}_** once this add-on is enabled in the AKS nodes resource group must have Contributor role set in the Application Gateway resource as well as Reader role set in the Application Gateway resource group.

+In addition to these prerequisites, be sure to meet all [network requirements for Azure Arc-enabled Kubernetes](network-requirements.md).

+Run the following command to connect your cluster. This command deploys the Azure Arc agents to the cluster and installs Helm v. 3.6.3 to the `.azure` folder of the deployment machine. This Helm 3 installation is only used for Azure Arc, and it doesn't remove or change any previously installed versions of Helm on the machine.

+1. On the deployment machine, set the environment variables needed for Azure CLI to use the outbound proxy server:

+2. On the Kubernetes cluster, run the connect command with the `proxy-https` and `proxy-http` parameters specified. If your proxy server is set up with both HTTP and HTTPS, be sure to use `--proxy-http` for the HTTP proxy and `--proxy-https` for the HTTPS proxy. If your proxy server only uses HTTP, you can use that value for both parameters.

+1. On the deployment machine, set the environment variables needed for Azure PowerShell to use the outbound proxy server:

+2. On the Kubernetes cluster, run the connect command with the proxy parameter specified:

+> * `--custom-ca-cert` is an alias for `--proxy-cert`. Either parameters can be used interchangeably. Passing both parameters in the same command will honor the one passed last.

+The ability to pass in the proxy certificate only without the proxy server endpoint details isn't currently supported via PowerShell.

+This article provides a guide for importing and exporting data with Azure Cache for Redis and provides the answers to commonly asked questions.

+- Caches running Redis 4.0 support RDB version 8 and below. Caches running Redis 6.0 support RDB version 9 and below.

+> Before beginning the import operation, ensure that your Redis Database (RDB) file or files are uploaded into page or block blobs in Azure storage, in the same region and subscription as your Azure Cache for Redis instance. If you are using managed identity for authentication, the storage account can be in a different subscription. For more information, see [Get started with Azure Blob storage](../storage/blobs/storage-quickstart-blobs-dotnet.md). If you exported your RDB file using the [Azure Cache for Redis Export](#export) feature, your RDB file is already stored in a page blob and is ready for importing.

+ >

+2. Select **Choose Storage Container** and to display a list of available storage accounts. Select the storage account you want. The storage account must be in the same region as your cache. If you're using managed identity for authentication, the storage account can be in a different subscription. Otherwise, the storage account must be in the same subscription as your cache.

+Yes, you can import data that was exported from Azure Cache for Redis instances. You can import RDB files from any Redis server running in any cloud or environment. The environments include Linux, Windows, or cloud providers such as Amazon Web Services. To do import this data, upload the RDB file from the Redis server you want into a page or block blob in an Azure Storage Account. Then, import it into your premium Azure Cache for Redis instance.

+For example, you might want to:

+For more information on supported RDB versions used with import, see the [compatibility section](#compatibility).

+When _persistence_ is configured, your cache persists a snapshot of the data to disk, based on a configurable backup frequency. The data is written with a Redis-proprietary binary format. If a catastrophic event occurs that disables both the primary and the replica caches, the cache data is restored automatically using the most recent snapshot.

+Data persistence is designed for disaster recovery. It isn't intended as a point-in-time recovery mechanism.

+- On the Premium tier, the data persistence file is stored in Azure Storage, but the file can't be imported into a different cache.

+- On the Enterprise tiers, the data persistence file is stored in a mounted disk that isn't user-accessible.

+- PowerShell instructions [to import Redis data](cache-how-to-manage-redis-cache-powershell.md#to-import-an-azure-cache-for-redis) and [to export Redis data](cache-how-to-manage-redis-cache-powershell.md#to-export-an-azure-cache-for-redis).

+- PowerShell instructions [to import Redis data](/powershell/module/az.redisenterprisecache/import-azredisenterprisecache) and [to export Redis data](/powershell/module/az.redisenterprisecache/export-azredisenterprisecache).

+In the _Premium_ tier, you can import and export data from a storage account in a different subscription than your cache, but you must use [managed identity](cache-managed-identity.md) as the authentication method. You will need to select the chosen subscription holding the storage account when configuring the import or export.

+> Not all features of ASP.NET Core are exposed by this model. Specifically, the ASP.NET Core middleware pipeline and routing capabilities are not available.

+1. Add a reference to the [Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore NuGet package, version 1.0.0-preview2 or later](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore/1.0.0-preview2) to your project.

+ You must also update your project to use [version 1.11.0 or later of Microsoft.Azure.Functions.Worker.Sdk](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Sdk/1.11.0) and [version 1.16.0 or later of Microsoft.Azure.Functions.Worker](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker/1.16.0).

+2. In your `Program.cs` file, update the host builder configuration to use `ConfigureFunctionsWebApplication()` instead of `ConfigureFunctionsWorkerDefaults()`. The following example shows a minimal setup without other customizations:

+ .ConfigureFunctionsWebApplication()

+Indicates whether the [Oryx build system](https://github.com/microsoft/Oryx) is used during deployment. `ENABLE_ORYX_BUILD` must be set to `true` when doing remote build deployments to Linux. For more information, see [Remote build](functions-deployment-technologies.md#remote-build).

+When you create and maintain your own custom linux container for your function app, the `linuxFxVersion` value is instead in the format `DOCKER|<IMAGE_URI>`, as in the following example:

+This indicates the registry source of the deployed container. For more information, see [Working with containers and Azure Functions](functions-how-to-custom-container.md).

+The following example shows an HTTP trigger that returns a "hello, world" response as an [IActionResult], using [ASP.NET Core integration in .NET Isolated](./dotnet-isolated-process-guide.md#aspnet-core-integration-preview):

+> When running functions locally, authorization is disabled regardless of the specified authorization level setting. After publishing to Azure, the `authLevel` setting in your trigger is enforced. Keys are still required when running [locally in a container](functions-create-container-registry.md#build-the-container-image-and-verify-locally).

+`func init` supports the following options, which don't support version 1.x unless otherwise noted:

+| **`--docker`** | Creates a Dockerfile for a container using a base image that is based on the chosen `--worker-runtime`. Use this option when you plan to deploy a containerized function app. |

+| **`--docker-only`** | Adds a Dockerfile to an existing project. Prompts for the worker-runtime if not specified or set in local.settings.json. Use this option when you plan to deploy a containerized function app and the project already exists. |

+> When you use either `--docker` or `--dockerfile` options, Core Tools automatically create the Dockerfile for C#, JavaScript, Python, and PowerShell functions. For Java functions, you must manually create the Dockerfile. For more information, see [Creating containerized function apps](functions-how-to-custom-container.md#creating-containerized-function-apps).

+| **`--force`** | Ignore prepublishing verification in certain scenarios. |

+The `func deploy` command is deprecated. Instead use [`func kubernetes deploy`](#func-kubernetes-deploy).

+ Title: Create Azure Functions in a local Linux container

+description: Get started with Azure Functions by creating a containerized function app on your local computer and publishing the image to a container registry.

+zone_pivot_groups: programming-languages-set-functions

+# Create a function app in a local Linux container

+This article shows you how to use Azure Functions Core tools to create your first function in a Linux container on your local computer, verify the function locally, and then publish the containerized function to a container registry. From a container registry, you can easily deploy your containerized functions to Azure.

+For a complete example of deploying containerized functions to Azure, which include the steps in this article, see one of the following articles:

+You can also create a function app in the Azure portal by using an existing containerized function app from a container registry. For more information, see [Azure portal create using containers](functions-how-to-custom-container.md#azure-portal-create-using-containers).

+## Next steps

+> [!div class="nextstepaction"]

+> [Working with containers and Azure Functions](./functions-how-to-custom-container.md)

+The following diagram shows how these files look on the file system for a function named "MyQueueFunction" and a custom handler executable named *handler.exe*.

+A custom handler can be deployed to every Azure Functions hosting option. If your handler requires operating system or platform dependencies (such as a language runtime), you may need to use a [custom container](./functions-how-to-custom-container.md).

+When creating a function app in Azure for custom handlers, we recommend you select .NET Core as the stack.

+Custom handlers run in the same environment as a typical Azure Functions app. Test your handler to ensure the environment contains all the dependencies it needs to run. For apps that require additional dependencies, you may need to run them using a [custom container image](./functions-how-to-custom-container.md) hosted on Azure Functions [Premium plan](functions-premium-plan.md).

+In this article, you create a function app running in a Linux container and deploy it to an Azure Container Apps environment from a container registry. By deploying to Container Apps, you are able to integrate your function apps into cloud-native microservices. For more information, see [Azure Container Apps hosting of Azure Functions](functions-container-apps-hosting.md).

+This article shows you how to use Functions tools to create your first function running in a Linux container, verify the functions locally, and then deploy the container to a Container Apps environment.

+Azure Functions can automatically perform builds on the code it receives after zip deployments. These builds behave slightly differently depending on whether your app is running on Windows or Linux.

+# [Windows](#tab/windows)

+All function apps running on Windows have a small management app, the SCM site provided by [Kudu](https://github.com/projectkudu/kudu). This site handles much of the deployment and build logic for Azure Functions.

+# [Linux](#tab/linux)

+To enable remote build on Linux, you must set the following in your application settings:

+The following considerations apply when using remote builds during deployment:

+>__How to use it:__ [Create your functions in a Linux container](functions-create-container-registry.md) then deploy the container to a Premium or Dedicated plan in Azure Functions or another container host. Use the [Azure Functions Core Tools](functions-run-local.md#) to create a customized Dockerfile for your project that you use to build a containerized function app. You can use the container in the following deployments:

+>+ Deploy to Azure Functions resources you create in the Azure portal. For more information, see [Azure portal create using containers](functions-how-to-custom-container.md#azure-portal-create-using-containers).

+You can automatically deploy your code to Azure Functions as a custom container after every successful build. To learn more about containers, see [Working with containers and Azure Functions](./functions-how-to-custom-container.md) .

+Functions makes it easy to deploy and run your function apps as Linux containers, which you create and maintain. Functions maintains a set of [lanuage-specific base images](https://mcr.microsoft.com/catalog?search=functions) that you can use when creating containerized function apps.

+For a complete example of how to create the local containerized function app from the command line and publish the image to a container registry, see [Create a function app in a local container](functions-create-container-registry.md).

+### Generate the Dockerfile

+Functions tooling provides a Docker option that generates a Dockerfile with your functions code project. You can use this file with Docker to create your functions in a container that derives from the correct base image (language and version).

+The way you create a Dockerfile depends on how you create your project.

+# [Command line](#tab/core-tools)

+ ```console

+ func init --docker

+ ```

+ ```console

+ func init --docker-only

+ ```

+For a complete example, see [Create a function app in a local container](functions-create-container-registry.md#create-and-test-the-local-functions-project).

+# [Visual Studio Code](#tab/vs-code)

+The Azure Functions extension for Visual Studio Code doesn't provide a way to create a Dockerfile when you create the project. However, you can instead create the Dockerfile for an existing project by using the `--docker-only` option when you run the [`func init`](./functions-core-tools-reference.md#func-init) command in the Terminal windows of an existing project folder, as in the following example:

+```console

+func init --docker-only

+```

+# [Visual Studio](#tab/vs)

+ ```console

+ func init --docker-only

+ ```

+### Creating your function app in a container

+With a Core Tools-generated Dockerfile in your code project, you can use Docker to create the containerized function app on your local computer. The following `docker build` command creates an image of your containerized functions from the project in the local directory:

+```console

+docker build --tag <DOCKER_ID>/<IMAGE_NAME>:v1.0.0 .

+```

+For an example of how to create the container, see [Build the container image and verify locally](functions-create-container-registry.md#build-the-container-image-and-verify-locally).

+When you make changes to your functions code project or need to update to the latest base image, you need to rebuild the container locally and republish the updated image to your chosen container registry. The following command rebuilds the image from the root folder with an updated version number and pushes it to your registry:

+## Azure portal create using containers

+When you create a function app in the [Azure portal](https://portal.azure.com), you can also create a deployment of the function app from an existing container image. The following steps create and deploy a function app from an [existing container image](#creating-your-function-app-in-a-container).

+1. From the Azure portal menu or the **Home** page, select **Create a resource**.

+1. In the **New** page, select **Compute** > **Function App**.

+1. On the **Basics** page, use the function app settings as specified in the following table:

+ | Setting | Suggested value | Description |

+ | | - | -- |

+ | **Subscription** | Your subscription | The subscription in which you create your function app. |

+ | **[Resource Group](../azure-resource-manager/management/overview.md)** | *myResourceGroup* | Name for the new resource group in which you create your function app. You should create a resource group because there are [known limitations when creating new function apps in an existing resource group](functions-scale.md#limitations-for-creating-new-function-apps-in-an-existing-resource-group).|

+ | **Function App name** | Globally unique name | Name that identifies your new function app. Valid characters are `a-z` (case insensitive), `0-9`, and `-`. |

+ | **Do you want to deploy code or container image?**| Container image | Deploy a containerized function app from a registry. To create a function app in registry, see [Create a function app in a local container](functions-create-container-registry.md). |

+ |**Region**| Preferred region | Select a [region](https://azure.microsoft.com/regions/) that's near you or near other services that your functions can access. |

+4. In **[Hosting options and plans](functions-scale.md)**, choose **Functions Premium**.

+ :::image type="content" source="media/functions-how-to-custom-container/function-app-create-container-functions-premium.png" alt-text="Screenshot of the Basics tab in the Azure portal when creating a function app for hosting a container in a Functions Premium plan.":::

+

+ This creates a function app hosted by Azure Functions in the [Premium plan](functions-premium-plan.md), which supports dynamic scaling. You can also choose to run in an **App Service plan**, but in this kind of dedicated plan you must manage the [scaling of your function app](functions-scale.md).

+4. In **[Hosting options and plans](functions-scale.md)**, choose **Azure Container Apps Environment plan**.

+ :::image type="content" source="media/functions-how-to-custom-container/function-app-create-container-apps-hosting.png" alt-text="Portal create Basics tab for a containerized function app hosted in Azure Container Apps.":::

+ This creates a new **Azure Container Apps Environment** resource to host your function app container. By default, the environment is created in a Consumption plan without zone redundancy, to minimize costs. You can also choose an existing Container Apps environment. For more information, see [Azure Container Apps hosting of Azure Functions](functions-container-apps-hosting.md).

+5. Accept the default options of creating a new storage account on the **Storage** tab and a new Application Insight instance on the **Monitoring** tab. You can also choose to use an existing storage account or Application Insights instance.

+6. Select the **Deployment** tab and unselect **Use quickstart image**. If you don't do this, the function app is deployed from the base image for your function app language.

+7. Choose your **Image type**, public or private. Choose **Private** if you're using Azure Container Registry or some other private registry. Supply the **Image** name, including the registry prefix. If you're using a private registry, provide the image registry authentication credentials.

+

+8. Select **Review + create** to review the app configuration selections.

+9. On the **Review + create** page, review your settings, and then select **Create** to provision the function app and deploy your container image from the registry.

+If you're [deploying a custom container image](./functions-how-to-custom-container.md), you must specify it with `linuxFxVersion` and include configuration that allows your image to be pulled, as in [Web App for Containers](../app-service/index.yml). Also, set `WEBSITES_ENABLE_APP_SERVICE_STORAGE` to `false`, since your app content is provided in the container itself:

+Kubernetes-based Functions provides the Functions runtime in a [Docker container](functions-create-container-registry.md) with event-driven scaling through KEDA. KEDA can scale in to 0 instances (when no events are occurring) and out to *n* instances. It does this by exposing custom metrics for the Kubernetes autoscaler (Horizontal Pod Autoscaler). Using Functions containers with KEDA makes it possible to replicate serverless function capabilities in any Kubernetes cluster. These functions can also be deployed using [Azure Kubernetes Services (AKS) virtual nodes](../aks/virtual-nodes-cli.md) feature for serverless infrastructure.

+* [Working with containers and Azure Functions](./functions-how-to-custom-container.md)

+When the container image can't be found, you'll see a `manifest unknown` error in the Docker logs. In this case, you can use the Azure CLI commands documented at [How to target Azure Functions runtime versions](set-runtime-version.md?tabs=azurecli#manual-version-updates-on-linux) to change the container image being referenced. If you've deployed a [custom container image](./functions-how-to-custom-container.md), you need to fix the image and redeploy the updated version to the referenced registry.

+* *Dockerfile*: (Optional) Used when publishing your project in a [custom container](./functions-how-to-custom-container.md).

+* *Dockerfile*: (Optional) Used when publishing your project in a [custom container](./functions-how-to-custom-container.md).

+The way you start the host depends on your runtime version:

+# [v4.x](#tab/v2)

+```

+func start

+```

+# [v1.x](#tab/v1)

+```

+func host start

+```

+### Considerations when running locally

+Keep in mind the following considerations when running your functions locally:

+Functions also lets you define your Functions project to run in a Docker container. Use the [`--docker` option][func init] of `func init` to generate a Dockerfile for your specific language. This file is then used when creating a container to deploy. For more information, see [Working with containers and Azure Functions](functions-how-to-custom-container.md).

+The following deployment uses an ARM template from [Azure Quickstart Templates](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.kubernetes/aks-azure-linux).

+> [Azure Linux Container Host tutorial](./tutorial-azure-linux-create-cluster.md)

+| Snap to roads | ¹ |

+¹ While there is no direct replacement for the Bing Maps *Snap to road* service, this functionality can be implemented using the Azure Maps [Route - Get Route Directions] REST API. For a complete code sample demonstrating the snap to road functionality, see the [Basic snap to road logic] sample that demonstrates how to snap individual points to the rendered roads on the map. Also see the [Snap points to logical route path] sample that shows how to snap points to the road network to form a logical path.

+[Basic snap to road logic]: https://samples.azuremaps.com/?search=Snap%20to%20road&sample=basic-snap-to-road-logic

+[Snap points to logical route path]: https://samples.azuremaps.com/?search=Snap%20to%20road&sample=snap-points-to-logical-route-path

+[Route - Get Route Directions]: https://learn.microsoft.com/rest/api/maps/route/get-route-directions

+The [Simple WFS example] sample shows how to easily query a Web Feature Service (WFS) and renders the returned features on the map. For the source code for this sample, see [Simple WFS example source code].

+The [WFS filter example] sample demonstrates the use of different filters with the WFS client. For the source code for this sample, see [WFS filter example source code].

+The [WFS service explorer] sample is a simple tool for exploring WFS services on Azure Maps. For the source code for this sample, see [WFS service explorer source code].

+[Simple WFS example source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Simple%20WFS%20example/Simple%20WFS%20example.html

+[WFS filter example source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/WFS%20filter%20examples/WFS%20filter%20examples.html

+[WFS service explorer source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/WFS%20service%20explorer/WFS%20service%20explorer.html

+The [Load spatial data] sample shows how to read a spatial data set, and render it on the map using the `SimpleDataLayer` class. The code uses a GPX file pointed to by a URL. For the source code of this sample, see [Load spatial data source code].

+The [Load KML onto map] sample shows how to load KML or KMZ files onto the map. For the source code of this sample, see [Load KML onto map source code].

+The [Spatial data write options] sample is a tool that demonstrates the majority of the write options that can be used with the `atlas.io.write` function. For the source code of this sample, see [Spatial data write options source code].

+The [Drag and drop spatial files onto map] sample allows you to drag and drop one or more KML, KMZ, GeoRSS, GPX, GML, GeoJSON or CSV files onto the map. For the source code of this sample, see [Drag and drop spatial files onto map source code].

+The [Read Well Known Text] sample shows how to read the well-known text string `POINT(-122.34009 47.60995)` and render it on the map using a bubble layer. For the source code of this sample, see [Read Well Known Text source code].

+The [Read and write Well Known Text] sample demonstrates how to read and write Well Known Text (WKT) strings as GeoJSON. For the source code of this sample, see [Read and write Well Known Text source code].

+[Load spatial data source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Load%20spatial%20data%20(simple)/Load%20spatial%20data%20(simple).html

+[Load KML onto map source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Load%20KML%20onto%20map/Load%20KML%20onto%20map.html

+[Spatial data write options source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Spatial%20data%20write%20options/Spatial%20data%20write%20options.html

+[Drag and drop spatial files onto map source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Drag%20and%20drop%20spatial%20files%20onto%20map/Drag%20and%20drop%20spatial%20files%20onto%20map.html

+[Read Well Known Text source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Read%20Well%20Known%20Text/Read%20Well%20Known%20Text.html

+[Read and write Well Known Text source code]: https://github.com/Azure-Samples/AzureMapsCodeSamples/blob/main/Samples/Spatial%20IO%20Module/Read%20and%20write%20Well%20Known%20Text/Read%20and%20write%20Well%20Known%20Text.html

+For more information on how to troubleshoot syslog issues with Azure Monitor Agent, see [here](azure-monitor-agent-troubleshoot-linux-vm-rsyslog.md).

+ 1. Check your rsyslog configuration at `/etc/rsyslog.conf` and `/etc/rsyslog.d/*` to see if you have any inputs bound to a non-default ruleset, as messages from these inputs won't be forwarded to Azure Monitor Agent. For instance, messages from an input configured with a non-default ruleset like `input(type="imtcp" port="514" `**`ruleset="myruleset"`**`)` won't be forward.

+## Troubleshooting issues on Arc-enabled server

+If after checking basic troubleshooting steps you don't see the Azure Monitor Agent emitting logs or find **'Failed to get MSI token from IMDS endpoint'** errors in `mdsd.err` log file, it's likely `syslog` user isn't a member of the group `himds`. Add `syslog` user to `himds` user group if the user isn't a member of this group. Create user `syslog` and the group `syslog`, if necessary, and make sure that the user is in that group. For more information check out Azure Arc-enabled server authentication requirements [here](../../azure-arc/servers/managed-identity-authentication.md).

+ - Do clean up all log files in the monitored directory. Tracking many log files can drive up agent CPU and Memory usage. Wait for at least 2 days to allow ample time for all logs to be processed.

+ - Do Not overwrite an existing file with new records. You should only append new records to the end of the file. Overwriting will cause data loss.

+ - Do Not rename a file to a new name and then open a new file with the same name. This could cause data loss.

+ - Do Not rename or copy large log files that match the file scan pattern in to the monitored directory. If you must, do not exceed 50MB per minute.

+ - Do Not rename a file that matches the file scan pattern to a new name that also matches the file scan pattern. This will cause duplicate data to be ingested.

+Use the [Azure monitor troubleshooter tool](use-azure-monitor-agent-troubleshooter.md) to look for common issues and share results with Microsoft.

+1. Use the Micrometer [global registry](https://micrometer.io/?/docs/concepts#_global_registry) to create a meter:

+| `properties.enabled` | False | boolean | Enable/disable group. Default is true. |

+ - Is collecting profiles.

+## Permissions

+To set a table's log data plan, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).

+When you change a table's plan from Analytics to Basic, Log Analytics immediately archives any data that's older than eight days and up to original data retention of the table. In other words, the total retention period of the table remains unchanged, unless you explicitly [modify the archive period](../logs/data-retention-archive.md).

+When you change a table's plan from Basic to Analytics, the changes take affect on existing data in the table immediately.

+> [!NOTE]

+> You can switch a table's plan once a week.

+## Permissions

+To configure set data retention and archiving, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).

+### Adjustments to retention and archive settings

+When you increase the retention policy, the new retention period applies to all data that's already been ingested into the table and hasn't yet been purged or removed.

+If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 180 days of interactive retention and no archive period. You decide to change the retention policy to 90 days of interactive retention without changing the total retention period of 180 days. Log Analytics immediately archives any data that's older than 90 days and none of the data is deleted.

