+ - In **Authority**, find `Enter_the_Tenant_Subdomain_Here` and replace it with the subdomain of your tenant. For example, if your tenant primary domain is `contoso.onmicrosoft.com`, use `contoso`. If you don't have your tenant name, [learn how to read your tenant details](how-to-create-customer-tenant-portal.md#get-the-customer-tenant-details).

+2. Save the file.

+In this tutorial;

+1. Replace the following values with the values from the Azure portal:

+ - Find the `Enter_the_Application_Id_Here` value and replace it with the **Application ID (clientId)** of the app you registered in the Microsoft Entra admin center.

+ - In **Authority**, find `Enter_the_Tenant_Subdomain_Here` and replace it with the subdomain of your tenant. For example, if your tenant primary domain is `contoso.onmicrosoft.com`, use `contoso`. If you don't have your tenant name, [learn how to read your tenant details](how-to-create-customer-tenant-portal.md#get-the-customer-tenant-details).

+2. Save the file.

+| 1.27 Preview | Azure policy 1.0.1<br>Metrics-Server 0.6.3<br>KEDA 2.10.0<br>Open Service Mesh 1.2.3<br>Core DNS V1.9.4<br>0.12.0</br>Overlay VPA 0.11.0<br>Azure-Keyvault-SecretsProvider 1.4.1<br>Ingress AppGateway 1.2.1<br>Eraser v1.1.1<br>Azure Workload Identity V1.1.1<br>ASC Defender 1.0.56<br>AAD Pod Identity 1.8.13.6<br>Gitops 1.7.0<br>KMS 0.5.0|Cilium 1.12.8<br>CNI 1.4.44<br> Cluster Autoscaler 1.8.5.3<br> | OS Image Ubuntu 22.04 Cgroups V2 <br>ContainerD 1.7 for Linux and 1.6 for Windows<br>|Keda 2.10.0 |Because of Ubuntu 22.04 FIPS certification status, we'll switch AKS FIPS nodes from 18.04 to 20.04 from 1.27 preview onwards.

+If available for undelete, Azure will return a record of the API Management instance showing its `deletionDate` and `scheduledPurgeDate`, for example:

+## Reuse an API Management instance name after deletion

+You **can** reuse the name of an API Management instance in a new deployment:

+* After the instance has been permanently deleted (purged) from Azure.

+* In the same subscription as the original instance.

+You **can't** reuse the name of an API Management instance in a new deployment:

+* While the instance is soft-deleted.

+* In a subscription other than the one used to deploy the original instance, even after the original instance has been permanently deleted (purged) from Azure. This restriction applies whether the new subscription used is in the same or a different Azure Active Directory tenant. The restriction is in effect for several days or longer after deletion, depending on the subscription type.

+ This restriction is because Azure reserves the service host name to a customer's tenant for a reservation period to prevent the threat of subdomain takeover with dangling DNS entries. For more information, see [Prevent dangling DNS entries and avoid subdomain takeover](/azure/security/fundamentals/subdomain-takeover). To see all dangling DNS entries for subscriptions in an Azure AD tenant, see [Identify dangling DNS entries](/azure/security/fundamentals/subdomain-takeover#identify-dangling-dns-entries).

+ `func new` creates a subfolder matching the function name that contains a code file appropriate to the project's chosen language and a configuration file named *function.json*.

+

+ ```python

+ import azure.functions as func

+

+ app = func.FunctionApp()

+

+ @app.function_name(name="HttpTrigger1")

+ @app.route(route="hello")

+ def test_function(req: func.HttpRequest) -> func.HttpResponse:

+ return func.HttpResponse("HttpTrigger1 function processed a request!")

+ ```

+

+1. Open the local.settings.json project file and verify that the `AzureWebJobsFeatureFlags` setting has a value of `EnableWorkerIndexing`. This is required for Functions to interpret your project correctly as the Python v2 model. You'll add this same setting to your application settings after you publish your project to Azure.

+1. In the local.settings.json file, update the `AzureWebJobsStorage` setting as in the following example:

+ ```json

+ "AzureWebJobsStorage": "UseDevelopmentStorage=true",

+ ```

+ This tells the local Functions host to use the storage emulator for the storage connection currently required by the Python v2 model. When you publish your project to Azure, you'll need to instead use the default storage account. If you're instead using an Azure Storage account, set your storage account connection string here.

+ |**Select a template for your project's first function** | Choose `HTTP trigger`. |

+ |**Name of the function you want to create**| Enter `HttpExample`.|

+ |**Authorization level**| Choose `ANONYMOUS`, which lets anyone call your function endpoint. For more information about the authorization level, see [Authorization keys](functions-bindings-http-webhook-trigger.md#authorization-keys).|

+4. Visual Studio Code uses the provided information and generates an Azure Functions project with an HTTP trigger. You can view the local project files in the Explorer. The generated `function_app.py` project file contains your functions.

+5. Open the local.settings.json project file and verify that the `AzureWebJobsFeatureFlags` setting has a value of `EnableWorkerIndexing`. This is required for Functions to interpret your project correctly as the Python v2 model. You'll add this same setting to your application settings after you publish your project to Azure.

+6. In the local.settings.json file, update the `AzureWebJobsStorage` setting as in the following example:

+ This tells the local Functions host to use the storage emulator for the storage connection currently required by the Python v2 model. When you publish your project to Azure, you'll need to instead use the default storage account. If you're instead using an Azure Storage account, set your storage account connection string here.

+ This command creates a folder matching the name of the function, *classify*. In that folder are two files: *\_\_init\_\_.py*, which contains the function code, and *function.json*, which describes the function's trigger and its input and output bindings. For details on the contents of these files, see [Programming model](./functions-reference-python.md?pivots=python-mode-configuration#programming-model) in the Python developer guide.

+ This command creates a folder matching the name of the function, *classify*. In that folder are two files: *\_\_init\_\_.py*, which contains the function code, and *function.json*, which describes the function's trigger and its input and output bindings. For details on the contents of these files, see [Programming model](./functions-reference-python.md?pivots=python-mode-configuration#programming-model) in the Python developer guide.

+To help diagnose the problem, we've provided a [troubleshooting script](https://github.com/microsoft/Docker-Provider/tree/ci_prod/scripts/troubleshoot).

+content_well_notification:

+ - AI-contribution

+Resource