+The Analytics log data plan includes 30 days of interactive retention. You can increase the interactive retention period to up to 730 days at an [additional cost](https://azure.microsoft.com/pricing/details/monitor/). If needed, you can reduce the interactive retention period to as low as four days using the API or CLI, however, since 30 days are included in the ingestion price, lowering the retention period below 30 days does not reduce costs. You can set the archive period to a total retention time of up to 2,556 days (seven years).

+- Custom logs created using the [HTTP Data Collector API](./data-collector-api.md) can't be exported, including text-based logs consumed by Log Analytics agent. Custom logs created using [data collection rules](./logs-ingestion-api-overview.md), including text-based logs can be can be exported.

+- Data export will gradually support more tables, but is currently limited to tables specified in the [supported tables](#supported-tables) section.

+- Export to Premium Storage Account isn't supported.

+The Storage Account can't be Premium, must be StorageV1 or later, and located in the same region as your workspace. If you need to replicate your data to other storage accounts in other regions, you can use any of the [Azure Storage redundancy options](../../storage/common/storage-redundancy.md#redundancy-in-a-secondary-region), including GRS and GZRS.

+| [Table-level Azure RBAC](#set-table-level-read-access) | Optional permissions that define specific data types in the workspace that you can access. Can be applies to all access modes or access control modes. |

+- **Workspace-context**: You can view all logs in the workspace for which you have permission. Queries in this mode are scoped to all data in tables that you have access to in the workspace. This access mode is used when logs are accessed with the workspace as the scope, such as when you select **Logs** on the **Azure Monitor** menu in the Azure portal.

+| Access a specific log table - legacy method | `Microsoft.OperationalInsights/workspaces/query/<table_name>/read` |

+| `Microsoft.Insights/logs/*/read` | Ability to view all log data for the resource |

+| `Microsoft.Insights/logs/<tableName>/read`<br>Example:<br>`Microsoft.Insights/logs/Heartbeat/read` | Ability to view specific table for this resource - legacy method |

+Table-level access allows you to let specific people read data only from a specific set of tables. It applies both for workspace-context and resource-context. There are two methods to define table-level permissions:

+* By assigning permissions to the table sub-resource under the workspace resource - this is the recommended method that is described in this section. This method is currently in **preview**.

+* By assigning special actions that contain table name to the workspace resource - this is the legacy method that is described in the next section. It has some limitations around custom log tables.

+Table-level RBAC is applied during query execution. It does not apply to metadata retrieval calls. For that reason, tables will appear in the list of tables even if they are not available to the user.

+> [!NOTE]

+> The recommended table-level access method described here does not apply during preview to Microsoft Sentinel Detection Rules. These rules might have access to more tables than intended.

+In order to apply table-level RBAC for a user, two assignments shall be made:

+1. Assign the user the ability to read the workspace details and to run a query without granting the ability to run a query on tables. This is done by assigning a special custom role on the workspace that has only the following actions:

+ - `Microsoft.OperationalInsights/workspaces/read`

+ - `Microsoft.OperationalInsights/workspaces/query/read`

+ - `Microsoft.OperationalInsights/workspaces/analytics/query/action`

+ - `Microsoft.OperationalInsights/workspaces/search/action`

+

+2. Assign the user a read permissions on the specific table sub-resource. Any role that has */read will be sufficient such as **Reader** role or **Log Analytics Reader** role. As table is a sub-resource of workspace, the workspace admins can also perform action on a specific table.

+> [!WARNING]

+> If the user has other assignments on the workspace, directly or via inheritence (e.g. user has Reader on the subscription that contains the workspace), the user will be able to access all tables in the workspace.

+The legacy method of table-level also uses [Azure custom roles](../../role-based-access-control/custom-roles.md) to let you grant specific users or groups access to specific tables in the workspace. Azure custom roles apply to workspaces with either workspace-context or resource-context [access control modes](#access-control-mode) regardless of the user's [access mode](#access-mode).

+Using the legacy method of table-level access, you can't grant access to individual custom log tables at the table level, but you can grant access to all custom log tables. To create a role with access to all custom log tables, create a custom role by using the following actions:

+### Considerations regarding table-level access

+## Permissions

+To restore data from an archived table, you need `Microsoft.OperationalInsights/workspaces/tables/write` and `Microsoft.OperationalInsights/workspaces/restoreLogs/write` permissions to the Log Analytics workspace, for example, as provided by the [Log Analytics Contributor built-in role](../logs/manage-access.md#built-in-roles).

+## Permissions

+To run a search job, you need `Microsoft.OperationalInsights/workspaces/tables/write` and `Microsoft.OperationalInsights/workspaces/searchJobs/write` permissions to the Log Analytics workspace, for example, as provided by the [Log Analytics Contributor built-in role](../logs/manage-access.md#built-in-roles).

+* [SAP ASE 16.0 on Azure NetApp Files for SAP Workloads on SLES15](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-ase-16-0-on-azure-netapp-files-for-sap-workloads-on-sles15/ba-p/3729496)

+* Using double encryption at rest might have performance impacts based on the workload type and frequency. The performance impact can range from a minimal 1-2% to possibly 15% or higher, depending on the workload profile.

+* [Create a capacity pool for Azure NetApp Files](azure-netapp-files-set-up-capacity-pool.md)

+ Title: Delete an Azure NetApp Files volume | Microsoft Docs

+description: Describes how to delete an Azure NetApp Files volume.

+documentationcenter: ''

+editor: ''

+ms.assetid:

+ na

+# Delete an Azure NetApp Files volume

+This article describes how to delete an Azure NetApp Files volume.

+> [!IMPORTANT]

+> If the volume you want to delete is in a replication relationship, follow the steps in [Delete source or destination volumes](cross-region-replication-delete.md#delete-source-or-destination-volumes).

+## Before you begin

+* Stop any applications that may be using the volume. Unmount the volume from all hosts before deleting.

+* Remove the volume from automounter configurations such as `fstab`.

+## Delete a volume

+1. From the Azure portal and under storage service, select **Volumes**. Locate the volume you want to delete.

+2. Right click the volume name and select **Delete**.

+ 

+## Next steps

+* [Delete volume replications or volumes](cross-region-replication-delete.md)

+* [Troubleshoot volume errors for Azure NetApp Files](troubleshoot-volumes.md)

+### Configure private access for a Relay namespace

+The following procedure provides step-by-step instructions for disabling public access to a Relay namespace and then adding a private endpoint to the namespace.

+1. On the **Networking** page, for **Public network access**, select **Disabled** if you want the namespace to be accessed only via private endpoints.

+1. For **Allow trusted Microsoft services to bypass this firewall**, select **Yes** if you want to allow [trusted Microsoft services](#trusted-services) to bypass this firewall.

+ :::image type="content" source="./media/private-link-service/public-access-disabled.png" alt-text="Screenshot of the Networking page with public network access as Disabled.":::

+1. Select the **Private endpoint connections** tab at the top of the page

+1. Select the **+ Private Endpoint** button at the top of the page.

+az bicep restore --file <bicep-file> [--force]

+> The Bicep parameters file is only supported in [Bicep CLI](./install.md) version 0.18.4 or newer, and [Azure CLI](/azure/install-azure-cli.md) version 2.47.0 or newer.

+> * The key point is that you must prepend **Public** ASN numbers to influence how Azure VMware Solution routes traffic back to on-premises. If you prepend using _Private_ ASN, Azure VMware Solution will ignore the prepend, and the ECMP behavior above will occur. Even if you operate a Private BGP ASN on-premises, it's still possible to configure your on-premises devices to utilize a Public ASN when prepending routes outbound, to ensure compatibility with Azure VMware Solution.

+> * Use either 2-byte or 4-byte public ASN numbers.

+> If connecting more than four Azure VMware Solution private clouds in the same Azure region to the same Azure virtual network is a requirement, use [AVS Interconnect](connect-multiple-private-clouds-same-region.md) to aggregate private cloud connectivity within the Azure region.

+> Customers should not advertise bogon routes over ExpressRoute from on-premises or their Azure VNet. Examples of bogon routes include 0.0.0.0/5 or 192.0.0.0/3.

+The diagram below describes the architectural components of the Azure VMware Solution.

+Each Azure VMware Solution architectural component has the following function:

+- Azure Subscription: Used to provide controlled access, budget, and quota management for the Azure VMware Solution.

+- Azure Region: Physical locations around the world where we group data centers into Availability Zones (AZs) and then group AZs into regions.

+- Azure Resource Group: Container used to place Azure services and resources into logical groups.

+- Azure VMware Solution Private Cloud: Uses VMware software, including vCenter Server, NSX-T Data Center software-defined networking, vSAN software-defined storage, and Azure bare-metal ESXi hosts to provide compute, networking, and storage resources.

+- Azure VMware Solution Resource Cluster: Uses VMware software, including vSAN software-defined storage, and Azure bare-metal ESXi hosts to provide compute, networking, and storage resources for customer workloads by scaling out the Azure VMware Solution private cloud.

+- VMware HCX: Provides mobility, migration, and network extension services.

+- VMware Site Recovery: Provides Disaster Recovery automation and storage replication services with VMware vSphere Replication. Third party Disaster Recovery solutions Zerto Disaster Recovery and JetStream Software Disaster Recovery are also supported.

+- Dedicated Microsoft Enterprise Edge (D-MSEE): Router that provides connectivity between Azure cloud and the Azure VMware Solution private cloud instance.

+- Azure Virtual Network (VNet): Private network used to connect Azure services and resources together.

+- Azure Route Server: Enables network appliances to exchange dynamic route information with Azure networks.

+- Azure Virtual Network Gateway: Cross premises gateway for connecting Azure services and resources to other private networks using IPSec VPN, ExpressRoute, and VNet to VNet.

+- Azure ExpressRoute: Provides high-speed private connections between Azure data centers and on-premises or colocation infrastructure.

+- Azure Virtual WAN (vWAN): Aggregates networking, security, and routing functions together into a single unified Wide Area Network (WAN).

+1. In NSX-T Manager, select **Networking** > **DHCP**, and then select **Add DHCP Profile**.

+1. Select **Add DHCP Profile**, enter a name, and select **Save**. NOTE: An IP address is not required if none is entered NSX-T Manager will set one.

+ :::image type="content" source="./media/manage-dhcp/dhcp-server-settings.png" alt-text="Screenshot showing how to add a DHCP Profile in NSX-T Manager." border="true":::

+1. Under **Networking** > **Tier-1 Gateways**, select the gateway where the segments are connected that DHCP is required. Edit the Tier-1 Gateway by clicking on the three ellipses and choose **Edit**.

+1. Select **Set DHCP Configuration**, select **DHCP Server** and then select the DHCP Server Profile created earlier. Click **Save**, then **Close Editing**.

+ :::image type="content" source="./media/manage-dhcp/edit-tier-1-gateway.png" alt-text="Screenshot showing how to edit the NSX-T Data Center Tier-1 Gateway for using a DHCP server." border="true":::

+1. Navigate to **Networking** > **Segments** and find the segment where DHCP is required. Click on **Edit** then **Set DHCP Config**.

+1. Select **Gateway DHCP Server** for DHCP Type, add a DHCP range, and click **Apply**.

+ :::image type="content" source="./media/manage-dhcp/add-subnet.png" alt-text="Screenshot showing how to add a subnet to the NSX-T Data Center Tier-1 Gateway for using a DHCP server." border="true":::

+- [JetStream Solution brief](https://www.jetstreamsoft.com/2020/09/28/disaster-recovery-for-avs/)

+- [Jetstream](https://www.jetstreamsoft.com/2020/09/28/disaster-recovery-for-avs/)

+- [RiverMeadow](https://www.rivermeadow.com/disaster-recovery-azure-blob)

+### Backup architecture for database with HANA System Replication (preview)

+- Learn about how to [backup SAP HANA System Replication databases in Azure VMs (preview)](sap-hana-database-with-hana-system-replication-backup.md).

+- Learn about how to [backup SAP HANA databases' snapshot instances in Azure VMs (preview)](sap-hana-database-instances-backup.md).

+# Quickstart: Back up SAP HANA System Replication on Azure VMs using Azure CLI (preview)

+# Quickstart: Restore SAP HANA System Replication on Azure VMs using Azure CLI (preview)

+## Back up a HANA system with replication enabled (preview)

+- [Back up SAP HANA System Replication databases on Azure VMs (preview)](sap-hana-database-with-hana-system-replication-backup.md).

+- [Back up SAP HANA database snapshot instances on Azure VMs (preview)](sap-hana-database-instances-backup.md).

+Azure Backup now supports backup and restore of SAP HANA System Replication (HSR) instance (preview).

+# Back up SAP HANA System Replication databases on Azure VMs (preview)

+- [Restore SAP HANA System Replication databases on Azure VMs (preview)](sap-hana-database-restore.md)

+- [About backing up SAP HANA System Replication databases on Azure VMs (preview)](sap-hana-database-about.md#back-up-a-hana-system-with-replication-enabled-preview)

+This tutorial describes how to back up SAP HANA database instance and SAP HANA System Replication (HSR) instance (preview) using Azure CLI.

+# [HSR (preview)](#tab/hsr)

+To create the Recovery Services vault for HSR instance protection, run the following command:

+# [HSR (preview)](#tab/hsr)

+# [HSR (preview)](#tab/hsr)

+# [HSR (preview)](#tab/hsr)

+This tutorial describes how to restore SAP HANA database instance and SAP HANA System Replication (HSR) instance (preview) using Azure CLI.

+# [HSR (preview)](#tab/hsr)

+# [HSR (preview)](#tab/hsr)

+For more information, see [Back up a HANA system with replication enabled (preview)](sap-hana-database-about.md#back-up-a-hana-system-with-replication-enabled-preview).

+* The VNet in which the Bastion resource is deployed or a directly peered VNet contains the VM resource to which you want to create a shareable link.

+| Rel 23-06 OOB | [5028623] | Latest Cumulative Update(LCU) | 5.82 | Jun 23, 2023 |

+| Rel 23-06 OOB | [5028591] | .NET Framework Rollup 4.6 ΓÇô 4.7.2/ .NET standalone update | 2.138 | Jun 22, 2023 |

+| Rel 23-06 OOB | [5028590] | .NET Framework Rollup 4.6 ΓÇô 4.7.2/ .NET standalone update | 4.118 | Jun 22, 2023 |

+| Rel 23-06 OOB | [5028589] | .NET Framework Rollup 4.6 ΓÇô 4.7.2/ .NET standalone update | 3.126 | Jun 22, 2023 |

+| Rel 23-06 | [5027123] | .NET Framework 4.8 Security and Quality Rollup  | 5.82 | Jun 13, 2023 |

+| Rel 23-06 OOB | [5028580] | .NET Framework Rollup 4.8 /.NET Standalone Update  | 5.82 | Jun 22, 2023 |

+| Rel 23-06 OOB | [5028588] | .NET Framework Rollup - 4.6-4.7.2 / .NET Standalone Update | 6.58 | Jun 22, 2023 |

+| Rel 23-06 OOB | [5028584] | .NET Framework Rollup - 4.8 / .NET Standalone Update | 7.26 | Jun 22, 2023 |

+| Rel 23-06 | [5027396] | Servicing Stack Update | 7.26 | |

+| Rel 23-06 | [5023789] | Servicing Stack Update | 6.58 | |

+[5028623]: https://support.microsoft.com/kb/5028623

+[5028591]: https://support.microsoft.com/kb/5028591

+[5028590]: https://support.microsoft.com/kb/5028590

+[5028589]: https://support.microsoft.com/kb/5028589

+[5027123]: https://support.microsoft.com/kb/5027123

+[5028580]: https://support.microsoft.com/kb/5028580

+[5028588]: https://support.microsoft.com/kb/5028588

+[5028584]: https://support.microsoft.com/kb/5028584

+1. Each training generates 100 sample audio files automatically, to help you test the model with a default script. Optionally, you can also check the box next to **Add my own test script** and provide your own test script with up to 100 utterances to test the model at no additional cost. The generated audio files are a combination of the automatic test scripts and custom test scripts. For more information, see [test script requirements](#test-script-requirements).

+1. Each training generates 100 sample audio files automatically, to help you test the model with a default script. Optionally, you can also check the box next to **Add my own test script** and provide your own test script with up to 100 utterances to test the model at no additional cost. The generated audio files are a combination of the automatic test scripts and custom test scripts. For more information, see [test script requirements](#test-script-requirements).

+1. Each training generates 100 sample audios for the default style and 20 for each preset style automatically, to help you test the model with a default script. Optionally, you can also check the box next to **Add my own test script** and provide your own test script with up to 100 utterances to test the default style at no additional cost. The generated audio files are a combination of the automatic test scripts and custom test scripts. For more information, see [test script requirements](#test-script-requirements).

+For example, to obtain the complete spoken sound for the word "Hello", you can concatenate the first spoken phoneme for each expected phoneme with the highest confidence score. In the following assessment result, when you speak the word "hello", the expected IPA phonemes are "h ɛ l oʊ". However, the actual spoken phonemes are "h ə l oʊ". You have five possible candidates for each expected phoneme in this example. The assessment result shows that the most likely spoken phoneme was `"ə"` instead of the expected phoneme `"ɛ"`. The expected phoneme `"ɛ"` only received a confidence score of 47. Other potential matches received confidence scores of 52, 17, and 2.

+ "Id": "bbb42ea51bdb46d19a1d685e635fe173",

+ "RecognitionStatus": 0,

+ "Offset": 7500000,

+ "Duration": 13800000,

+ "DisplayText": "Hello.",

+ "NBest": [

+ {

+ "Confidence": 0.975003,

+ "Lexical": "hello",

+ "ITN": "hello",

+ "MaskedITN": "hello",

+ "Display": "Hello.",

+ "PronunciationAssessment": {

+ "AccuracyScore": 100,

+ "FluencyScore": 100,

+ "CompletenessScore": 100,

+ "PronScore": 100

+ },

+ "Words": [

+ {

+ "Word": "hello",

+ "Offset": 7500000,

+ "Duration": 13800000,

+ "PronunciationAssessment": {

+ "AccuracyScore": 99.0,

+ "ErrorType": "None"

+ },

+ "Syllables": [

+ {

+ "Syllable": "hɛ",

+ "PronunciationAssessment": {

+ "AccuracyScore": 91.0

+ },

+ "Offset": 7500000,

+ "Duration": 4100000

+ },

+ {

+ "Syllable": "loʊ",

+ "PronunciationAssessment": {

+ "AccuracyScore": 100.0

+ },

+ "Offset": 11700000,

+ "Duration": 9600000

+ }

+ ],

+ "Phonemes": [

+ {

+ "Phoneme": "h",

+ "PronunciationAssessment": {

+ "AccuracyScore": 98.0,

+ "NBestPhonemes": [

+ {

+ "Phoneme": "h",

+ "Score": 100.0

+ },

+ {

+ "Phoneme": "oʊ",

+ "Score": 52.0

+ },

+ {

+ "Phoneme": "ə",

+ "Score": 35.0

+ },

+ {

+ "Phoneme": "k",

+ "Score": 23.0

+ },

+ {

+ "Phoneme": "æ",

+ "Score": 20.0

+ }

+ ]

+ },

+ "Offset": 7500000,

+ "Duration": 3500000

+ },

+ {

+ "Phoneme": "ɛ",

+ "PronunciationAssessment": {

+ "AccuracyScore": 47.0,

+ "NBestPhonemes": [

+ {

+ "Phoneme": "ə",

+ "Score": 100.0

+ },

+ {

+ "Phoneme": "l",

+ "Score": 52.0

+ },

+ {

+ "Phoneme": "ɛ",

+ "Score": 47.0

+ },

+ {

+ "Phoneme": "h",

+ "Score": 17.0

+ },

+ {

+ "Phoneme": "æ",

+ "Score": 2.0

+ }

+ ]

+ },

+ "Offset": 11100000,

+ "Duration": 500000

+ },

+ {

+ "Phoneme": "l",

+ "PronunciationAssessment": {

+ "AccuracyScore": 100.0,

+ "NBestPhonemes": [

+ {

+ "Phoneme": "l",

+ "Score": 100.0

+ },

+ {

+ "Phoneme": "oʊ",

+ "Score": 46.0

+ },

+ {

+ "Phoneme": "ə",

+ "Score": 5.0

+ },

+ {

+ "Phoneme": "ɛ",

+ "Score": 3.0

+ },

+ {

+ "Phoneme": "u",

+ "Score": 1.0

+ }

+ ]

+ },

+ "Offset": 11700000,

+ "Duration": 1100000

+ },

+ {

+ "Phoneme": "oʊ",

+ "PronunciationAssessment": {

+ "AccuracyScore": 100.0,

+ "NBestPhonemes": [

+ {

+ "Phoneme": "oʊ",

+ "Score": 100.0

+ },

+ {

+ "Phoneme": "d",

+ "Score": 29.0

+ },

+ {

+ "Phoneme": "t",

+ "Score": 24.0

+ },

+ {

+ "Phoneme": "n",

+ "Score": 22.0

+ },

+ {

+ "Phoneme": "l",

+ "Score": 18.0

+ }

+ ]

+ },

+ "Offset": 12900000,

+ "Duration": 8400000

+ }

+ ]

+ }

+ ]

+ }

+ ]

+}

+* The Docker `pull` command to download the container.

+Now that you've downloaded your container, you need to execute the `docker run` command with the following parameters:

+* **`DownloadLicense=True`**. This parameter downloads a license file that enables your Docker container to run when it isn't connected to the internet. It also contains an expiration date, after which the license file is invalid to run the container. You can only use the license file in corresponding approved container.

+| `{LICENSE_MOUNT}` | The path where the license is downloaded, and mounted. | `/host/license:/path/to/license/directory` |

+ | `{MODEL_MOUNT_PATH}`| The path where the machine translation models are downloaded, and mounted. Your directory structure must be formatted as **/usr/local/models** | `/host/translator/models:/usr/local/models`|

+| `{API_KEY}` | The key for your Text Translation resource. You can find it on your resource's **Key and endpoint** page, in the Azure portal. |`{string}`|

+| `{LICENSE_MOUNT}` | The path where the license is located and mounted. | `/host/translator/license:/path/to/license/directory` |

+|`{MODEL_MOUNT_PATH}`| The path where the machine translation models are downloaded, and mounted. Your directory structure must be formatted as **/usr/local/models** | `/host/translator/models:/usr/local/models`|

+When run in a disconnected environment, an output mount must be available to the container to store usage logs. For example, you would include `-v /host/output:{OUTPUT_PATH}` and `Mounts:Output={OUTPUT_PATH}` in the following example, replacing `{OUTPUT_PATH}` with the path where the logs are stored:

+The following endpoint provides a report summarizing all of the usage collected in the mounted billing record directory.

+The usage-logs endpoint returns a JSON response similar to the following example:

+The following endpoint provides a report summarizing usage over a specific month and year:

+This usage-logs endpoint returns a JSON response similar to the following example:

+Commitment plans for disconnected containers have a calendar year commitment period. When you purchase a plan, you're charged the full price immediately. During the commitment period, you can't change your commitment plan, however you can purchase more unit(s) at a pro-rated price for the remaining days in the year. You have until midnight (UTC) on the last day of your commitment, to end a commitment plan.

+ If you decide that you don't want to continue purchasing a commitment plan, you can set your resource's autorenewal to **Do not auto-renew**. Your commitment plan expires on the displayed commitment end date. After this date, you won't be charged for the commitment plan. You're still able to continue using the Azure resource to make API calls, charged at pay-as-you-go pricing. You have until midnight (UTC) on the last day of the year to end a commitment plan for disconnected containers. If you do so, you avoid charges for the following year.

+Run the container with an output mount and logging enabled. These settings enable the container to generate log files that are helpful for troubleshooting issues that occur while starting or running the container.

+2. Enter the applicable information to create your resource. Be sure to select the standard pricing tier.

+ > [!NOTE]

+ > If you intend to purchase a commitment tier for disconnected container usage, you will need to request separate access and select the **Commitment tier disconnected containers** pricing tier. See the [disconnected containers](./containers/disconnected-containers.md) article for more information

+

+3. Once your resource is created, you'll be able to change your pricing from pay-as-you-go, to a commitment plan.

+ * **Commitment tier** - The commitment tier for the feature. The commitment tier is enabled immediately when you select **Purchase** and you will be charged the commitment amount on a pro-rated basis.

+ * **Auto-renewal** - Choose how you want to renew, change, or cancel the current commitment plan starting with the next billing cycle. If you decide to auto-renew, the **Auto-renewal date** is the date (in your local timezone) when you'll be charged for the next billing cycle. This date coincides with the start of the calendar month.

+If you use the resource above the quota provided, you'll be charged for the additional usage as per the overage amount mentioned in the commitment tier.

+The commitment plans have a calendar month commitment period. You can purchase a commitment plan at any time from the default pay-as-you-go pricing model. When you purchase a plan, you'll be charged a pro-rated price for the remaining month. During the commitment period, you can't change the commitment plan for the current month. However, you can choose a different commitment plan for the next calendar month. The billing for the next month would happen on the first day of the next month.

+If you decide that you don't want to continue purchasing a commitment plan, you can set your resource's auto-renewal to **Do not auto-renew**. Your commitment plan will expire on the displayed commitment end date. After this date, you won't be charged for the commitment plan. You'll be able to continue using the Azure resource to make API calls, charged at pay-as-you-go pricing. You have until midnight (UTC) on the last day of each month to end a commitment plan, and not be charged for the following month.

+* [Prediction API](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation)

+Once you are satisfied with how your model performs, it's ready to be deployed, and query it for predictions from utterances. Deploying a model makes it available for use through the [prediction API](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation).

+After you have reviewed the model's performance and decide it's fit to be used in your environment, you need to assign it to a deployment to be able to query it. Assigning the model to a deployment makes it available for use through the [prediction API](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation). It is recommended to create a deployment named `production` to which you assign the best model you have built so far and use it in your system. You can create another deployment called `staging` to which you can assign the model you're currently working on to be able to test it. You can have a maximum on 10 deployments in your project.

+* [Prediction API](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation)

+6. **Deploy the model**: Deploying a model makes it available for use via the [prediction API](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation).

+|REST APIs (Runtime) | [REST API documentation](/rest/api/language/2023-04-01/conversation-analysis-runtime/analyze-conversation) | |

+ Title: Chat metrics definitions for Azure Communication Service

+description: This document covers definitions of chat metrics available in the Azure portal.

+# Chat metrics overview

+Azure Communication Services currently provides metrics for all ACS primitives. [Azure Metrics Explorer](../../../azure-monitor\essentials\metrics-getting-started.md) can be used to plot your own charts, investigate abnormalities in your metric values, and understand your API traffic by using the metrics data that Chat requests emit.

+## Where to find metrics

+Primitives in Azure Communication Services emit metrics for API requests. These metrics can be found in the Metrics tab under your Communication Services resource. You can also create permanent dashboards using the workbooks tab under your Communication Services resource.

+## Metric definitions

+All API request metrics contain three dimensions that you can use to filter your metrics data. These dimensions can be aggregated together using the `Count` aggregation type and support all standard Azure Aggregation time series including `Sum`, `Average`, `Min`, and `Max`.

+More information on supported aggregation types and time series aggregations can be found [Advanced features of Azure Metrics Explorer](../../../azure-monitor/essentials/metrics-charts.md#aggregation).

+- **Operation** - All operations or routes that can be called on the Azure Communication Services Chat gateway.

+- **Status Code** - The status code response sent after the request.

+- **StatusSubClass** - The status code series sent after the response.

+### Chat API request metric operations

+The following operations are available on Chat API request metrics:

+| Operation / Route | Description |

+| -- | - |

+| GetChatMessage | Gets a message by message ID. |

+| ListChatMessages | Gets a list of chat messages from a thread. |

+| SendChatMessage | Sends a chat message to a thread. |

+| UpdateChatMessage | Updates a chat message. |

+| DeleteChatMessage | Deletes a chat message. |

+| GetChatThread | Gets a chat thread. |

+| ListChatThreads | Gets the list of chat threads of a user. |

+| UpdateChatThread | Updates a chat thread's properties. |

+| CreateChatThread | Creates a chat thread. |

+| DeleteChatThread | Deletes a thread. |

+| GetReadReceipts | Gets read receipts for a thread. |

+| SendReadReceipt | Sends a read receipt event to a thread, on behalf of a user. |

+| SendTypingIndicator | Posts a typing event to a thread, on behalf of a user. |

+| ListChatThreadParticipants | Gets the members of a thread. |

+| AddChatThreadParticipants | Adds thread members to a thread. If members already exist, no change occurs. |

+| RemoveChatThreadParticipant | Remove a member from a thread. |

+If a request is made to an operation that isn't recognized, you receive a "Bad Route" value response.

+## Next steps

+- Learn more about [Data Platform Metrics](../../../azure-monitor/essentials/data-platform-metrics.md).

+ Title: Call automation metrics definitions for Azure Communication Service

+description: This document covers definitions of call automation metrics available in the Azure portal.

+# Call automation metrics overview

+Azure Communication Services currently provides metrics for all ACS primitives. [Azure Metrics Explorer](../../../../azure-monitor\essentials\metrics-getting-started.md) can be used to plot your own charts, investigate abnormalities in your metric values, and understand your API traffic by using the metrics data that call automation requests emit.

+## Where to find metrics

+Primitives in Azure Communication Services emit metrics for API requests. These metrics can be found in the Metrics tab under your Communication Services resource. You can also create permanent dashboards using the workbooks tab under your Communication Services resource.

+## Metric definitions

+All API request metrics contain three dimensions that you can use to filter your metrics data. These dimensions can be aggregated together using the `Count` aggregation type and support all standard Azure Aggregation time series including `Sum`, `Average`, `Min`, and `Max`.

+More information on supported aggregation types and time series aggregations can be found [Advanced features of Azure Metrics Explorer](../../../../azure-monitor/essentials/metrics-charts.md#aggregation).

+- **Operation** - All operations or routes that can be called on the Azure Communication Services Chat gateway.

+- **Status Code** - The status code response sent after the request.

+- **StatusSubClass** - The status code series sent after the response.

+### Call Automation API requests

+The following operations are available on Call Automation API request metrics:

+| Operation / Route | Description |

+| -- | - |

+| Create Call | Create an outbound call to user.

+| Answer Call | Answer an inbound call. |

+| Redirect Call | Redirect an inbound call to another user. |

+| Reject Call | Reject an inbound call. |

+| Transfer Call To Participant | Transfer 1:1 call to another user. |

+| Play | Play audio to call participants. |

+| PlayPrompt | Play a prompt to users as part of the Recognize action. |

+| Recognize | Recognize user input from call participants. |

+| Add Participants | Add a participant to a call. |

+| Remove Participants | Remove a participant from a call. |

+| HangUp Call | Hang up your call leg. |

+| Terminate Call | End the call for all participants. |

+| Get Call | Get details about a call. |

+| Get Participant | Get details on a call participant. |

+| Get Participants | Get all participants in a call. |

+| Delete Call | Delete a call. |

+| Cancel All Media Operations | Cancel all ongoing or queued media operations in a call. |

+## Next steps

+- Learn more about [Data Platform Metrics](../../../../azure-monitor/essentials/data-platform-metrics.md).

+ Title: "Monitor Azure Communication Services direct routing"

+audience: ITPro

+description: Learn how to monitor Azure Communication Services direct routing configuration, including Session Border Controllers, cloud components, and Telecom trunks.

+# Monitor direct routing

+This article describes how to monitor your direct routing configuration.

+The ability to make and receive calls by using direct routing involves the following components:

+- Session Border Controllers (SBCs)

+- Direct routing components in the Microsoft Cloud

+- Telecom trunks

+If you have difficulties troubleshooting issues, you can open a support case with your SBC vendor or Microsoft.

+Microsoft is working on providing more tools for troubleshooting and monitoring. Check the documentation periodically for updates.

+## Monitoring availability of Session Border Controllers using Session Initiation Protocol (SIP) OPTIONS messages

+Azure Communication Services direct routing uses SIP OPTIONS sent by the Session Border Controller to monitor SBC health. There are no actions required from the Azure administrator to enable the SIP OPTIONS monitoring.

+## Monitor with Azure portal and SBC logs

+In some cases, especially during the initial pairing, there might be issues related to misconfiguration of the SBCs or the direct routing service.

+You can use the following tools to monitor your configuration:

+- Azure portal

+- SBC logs

+In the direct routing section of Azure portal, you can check [SBC connection status](../direct-routing-provisioning.md#session-border-controller-connection-status).

+If calls can be made, you can also check [Azure monitors logs](../../analytics/logs/voice-and-video-logs.md) that provide descriptive SIP error codes

+SBC logs also is a great source of data for troubleshooting. Reach out to your SBC vendor's documentation on how to configure and collect those logs.

+## Next steps

+[Troubleshoot direct routing connectivity](./troubleshoot-tls-certificate-sip-options.md)

+[Troubleshoot outbound calling](./troubleshoot-outbound-calls.md)

+ Title: Troubleshoot Azure Communication Services direct routing outbound calls issues

+description: Learn how to troubleshoot Azure Communication Services direct routing potential issues that affect outbound calls.

+audience: ITPro

+# Issues that affect outbound direct routing calls

+You might experience various issues when you use direct routing to make outbound calls from an app built on Azure Communication Services (ACS) Software Development Kit (SDK) to a Session Border Controller (SBC). These issues include:

+- An incorrect or anonymous caller ID is displayed to the call recipient.

+- A connection to the SBC isn't established.

+- Some users are unable to make calls.

+- No users in a tenant are able to make calls.

+This article discusses potential causes of these issues, and provides resolutions that you can try.

+## Incorrect caller ID displayed to the recipient

+When you use direct routing, the caller ID information that is delivered to the call recipient is listed in the `From` and `P-Asserted-Identity` headers in the Session Initiation Protocol (SIP) options message.

+The `From` header contains any of the following items:

+- The phone number that's used as an `alternateCallerId` property of a `startCall` method in [Client Calling SDK](../../../quickstarts/telephony/pstn-call.md).

+ If an `alternateCallerId` wasn't provided, it's replaced with "anonymous".

+- The phone number string that's passed when creating a `PhoneNumberIdentifier` object in [Call Automation SDK](../../../how-tos/call-automation/actions-for-call-control.md#make-an-outbound-call)

+- The phone number of the original caller if an Call Automation SDK [redirects the call](../../../how-tos/call-automation/actions-for-call-control.md#redirect-a-call).

+- The phone number selected as a Caller ID in Omnichannel Agent client application.

+The `P-Asserted-Identity` header contains the phone number of the user who is billed for the call. The `Privacy:id` indicates that the information in the header has to be hidden from the call recipient.

+### Cause

+If the information in the `From` and `P-Asserted-Identity` headers doesn't match, and if the Public Switched Telephone Network (PSTN) prioritizes the `P-Asserted-Identity` header information over the `From` header information, then incorrect information is displayed.

+### Resolution

+To make sure that the correct caller ID is displayed to the call recipient, configure the SBC to either remove the `P-Asserted-Identity` header from the SIP INVITE message or modify its contents.

+## Connection to the SBC not established

+Sometimes, calls reach the SBC but no connection is established. In this situation, when the SBC receives a SIP OPTIONS message from Microsoft, it returns a failure message that includes error codes in the range of 400 to 699.

+Any of the following causes might prevent a connection to the SBC.

+### Cause 1

+The SIP failure message is coming from another telephony device that is on the same network as the SBC.

+### Resolution 1

+Troubleshoot the other device to fix the error. If you need assistance, contact the device vendor.

+### Cause 2

+Your PSTN provider is experiencing some issue and is sending the SIP failure message. This is most likely the case if the failure error code is SIP 403 or SIP 404.

+### Resolution 2

+Contact your PSTN provider for support to fix the issue.

+### Cause 3

+The issue isn't coming from another device on the network or by your PSTN provider. However, the cause is otherwise unknown.

+### Resolution 3

+Contact the SBC vendor support to fix the issue.

+## Some users are unable to make calls

+If the connection between the Microsoft and the SBC is working correctly, but some users or applications can't make calls, the issue might be an incorrect scope of an Azure Communication Services access token

+### Cause 1

+Azure Communication Services access token was created with a chat scope.

+### Resolution 1

+Make sure that all the Azure Communication Services access tokens that are used for making calls are generated [with a `voip` scope](../../identity-model.md#access-tokens).

+### Cause 2

+None of the patterns in the Voice Routes match the dialed number.

+### Resolution 2

+Make sure that the following conditions are true:

+- There's a pattern in the Voice Route that matches the dialed number.

+- The SBC that's specified for the Voice Route is **Online**. If it's **Inactive**, either set it up to become **Online** or select a different SBC that is **Online**

+### Cause 3

+The SBC isn't responding to SIP OPTIONS messages because some device on the network, such as a firewall, is blocking the messages.

+### Resolution 3

+Make sure that the SIP Signaling IPs and FQDNs are allowed on all network devices that connect the SBC to the internet. The IP addresses that must be allowed are listed at [SIP Signaling: FQDNs](../direct-routing-infrastructure.md#sip-signaling-fqdns).

+## Related articles

+- [Troubleshoot direct routing connectivity](./troubleshoot-tls-certificate-sip-options.md)

+- [Plan for Azure direct routing](../direct-routing-infrastructure.md)

+- [Pair the Session Border Controller and configure voice routing](../direct-routing-provisioning.md)

+- [Outbound call to a phone number](../../../quickstarts/telephony/pstn-call.md)

+ Title: "Troubleshoot Azure Communication Services direct routing TLS certificate and SIP OPTIONS issues"

+audience: ITPro

+description: Learn how to troubleshoot Azure Communication Services direct routing connectivity with Session Border Controllers - TLS certificate and SIP OPTIONS issues.

+# Session Border Controller (SBC) connectivity issues

+When you set up a direct routing, you might experience the following Session Border Controller (SBC) connectivity issues:

+- Session Initiation Protocol (SIP) OPTIONS aren't received.

+- Transport Layer Security (TLS) connections problems occur.

+- The SBC doesn't respond.

+- The SBC is marked as inactive in the Azure portal.

+The following conditions are most likely to cause such issues:

+- A TLS certificate experiences problems.

+- An SBC isn't configured correctly for direct routing.

+This article lists some common issues that are related to SIP OPTIONS and TLS certificates, and provides resolutions that you can try.

+## Overview of the SIP OPTIONS process

+- The SBC sends a TLS connection request that includes a TLS certificate to the SIP proxy server Fully Qualified Domain Name (FQDN) (for example, **sip.pstnhub.microsoft.com**).

+- The SIP proxy checks the connection request.

+ - If the request isn't valid, the TLS connection is closed and the SIP proxy doesn't receive SIP OPTIONS from the SBC.

+ - If the request is valid, the TLS connection is established, and the SBC sends SIP OPTIONS to the SIP proxy.

+- After SIP proxy receives SIP OPTIONS, it checks the Record-Route to determine whether the SBC FQDN belongs to a known Communication resource. If the FQDN information isn't detected there, the SIP proxy checks the Contact header.

+- If the SBC FQDN is detected and recognized, the SIP proxy sends a **200 OK** message by using the same TLS connection.

+- The SIP proxy sends SIP OPTIONS to the SBC FQDN that is listed in the Contact header of the SIP options received from the SBC.

+- After receiving SIP OPTIONS from the SIP proxy, the SBC responds by sending a **200 OK** message. This step confirms that the SBC is healthy.

+- As the final step, the SBC is marked as **Online** in the Azure portal.

+## SIP OPTIONS issues

+After the TLS connection is successfully established, and the SBC is able to send and receive messages to and from the SIP proxy, there might still be problems that affect the format or content of SIP OPTIONS.

+### SBC doesn't receive a "200 OK" response from SIP proxy

+This situation might occur if youΓÇÖre using an older version of TLS. To enforce stricter security, enable TLS 1.2.

+Make sure that your SBC certificate isn't self-signed and that you got it from a [trusted Certificate Authority (CA)](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+If youΓÇÖre using TLS version 1.2 or higher, and your SBC certificate is valid, then the issue might occur because the FQDN is misconfigured in your SIP profile and not recognized as belonging to any Communication resource. Check for the following conditions, and fix any errors that you find:

+- The FQDN provided by the SBC in the Record-Route or Contact header is different from what is configured in Azure Communication resource.

+- The Contact header contains an IP address instead of the FQDN.

+- The domain isnΓÇÖt [fully validated](../../../how-tos/telephony/domain-validation.md). If you add an FQDN that wasnΓÇÖt validated previously, you must validate it.

+### SBC receives "200 OK" response but not SIP OPTIONS

+The SBC receives the **200 OK** response from the SIP proxy but not the SIP OPTIONS that were sent from the SIP proxy. If this error occurs, make sure that the FQDN that's listed in the Record-Route or Contact header is correct and resolves to the correct IP address.

+Another possible cause for this issue might be firewall rules that are preventing incoming traffic. Make sure that firewall rules are configured to allow incoming connections from all [SIP proxy signaling IP addresses](../direct-routing-infrastructure.md#sip-signaling-fqdns).

+### SBC status is intermittently inactive

+This issue might occur if:

+

+- The SBC is configured to send SIP OPTIONS not to FQDNs but to the specific IP addresses that they resolve to. During maintenance or outages, these IP addresses might change to a different datacenter. Therefore, the SBC is sending SIP OPTIONS to an inactive or unresponsive datacenter. To resolve the issue:

+ - Make sure that the SBC is discoverable and configured to send SIP OPTIONS to only FQDNs.

+ - Make sure that all devices in the route, such as SBCs and firewalls, are configured to allow communication to and from all Microsoft SIP signaling FQDNs.

+ - To provide a failover option when the connection from an SBC is made to a datacenter that's experiencing an issue, the SBC must be configured to use all three SIP proxy FQDNs:

+ - sip.pstnhub.microsoft.com

+ - sip2.pstnhub.microsoft.com

+ - sip3.pstnhub.microsoft.com

+ > [!NOTE]

+ > Devices that support DNS names can use sip-all.pstnhub.microsoft.com to resolve to all possible IP addresses.

+ For more information, see [SIP Signaling: FQDNs](../direct-routing-infrastructure.md#sip-signaling-fqdns).

+- The installed root or intermediate certificate isn't part of the SBC certificate chain issuer. When the SBC starts the three-way handshake during the authentication process, the Azure service is unable to validate the certificate chain on the SBC and resets the connection. The SBC may be able to authenticate again as soon as the public root certificate is loaded again on the service cache or the certificate chain is fixed on the SBC. Make sure that the intermediate and root certificates installed on the SBC are correct.

+

+ For more information about certificates, see [SBC certificates and domain names](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+

+### FQDN doesnΓÇÖt match the contents of CN or SAN in the provided certificate

+This issue occurs if a wildcard doesn't match a lower-level subdomain. For example, the wildcard `\*\.contoso.com` would match `sbc1.contoso.com`, but not `sbc.acs.contoso.com`. You can't have multiple levels of subdomains under a wildcard. If the FQDN doesnΓÇÖt match the Common Name (CN) or Subject Alternate Name (SAN) in the provided certificate, request a new certificate that matches your domain names.

+For more information about certificates, see [SBC certificates and domain names](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+## TLS connection issues

+If the TLS connection is closed right away and SIP OPTIONS aren't received from the SBC, or if **200 OK** isn't received from the SBC, then the problem might be with the TLS version. The TLS version configured on the SBC should be 1.2 or higher.

+### SBC certificate is self-signed or not from a trusted CA

+If the SBC certificate is self-signed, it isn't valid. Make sure that the SBC certificate is obtained from a trusted Certificate Authority (CA).

+For a list of supported CAs, see [SBC certificates and domain names](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+### SBC doesn't trust SIP proxy certificate

+If the SBC doesn't trust the SIP proxy certificate, download and install the Baltimore CyberTrust root certificate **and** he DigiCert Global Root G2 certificates on the SBC. To download those certificates, see [Microsoft 365 encryption chains](/microsoft-365/compliance/encryption-office-365-certificate-chains).

+For a list of supported CAs, see [SBC certificates and domain names](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+### SBC certificate is invalid

+If the SBC connection status in the Azure portal indicates that the SBC certificate is expired, request or renew the certificate from a trusted Certificate Authority (CA). Then, install it on the SBC. For a list of supported CAs, see [SBC certificates and domain names](../direct-routing-infrastructure.md#sbc-certificates-and-domain-names).

+

+When you renew the SBC certificate, you must remove the TLS connections that were established from the SBC to Microsoft with the old certificate and re-establish them with the new certificate. Doing so ensures that certificate expiration warnings aren't triggered in Azure portal.

+To remove the old TLS connections, restart the SBC during a time frame that has low traffic such as a maintenance window. If you can't restart the SBC, contact the vendor for instructions to force the closure of all old TLS connections.

+### SBC certificate or intermediary certificates are missing in the SBC TLS "Hello" message

+Check that a valid SBC certificate and all required intermediate certificates are installed correctly, and that the TLS connection settings on the SBC are correct.

+Sometimes, even if everything looks correct, a closer examination of the packet capture might reveal that the TLS certificate isn't provided to the Microsoft infrastructure.

+### SBC connection is interrupted

+The TLS connection is interrupted or not set up even though the certificates and SBC settings experience no issues.

+One of the intermediary devices (such as a firewall or a router) on the path between the SBC and the Microsoft network might close the TLS connection. Check for any connection issues within your managed network, and fix them.

+## Related articles

+- [Monitor direct routing](./monitor-direct-routing.md)

+- [Plan for Azure direct routing](../direct-routing-infrastructure.md)

+- [Pair the Session Border Controller and configure voice routing](../direct-routing-provisioning.md)

+- [Outbound call to a phone number](../../../quickstarts/telephony/pstn-call.md)

+To configure sender authentication for your domains, additional DNS records need to be added to your domain. Below, we provide steps where Azure Communication Services will offer records that should be added to your DNS. However, depending on whether the domain you are registering is a root domain or a subdomain, you will need to add the records to the respective zone or make appropriate alterations to the records that we generate.

+As an example, let's consider adding SPF and DKIM records for the custom domain "sales.us.notification.azurecommtest.net." The following are different methods for adding these records to the DNS, depending on the level of the Zone where the records are being added.

+1. Zone: **sales.us.notification.azurecommtest.net**

+ | Record | Type | Name | Value |

+ | | | | |

+ |SPF | TXT | sales.us.notification.azurecommtest.net | v=spf1 include:spf.protection.outlook.com -all |

+ | DKIM | CNAME | selector1-azurecomm-prod-net._domainkey | selector1-azurecomm-prod-net._domainkey.azurecomm.net |

+ | DKIM2 | CNAME | selector2-azurecomm-prod-net._domainkey | selector2-azurecomm-prod-net._domainkey.azurecomm.net |

+The records that get generated in our portal assumes that you will be adding these records in DNS in this Zone **sales.us.notification.azurecommtest.net**.

+2. Zone: **us.notification.azurecommtest.net**

+ | Record | Type | Name | Value |

+ | | | | |

+ |SPF | TXT | sales | v=spf1 include:spf.protection.outlook.com -all |

+ | DKIM | CNAME | selector1-azurecomm-prod-net._domainkey.**sales** | selector1-azurecomm-prod-net._domainkey.azurecomm.net |

+ | DKIM2 | CNAME | selector2-azurecomm-prod-net._domainkey.**sales** | selector2-azurecomm-prod-net._domainkey.azurecomm.net |

+

+3. Zone: **notification.azurecommtest.net**

+ | Record | Type | Name | Value |

+ | | | | |

+ |SPF | TXT | sales.us | v=spf1 include:spf.protection.outlook.com -all |

+ | DKIM | CNAME | selector1-azurecomm-prod-net._domainkey.**sales.us** | selector1-azurecomm-prod-net._domainkey.azurecomm.net |

+ | DKIM2 | CNAME | selector2-azurecomm-prod-net._domainkey.**sales.us** | selector2-azurecomm-prod-net._domainkey.azurecomm.net |

+

+

+4. Zone: **azurecommtest.net**

+ | Record | Type | Name | Value |

+ | | | | |

+ |SPF | TXT | sales.us.notification | v=spf1 include:spf.protection.outlook.com -all |

+ | DKIM | CNAME | selector1-azurecomm-prod-net._domainkey.**sales.us.notification** | selector1-azurecomm-prod-net._domainkey.azurecomm.net |

+ | DKIM2 | CNAME | selector2-azurecomm-prod-net._domainkey.**sales.us.notification** | selector2-azurecomm-prod-net._domainkey.azurecomm.net |

+

+#### Adding SPF and DKIM Records

+ Click **Next** once you've completed this step.

+- Learn more about [how calling works](../../concepts/voice-video-calling/about-call-types.md)

+Use the `npm install` command to install the beta Azure Communication Services UI Library for JavaScript.

+npm install @azure/communication-react@1.5.1-beta.5

+- [Learn about authentication](../concepts/authentication.md)

+This how-to guide shows how to access your SQL database from a workflow in Azure Logic Apps with the SQL Server connector. You can then create automated workflows that run when triggered by events in your SQL database or in other systems and run actions to manage your SQL data and resources.

+ * Consumption workflow

+ * Standard workflow

+* Consumption workflows: [Visual Studio](../logic-apps/quickstart-create-logic-apps-with-visual-studio.md) or [Visual Studio Code](../logic-apps/quickstart-create-logic-apps-visual-studio-code.md)

+* Standard workflows: [Visual Studio Code](../logic-apps/create-single-tenant-workflows-visual-studio-code.md)

+1. In the [Azure portal](https://portal.azure.com), open your Consumption logic app and blank workflow in the designer.

+1. In the designer, under the search box, select **Standard**. Then, [follow these general steps](../logic-apps/create-workflow-with-trigger-or-action.md?tabs=consumption#add-trigger) to add the [SQL Server managed trigger you want](/connectors/sql/#triggers).

+ This example continues with the trigger named **When an item is created**.

+1. If prompted, provide the [information for your connection](#create-connection). When you're done, select **Create**.

+1. After the trigger information box appears, provide the necessary information required by [your selected trigger](/connectors/sql/#triggers).

+ For this example, in the trigger named **When an item is created**, provide the values for the SQL server name and database name, if you didn't previously provide them. Otherwise, from the **Table name** list, select the table that you want to use. Select the **Frequency** and **Interval** to set the schedule for the trigger to check for new items.

+ 

+1. In the [Azure portal](https://portal.azure.com), open your Standard logic app and blank workflow in the designer.

+1. In the designer, [follow these general steps](../logic-apps/create-workflow-with-trigger-or-action.md?tabs=standard#add-trigger) to find and add the SQL Server [built-in trigger](/azure/logic-apps/connectors/built-in/reference/sql/#triggers) or [managed trigger](/connectors/sql/#triggers) you want.

+ For example, you might select the built-in trigger named **When a row is inserted** or the managed trigger named **When a row is created**. This example continues with the built-in trigger named **When a row is inserted**.

+1. If prompted, provide the [information for your connection](#create-connection). When you're done, select **Create**.

+1. After the trigger information box appears, provide the information required by your selected [built-in trigger](/azure/logic-apps/connectors/built-in/reference/sql/#triggers) or [managed trigger](/connectors/sql/#triggers).

+ For this example, in the trigger named **When a row is inserted**, from the **Table name** list, select the table that you want to use.

+ 

+* Consumption workflows: [Visual Studio](../logic-apps/quickstart-create-logic-apps-with-visual-studio.md) or [Visual Studio Code](../logic-apps/quickstart-create-logic-apps-visual-studio-code.md)

+* Standard workflows: [Visual Studio Code](../logic-apps/create-single-tenant-workflows-visual-studio-code.md)

+1. In the [Azure portal](https://portal.azure.com), open your Consumption logic app and workflow in the designer.

+1. In the designer, [follow these general steps](../logic-apps/create-workflow-with-trigger-or-action.md?tabs=consumption#add-action) to add the [SQL Server managed action you want](/connectors/sql/#actions).

+ This example continues with the action named **Get row**, which gets a single record.

+1. If prompted, provide the [information for your connection](#create-connection). When you're done, select **Create**.

+1. After the action information box appears, from the **Table name** list, select the table that you want to use. In the **Row id** property, enter the ID for the record that you want.

+ For this example, the table name is **SalesLT.Customer**.

+ 

+1. In the [Azure portal](https://portal.azure.com), open your Standard logic app and workflow in the designer.

+1. In the designer, [follow these general steps](../logic-apps/create-workflow-with-trigger-or-action.md?tabs=standard#add-action) to find and add the SQL Server [built-in action](/azure/logic-apps/connectors/built-in/reference/sql/#actions) or [managed action](/connectors/sql/#actions) you want.

+ For example, you might select the built-in action named **Execute query** or the managed action named **Get row**, which gets a single record. This example continues with the managed action named **Get row**.

+1. If prompted, provide the [information for your connection](#create-connection). When you're done, select **Create**.

+1. After the action information box appears, provide the values for the SQL server name and database name, if you didn't previously provide them. Otherwise, from the **Table name** list, select the table that you want to use. In the **Row id** property, enter the ID for the record that you want.

+ For this example, the table name is **SalesLT.Customer**.

+ 

+ **Consumption workflows**

+ 

+ **Standard workflows**

+ 

+ **Consumption workflows**

+ 

+ **Standard workflows**

+ 

+ **Consumption workflows**

+ 

+ **Standard workflows**

+ 

+1. In the [Azure portal](https://portal.azure.com), open your logic app and workflow in the designer.

+1. In the designer, under the action where you call the stored procedure, add the built-in action named [**Parse JSON**](../logic-apps/logic-apps-perform-data-operations.md#parse-json-action).

+1. To reference the JSON content properties, select inside the edit boxes where you want to reference those properties so that the dynamic content list appears. In the list, under the [**Parse JSON**](../logic-apps/logic-apps-perform-data-operations.md#parse-json-action) heading, select the data tokens for the JSON content properties that you want.

+ Title: Blue-Green Deployment in Azure Container Apps

+description: Minimize downtime and reduce the risks associated with new releases by using Blue/Green deployment in Azure Container Apps.

+zone_pivot_groups: azure-cli-bicep

+# Blue-Green Deployment in Azure Container Apps

+[Blue-Green Deployment](https://martinfowler.com/bliki/BlueGreenDeployment.html) is a software release strategy that aims to minimize downtime and reduce the risk associated with deploying new versions of an application. In a blue-green deployment, two identical environments, referred to as "blue" and "green," are set up. One environment (blue) is running the current application version and one environment (green) is running the new application version.

+Once green environment is tested, the live traffic is directed to it, and the blue environment is used to deploy a new application version during next deployment cycle.

+You can enable blue-green deployment in Azure Container Apps by combining [container apps revisions](revisions.md), [traffic weights](traffic-splitting.md), and [revision labels](revisions.md#revision-labels).

+You use revisions to create instances of the blue and green versions of the application.

+| Revision | Description |

+|||

+| *Blue* revision | The revision labeled as *blue* is the currently running and stable version of the application. This revision is the one that users interact with, and it's the target of production traffic. |

+| *Green* revision | The revision labeled as *green* is a copy of the *blue* revision except it uses a newer version of the app code and possibly new set of environment variables. It doesn't receive any production traffic initially but is accessible via a labeled fully qualified domain name (FQDN). |

+After you test and verify the new revision, you can then point production traffic to the new revision. If you encounter issues, you can easily roll back to the previous version.

+| Actions | Description |

+|||

+| Testing and verification | The *green* revision is thoroughly tested and verified to ensure that the new version of the application functions as expected. This testing may involve various tasks, including functional tests, performance tests, and compatibility checks. |

+| Traffic switch | Once the *green* revision passes all the necessary tests, a traffic switch is performed so that the *green* revision starts serving production load. This switch is done in a controlled manner, ensuring a smooth transition. |

+| Rollback | If problems occur in the *green* revision, you can revert the traffic switch, routing traffic back to the stable *blue* revision. This rollback ensures minimal impact on users if there are issues in the new version. The *green* revision is still available for the next deployment. |

+| Role change | The roles of the blue and green revisions change after a successful deployment to the *green* revision. During the next release cycle, the *green* revision represents the stable production environment while the new version of the application code is deployed and tested in the *blue* revision.

+This article shows you how to implement blue-green deployment in a container app. To run the following examples, you need a container app environment where you can create a new app.

+> [!NOTE]

+> Refer to [containerapps-blue-green repository](https://github.com/Azure-Samples/containerapps-blue-green) for a complete example of a github workflow that implements blue-green deployment for Container Apps.

+## Create a container app with multiple active revisions enabled

+The container app must have the `configuration.activeRevisionsMode` property set to `multiple` to enable traffic splitting. To get deterministic revision names, you can set the `template.revisionSuffix` configuration setting to a string value that uniquely identifies a release. For example you can use build numbers, or git commits short hashes.

+For the following commands, a set of commit hashes was used.

+```azurecli

+export APP_NAME=<APP_NAME>

+export APP_ENVIRONMENT_NAME=<APP_ENVIRONMENT_NAME>

+export RESOURCE_GROUP=<RESOURCE_GROUP>

+# A commitId that is assumed to correspond to the app code currently in production

+export BLUE_COMMIT_ID=fb699ef

+# A commitId that is assumed to correspond to the new version of the code to be deployed

+export GREEN_COMMIT_ID=c6f1515

+# create a new app with a new revision

+az containerapp create --name $APP_NAME \

+ --environment $APP_ENVIRONMENT_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --image mcr.microsoft.com/k8se/samples/test-app:$BLUE_COMMIT_ID \

+ --revision-suffix $BLUE_COMMIT_ID \

+ --env-vars REVISION_COMMIT_ID=$BLUE_COMMIT_ID \

+ --ingress external \

+ --target-port 80 \

+ --revisions-mode multiple

+# Fix 100% of traffic to the revision

+az containerapp ingress traffic set \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --revision-weight $APP_NAME--$BLUE_COMMIT_ID=100

+# give that revision a label 'blue'

+az containerapp revision label add \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --label blue \

+ --revision $APP_NAME--$BLUE_COMMIT_ID

+```

+Save the following code into a file named `main.bicep`.

+```bicep

+targetScope = 'resourceGroup'

+param location string = resourceGroup().location

+@minLength(1)

+@maxLength(64)

+@description('Name of containerapp')

+param appName string

+@minLength(1)

+@maxLength(64)

+@description('Container environment name')

+param containerAppsEnvironmentName string

+@minLength(1)

+@maxLength(64)

+@description('CommitId for blue revision')

+param blueCommitId string

+@maxLength(64)

+@description('CommitId for green revision')

+param greenCommitId string = ''

+@maxLength(64)

+@description('CommitId for the latest deployed revision')

+param latestCommitId string = ''

+@allowed([

+ 'blue'

+ 'green'

+])

+@description('Name of the label that gets 100% of the traffic')

+param productionLabel string = 'blue'

+var currentCommitId = !empty(latestCommitId) ? latestCommitId : blueCommitId

+resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2022-03-01' existing = {

+ name: containerAppsEnvironmentName

+}

+resource blueGreenDeploymentApp 'Microsoft.App/containerApps@2022-11-01-preview' = {

+ name: appName

+ location: location

+ tags: {

+ blueCommitId: blueCommitId

+ greenCommitId: greenCommitId

+ latestCommitId: currentCommitId

+ productionLabel: productionLabel

+ }

+ properties: {

+ environmentId: containerAppsEnvironment.id

+ configuration: {

+ maxInactiveRevisions: 10 // Remove old inactive revisions

+ activeRevisionsMode: 'multiple' // Multiple active revisions mode is required when using traffic weights

+ ingress: {

+ external: true

+ targetPort: 80

+ traffic: !empty(blueCommitId) && !empty(greenCommitId) ? [

+ {

+ revisionName: '${appName}--${blueCommitId}'

+ label: 'blue'

+ weight: productionLabel == 'blue' ? 100 : 0

+ }

+ {

+ revisionName: '${appName}--${greenCommitId}'

+ label: 'green'

+ weight: productionLabel == 'green' ? 100 : 0

+ }

+ ] : [

+ {

+ revisionName: '${appName}--${blueCommitId}'

+ label: 'blue'

+ weight: 100

+ }

+ ]

+ }

+ }

+ template: {

+ revisionSuffix: currentCommitId

+ containers:[

+ {

+ image: 'mcr.microsoft.com/k8se/samples/test-app:${currentCommitId}'

+ name: appName

+ resources: {

+ cpu: json('0.5')

+ memory: '1.0Gi'

+ }

+ env: [

+ {

+ name: 'REVISION_COMMIT_ID'

+ value: currentCommitId

+ }

+ ]

+ }

+ ]

+ }

+ }

+}

+output fqdn string = blueGreenDeploymentApp.properties.configuration.ingress.fqdn

+output latestRevisionName string = blueGreenDeploymentApp.properties.latestRevisionName

+```

+Deploy the app with the Bicep template using this command:

+```azurecli

+export APP_NAME=<APP_NAME>

+export APP_ENVIRONMENT_NAME=<APP_ENVIRONMENT_NAME>

+export RESOURCE_GROUP=<RESOURCE_GROUP>

+# A commitId that is assumed to belong to the app code currently in production

+export BLUE_COMMIT_ID=fb699ef

+# A commitId that is assumed to belong to the new version of the code to be deployed

+export GREEN_COMMIT_ID=c6f1515

+# create a new app with a blue revision

+az deployment group create \

+ --name createapp-$BLUE_COMMIT_ID \

+ --resource-group $RESOURCE_GROUP \

+ --template-file main.bicep \

+ --parameters appName=$APP_NAME blueCommitId=$BLUE_COMMIT_ID containerAppsEnvironmentName=$APP_ENVIRONMENT_NAME \

+ --query properties.outputs.fqdn

+```

+## Deploy a new revision and assign labels

+The *blue* label currently refers to a revision that takes the production traffic arriving on the app's FQDN. The *green* label refers to a new version of an app that is about to be rolled out into production. A new commit hash identifies the new version of the app code. The following command deploys a new revision for that commit hash and marks it with *green* label.

+```azurecli

+#create a second revision for green commitId

+az containerapp update --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --image mcr.microsoft.com/k8se/samples/test-app:$GREEN_COMMIT_ID \

+ --revision-suffix $GREEN_COMMIT_ID \

+ --set-env-vars REVISION_COMMIT_ID=$GREEN_COMMIT_ID

+#give that revision a 'green' label

+az containerapp revision label add \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --label green \

+ --revision $APP_NAME--$GREEN_COMMIT_ID

+```

+```azurecli

+#deploy a new version of the app to green revision

+az deployment group create \

+ --name deploy-to-green-$GREEN_COMMIT_ID \

+ --resource-group $RESOURCE_GROUP \

+ --template-file main.bicep \

+ --parameters appName=$APP_NAME blueCommitId=$BLUE_COMMIT_ID greenCommitId=$GREEN_COMMIT_ID latestCommitId=$GREEN_COMMIT_ID productionLabel=blue containerAppsEnvironmentName=$APP_ENVIRONMENT_NAME \

+ --query properties.outputs.fqdn

+```

+The following example shows how the traffic section is configured. The revision with the *blue* `commitId` is taking 100% of production traffic while the newly deployed revision with *green* `commitId` doesn't take any production traffic.

+```json

+{

+ "traffic": [

+ {

+ "revisionName": "<APP_NAME>--0b699ef",

+ "weight": 100,

+ "label": "blue"

+ },

+ {

+ "revisionName": "<APP_NAME>--c6f1515",

+ "weight": 0,

+ "label": "green"

+ }

+ ]

+}

+```

+The newly deployed revision can be tested by using the label-specific FQDN:

+```azurecli

+#get the containerapp environment default domain

+export APP_DOMAIN=$(az containerapp env show -g $RESOURCE_GROUP -n $APP_ENVIRONMENT_NAME --query properties.defaultDomain -o tsv | tr -d '\r\n')

+#Test the production FQDN

+curl -s https://$APP_NAME.$APP_DOMAIN/api/env | jq | grep COMMIT

+#Test the blue lable FQDN

+curl -s https://$APP_NAMEblue.$APP_DOMAIN/api/env | jq | grep COMMIT

+#Test the green lable FQDN

+curl -s https://$APP_NAMEgreen.$APP_DOMAIN/api/env | jq | grep COMMIT

+```

+## Send production traffic to the green revision

+After confirming that the app code in the *green* revision works as expected, 100% of production traffic is sent to the revision. The *green* revision now becomes the production revision.

+```azurecli

+# set 100% of traffic to green revision

+az containerapp ingress traffic set \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --label-weight blue=0 green=100

+```azurecli

+# make green the prod revision

+az deployment group create \

+ --name make-green-prod-$GREEN_COMMIT_ID \

+ --resource-group $RESOURCE_GROUP \

+ --template-file main.bicep \

+ --parameters appName=$APP_NAME blueCommitId=$BLUE_COMMIT_ID greenCommitId=$GREEN_COMMIT_ID latestCommitId=$GREEN_COMMIT_ID productionLabel=green containerAppsEnvironmentName=$APP_ENVIRONMENT_NAME \

+ --query properties.outputs.fqdn

+```

+The following example shows how the `traffic` section is configured after this step. The *green* revision with the new application code takes all the user traffic while *blue* revision with the old application version doesn't accept user requests.

+```json

+{

+ "traffic": [

+ {

+ "revisionName": "<APP_NAME>--c6f1515",

+ "weight": 0,

+ "label": "blue"

+ },

+ {

+ "revisionName": "<APP_NAME>--0b699ef",

+ "weight": 100,

+ "label": "green"

+ }

+ ]

+}

+```

+## Roll back the deployment if there were problems

+If after running in production, the new revision is found to have bugs, you can roll back to the previous good state. After the rollback, 100% of the traffic is sent to the old version in the *blue* revision and that revision is designated as the production revision again.

+```azurecli

+# set 100% of traffic to green revision

+az containerapp ingress traffic set \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --label-weight blue=100 green=0

+```

+```azurecli

+# rollback traffic to blue revision

+az deployment group create \

+ --name rollback-to-blue-$GREEN_COMMIT_ID \

+ --resource-group $RESOURCE_GROUP \

+ --template-file main.bicep \

+ --parameters appName=$APP_NAME blueCommitId=$BLUE_COMMIT_ID greenCommitId=$GREEN_COMMIT_ID latestCommitId=$GREEN_COMMIT_ID productionLabel=blue containerAppsEnvironmentName=$APP_ENVIRONMENT_NAME \

+ --query properties.outputs.fqdn

+```

+After the bugs are fixed, the new version of the application is deployed as a *green* revision again. The *green* version eventually becomes the production revision.

+## Next deployment cycle

+Now the *green* label marks the revision currently running the stable production code.

+During the next deployment cycle, the *blue* identifies the revision with the new application version being rolled out to production.

+The following commands demonstrate how to prepare for the next deployment cycle.

+```azurecli

+# set the new commitId

+export BLUE_COMMIT_ID=ad1436b

+# create a third revision for blue commitId

+az containerapp update --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --image mcr.microsoft.com/k8se/samples/test-app:$BLUE_COMMIT_ID \

+ --revision-suffix $BLUE_COMMIT_ID \

+ --set-env-vars REVISION_COMMIT_ID=$BLUE_COMMIT_ID

+# give that revision a 'blue' label

+az containerapp revision label add \

+ --name $APP_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --label blue \

+ --revision $APP_NAME--$BLUE_COMMIT_ID

+```

+```azurecli

+# set the new commitId

+export BLUE_COMMIT_ID=ad1436b

+# deploy new version of the app to blue revision

+az deployment group create \

+ --name deploy-to-blue-$BLUE_COMMIT_ID \

+ --resource-group $RESOURCE_GROUP \

+ --template-file main.bicep \

+ --parameters appName=$APP_NAME blueCommitId=$BLUE_COMMIT_ID greenCommitId=$GREEN_COMMIT_ID latestCommitId=$BLUE_COMMIT_ID productionLabel=green containerAppsEnvironmentName=$APP_ENVIRONMENT_NAME \

+ --query properties.outputs.fqdn

+```

+## Next steps

+> [!div class="nextstepaction"]

+> [Traffic Weights](traffic-splitting.md)

+- Gradually phase in a new revision in blue-green deployments. For more information about blue-green deployment, see [blue-green deployment](blue-green-deployment.md).

+Traffic splitting is useful for testing updates to your container app. You can use traffic splitting to gradually phase in a new revision in [blue-green deployments](blue-green-deployment.md) or in [A/B testing](https://wikipedia.org/wiki/A/B_testing).

+> [Blue-green deployment](blue-green-deployment.md)

+If you need to access Microsoft Container Registry (MCR) from behind a firewall, see the guidance to configure [MCR client firewall rules](https://github.com/microsoft/containerregistry/blob/main/docs/client-firewall-rules.md). MCR is the primary registry for all Microsoft-published docker images, such as Windows Server images.

+[oci-artifact-manifest]: https://github.com/opencontainers/image-spec/blob/main/manifest.md

+> [!NOTE]

+> If you have running applications using the Azure Cosmos DB SDKs, there might be transient timeouts during the configuration update. Make sure your application is designed to be [resilient to transient connectivity failures](./nosql/conceptual-resilient-sdk-applications.md) and have retry logic in place in case it's needed.

+ Title: Cost allocation

+description: This article helps you understand the cost allocation capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Cost allocation

+This article helps you understand the cost allocation capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Cost allocation refers to the process of attributing and assigning costs to specific departments, teams, and projects within an organization.**

+Identify the most critical attributes to report against based on stakeholder needs. Consider the different reporting structures within the organization and how you'll handle change over time. Consider engineering practices that may introduce different types of cost that need to be analyzed independently.

+Establish and maintain a mapping of cloud and on-premises costs to each attribute and apply governance policies to ensure data is appropriately tagged in advance. Define a process for how to handle tagging gaps and misses.

+Cost allocation is the foundational element of cost accountability and enables organizations to gain visibility into the financial impact of their cloud solutions and related activities and initiatives.

+## Getting started

+When you first start managing cost in the cloud, you use the native "allocation" tools to organize subscriptions and resources to align to your primary organizational reporting structure. For anything beyond it, [tags](../../azure-resource-manager/management/tag-resources.md) can augment cloud resources and their usage to add business context, which is critical for any cost allocation strategy.

+Cost allocation is usually an afterthought and requires some level of cleanup when introduced. You need a plan to implement your cost allocation strategy. We recommend outlining that plan first to get alignment and possibly prototyping on a small scale to demonstrate the value.

+- Decide how you want to manage access to the cloud.

+ - At what level in the organization do you want to centrally provision access to the cloud: Departments, teams, projects, or applications? High levels require more governance and low levels require more management.

+ - What [cloud scope](../costs/understand-work-scopes.md) do you want to provision for this level?

+ - Billing scopes are used for to organize costs between and within invoices.

+ - [Management groups](../../governance/management-groups/overview.md) are used to organize costs for resource management. You can optimize management groups for policy assignment or organizational reporting.

+ - Subscriptions provide engineers with the most flexibility to build the solutions they need but can also come with more management and governance requirements due to this freedom.

+ - Resource groups enable engineers to deploy some solutions but may require more support when solutions require multiple resource groups or options to be enabled at the subscription level.

+- How do you want to use management groups?

+ - Organize subscriptions into environment-based management groups to optimize for policy assignment. Management groups allow policy admins to manage policies at the top level but blocks the ability to perform cross-subscription reporting without an external solution, which increases your data analysis and showback efforts.

+ - Organize subscriptions into management groups based on the organizational hierarchy to optimize for organizational reporting. Management groups allow leaders within the organization to view costs more naturally from the portal but requires policy admins to use tag-based policies, which increases policy and governance efforts. Also keep in mind you may have multiple organizational hierarchies and management groups only support one.

+- [Define a comprehensive tagging strategy](/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging) that aligns with your organization's cost allocation objectives.

+ - Consider the specific attributes that are relevant for cost attribution, such as:

+ - How to map costs back to financial constructs, for example, cost center?

+ - Can you map back to every level in the organizational hierarchy, for example, business unit, department, division, and team?

+ - Who is accountable for the service, for example, business owner and engineering owner?

+ - What effort does this map to, for example project and application?

+ - What is the engineering purpose of this resource, for example, environment, component, and purpose?

+ - Clearly communicate tagging guidelines to all stakeholders.

+- Once defined, it's time to implement your cost allocation strategy.

+ - Consider a top-down approach that prioritizes getting departmental costs in place before optimizing at the lowest project and environment level. You may want to implement it in phases, depending on how broad and deep your organization is.

+ - Enable [tag inheritance in Cost Management](../costs/enable-tag-inheritance.md) to copy subscription and resource group tags in cost data only. It doesn't change tags on your resources.

+ - Use Azure Policy to [enforce your tagging strategy](../../azure-resource-manager/management/tag-policies.md), automate the application of tags at scale, and track compliance status. Use compliance as a KPI for your tagging strategy.

+ - If you need to move costs between subscriptions, resource groups, or add or change tags, [configure allocation rules in Cost Management](../costs/allocate-costs.md). Cost allocation is covered in detail at [Managing shared costs](capabilities-shared-cost.md).

+ - Consider [grouping related resources together with the ΓÇ£cm-resource-parentΓÇ¥ tag](../costs/enable-preview-features-cost-management-labs.md#group-related-resources-in-the-cost-analysis-preview) to view costs together in Cost analysis.

+ - Distribute responsibility for any remaining change to scale out and drive efficiencies.

+- Make note of any unallocated costs or costs that should be split but couldn't be. You cover it as part of [Managing shared costs](capabilities-shared-cost.md).

+Once all resources are tagged and/or organized into the appropriate resource groups and subscriptions, you can report against that data as part of [Data analysis and showback](capabilities-analysis-showback.md).

+Keep in mind that tagging takes time to apply, review, and clean up. Expect to go through multiple tagging cycles after everyone has visibility into the cost data. Many people don't realize there's a problem until they have visibility, which is why FinOps is so important.

+## Building on the basics

+At this point, you have a cost allocation strategy with detailed cloud management and tagging requirements. Tagging should be automatically enforced or at least tracked with compliance KPIs. As you move beyond the basics, consider the points:

+- Fill any gaps unmet by native tools.

+ - At a minimum, this gap requires reporting outside the portal, where tagging gaps can be merged with other data.

+ - If tagging gaps need to be resolved directly in the data, you need to implement [Data ingestion and normalization](capabilities-ingestion-normalization.md).

+- Consider other costs that aren't yet covered or might be tracked separately.

+ - Strive to drive consistency across data sources to align tagging implementations. When not feasible, implement cleanup as part of [Data ingestion and normalization](capabilities-ingestion-normalization.md) or reallocate costs as part of your overarching cost allocation strategy.

+- Regularly review and refine your cost allocation strategy.

+ - Consider this process as part of your reporting feedback loop. If your cost allocation strategy is falling short, the feedback you get may not be directly associated with cost allocation or metadata. It may instead be related to reporting. Watch out for this feedback and ensure the feedback is addressed at the most appropriate layer.

+ - Ensure naming, metadata, and hierarchy requirements are being used consistently and effectively throughout your environment.

+ - Consider other KPIs to track and monitor success of your cost allocation strategy.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Cost allocation (metadata & hierarchy) capability](https://www.finops.org/framework/capabilities/cost-allocation/) article in the FinOps Framework documentation.

+## Next steps

+- [Data analysis and showback](capabilities-analysis-showback.md)

+- [Managing shared costs](capabilities-shared-cost.md)

+ Title: Data analysis and showback

+description: This article helps you understand the data analysis and showback capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Data analysis and showback

+This article helps you understand the data analysis and showback capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Data analysis refers to the practice of analyzing and interpreting data related to cloud usage and costs. Showback refers to enabling cost visibility throughout an organization.**

+Provides transparency and visibility into cloud usage and costs across different departments, teams, and projects. Organizational alignment requires cost allocation metadata and hierarchies, and enabling visibility requires structured access control against these hierarchies.

+Data analysis and showback require a deep understanding of organizational needs to provide an appropriate level of detail to each stakeholder. Consider the following points:

+- Level of knowledge and experience each stakeholder has

+- Different types of reporting and analytics you can provide

+- Assistance they need to answer their questions

+With the right tools, data analysis and showback enable stakeholders to understand how resources are used, track cost trends, and make informed decisions regarding resource allocation, optimization, and budget planning.

+## When to prioritize

+Data analysis and showback are a common part of your iterative process. Some examples of when you want to prioritize data analysis and showback include:

+- New datasets become available, which need to be prepared for stakeholders.

+- New requirements are raised to add or update reports.

+- Implementing more cost visibility measures to drive awareness.

+If you're new to FinOps, we recommend starting with data analysis and showback using native cloud tools as you learn more about the data and the specific needs of your stakeholders. You revisit this capability again as you adopt new tools and datasets, which could be ingested into a custom data store or used by a third-party solution from the Marketplace.

+## Before you begin

+Before you can effectively analyze usage and costs, you need to familiarize yourself with [how you're charged for the services you use](https://azure.microsoft.com/pricing#product-pricing). Understanding the factors that contribute to costs such as compute, storage, networking, data transfer, or executions helps you understand what you ultimately get billed. Understanding how your service usage aligns with the various pricing models also helps you understand what you get billed. These patterns vary between services, which can result in unexpected charges if you don't fully understand how you're charged and how you can stop billing.

+>[!NOTE]

+> For example, many people understand "VMs are not billed when they're not running." However, this is only partially true. There's a slight nuance for VMs where a "stopped" VM _will_ continue to charge you, because the cloud provider is still reserving that capacity for you. To stop billing, you must "deallocate" the VM. But you also need to remember that compute time isn't the only charge for a VM ΓÇô you're also charged for network bandwidth, disk storage, and other connected resources. In the simplest example, a deallocated VM will always charge you for disk storage, even if the VM is not running. Depending on what other services you have connected, there could be other charges as well. This is why it's important to understand how the services and features you use will charge you.

+We also recommend learning about [how cost data is tracked, stored, and refreshed in Microsoft Cost Management](../costs/understand-cost-mgt-data.md). Some examples include:

+- Which subscription types (or offers) are supported. For instance, data for classic CSP and sponsorship subscriptions isn't available in Cost Management and must be obtained from other data sources.

+- Which charges are included. For instance, taxes aren't included.

+- How tags are used and tracked. For instance, some resources don't support tags and [tag inheritance](../costs/enable-tag-inheritance.md) must be enabled manually to inherit tags from subscriptions and resource groups.

+- When to use "actual" and "amortized" cost.

+ - "Actual" cost shows charges as they were or as they'll get shown on the invoice. Use actual costs for invoice reconciliation.

+ - "Amortized" cost shows the effective cost of resources that used a commitment-based discount (reservation or savings plan). Use amortized costs for cost allocation, to "smooth out" large purchases that may look like usage spikes, and numerous commitment-based discount scenarios.

+- How credits are applied. For instance, credits are applied when the invoice is generated and not when usage is tracked.

+Understanding your cost data is critical to enable accurate and meaningful showback to all stakeholders.

+## Getting started

+When you first start managing cost in the cloud, you use the native tools:

+- [Cost analysis](../costs/quick-acm-cost-analysis.md) helps you explore and get quick answers about your costs.

+- [Power BI](/power-bi/connect-data/desktop-connect-azure-cost-management) helps you build advanced reports merged with other cloud or business data.

+- [Billing](../manage/index.yml) helps you review invoices and manage credits.

+- [Azure Monitor](../../azure-monitor/overview.md) helps you analyze resource usage metrics, logs, and traces.

+- [Azure Resource Graph](../../governance/resource-graph/overview.md) helps you explore resource configuration, changes, and relationships.

+As a starting point, we focus on tools available in the Azure portal and Microsoft 365 admin center.

+- Familiarize yourself with the [built-in views in Cost analysis](../costs/cost-analysis-built-in-views.md), concentrate on your top cost contributors, and drill in to understand what factors are contributing to that cost.

+ - Use the Services view to understand the larger services (not individual cloud resources) that have been purchased or are being used within your environment. This view is helpful for some stakeholders to get a high-level understanding of what's being used when they may not know the technical details of how each resource is contributing to business goals.

+ - Use the Subscriptions and Resource groups views to identify which departments, teams, or projects are incurring the highest cost, based on how you've organized your resources.

+ - Use the Resources view to identify which deployed resources are incurring the highest cost.

+ - Use the Reservations view to review utilization for a billing account or billing profile or to break down usage to the individual resources that received the reservation discount.

+ - Always use the view designed to answer your question. Avoid using the most detailed view to answer all questions, as it's slower and requires more work to find the answer you need.

+ - Use drilldown, filtering, and grouping to narrow down to the data you need, including the cost meters of an individual resource.

+- [Save and share customized views](../costs/save-share-views.md) to revisit them later, collaborate with stakeholders, and drive awareness of current costs.

+ - Use private views for yourself and shared views for others to see and manage.

+ - Pin views to the Azure portal dashboard to create a heads-up display when you sign into the portal.

+ - Download an image of the chart and copy a link to the view to provide quick access from external emails, documents, etc. Note recipients are required to sign in and have access to the cost data.

+ - Download summarized data to share with others who don't have direct access.

+ - Subscribe to scheduled alerts to send emails with a chart and/or data to stakeholders on a daily, weekly, or monthly basis.

+- As you review costs, make note of questions that you can't answer with the raw cloud usage and cost data. Feed this back into your cost allocation strategy to ensure more metadata is added via tags and labels.

+- Use the different tools optimized to provide the details you need to understand the holistic picture of your resource cost and usage.

+ - [Analyze resource usage metrics in Azure Monitor](../../azure-monitor/essentials/tutorial-metrics.md).

+ - [Review resource configuration changes in Azure Resource Graph](../../governance/resource-graph/how-to/get-resource-changes.md).

+- If you need to build more advanced reports or merge cost data with other cloud or business data, [connect to Cost Management data in Power BI](/power-bi/connect-data/desktop-connect-azure-cost-management).

+## Building on the basics

+At this point, you're likely productively utilizing the native reporting and analysis solutions in the portal and have possibly started building advanced reports in Power BI. As you move beyond the basics, consider the following to help you scale your reporting and analysis capabilities:

+- Talk to your stakeholders to ensure you have a firm understanding of their end goals.

+ - Differentiate between "tasks" and "goals." Tasks are performed to accomplish goals and will change as technology and our use of it evolves, while goals are more consistent over time.

+ - Think about what they'll do after you give them the data. Can you help them achieve that through automation or providing links to other tools or reports? How can they rationalize cost data against other business metrics (the benefits their resources are providing)?

+ - Do you have all the data you need to facilitate their goals? If not, consider ingesting other datasets to streamline their workflow. Adding other datasets is a common reason for moving from in-portal reporting into a custom or third-party solution to support other datasets.

+- Consider reporting needs of each capability. Some examples include:

+ - Cost breakdowns aligned to cost allocation metadata and hierarchies.

+ - Optimization reports tuned to specific services and pricing models.

+ - Commitment-based discount utilization, coverage, savings, and chargeback.

+ - Reports to track and drill into KPIs across each capability.

+- How can you make your reporting and KPIs an inherent part of day-to-day business and operations?

+ - Promote dashboards and KPIs at recurring meetings and reviews.

+ - Consider both bottom-up and top-down approaches to drive FinOps through data.

+ - Use alerting systems and collaboration tools to raise awareness of costs on a recurring basis.

+- Regularly evaluate the quality of the data and reports.

+ - Consider introducing a feedback mechanism to learn how stakeholders are using reports and when they can't or or aren't meeting their needs. Use it as a KPI for your reports.

+ - Focus heavily on data quality and consistency. Many issues surfaced within the reporting tools are result from the underlying data ingestion, normalization, and cost allocation processes. Channel the feedback to the right stakeholders and raise awareness of and resolve issues that are impacting end-to-end cost visibility, accountability, and optimization.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Data analysis and showback capability](https://www.finops.org/framework/capabilities/analysis-showback/) article in the FinOps Framework documentation.

+## Next steps

+- [Forecasting](capabilities-forecasting.md)

+- [Managing anomalies](capabilities-anomalies.md)

+- [Budget management](capabilities-budgets.md)

+ Title: Managing anomalies

+description: This article helps you understand the managing anomalies capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Managing anomalies

+This article helps you understand the managing anomalies capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Managing anomalies refers to the practice of detecting and addressing abnormal or unexpected cost and usage patterns in a timely manner.**

+Use automated tools to detect anomalies and notify stakeholders. Review usage trends periodically to reveal anomalies automated tools may have missed.

+Investigate changes in application behaviors, resource utilization, and resource configuration to uncover the root cause of the anomaly.

+With a systematic approach to anomaly detection, analysis, and resolution, organizations can minimize unexpected costs that impact budgets and business operations. And, they can even identify and prevent security and reliability incidents that can surface in cost data.

+## Getting started

+When you first start managing cost in the cloud, you use the native tools available in the portal.

+- Start with proactive alerts.

+ - [Subscribe to anomaly alerts](../understand/analyze-unexpected-charges.md#create-an-anomaly-alert) for each subscription in your environment to receive email alerts when an unusual spike or drop has been detected in your normalized usage based on historical usage.

+ - Consider [subscribing to scheduled alerts](../costs/save-share-views.md#subscribe-to-scheduled-alerts) to share a chart of the recent cost trends with stakeholders. It can help you drive awareness as costs change over time and potentially catch changes the anomaly model may have missed.

+ - Consider [creating a budget in Cost Management](../costs/tutorial-acm-create-budgets.md) to track that specific scope or workload. Specify filters and set alerts for both actual and forecast costs for finer-grained targeting.

+- Review costs periodically, using detailed cost breakdowns, usage analytics, and visualizations to identify potential anomalies that may have been missed.

+ - Use smart views in Cost analysis to [review anomaly insights](../understand/analyze-unexpected-charges.md#identify-cost-anomalies) that were automatically detected for each subscription.

+ - Use customizable views in Cost analysis to [manually find unexpected changes](../understand/analyze-unexpected-charges.md#manually-find-unexpected-cost-changes).

+ - Consider [saving custom views](../costs/save-share-views.md) that show cost over time for specific workloads to save time.

+ - Consider creating more detailed usage reports using [Power BI](/power-bi/connect-data/desktop-connect-azure-cost-management).

+- Once an anomaly is identified, take appropriate actions to address it.

+ - Review the anomaly details with the engineers who manage the related cloud resources. Some autodetected "anomalies" are planned or at least known resource configuration changes as part of building and managing cloud services.

+ - If you need lower-level usage details, review resource utilization in [Azure Monitor metrics](../../azure-monitor/essentials/metrics-getting-started.md).

+ - If you need resource details, review [resource configuration changes in Azure Resource Graph](../../governance/resource-graph/how-to/get-resource-changes.md).

+## Building on the basics

+At this point, you have automated alerts configured and ideally views and reports saved to streamline periodic checks.

+- Establish and automate KPIs, such as:

+ - Number of anomalies each month or quarter.

+ - Total cost impact of anomalies each month or quarter

+ - Response time to detect and resolve anomalies.

+ - Number of false positives and false negatives.

+- Expand coverage of your anomaly detection and response process to include all costs.

+- Define, document, and automate workflows to guide the response process when anomalies are detected.

+- Foster a culture of continuous learning, innovation, and collaboration.

+ - Regularly review and refine anomaly management processes based on feedback, industry best practices, and emerging technologies.

+ - Promote knowledge sharing and cross-functional collaboration to drive continuous improvement in anomaly detection and response capabilities.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Managing anomalies capability](https://www.finops.org/framework/capabilities/manage-anomalies/) article in the FinOps Framework documentation.

+## Next steps

+- [Budget management](capabilities-budgets.md)

+ Title: Budget management

+description: This article helps you understand the budget management capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Budget management

+This article helps you understand the budget management capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Budget management refers to the process of overseeing and tracking financial plans and limits over a given period to effectively manage and control spending.**

+Analyze historical usage and cost trends and adjust for future plans to estimate monthly, quarterly, and yearly costs that are realistic and achievable. Repeat for each level in the organization for a complete picture of organizational budgets.

+Configure alerting and automated actions to notify stakeholders and protect against budget overages. Investigate unexpected variance to budget and take appropriate actions. Review and adjust budgets regularly to ensure they remain accurate and reflect any changes in the organization's financial situation.

+Effective budget management helps ensure organizations operate within their means and are able to achieve financial goals. Unexpected costs can impact external business decisions and initiatives that could have widespread impact.

+## Getting started

+When you first start managing cost in the cloud, you may not have your financial budgets mapped to every subscription and resource group. You may not even have the budget mapped to your billing account yet. It's okay. Start by configuring cost alerts. The exact amount you use isn't as important as having _something_ to let you know when costs are escalating.

+- Start by [creating a monthly budget in Cost Management](../costs/tutorial-acm-create-budgets.md) at the primary scope you manage, whether that's a billing account, management group, subscription, or resource group.

+ - If you're not sure where to start, set your budget amount based on the cost of the previous months. You can also set it to be explicitly higher than what you intend, to catch an exceedingly high jump in costs, if you're not concerned with smaller moves. No matter what you set, you can always change it later.

+ - If you do want to provide a more realistic alert threshold, see [Estimate the initial cost of your cloud project](/azure/well-architected/cost/design-initial-estimate).

+ - Configure one or more alerts on actual or forecast cost to be sent to stakeholders.

+ - If you need to proactively stop billing before costs exceed a certain threshold on a subscription or resource group, [execute an automated action when alerts are triggered](../manage/cost-management-budget-scenario.md).

+- If you have concerns about rollover costs from one month to the next as they accumulate for the quarter or year, create quarterly and yearly budgets.

+- If you're not concerned about "overage," but would still like to stay informed about costs, [save a view in Cost analysis](../costs/save-share-views.md) and [subscribe to scheduled alerts](../costs/save-share-views.md#subscribe-to-scheduled-alerts). Then share a chart of the cost trends to stakeholders. It can help you drive accountability and awareness as costs change over time before you go over budget.

+- Consider [subscribing to anomaly alerts](../understand/analyze-unexpected-charges.md#create-an-anomaly-alert) for each subscription to ensure everyone is aware of anomalies as they're identified.

+- Repeat these steps to configure alerts for the stakeholders of each scope and application you want to be monitored for maximum visibility and accountability.

+- Consider reviewing costs against your budget periodically to ensure costs remain on track with your expectations.

+## Building on the basics

+So far, you've defined granular and targeted cost alerts for each scope and application and ideally review your cost as a KPI with all stakeholders at regular meetings. Consider the following points to further refine your budget management process:

+- Refine the budget granularity to enable more targeted oversight.

+- Encourage all teams to take ownership of their budget allocations and expenses.

+ - Educate them about the impact of their actions on the overall budget and empower them to make informed decisions.

+- Streamline the process for making budget adjustments, ensuring teams easily understand and follow it.

+- [Automate budget creation](../automate/automate-budget-creation.md) with new subscriptions and resource groups.

+- If not done earlier, use automation tools like Azure Logic Apps or Alerts to [execute automated actions when budget alerts are triggered](../manage/cost-management-budget-scenario.md). Tools can be especially helpful on test subscriptions.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see to the [Budget management](https://www.finops.org/framework/capabilities/budget-management) article in the FinOps Framework documentation.

+## Next steps

+- [Forecasting](capabilities-forecasting.md)

+- [Onboarding workloads](capabilities-workloads.md)

+- [Chargeback and finance integration](capabilities-chargeback.md)

+ Title: Chargeback and finance integration

+description: This article helps you understand the chargeback and finance integration capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Chargeback and finance integration

+This article helps you understand the chargeback and finance integration capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Chargeback refers to the process of billing internal teams for their respective cloud costs. Finance integration involves leveraging existing internal finance tools and processes.**

+Plan the chargeback model with IT and Finance departments. Use the organizational cost allocation strategy that factors in how stakeholders agreed to account for shared costs and commitment-based discounts.

+Use existing tools and processes to manage cloud costs as part of organizational finances. Chargeback is represented in the accounting system, [budgets](capabilities-budgets.md) are managed through the budget system, etc.

+Chargeback and finance integration enables increased transparency, more direct accountability for the costs each department incurs, and reduced overhead costs.

+## Before you begin

+Chargeback, cost allocation, and showback are all important components of your FinOps practice. While you can implement them in any order, we generally recommend most organizations start with [showback](capabilities-analysis-showback.md) to ensure each team has visibility of the charges they're responsible for ΓÇô at least at a cloud scope level. Then implement [cost allocation](capabilities-allocation.md) to align cloud costs to the organizational reporting hierarchies, and lastly implement chargeback based on that cost allocation strategy. Consider reviewing the [Data analysis and showback](capabilities-analysis-showback.md) and [Cost allocation](capabilities-allocation.md) capabilities if you haven't implemented them yet. You may also find [Managing shared costs](capabilities-shared-cost.md) and [Managing commitment-based discounts](capabilities-commitment-discounts.md) capabilities to be helpful in implementing a complete chargeback solution.

+## Getting started

+Chargeback and finance integration is all about integrating with your own internal tools. Consider the following points:

+- Collaborate with stakeholders across finance, business, and technology to plan and prepare for chargeback.

+- Document how chargeback works and be prepared for questions.

+- Use the organizational [cost allocation](capabilities-allocation.md) strategy that factors in how stakeholders agreed to account for [shared costs](capabilities-shared-cost.md) and [commitment-based discounts](capabilities-commitment-discounts.md).

+ - If you haven't established one, consider simpler chargeback models that are fair and agreed upon by all stakeholders.

+- Use existing tools and processes to manage cloud costs as part of organizational finances.

+## Building on the basics

+At this point, you have a basic chargeback model that all stakeholders have agreed to. As you move beyond the basics, consider the following points:

+- Consider implementing a one-way sync from your budget system to [Cost Management budgets](../automate/automate-budget-creation.md) to use automated alerts based on machine learning forecasts.

+- If you track manual forecasts, consider creating Cost Management budgets for your forecast values as well. It gives you separate tracking and alerting for budgets separate from your forecast.

+- Automate your [cost allocation](capabilities-allocation.md) strategy through tagging.

+- Expand coverage of [shared costs](capabilities-shared-cost.md) and [commitment-based discounts](capabilities-commitment-discounts.md) if not already included.

+- Fully integrate chargeback and showback reporting with the organization's finance tools.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Chargeback and finance integration capability](https://www.finops.org/framework/capabilities/chargeback/) article in the FinOps Framework documentation.

+## Next steps

+- [Data analysis and showback](capabilities-analysis-showback.md)

+- [Managing shared costs](capabilities-shared-cost.md)

+- [Managing commitment-based discounts](capabilities-commitment-discounts.md)

+ Title: Managing commitment-based discounts

+description: This article helps you understand the managing commitment-based discounts capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Managing commitment-based discounts

+This article helps you understand the managing commitment-based discounts capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Managing commitment-based discounts is the practice of obtaining reduced rates on cloud services by committing to a certain level of usage or spend over a specific period.**

+Review daily usage and cost trends to estimate how much you expect to use or spend over the next one to five years. Use [Forecasting](capabilities-forecasting.md) and account for future plans.

+Commit to specific hourly usage targets to receive discounted rates and save up to 72% with [Azure reservations](../reservations/save-compute-costs-reservations.md). Or for more flexibility, commit to a specific hourly spend to save up to 65% with [Azure savings plans for compute](../savings-plan/savings-plan-compute-overview.md). Reservation discounts can be applied to resources of the specific type, SKU, and location only. Savings plan discounts are applied to a family of compute resources across types, SKUs, and locations. The extra specificity with reservations is what drives more favorable discounting.

+Adopting a commitment-based strategy allows organizations to reduce their overall cloud costs while maintaining the same or higher usage by taking advantage of discounts on the resources they already use.

+## Before you begin

+While you can save by using reservations and savings plans, there's also a risk that you may not end up using that capacity. You could end up underutilizing the commitment and lose money. While losing money is rare, it's possible. We recommend starting small and making targeted, high-confidence decisions. We also recommend not waiting too long to decide on how to approach commitment-based discounts when you do have consistent usage because you're effectively losing money. Start small and learn as you go. But first, learn how [reservation](../reservations/reservation-discount-application.md) and [savings plan](../savings-plan/discount-application.md) discounts are applied.

+Before you purchase either a reservation or a savings plan, consider the usage you want to commit to. If you have high confidence, you maintain a specific level of usage for that type, SKU, and location, strongly consider starting with a reservation. For maximum flexibility, you can use savings plans to cover a wide range of compute costs by committing to a specific hourly spend instead of hourly usage.

+## Getting started

+Microsoft offers several tools to help you identify when you should consider purchasing reservations or savings plans. You can choose whether you want to start by analyzing usage or by reviewing the system-generated recommendations based on your historical usage and cost. We recommend starting with the recommendations to focus your initial efforts:

+- One of the most common starting points is [Azure Advisor cost recommendations](../../advisor/advisor-reference-cost-recommendations.md).

+- For more flexibility, you can view and filter recommendations in the [reservation](../reservations/reserved-instance-purchase-recommendations.md) and [savings plan](../savings-plan/purchase-recommendations.md#purchase-recommendations-in-the-azure-portal) purchase experiences.

+- Lastly, you can also view reservation recommendations in [Power BI](/power-bi/connect-data/desktop-connect-azure-cost-management).

+- After you know what to look for, you can [analyze your usage data](../reservations/determine-reservation-purchase.md#analyze-usage-data) to look for the specific usage you want to purchase a reservation for.

+After purchasing commitments, you can:

+- View utilization from the [reservation](../reservations/reservation-utilization.md) or [savings plan](../savings-plan/view-utilization.md) page in the portal.

+ - Consider expanding the scope or enabling instance size flexibility (when available) to increase utilization and maximize savings of an existing commitment.

+ - [Configure reservation utilization alerts](../costs/reservation-utilization-alerts.md) to notify stakeholders if utilization drops below a desired threshold.

+- View showback and chargeback reports for [reservations](../reservations/charge-back-usage.md) and [savings plans](../savings-plan/charge-back-costs.md).

+## Building on the basics

+At this point, you have commitment-based discounts in place. As you move beyond the basics, consider the following points:

+- Configure commitments to automatically renew for [reservations](../reservations/reservation-renew.md) and [savings plans](../savings-plan/renew-savings-plan.md).

+- Calculate cost savings for [reservations](../reservations/calculate-ea-reservations-savings.md) and [savings plans](../savings-plan/calculate-ea-savings-plan-savings.md).

+- If you use multiple accounts, clouds, or providers, expand coverage of your commitment-based discounts efforts to include all accounts.

+ - Consider implementing a consistent utilization and coverage monitoring system that covers all accounts.

+- Establish a process for centralized purchasing of commitment-based offers, assigning responsibility to a dedicated team or individual.

+- Consider programmatically aligning governance policies with commitments to prioritize SKUs and locations that are covered by reservations and aren't fully utilized when deploying new applications.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Managing commitment-based discounts capability](https://www.finops.org/framework/capabilities/manage-commitment-based-discounts/) article in the FinOps Framework documentation.

+## Next steps

+- [Data analysis and showback](capabilities-analysis-showback.md)

+- [Cloud policy and governance](capabilities-policy.md)

+ Title: Establishing a FinOps culture

+description: This article helps you understand the Establishing a FinOps culture capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Establishing a FinOps culture

+This article helps you understand the Establishing a FinOps culture capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Establishing a FinOps culture is about fostering a mindset of accountability and collaboration to accelerate and drive business value with cloud technology.**

+Evangelize the importance of a cost-aware culture that prioritizes driving business value over minimizing costs. Set clear expectations and goals for all stakeholders that are aligned with the mission and encourage accountability and responsibility for all actions taken.

+Lead with data. Establish and promote success metrics aligned with individual teams' goals.

+Establishing a FinOps culture gets the entire organization moving in the same direction and accelerates business goals through more efficient workflows and better team collaboration. Everyone can make more informed decisions together and increase operational flexibility.

+## Getting started

+When you first start, not all stakeholders are familiar with what FinOps is and their role within it. Consider the following to get off the ground:

+- Start by finding enthusiasts who are passionate about FinOps, cost optimization, efficiency, or data-driven use of technology to accelerate business goals.

+ - Build an informal [steering committee](capabilities-structure.md) and meet weekly or monthly to agree on goals, formulate strategy and tactics, and collaborate on the execution.

+- Research your stakeholders and organizations.

+ - Understand what motivates them through their mission and success criteria.

+ - Learn about the challenges they face and look for opportunities for FinOps to help address them.

+ - Identify potential promoters and detractors and empathize with why they would or wouldn't support your efforts. Factor both sides into your strategy.

+- Identify an initial sponsor and prepare a pitch that explains how your strategy leads to a positive impact on their mission and success criteria. Present your plan with clear asks and next steps.

+ - You're creating a mini startup. Do your research around how to prepare for these early meetings.

+ - Utilize [FinOps Foundation resources](https://www.finops.org/resources) to build your pitch, strategy, and more.

+ - Use the [FinOps community](https://www.finops.org/community/getting-started/) to share their knowledge and experience. They've been where you are.

+- Dual-track your FinOps efforts: Drive lightweight FinOps initiatives with large returns while you cultivate your community. Nothing is better proof than data.

+ - Promote and celebrate your wins with early adopters.

+- Expand and formalize your steering committee as you develop broader sponsorship across business, finance, and engineering.

+## Building on the basics

+At this point, you have a steering committee that has early wins under its belt with basic support from the core stakeholder groups. As you move beyond the basics, consider the following points:

+- Define and document your operating model and evolve your strategy as a collaborative community.

+- Brainstorm metrics and tactics that can demonstrate value and inspire different stakeholders through effective communication.

+- Consider tools that can help self-promote your successes, like reports and dashboards.

+- Share regular updates that celebrate small wins to demonstrate value.

+- Look for opportunities to scale through other organizational priorities and initiatives.

+- Explore ways to "go big" and launch a fully supported FinOps practice with a central team. Learn from other successful initiatives within the organization.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Establishing a FinOps culture capability](https://www.finops.org/framework/capabilities/establish-finops-culture/) article in the FinOps Framework documentation.

+## Next steps

+- [Establishing a FinOps decision and accountability structure](capabilities-structure.md)

+- [Cloud policy and governance](capabilities-policy.md)

+- [FinOps education and enablement](capabilities-education.md)

+ Title: FinOps education and enablement

+description: This article helps you understand the FinOps education and enablement capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# FinOps education and enablement

+This article helps you understand the FinOps education and enablement capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**FinOps education and enablement involves refers to the process of providing training, resources, and support to help individuals and teams within an organization adopt FinOps practices.**

+Identify and share available training content with stakeholders. Create a central repository for training resources and provide introductory material that aligns with your FinOps processes.

+Consider marketing initiatives to drive awareness, encourage discussion and sharing lessons learned, or get people actively participating and learning (for example, hackathon or innovation sprint). Focus on the value FinOps brings and share data from your early successes.

+Provide a direct channel to get help and support as people are learning. Be responsive and establish a feedback loop to learn from help and support initiatives.

+By formalizing FinOps education and enablement, stakeholders develop the knowledge and skills needed to effectively manage and optimize cloud usage and costs. Organizations see:

+- Accelerated adoption of FinOps practices, leading to improved financial performance

+- Increased agility

+- Better alignment between cloud spending and business goals

+## Getting started

+Implementing a plan for FinOps education and enablement is like most other training and development efforts. Consider the following points:

+- If you're new to training and development, research common approaches and best practices.

+- Use existing online resources from [Microsoft](https://azure.microsoft.com/solutions/finops), [FinOps Foundation](https://finops.org/), and others.

+- Research and build targeted content and marketing strategies around common pain points experienced by your organization.

+ - Consider focusing on a few key areas of interest to make more progress.

+ - Experiment with different lightweight approaches to see what works best within your organization.

+- Target the core areas that are critical for FinOps, like:

+ - Cross-functional collaboration between finance, engineering, and business teams.

+ - Cloud-specific knowledge and terminology.

+ - Continuous improvement best practices around monitoring, analyzing, and optimizing cloud usage and costs.

+- Consider activities like formal training programs (for example, [FinOps Foundation training](https://learn.finops.org/)), on-the-job training, mentoring, coaching, and self-directed learning.

+- Explore targeted learning tools that could help accelerate efforts.

+- Use available collaboration tools like Teams, Viva Engage, and SharePoint.

+- Find multiple avenues to promote the program (for example, hackathons, lunch and learns).

+- Track and measure success to demonstrate the value of your training and development efforts.

+- Consider specific training for nontechnical roles, such as finance and business teams or senior leadership.

+## Building on the basics

+At this point, you have a central repository for training content and targeted initiatives to drive awareness and encourage collaboration. As you move beyond the basics, consider the following points:

+- Expand coverage to more or all capabilities and document processes and key contacts.

+- Track telemetry and establish a feedback loop to learn from learning resources and help and support workflows.

+ - Review findings regularly and factor into future plans.

+- Consider establishing an official internal support channel to provide help and support.

+- Seek out and engage with stakeholders within your organization, including senior level sponsorship and cultivated supporters to build momentum.

+- Identify people with passion for cost optimization and data-driven decision making to be part of the [FinOps steering committee](capabilities-structure.md).

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [FinOps education and enablement capability](https://www.finops.org/framework/capabilities/education-enablement/) article in the FinOps Framework documentation.

+## Next steps

+- [Establishing a FinOps decision and accountability structure](capabilities-structure.md)

+- [Establishing a FinOps culture](capabilities-culture.md)

+ Title: Resource utilization and efficiency

+description: This article helps you understand the resource utilization and efficiency capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Resource utilization and efficiency

+This article helps you understand the resource utilization and efficiency capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Resource utilization and efficiency refers to the process of ensuring cloud services are utilized and tuned to maximize business value and minimize wasteful spending.**

+Review how services are being used and ensure each is maximizing return on investment. Evaluate and implement best practices and recommendations.

+Every cost should have direct or indirect traceability back to business value. Eliminate fully "optimized" resources that aren't contributing to business value.

+Resource utilization and efficiency maximize the business value of cloud costs by avoiding unnecessary costs that don't contribute to the mission, which in turn increases return on investment and profitability.

+## Getting started

+When you first start managing cost in the cloud, you use the native tools to drive efficiency and optimize costs in the portal.

+- Review and implement [Azure Advisor cost recommendations](../../advisor/advisor-reference-cost-recommendations.md).

+ - Azure Advisor gives you high-confidence recommendations based on your usage. Azure Advisor is always the best place to start when looking to optimize any workload.

+ - Consider [subscribing to Azure Advisor alerts](../../advisor/advisor-alerts-portal.md) to get notified when there are new cost recommendations.

+- Review your usage and purchase [commitment-based discounts](capabilities-commitment-discounts.md) when it makes sense.

+- Take advantage of Azure Hybrid Benefit for [Windows](/windows-server/get-started/azure-hybrid-benefit), [Linux](../../virtual-machines/linux/azure-hybrid-benefit-linux.md), and [SQL Server](/azure/azure-sql/azure-hybrid-benefit).

+- Review and implement [Cloud Adoption Framework costing best practices](/azure/cloud-adoption-framework/govern/cost-management/best-practices).

+- Review and implement [Azure Well-Architected Framework cost optimization guidance](/azure/well-architected/cost/overview).

+- Familiarize yourself with the services you use, how you're charged, and what service-specific cost optimization options you have.

+ - You can discover the services you use from the Azure portal All resources page or from the [Services view in Cost analysis](../costs/cost-analysis-built-in-views.md#break-down-product-and-service-costs).

+ - Explore the [Azure pricing pages](https://azure.microsoft.com/pricing) and [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator) to learn how each service charges you. Use them to identify options that may reduce costs. For example, shared infrastructure and commitment discounts.

+ - Review service documentation to learn about any cost-related features that could help you optimize your environment or improve cost visibility. Some examples:

+ - Choose [spot VMs](/azure/well-architected/cost/optimize-vm#spot-vms) for low priority, interruptible workloads.

+ - Avoid [cross-region data transfer](/azure/well-architected/cost/design-regions#traffic-across-billing-zones-and-regions).

+## Building on the basics

+At this point, you've implemented all the basic cost optimization recommendations and tuned applications to meet the most fundamental best practices. As you move beyond the basics, consider the following points:

+- Automate cost recommendations using [Azure Resource Graph](../../advisor/resource-graph-samples.md).

+- Implement the [Workload management and automation capability](capabilities-workloads.md) for more optimizations.

+- Stay abreast of emerging technologies, tools, and industry best practices to further optimize resource utilization.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Resource utilization and efficiency capability](https://www.finops.org/framework/capabilities/utilization-efficiency/) article in the FinOps Framework documentation.

+## Next steps

+- [Managing commitment-based discounts](capabilities-commitment-discounts.md)

+- [Workload management and automation](capabilities-workloads.md)

+- [Measuring unit cost](capabilities-unit-costs.md)

+ Title: Forecasting

+description: This article helps you understand the forecasting capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Forecasting

+This article helps you understand the forecasting capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Forecasting involves analyzing historical trends and future plans to predict costs, understand the impact on current budgets, and influence future budgets.**

+Analyze historical usage and cost trends to identify any patterns you expect to change. Augment that with future plans to generate an informed forecast.

+Periodically review forecasts against the current budgets to identify risk and initiate remediation efforts. Establish a plan to balance budgets across teams and departments and factor the learnings into future budgets.

+With an accurate, detailed forecast, organizations are better prepared to adapt to future change.

+## Before you begin

+Before you can effectively forecast future usage and costs, you need to familiarize yourself with [how you're charged for the services you use](https://azure.microsoft.com/pricing#product-pricing).

+Understanding how changes to your usage patterns affect future costs is informed with:

+- Understanding the factors that contribute to costs (for example, compute, storage, networking, and data transfer)

+- How your usage of a service aligns with the various pricing models (for example, pay-as-you-go, reservations, and Azure Hybrid Benefit)

+## Getting started

+When you first start managing cost in the cloud, you use the native Cost analysis experience in the portal.

+The simplest option is to [use Cost analysis to project future costs](../costs/cost-analysis-common-uses.md#view-forecast-costs) using the Daily costs or Accumulated costs view. If you have consistent usage with little to no anomalies or large variations, it may be all you need.

+If you do see anomalies or large (possibly expected) variations in costs, you may want to customize the view to build a more accurate forecast. To do so, you need to analyze the data and filter out anything that might skew the results.

+- Use Cost analysis to analyze historical trends and identify abnormalities.

+ - Before you start, determine if you're interested in your costs as they're billed or if you want to forecast the effective costs after accounting for commitment-based discounts. If you want the effective cost, [change the view to use amortized cost](../costs/customize-cost-analysis-views.md#switch-between-actual-and-amortized-cost).

+ - Start with the Daily costs view, then change the date range to look back as far as you're interested in looking forward. For instance, if you want to predict the next 12 months, then set the date range to the last 12 months.

+ - Filter out all purchases (`Charge type = Purchase`). Make a note of them as you need to forecast them separately.

+ - Group costs to identify new and old (deleted) subscriptions, resource groups, and resources.

+ - If you see any deleted items, filter them out.

+ - If you see any that are new, make note of them and then filter them out. You forecast them separately. Consider saving your view under a new name as one way to "remember" them for later.

+ - If you have future dates included in your view, you may notice the forecast is starting to level out. It happens because the abnormalities are no longer being factored into the algorithm.

+ - If you see any large spikes or dips, group the data by one of the [grouping options](../costs/group-filter.md) to identify what the cause was.

+ - Try different options until you discover the cause using the same approach as you would in [finding unexpected changes in cost](../understand/analyze-unexpected-charges.md#manually-find-unexpected-cost-changes).

+ - If you want to find the exact change that caused the cost spike (or dip), use tools like [Azure Monitor](../../azure-monitor/overview.md) or [Resource Graph](../../governance/resource-graph/how-to/get-resource-changes.md) in a separate window or browser tab.

+ - If the change was a segregated charge and shouldn't be factored into the forecast, filter it out. Be careful not to filter out other costs as it will skew the forecast. If necessary, start by forecasting a smaller scope to minimize risk of filtering more and repeat the process per scope.

+ - If the change is in a scope that shouldn't get filtered out, make note of that scope and then filter it out. You forecast them separately.

+ - Consider filtering out any subscriptions, resource groups, or resources that were reconfigured during the period and may not reflect an accurate picture of future costs. Make note of them so you can forecast them separately.

+ - At this point, you should have a fairly clean picture of consistent costs.

+- Change the date range to look at the future period. For example, the next 12 months.

+ - If interested in the total accumulated costs for the period, change the granularity to `Accumulated`.

+- Make note of the forecast, then repeat this process for each of the datasets that were filtered out.

+ - You may need to shorten the future date range to ensure the historical anomaly or resource change doesn't affect the forecast. If the forecast is affected, manually project the future costs based on the daily or monthly run rate.

+- Next factor in any changes you plan to make to your environment.

+ - This part can be a little tricky and needs to be handled separately per workload.

+ - Start by filtering down to only the workload that is changing. If the planned change only impacts a single meter, like the number of uptime hours a VM may have or total data stored in a storage account, then filter down to that meter.

+ - Use the [pricing calculator](https://azure.microsoft.com/pricing/calculator) to determine the difference between what you have today and what you intend to have. Then, take the difference and manually apply that to your cost projections for the intended period.

+ - Repeat the process for each of the expected changes.

+Whichever approach worked best for you, compare your forecast with your current budget to see where you're at today. If you filtered data down to a smaller scope or workload:

+- Consider [creating a budget in Cost Management](../costs/tutorial-acm-create-budgets.md) to track that specific scope or workload. Specify filters and set alerts for both actual and forecast costs.

+- [Save a view in Cost analysis](../costs/save-share-views.md) to monitor that cost and budget over time.

+- Consider [subscribing to scheduled alerts](../costs/save-share-views.md#subscribe-to-scheduled-alerts) for this view to share a chart of the cost trends with stakeholders. It can help you drive accountability and awareness as costs change over time before you go over budget.

+- Consider [subscribing to anomaly alerts](../understand/analyze-unexpected-charges.md#create-an-anomaly-alert) for each subscription to ensure everyone is aware of anomalies as they're identified.

+Consider reviewing forecasts monthly or quarterly to ensure you remain on track with your expectations.

+## Building on the basics

+At this point, you have a manual process for generating a forecast. As you move beyond the basics, consider the following points:

+- Expand coverage of your forecast calculations to include all costs.

+- If ingesting cost data into a separate system, use or introduce a forecast capability that spans all of your cost data. Consider using [Automated Machine Learning (AutoML)](../../machine-learning/how-to-auto-train-forecast.md) to minimize your effort.

+- Integrate forecast projections into internal budgeting tools.

+- Automate cost variance detection and mitigation.

+ - Implement automated processes to identify and address cost variances in real-time.

+ - Establish workflows or mechanisms to investigate and mitigate the variances promptly, ensuring cost control and alignment with forecasted budgets.

+- Build custom forecast and budget reporting against actuals that's available to all stakeholders.

+- If you're [measuring unit costs](capabilities-unit-costs.md), consider establishing a forecast for your unit costs to better understand whether you're trending towards higher or lower cost vs. revenue.

+- Establish and automate KPIs, such as:

+ - Cost vs. forecast to measure the accuracy of the forecast algorithm.

+ - It can only be performed when there are expected usage patterns and no anomalies.

+ - Target \<12% variance when there are no anomalies.

+ - Cost vs. forecast to measure whether costs were on target.

+ - It's evaluated whether there are anomalies or not to measure the performance of the cloud solution.

+ - Target 12-20% variance where \<12% would be an optimized team, project, or workload.

+ - Number of unexpected anomalies during the period that caused cost to go outside the expected range.

+ - Time to react to forecast alerts.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Forecasting capability](https://www.finops.org/framework/capabilities/forecasting) article in the FinOps Framework documentation.

+## Next steps

+- Budget management

+- Managing commitment-based discounts

+ Title: FinOps and intersecting frameworks

+description: This article helps you understand the FinOps and intersecting frameworks capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# FinOps and intersecting frameworks

+This article helps you understand the FinOps and intersecting frameworks capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**FinOps and intersecting frameworks refers to integrating FinOps practices with other frameworks and methodologies used by an organization.**

+Identify what frameworks and methodologies are used within your organization. Learn about the processes and benefits each framework provides and how they overlap with FinOps. Develop a plan for how processes can be aligned to achieve collective goals.

+## Getting started

+Implementation of this capability is highly dependent on how your organization has adopted each of the following frameworks and methodologies and what tools you've selected for each. See the following articles for details:

+- [IT Asset Management (ITAM)](https://www.finops.org/framework/capabilities/finops-itam/) by FinOps Foundation

+- [Sustainability](https://www.finops.org/framework/capabilities/finops-sustainability/) by FinOps Foundation

+- [Sustainability workloads](/azure/well-architected/sustainability/sustainability-get-started)

+- IT Service Management

+ - [Azure Monitor integration](../../azure-monitor/alerts/itsmc-overview.md)

+ - [Azure DevOps and ServiceNow](/azure/devops/pipelines/release/approvals/servicenow)

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [FinOps and intersecting frameworks capability](https://www.finops.org/framework/capabilities/finops-intersection/) article in the FinOps Framework documentation.

+## Next steps

+- [Microsoft Cloud Adoption Framework for Azure](/azure/cloud-adoption-framework/overview)

+- [Microsoft Azure Well-Architected Framework](/azure/well-architected/)

+ Title: Data ingestion and normalization

+description: This article helps you understand the data ingestion and normalization capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Data ingestion and normalization

+This article helps you understand the data ingestion and normalization capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+_Data ingestion and normalization refers to the process of collecting, transforming, and organizing data from various sources into a single, easily accessible repository._

+Gather cost, utilization, performance, and other business data from cloud providers, vendors, and on-premises systems. Gathering the data can include:

+- Internal IT data. For example, from a configuration management database (CMDB) or IT asset management (ITAM) systems.

+- Business-specific data, like organizational hierarchies and metrics that map cloud costs to or quantify business value. For example, revenue, as defined by your organizational and divisional mission statements.

+Consider how data gets reported and plan for data standardization requirements to support reporting on similar data from multiple sources, like cost data from multiple clouds or account types. Prefer open standards and interoperability with and across providers, vendors, and internal tools. It may also require restructuring data in a logical and meaningful way by categorizing or tagging data so it can be easily accessed, analyzed, and understood.

+When armed with a comprehensive collection of cost and usage information tied to business value, organizations can empower stakeholders and accelerate the goals of other FinOps capabilities. Stakeholders are able to make more informed decisions, leading to more efficient use of resources and potentially significant cost savings.

+## Before you begin

+While data ingestion and normalization are critical to long-term efficiency and effectiveness of any FinOps practice, it isn't a blocking requirement for your initial set of FinOps investments. If it is your first iteration through the FinOps lifecycle, consider lighter-weight capabilities that can deliver quicker return on investment, like [Data analysis and showback](capabilities-analysis-showback.md). Data ingestion and normalization can require significant time and effort depending on account size and complexity. We recommend focusing on this process once you have the right level of understanding of the effort and commitment from key stakeholders to support that effort.

+## Getting started

+When you first start managing cost in the cloud, you use the native tools available in the portal or through Power BI. If you need more, you may download the data for local analysis, or possibly build a small report or merge it with another dataset. Eventually, you need to automate this process, which is where "data ingestion" comes in. As a starting point, we focus on ingesting cost data into a common data store.

+- Before you ingest cost data, think about your reporting needs.

+ - Talk to your stakeholders to ensure you have a firm understanding of what they need. Try to understand their motivations and goals to ensure the data or reporting helps them.

+ - Identify the data you need, where you can get the data from, and who can give you access. Make note of any common datasets that may require normalization.

+ - Determine the level of granularity required and how often the data needs to be refreshed. Daily cost data can be a challenge to manage for a large account. Consider monthly aggregates to reduce costs and increase query performance and reliability if that meets your reporting needs.

+- Consider using a third-party FinOps platform.

+ - Review the available [third-party solutions in the Azure Marketplace](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/MarketplaceOffersBlade/searchQuery/cost).

+- Select the [cost details solution](../automate/usage-details-best-practices.md) that is right for you. We recommend scheduled exports, which push cost data to a storage account on a daily or monthly basis.

+ - If you use daily exports, notice that data is pushed into a new file each day. Ensure that you only select the latest day when reporting on costs.

+- Determine if you need a data integration or workflow technology to process data.

+ - In an early phase, you may be able to keep data in the exported storage account without other processing. We recommend that you keep the data there for small accounts with lightweight requirements and minimal customization.

+ - If you need to ingest data into a more advanced data store or perform data cleanup or normalization, you may need to implement a data pipeline. [Choose a data pipeline orchestration technology](/azure/architecture/data-guide/technology-choices/pipeline-orchestration-data-movement).

+- Determine what your data storage requirements are.

+ - In an early phase, we recommend using the exported storage account for simplicity and lower cost.

+ - If you need an advanced query engine or expect to hit data size limitations within your reporting tools, you should consider ingesting data into an analytical data store. [Choose an analytical data store](/azure/architecture/data-guide/technology-choices/analytical-data-stores).

+## Building on the basics

+At this point, you have a data pipeline and are ingesting data into a central data repository. As you move beyond the basics, consider the following points:

+- Normalize data to a standard schema to support aligning and blending data from multiple sources.

+ - For cost data, we recommend using the [FinOps Open Cost & Usage Specification (FOCUS) schema](https://finops.org/focus).

+- Complement cloud cost data with organizational hierarchies and budgets.

+ - Consider labeling or tagging requirements to map cloud costs to organizational hierarchies.

+- Enrich cloud resource and solution data with internal CMDB or ITAM data.

+- Consider what internal business and revenue metrics are needed to map cloud costs to business value.

+- Determine what other datasets are required based on your reporting needs:

+ - Cost and pricing

+ - [Azure retail prices](/rest/api/cost-management/retail-prices/azure-retail-prices) for pay-as-you-go rates without organizational discounts.

+ - [Price sheets](/rest/api/cost-management/price-sheet/download) for organizational pricing for Microsoft Customer Agreement accounts.

+ - [Price sheets](/rest/api/consumption/price-sheet/get) for organizational pricing for Enterprise Agreement accounts.

+ - [Balance summary](/rest/api/consumption/balances/get-by-billing-account) for Enterprise Agreement monetary commitment balance.

+ - Commitment-based discounts

+ - [Reservation details](/rest/api/cost-management/generate-reservation-details-report) for recommendation details.

+ - [Benefit utilization summaries](/rest/api/cost-management/generate-benefit-utilization-summaries-report) for savings plans.

+ - Utilization and efficiency

+ - [Resource Graph](/rest/api/azureresourcegraph/resourcegraph(2020-04-01-preview)/resources/resources) for Azure Advisor recommendations.

+ - [Monitor metrics](/rest/api/monitor/metrics-data-plane/batch) for resource usage.

+ - Resource details

+ - [Resource Graph](/rest/api/azureresourcegraph/resourcegraph(2020-04-01-preview)/resources/resources) for resource details.

+ - [Resource changes](/rest/api/resources/changes/list) to list resource changes from the past 14 days.

+ - [Subscriptions](/rest/api/resources/subscriptions/list) to list subscriptions.

+ - [Tags](/rest/api/resources/tags/list) for tags that have been applied to resources and resource groups.

+ - [Azure service-specific APIs](/rest/api/azure/) for lower-level configuration and utilization details.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Data ingestion and normalization capability](https://www.finops.org/framework/capabilities/data-normalization/) article in the FinOps Framework documentation.

+## Next steps

+- Read about [Cost allocation](capabilities-allocation.md) to learn how to allocate costs to business units and applications.

+- Read about [Data analysis and showback](capabilities-analysis-showback.md) to learn how to analyze and report on costs.

+ Title: Onboarding workloads

+description: This article helps you understand the onboarding workloads capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Onboarding workloads

+This article helps you understand the onboarding workloads capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Onboarding workloads refers to the process of bringing new and existing applications into the cloud based on their financial and technical feasibility.**

+Establish a process to incorporate new and existing projects into the cloud and your FinOps practice. Introduce new stakeholders to the FinOps culture and approach.

+Assess projects' technical feasibility given current cloud resources and capabilities and financial feasibility given the return on investment, current budget, and projected forecast.

+A streamlined onboarding process ensures teams have a smooth transition into the cloud without sacrificing technical, financial, or business principles or goals and minimizing disruptions to business operations.

+## Getting started

+Onboarding projects is an internal process that depends solely on your technical, financial, and business governance policies.

+- Start by familiarizing yourself with existing governance policies and onboarding processes within the organization.

+ - Should FinOps be added to an existing onboarding process?

+ - Are there working processes you can use or copy?

+ - Are there any stakeholders who can help you get your process stood up?

+ - Who has access to provision new workloads in the cloud? How are you notified that they're created?

+ - What governance measures exist to structure and tag new cloud resources? For example, Azure Policy enforcing tagging requirements.

+- In the beginning, keep it simple and focus on the basics.

+ - Introduce new stakeholders to the FinOps Framework by having them review [What is FinOps](overview-finops.md).

+ - Help them learn your culture and processes.

+ - Determine if you have the budget.

+ - Ensure the team runs through the [Forecasting capability](capabilities-forecasting.md) to estimate costs.

+ - Evaluate whether the budget has capacity for the estimated cost.

+ - Request department heads reprioritize existing projects to find capacity either by using capacity from under-utilized projects or by deprioritizing existing projects.

+ - Escalate through leadership as needed until budget capacity is established.

+ - Consider updating forecasts within the scope of the budget changes to ensure feasibility.

+## Building on the basics

+At this point, you have a simple process where stakeholders are introduced to FinOps, and new projects are at least being vetted against budget capacity. As you move beyond the basics, consider the following points:

+- Automate the onboarding process.

+ - Consider requiring simple FinOps training.

+ - Consider budget change request and approval process that automates reprioritization and change notification to stakeholders.

+- Introduce technical feasibility into the approval process. Some considerations to include:

+ - Cost efficiency ΓÇô Implementation/migration, infrastructure, support

+ - Resiliency ΓÇô Performance, reliability, security

+ - Sustainability ΓÇô Carbon footprint

+## Developing a process

+Document your onboarding process. Using existing tools and processes where available and strive to automate as much as possible to make the process lightweight, effortless, and seamless.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Onboarding workloads capability](https://www.finops.org/framework/capabilities/onboarding-workloads/) article in the FinOps Framework documentation.

+## Next steps

+- [Forecasting](capabilities-forecasting.md)

+- [Cloud policy and governance](capabilities-policy.md)

+ Title: Cloud policy and governance

+description: This article helps you understand the cloud policy and governance capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Cloud policy and governance

+This article helps you understand the cloud policy and governance capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Cloud policy and governance refers to the process of defining, implementing, and monitoring a framework of rules that guide an organization's FinOps efforts.**

+Define your governance goals and success metrics. Review and document how existing policies are updated to account for FinOps efforts. Review with all stakeholders to get buy-in and endorsement.

+Establish a rollout plan that starts with audit rules and slowly (and safely) expands coverage to drive compliance without negatively impacting engineering efforts.

+Implementing a policy and governance strategy enables organizations to sustainably implement FinOps at scale. Policy and governance can act as a multiplier to FinOps efforts by building them natively into day-to-day operations.

+## Getting started

+When you first start managing cost in the cloud, you use the native compliance tracking and enforcement tools.

+- Review your existing FinOps processes to identify opportunities for policy to automate enforcement. Some examples:

+ - [Enforce your tagging strategy](../../governance/policy/tutorials/govern-tags.md) to support different capabilities, like:

+ - Organizational reporting hierarchy tags for [cost allocation](capabilities-allocation.md).

+ - Financial reporting tags for [chargeback](capabilities-chargeback.md).

+ - Environment and application tags for [workload management](capabilities-workloads.md).

+ - Business and application owners for [anomalies](capabilities-anomalies.md).

+ - Monitor required and suggested alerting for [anomalies](capabilities-anomalies.md) and [budgets](capabilities-budgets.md).

+ - Block or audit the creation of more expensive resource SKUs (for example, E-series virtual machines).

+ - Implementation of cost recommendations and unused resources for [utilization and efficiency](capabilities-efficiency.md).

+ - Application of Azure Hybrid Benefit for [utilization and efficiency](capabilities-efficiency.md).

+ - Monitor [commitment-based discounts](capabilities-commitment-discounts.md) coverage.

+- Identify what policies can be automated through [Azure Policy](../../governance/policy/overview.md) and which need other tooling.

+- Review and [implement built-in policies](../../governance/policy/assign-policy-portal.md) that align with your needs and goals.

+- Start small with audit policies and expand slowly (and safely) to ensure engineering efforts aren't negatively impacted.

+ - Test rules before you roll them out and consider a staged rollout where each stage has enough time to get used and garner feedback. Start small.

+## Building on the basics

+At this point, you have a basic set of policies in place that are being managed across the organization. As you move beyond the basics, consider the following points:

+- Formalize compliance reporting and promote within leadership conversations across stakeholders.

+ - Map governance efforts to FinOps efficiencies that can be mapped back to more business value with less effort.

+- Expand coverage of more scenarios.

+ - Consider evaluating ways to quantify the impact of each rule in cost and/or business value.

+- Integrate policy and governance into every conversation to establish a plan for how you want to automate the tracking and application of new policies.

+- Consider advanced governance scenarios outside of Azure Policy. Build monitoring solutions using systems like [Power Automate](/power-automate/getting-started) or [Logic Apps](../../logic-apps/logic-apps-overview.md).

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Cloud policy and governance capability](https://www.finops.org/framework/capabilities/policy-governance/) article in the FinOps Framework documentation.

+## Next steps

+- [Establishing a FinOps culture](capabilities-culture.md)

+- [Workload management and automation](capabilities-workloads.md)

+ Title: Managing shared cost

+description: This article helps you understand the managing shared cost capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Managing shared cost

+This article helps you understand the managing shared cost capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Managing shared cost refers to the process of redistributing the cost of shared services to the teams and applications that utilized them.**

+Identify shared costs and develop an allocation plan that defines the rules and methods for dividing the shared costs fairly and equitably. Track and report shared costs and their allocation to the relevant stakeholders. Regularly review and update allocation plan to ensure it remains accurate and fair.

+Effectively managing shared costs reduces overhead, increases transparency and accountability, and better aligns cloud costs to business value while maximizing the efficiencies and cost savings from shared services.

+## Before you begin

+Before you start, it's important to have a clear understanding of your organization's goals and priorities when it comes to managing shared costs. Keep in mind that not all shared costs may need to be redistributed, and some are more effectively managed with other means. Carefully evaluate each shared cost to determine the most appropriate approach for your organization.

+This guide doesn't cover commitment-based discounts, like reservations and savings plans. For details about how to handle showback and chargeback, refer to [Managing commitment-based discounts](capabilities-commitment-discounts.md).

+## Getting started

+When you first start managing cost in the cloud, you use the native allocation tools to manage shared costs. Start by identifying shared costs and how they should be handled.

+- If your organization previously implemented the [Cost allocation capability](capabilities-allocation.md), refer back to any notes about unallocated or shared costs.

+- Notify stakeholders that you're evaluating shared costs and request details about any known scenarios. Self-identification can save you significant time and effort.

+- Review the services that have been purchased and are being used with the [Services view in Cost analysis](../costs/cost-analysis-built-in-views.md#break-down-product-and-service-costs).

+- Familiarize yourself with each service to determine if they're designed for and/or could be used for shared resources. A few examples of commonly shared services are:

+ - Application hosting services, like Azure Kubernetes Service, Azure App Service, and Azure Virtual Desktop.

+ - Observability tools, like Azure Monitor and Log Analytics.

+ - Management and security tools, like Microsoft Defender for Cloud and DevTest Labs.

+ - Networking services, like ExpressRoute.

+ - Database services, like Cosmos DB and SQL databases.

+ - Collaboration and productivity tools, like Microsoft 365.

+- Contact stakeholders who are responsible for the potentially shared services. Make sure they understand if the shared services are shared and how costs are allocated today. If not accounted for, how allocation could or should be done.

+- Use [cost allocation rules in Microsoft Cost Management](../costs/allocate-costs.md) to redistribute shared costs based on static percentages or compute, network, or storage costs.

+- Regularly review and update allocation rules to ensure they remain accurate and fair.

+## Building on the basics

+At this point, your simple cost allocation scenarios may be addressed. You're left with more complicated scenarios that require more effort to accurately quantify and redistribute. As you move beyond the basics, consider the following points:

+- Establish and track common KPIs, like the percentage of unallocated shared costs.

+- Use utilization data from [Azure Monitor metrics](../../azure-monitor/essentials/data-platform-metrics.md) where possible to understand service usage.

+- Consider using application telemetry to quantify the distribution of shared costs. It's discussed more in [Measuring unit costs](capabilities-unit-costs.md).

+- Automate the process of identifying the percentage breakdown of shared costs and consider using allocation rules in Cost Management to redistribute the costs.

+- Automate cost allocation rules to update their respective percentages based on changing usage patterns.

+- Consider sharing targeted reporting about the distribution of shared costs with relevant stakeholders.

+- Build a reporting process to raise awareness of and drive accountability for unallocated shared costs.

+- Share guidance with stakeholders on how they can optimize shared costs.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Managing shared cost](https://www.finops.org/framework/capabilities/manage-shared-cloud-cost/) article in the FinOps Framework documentation.

+## Next steps

+- [Data analysis and showback](capabilities-analysis-showback.md)

+- [Chargeback and finance integration](capabilities-chargeback.md)

+- [Measuring unit costs](capabilities-unit-costs.md)

+ Title: Establishing a FinOps decision and accountability structure

+description: This article helps you understand the establishing a FinOps decision and accountability structure capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Establishing a FinOps decision and accountability structure

+This article helps you understand the establishing a FinOps decision and accountability structure capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Establishing a FinOps decision and accountability structure involves defining roles and responsibilities, bridging gaps between teams, and enabling cross-functional collaboration and conflict resolution.**

+Define the roles, responsibilities, and activities required to effectively manage cost within the organization. Delegate accountability and decision-making authority to a cross-functional steering committee that can provide balanced oversight for technical, financial, and business priorities.

+Describe the steering committee "chain of command" and how information moves within the company, aligning with the organization's goals and objectives. Document the principles and processes needed to address challenges and resolve conflicts.

+Establishing a FinOps steering committee can help stakeholders within an organization align on a single process. The committee can also decide on the "rules of engagement" to effectively adopt and drive FinOps. All the while, ensuring accountability, fairness, and transparency and making sure senior decision makers can make informed decisions quickly.

+## Getting started

+When you first start managing cost in the cloud, you may not need to build a FinOps steering committee. The need for a more formal process increases as your organization grows and adopts the cloud more. Consider the following starting points:

+- Start a recurring meeting with representatives from finance, business, and engineering teams.

+ - If you have a central team responsible for cost management, consider having them chair the committee.

+- Discuss and document the roles and responsibilities of each committee member.

+ - FinOps Foundation proposes one potential [responsibility assignment matrix (RACI model)](https://www.finops.org/wg/adopting-finops/#accountability-and-expectations-by-team-raci--daci-modeling).

+- Collaborate on [planning your first FinOps iteration](conduct-finops-iteration.md).

+ - Make notes where there are differing perspectives and opinions. Discuss those topics for alignment in the future.

+ - Start small and find common ground to enable the committee to execute a successful iteration. It's OK if you don't solve every problem.

+ - Document decisions and outline processes, key contacts, and required activities. Documentation can be a small checklist in early stages. Focus on winning as one rather than documenting everything and executing perfectly.

+## Building on the basics

+At this point, you have a regular cadence of meetings, but not much structure. As you move beyond the basics, consider the following points:

+- Review the [FinOps Framework guidance](https://www.finops.org/framework/capabilities/decision-accountability-structure/) for how to best scale out your FinOps steering committee efforts.

+- Review the Cloud Adoption Framework guidance for tips on how to [drive organizational alignment](/azure/cloud-adoption-framework/organize) on a larger scale. You may find opportunities to align with other governance initiatives.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, see the [Establishing a FinOps decision and accountability structure capability](https://www.finops.org/framework/capabilities/decision-accountability-structure/) article in the FinOps Framework documentation.

+## Next steps

+- [Onboarding workloads](capabilities-workloads.md)

+ Title: Measuring unit costs

+description: This article helps you understand the measuring unit costs capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Measuring unit costs

+This article helps you understand the measuring unit costs capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+ **_Measuring unit costs refers to the process of calculating the cost of a single unit of a business that can show the business value of the cloud._**

+Identify what a single unit is for your business ΓÇô like a sale transaction for an ecommerce site or a user for a social app. Map each unit to the supporting cloud services that support it. Split the cost of shared infrastructure with utilization data to quantify the total cost of each unit.

+Measuring unit costs provides insights into profitability and allows organizations to make data-driven business decisions regarding cloud investments. Unit economics is what ties the cloud to measurable business value.

+## Before you begin

+Before you can effectively measure unit costs, you need to familiarize yourself with [how you're charged for the services you use](https://azure.microsoft.com/pricing#product-pricing). Understanding the factors that contribute to costs, helps you break down the usage and costs and map them to individual units. Cost contributing-factors factors include compute, storage, networking, and data transfer. How your service usage aligns with the various pricing models (for example, pay-as-you-go, reservations, and Azure Hybrid Benefit) also impacts your costs.

+## Getting started

+Measuring unit costs isn't a simple task. Unit economics requires a deep understanding of your architecture and needs multiple datasets to pull together the full picture. The exact data you need depends on the services you use and the telemetry you have in place.

+- Start with application telemetry.

+ - The more comprehensive your application telemetry is, the simpler unit economics can be to generate. Log when critical functions are executed and how long they run. You can use that to deduce the run time of each unit or relative to a function that correlates back to the unit.

+ - When application telemetry isn't directly possible, consider workarounds that can log telemetry, like [API Management](../../api-management/api-management-key-concepts.md) or even [configuring alert rules in Azure Monitor](../../azure-monitor/alerts/alerts-create-new-alert-rule.md) that trigger [action groups](../../azure-monitor/alerts/action-groups.md) that log the telemetry. The goal is to get all usage telemetry into a single, consistent data store.

+ - If you don't have telemetry in place, consider setting up [Application Insights](../../azure-monitor/app/app-insights-overview.md), which is an extension of Azure Monitor.

+- Use [Azure Monitor metrics](../../azure-monitor/essentials/data-platform-metrics.md) to pull resource utilization data.

+ - If you don't have telemetry, see what metrics are available in Azure Monitor that can map your application usage to the costs. You need anything that can break down the usage of your resources to give you an idea of what percentage of the billed usage was from one unit vs. another.

+ - If you don't see the data you need in metrics, also check [logs and traces in Azure Monitor](../../azure-monitor/overview.md#data-platform). It may not be a direct correlation to usage but might be able to give you some indication of usage.

+- Use service-specific APIs to get detailed usage telemetry.

+ - Every service uses Azure Monitor for a core set of logs and metrics. Some services also provide more detailed monitoring and utilization APIs to get more details than are available in Azure Monitor. Explore [Azure service documentation](../../index.yml) to find the right API for the services you use.

+- Using the data you've collected, quantify the percentage of usage coming from each unit.

+ - Use pricing and usage data to facilitate this effort. It's typically best done after [Data ingestion and normalization](capabilities-ingestion-normalization.md) due to the high amount of data required to calculate accurate unit costs.

+ - Some amount of usage isn't mapped back to a unit. There are several ways to account for this cost, like distributing based on those known usage percentages or treating it as overhead cost that should be minimized separately.

+## Building on the basics

+- Automate any aspects of the unit cost calculation that haven't been fully automated.

+- Consider expanding unit cost calculations to include other costs, like external licensing, on-premises operational costs, and labor.

+- Build unit costs into business KPIs to maximize the value of the data you've collected.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Measuring unit costs capability](https://www.finops.org/framework/capabilities/measure-unit-costs/) article in the FinOps Framework documentation.

+## Next steps

+- [Data analysis and showback](capabilities-analysis-showback.md)

+- [Managing shared costs](capabilities-shared-cost.md)

+ Title: Workload management and automation

+description: This article helps you understand the workload management and automation capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+keywords:

+# Workload management and automation

+This article helps you understand the workload management and automation capability within the FinOps Framework and how to implement that in the Microsoft Cloud.

+## Definition

+**Workload management and automation refers to running resources only when necessary and at the level or capacity needed for the active workload.**

+Tag resources based on their up-time requirements. Review resource usage patterns and determine if they can be scaled down or even shutdown (to stop billing) during off-peak hours. Consider cheaper alternatives to reduce costs.

+An effective workload management and automation plan can significantly reduce costs by adjusting configuration to match supply to demand dynamically, ensuring the most effective utilization.

+## Getting started

+When you first start working with a service, consider the following points:

+- Can the service be stopped (and if so, stop billing)?

+ - If the service can't be stopped, review alternatives to determine if there are any options that can be stopped to stop billing.

+ - Pay close attention to noncompute charges that may continue to be billed when a resource is stopped so you're not surprised. Storage is a common example of a cost that continues to be charged even if a compute resource that was using the storage is no longer running.

+- Does the service support serverless compute?

+ - Serverless compute tiers can reduce costs when not active. Some examples: [Azure SQL Database](/azure/azure-sql/database/serverless-tier-overview), [Azure SignalR Service](/azure/azure-signalr/concept-service-mode), [Cosmos DB](../../cosmos-db/serverless.md), [Synapse Analytics](../../synapse-analytics/sql/on-demand-workspace-overview.md), [Azure Databricks](/azure/databricks/serverless-compute/).

+- Does the service support autostop or autoshutdown functionality?

+ - Some services support autostop natively, like [Microsoft Dev Box](../../dev-box/how-to-configure-stop-schedule.md), [Azure DevTest Labs](../../devtest-labs/devtest-lab-auto-shutdown.md), [Azure Lab Services](../../lab-services/how-to-configure-auto-shutdown-lab-plans.md), and [Azure Load Testing](../../load-testing/how-to-define-test-criteria.md#auto-stop-configuration).

+ - If you use a service that supports being stopped, but not autostopping, consider using a lightweight flow in [Power Automate](/power-automate/getting-started) or [Logic Apps](../../logic-apps/logic-apps-overview.md).

+- Does the service support autoscaling?

+ - If the service supports [autoscaling](/azure/architecture/best-practices/auto-scaling), configure it to scale based on your application's needs.

+ - Autoscaling can work with autostop behavior for maximum efficiency.

+- Consider automatically stopping and manually starting nonproduction resources during work hours to avoid unnecessary costs.

+ - Avoid automatically starting nonproduction resources that aren't used every day.

+ - If you choose to autostart, be aware of vacations and holidays where resources may get started automatically but not be used.

+ - Consider tagging manually stopped resources. [Save a query in Azure Resource Graph](../../governance/resource-graph/first-query-portal.md) or a view in the All resources list and pin it to the Azure portal dashboard to ensure all resources are stopped.

+- Consider architectural models such as containers and serverless to only use resources when they're needed, and to drive maximum efficiency in key services.

+## Building on the basics

+At this point, you have setup autoscaling and autostop behaviors. As you move beyond the basics, consider the following points:

+- Automate the process of automatically scaling or stopping resources that don't support it or have more complex requirements.

+ - Consider using automation services, like [Azure Automation](../../automation/automation-solution-vm-management.md) or [Azure Functions](../../azure-functions/start-stop-vms/overview.md).

+- [Assign an "Env" or Environment tag](../../azure-resource-manager/management/tag-resources.md) to identify which resources are for development, testing, staging, production, etc.

+ - Prefer assigning tags at a subscription or resource group level. Then enable the [tag inheritance policy for Azure Policy](../../governance/policy/samples/built-in-policies.md#tags) and [Cost Management tag inheritance](../costs/enable-tag-inheritance.md) to cover resources that don't emit tags with usage data.

+ - Consider setting up automated scripts to stop resources with specific up-time profiles (for example, stop developer VMs during off-peak hours if they haven't been used in 2 hours).

+ - Document up-time expectations based on specific tag values and what happens when the tag isn't present.

+ - [Use Azure Policy to track compliance](../../governance/policy/how-to/get-compliance-data.md) with the tag policy.

+ - Use Azure Policy to enforce specific configuration rules based on environment.

+ - Consider using "override" tags to bypass the standard policy when needed. Track the cost and report them to stakeholders to ensure accountability.

+- Consider establishing and tracking KPIs for low-priority workloads, like development servers.

+## Learn more at the FinOps Foundation

+This capability is a part of the FinOps Framework by the FinOps Foundation, a non-profit organization dedicated to advancing cloud cost management and optimization. For more information about FinOps, including useful playbooks, training and certification programs, and more, see the [Workload management and automation capability](https://www.finops.org/framework/capabilities/workload-management-automation) article in the FinOps Framework documentation.

+## Next steps

+- [Resource utilization and efficiency](capabilities-efficiency.md)

+- [Cloud policy and governance](capabilities-policy.md)

+- Advisor has only single-subscription scope recommendations. If you want to see recommendations for the entire billing scope (Billing account or billing profile), then:

+- In the Azure portal, navigate to Reservations > Add and then select the type that you want to see the recommendations for.

+- The recommendations quantity and savings are for a three-year reservation, where available. If a three-year reservation isn't sold for the service, the recommendation is calculated using the one-year reservation price.

+- The recommendation calculations include any special discounts that you might have on your on-demand usage rates.

+- If you purchase a shared-scope reservation, Advisor reservation purchase recommendations can take up to five days to disappear.

+- Azure classic compute resources such as classic VMs are explicitly excluded from reservation recommendations. Microsoft recommends that users avoid making long-term commitments to legacy services that are being deprecated.

+- [Windows software costs not included with reservations](reserved-instance-windows-software-costs.md)

+If you lower the reservation quantity, your savings are also reduced. Although utilization is increased, there might be periods when your reservations don't fully cover your use. Usage beyond your reservation quantity is used by more expensive pay-as-you-go resources. The following example image illustrates the point. We've manually reduced the reservation quantity to 4. The reservation utilization is increased, but the overall savings are reduced because pay-as-you-go costs are present.

+ > [!NOTE]

+ > The respective Azure Arc servers for EC2 instances or GCP virtual machines that no longer exist (and the respective Azure Arc servers with a status of ["Disconnected" or "Expired"](https://learn.microsoft.com/azure/azure-arc/servers/overview)) will be removed after 7 days. This process removes irrelevant Azure ARC entities, ensuring only Azure Arc servers related to existing instances are displayed.

+ > [!NOTE]

+ > The respective Azure Arc servers for EC2 instances or GCP virtual machines that no longer exist (and the respective Azure Arc servers with a status of ["Disconnected" or "Expired"](https://learn.microsoft.com/azure/azure-arc/servers/overview)) will be removed after 7 days. This process removes irrelevant Azure ARC entities, ensuring only Azure Arc servers related to existing instances are displayed.

+This article lists the recommendations you might see in Microsoft Defender for Cloud if you've connected an AWS account from the **Environment settings** page. The recommendations shown in your environment depend on the resources you're protecting and your customized configuration.

+### Data plane recommendations

+All the data plane recommendations listed [here](kubernetes-workload-protections.md#view-and-configure-the-bundle-of-recommendations) are supported under AWS after [enabling the Azure policy extension](kubernetes-workload-protections.md#enable-kubernetes-data-plane-hardening).

+This article lists the recommendations you might see in Microsoft Defender for Cloud if you've connected a GCP project from the **Environment settings** page. The recommendations shown in your environment depend on the resources you're protecting and your customized configuration.

+### Data plane recommendations

+All the data plane recommendations listed [here](kubernetes-workload-protections.md#view-and-configure-the-bundle-of-recommendations) are supported under GCP after [enabling the Azure policy extension](kubernetes-workload-protections.md#enable-kubernetes-data-plane-hardening).

+Azure DNS currently doesn't support purchasing of domain names. For an annual fee, you can buy a domain name by using [App Service domains](../app-service/manage-custom-dns-buy-domain.md#buy-and-map-an-app-service-domain) or a third-party domain name registrar. Your domains then can be hosted in Azure DNS for record management. For more information, see [Delegate a domain to Azure DNS](dns-domain-delegation.md).

+ Title: Microsoft Azure Data Manager for Energy csv parser ingestion workflow concept

+A CSV Parser [DAG](https://airflow.apache.org/docs/apache-airflow/1.10.12/concepts.html#dags) allows a customer to load data into Microsoft Azure Data Manager for Energy instance based on a custom schema that is, a schema that doesn't match the [OSDU&trade;](https://osduforum.org) Well Known Schema (WKS). Customers must create and register the custom schema using the Schema service before loading the data.

+A CSV Parser DAG implements an ELT (Extract Load and Transform) approach to data loading, that is, data is first extracted from the source system in a CSV format, and it's loaded into the Azure Data Manager for Energy instance. It could then be transformed to the [OSDU&trade;](https://osduforum.org) Well Known Schema using a mapping service.

+A CSV Parser DAG allows the customers to load the CSV data into the Microsoft Azure Data Manager for Energy instance. It parses each row of a CSV file and creates a storage metadata record. It performs `schema validation` to ensure that the CSV data conforms to the registered custom schema. It automatically performs `type coercion` on the columns based on the schema data type definition. It generates `unique id` for each row of the CSV record by combining source, entity type and a Base64 encoded string formed by concatenating natural key(s) in the data. It performs `unit conversion` by converting declared frame of reference information into appropriate persistable reference using the Unit service. It performs `CRS conversion` for spatially aware columns based on the Frame of Reference (FoR) information present in the schema. It creates `relationships` metadata as declared in the source schema. Finally, it `persists` the metadata record using the Storage service.

+* **File service** facilitates the management of files in the Azure Data Manager for Energy instance. It allows the user to securely upload, discovery and download files from the data platform.

+* **Schema service** facilitates the management of schemas in the Azure Data Manager for Energy instance. It allows the user to create, fetch and search for schemas in the data platform.

+* **Workflow service** facilitates the management of workflows in the Azure Data Manager for Energy instance. It's a wrapper service on top of the Airflow orchestration engine.

+To execute the CSV Parser DAG workflow, the user must first create and register the schema using the workflow service. Once the schema is created, the user then uses the File service to upload the CSV file to the Microsoft Azure Data Manager for Energy instances, and also creates the storage record of file generic kind. The file service then provides a file ID to the user, which is used while triggering the CSV Parser workflow using the Workflow service. The Workflow service provides a run ID, which the user could use to track the status of the CSV Parser workflow run.

+**IT Developers** build systems to connect data to domain applications (internal and external ΓÇô for example, Petrel) which enables data managers to deliver projects to geoscientists. The DDMS suite on Azure Data Manager for Energy helps automate these workflows and eliminates time spent managing updates.

+**Geoscientists** use domain applications for key Exploration and Production workflows such as Seismic interpretation and Well tie analysis. While these users won't directly interact with the DDMS, their expectations for data performance and accessibility will drive requirements for the DDMS in the Foundation Tier. Azure will enable geoscientists to stream cross domain data instantly in OSDU&trade; compatible applications (for example, Petrel) connected to Azure Data Manager for Energy.

+Azure Data Manager for Energy is an OSDU&trade; compatible product, meaning that its landscape and release model are dependent on OSDU&trade;.

+Currently, OSDU&trade; certification and release process are not fully defined yet and this topic should be defined as a part of the Azure Data Manager for Energy Foundation Architecture.

+OSDU&trade; R3 M8 is the base for the scope of the Azure Data Manager for Energy Foundation Private ΓÇô as a latest stable, tested version of the platform.

+[OSDU&trade; community DDMS Overview](https://community.opengroup.org/osdu/documentation/-/wikis/OSDU&trade;-(C)/Design-and-Implementation/Domain-&-Data-Management-Services#ddms-requirements) provides an extensive overview of DDMS motivation and community requirements from a user, technical, and business perspective. These principles are extended to Azure Data Manager for Energy.

+ Title: Microsoft Azure Data Manager for Energy entitlement concepts

+description: This article describes the various concepts regarding the entitlement services in Azure Data Manager for Energy

+Access management is a critical function for any service or resource. Entitlement service helps you manage who has access to your Azure Data Manager for Energy instance, what they can do with it, and what services they have access to.

+The entitlements service of Azure Data Manager for Energy allows you to create groups, and an entitlement group defines permissions on services/data sources for your Azure Data Manager for Energy instance. Users added by you to that group obtain the associated permissions.

+ Title: Microsoft Azure Data Manager for Energy - index and search workflow concepts

+# Azure Data Manager for Energy indexing and search workflows

+ Title: Microsoft Azure Data Manager for Energy manifest ingestion concepts

+Manifest-based file ingestion provides end-users and systems a robust mechanism for loading metadata about datasets in Azure Data Manager for Energy instance. This metadata is indexed by the system and allows the end-user to search the datasets.

+Azure Data Manager for Energy instance has out-of-the-box support for Manifest-based file ingestion workflow. `Osdu_ingest` Airflow DAG is pre-configured in your instance.

+Before running the Manifest-based file ingestion workflow, customers must ensure that the user accounts running the workflow have access to the core services (Search, Storage, Schema, Entitlement and Legal) and Workflow service (see [Entitlement roles](https://community.opengroup.org/osdu/platform/deployment-and-operations/infra-azure-provisioning/-/blob/master/docs/osdu-entitlement-roles.md) for details). As part of Azure Data Manager for Energy instance provisioning, the OSDU&trade; standard schemas and associated reference data are pre-loaded. Customers must ensure that the user account used for ingesting the manifests is included in appropriate owners and viewers ACLs. Customers must ensure that manifests are configured with correct legal tags, owners and viewers ACLs, reference data, etc.

+ Title: Microsoft Azure Data Manager for Energy - How to convert a segy to ovds file

+3. Ensure that an Azure Data Manager for Energy instance is created already

+ Title: Microsoft Azure Data Manager for Energy - How to convert segy to zgy file

+3. Ensure that your Azure Data Manager for Energy instance is created already

+ Title: How to enable CORS - Azure Data Manager for Energy

+# Use CORS for resource sharing in Azure Data Manager for Energy

+This document is to help you as user of Azure Data Manager for Energy to set up CORS policies.

+You can set CORS rules for each Azure Data Manager for Energy instance. When you set CORS rules for the instance, it gets applied automatically across all the services and storage accounts linked with your Azure Data Manager for Energy resource. Once you set the CORS rules, then a properly authorized request made against the service evaluates from a different domain to determine whether it's allowed according to the rules you've specified.

+## Enabling CORS on Azure Data Manager for Energy instance

+1. Create an **Azure Data Manager for Energy** instance.

+9. An **Azure Data Manager for Energy** instance is created with CORS policy.

+2. Rules evaluation proceeds if the origin domain is included in the list or all domains are allowed with the wildcard character (*). If the origin domain isn't included, the request fails.

+ Title: Create a Microsoft Azure Data Manager for Energy instance

+description: Quickly create an Azure Data Manager for Energy instance

+# Quickstart: Create an Azure Data Manager for Energy instance

+Get started by creating an Azure Data Manager for Energy instance on Azure portal on a web browser. You first register an Azure application on Active Directory and then use the application ID to create an Azure Data Manager for Energy instance in your chosen Azure Subscription and region.

+The setup of Azure Data Manager for Energy instance can be triggered using a simple interface on Azure portal and takes about 50 minutes to complete.

+Azure Data Manager for Energy is a managed "Platform as a service (PaaS)" offering from Microsoft that builds on top of the [OSDU&trade;](https://osduforum.org/) Data Platform. Azure Data Manager for Energy lets you ingest, transform, and export subsurface data by letting you connect your consuming in-house or third-party applications.

+Active Azure Subscription | You'll need the Azure subscription ID in which you want to install Azure Data Manager for Energy. You need to have appropriate permissions to create Azure resources in this subscription.

+Application ID | You'll need an [application ID](../active-directory/develop/application-model.md) (often referred to as "App ID" or a "client ID"). This application ID will be used for authentication to Azure Active Directory and will be associated with your Azure Data Manager for Energy instance. You can [create an application ID](../active-directory/develop/quickstart-register-app.md) by navigating to Active directory and selecting *App registrations* > *New registration*.

+## Create an Azure Data Manager for Energy instance

+1. Sign in to [Microsoft Azure Marketplace](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/MarketplaceOffersBlade/selectedMenuItemId/home)

+1. If you have access to multiple tenants, use the *Directories + subscriptions* filter in the top menu to switch to the tenant in which you want to install Azure Data Manager for Energy.

+1. Use the search bar in the Azure Marketplace (not the global Azure search bar on top of the screen) to search for *Azure Data Manager for Energy*.

+ [](media/quickstart-create-microsoft-energy-data-services-instance/search-meds-on-azure-marketplace.png#lightbox)

+1. In the search page, select *Create* on the card titled "Azure Data Manager for Energy".

+1. A new window appears. Complete the *Basics* tab by choosing the *subscription*, *resource group*, and the *region* in which you want to create your instance of Azure Data Manager for Energy. Enter the *App ID* that you created during the prerequisite steps.

+ [](media/quickstart-create-microsoft-energy-data-services-instance/input-basic-details.png#lightbox)

+ Data Partition name | Name should be 1-10 char long consisting of lowercase alphanumeric characters and hyphens. It should start with an alphanumeric character and not contain consecutive hyphens. The data partition names that you chose are automatically prefixed with your Azure Data Manager for Energy instance name. This compound name will be used to refer to your data partition in application and API calls.

+ > Azure Data Manager for Energy instance and data partition names, once created, cannot be changed later.

+1. Move to the next tab, *Networking*, and configure as needed. Learn more about [setting up a Private Endpoint in Azure Data Manager for Energy](../energy-data-services/how-to-set-up-private-links.md)

+

+ [](media/quickstart-create-microsoft-energy-data-services-instance/networking-tab.png#lightbox)

+1. Move to the next tab, *Encryption*, and configure as needed. Learn how to encrypt your data with [customer managed encryption keys](../energy-data-services/how-to-manage-data-security-and-encryption.md), and manage data security using [managed identities in Azure Data Manager for Energy](../energy-data-services/how-to-use-managed-identity.md).

+ [](media/quickstart-create-microsoft-energy-data-services-instance/encryption-tab.png#lightbox)

+1. Navigate to the *Tags* tab and enter any tags that you would want to specify. If nothing, this field can be left blank.

+1. Navigate to the *Resource Sharing (CORS)* tab and configure as needed. Learn more about [Use CORS for resource sharing in Azure Data Manager for Energy](../energy-data-services/how-to-enable-cors.md).

+ [](media/quickstart-create-microsoft-energy-data-services-instance/cors-tab.png#lightbox)

+

+1. Optional step: You can download an Azure Resource Manager (ARM) template and use it for automated deployments of Azure Data Manager for Energy in future. Select *View automation template* located in the *Review + create* tab.

+

+ [](media/quickstart-create-microsoft-energy-data-services-instance/deployment-progress.png#lightbox)

+ You will find the newly created Azure Data Manager for Energy resource in your resource group. Select it to open the resource UI on portal.

+

+

+ [](media/quickstart-create-microsoft-energy-data-services-instance/overview-data-manager-for-energy.png#lightbox)

+

+## Delete an Azure Data Manager for Energy instance

+Deleting a Microsoft Energy Data instance also deletes any data that you've ingested. This action is permanent and the ingested data can't be recovered. To delete an Azure Data Manager for Energy instance, complete the following steps:

+2. This step is optional. Go to Azure Active Directory and delete the *app registration* that you linked to your Azure Data Manager for Energy instance.

+After provisioning an Azure Data Manager for Energy instance, you can learn about user management on this instance.

+{

+}

+{

+}

+{

+}

+{

+}

+1. On the **Networking** page, for **Public network access**, select **Disabled** if you want the namespace to be accessed only via private endpoints.

+1. For **Allow trusted Microsoft services to bypass this firewall**, select **Yes** if you want to allow [trusted Microsoft services](#trusted-microsoft-services) to bypass this firewall.

+ :::image type="content" source="./media/private-link-service/public-access-disabled.png" alt-text="Screenshot of the Networking page with public network access as Disabled.":::

+ > * The recommendation is to configure encryption with xpn ciphers to avoid intermittent session drops observed with non-xpn ciphers on high speed links.

+- **SNAT** - More ports are available for outbound SNAT connections, reducing the potential for SNAT port exhaustion. At this time, Azure Firewall randomly selects the source public IP address to use for a connection. If you have any downstream filtering on your network, you need to allow all public IP addresses associated with your firewall. Consider using a [public IP address prefix](../virtual-network/ip-services/public-ip-address-prefix.md) to simplify this configuration.

+One of the challenges with using a large number of public IP addresses is when there are downstream IP address filtering requirements. Azure Firewall randomly selects the source public IP address to use for a connection, so you need to allow all public IP addresses associated with it. Even if you use [Public IP address prefixes](../virtual-network/ip-services/public-ip-address-prefix.md) and you need to associate 250 public IP addresses to meet your outbound SNAT port requirements, you still need to create and allow 16 public IP address prefixes.

+> [!WARNING]

+> Azure Front Door currently only supports Key Vault accounts in the same subscription as the Front Door configuration. Choosing a Key Vault under a different subscription than your Front Door will result in a failure.

+ **Resolution type** specifies how the MedTech service associates device data with FHIR Device resources and FHIR Patient resources. The MedTech service reads Device and Patient resources from the FHIR service using [device identifiers](https://www.hl7.org/fhir/r4/device-definitions.html#Device.identifier) and [patient identifiers](https://www.hl7.org/fhir/r4/patient-definitions.html#Patient.identifier). If an [encounter identifier](https://hl7.org/fhir/r4/encounter-definitions.html#Encounter.identifier) is specified and extracted from the device data, it's linked to the observation if an encounter exists on the FHIR service with that identifier. If the encounter identifier is successfully normalized, but no FHIR Encounter exists with that encounter identifier, a **FhirResourceNotFound** exception is thrown.

+ If **Create** was selected, and Device or Patient resources are missing when the MedTech service is reading the device data, new resources are created using the identifiers included in the device data.

+ If **Lookup** was selected, and Device or Patient resources are missing, an error occurs, and the device data isn't processed. A **DeviceNotFoundException** and/or a **PatientNotFoundException** error is generated, depending on the type of resource not found.

+You complete the following tasks:

+* Use Azure CLI to create and manage an Azure IoT hub that the ESP32 DevKit connects to

+To connect the ESP32 DevKit to Azure, you modify configuration settings, build the image, and flash the image to the device.

+1. Select <kbd>Shift</kbd>+<kbd>S</kbd> to open the save options. This menu lets you save the configuration to a file named *skconfig* in the current *.\aziotkit* directory.

+You can use Azure IoT Explorer to view and manage the properties of your devices. In the following sections, you use the Plug and Play capabilities that are visible in IoT Explorer to manage and interact with the ESP32 DevKit. These capabilities rely on the device model published for the ESP32 DevKit in the public model repository. You configured IoT Explorer to search this repository for device models earlier in this quickstart. In many cases, you can perform the same action without using plug and play by selecting IoT Explorer menu options. However, using plug and play often provides an enhanced experience. IoT Explorer can read the device model specified by a plug and play device and present information specific to that device.

+> [!div class="nextstepaction"]

+> [MQTT Application samples](https://github.com/Azure-Samples/MqttApplicationSamples)

+- Azure IoT [security best practices](../iot/iot-overview-security.md) to guide the deployment process.

+1. For both IoT Edge hub and IoT Edge agent, add an environment variable called **StorageFolder** that points to a directory in the module.

+ "StorageFolder": {

+ "StorageFolder": {

+On version 1.4 and newer, there's no need for manually setting ownership or permissions for host storage backing the `StorageFolder`. Permissions and ownership are automatically managed by the system modules during startup.

+> [!IMPORTANT]

+> Your PKI infrastructure should support RSA-2048 bit keys and EC P-256 keys. For example, your EST servers should support these key types. You can use other key types, but we only test RSA-2048 bit keys and EC P-256 keys.

+>

+Intel-based VMware ESXi [6.7](https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-esxi-vcenter-server-67-release-notes.html) and [7.0](https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-esxi-vcenter-server-70-release-notes.html) versions can host Azure IoT Edge for Linux on Windows on top of a Windows virtual machine. Read [VMware KB2009916](https://kb.vmware.com/s/article/2009916) for more information on VMware ESXi nested virtualization support.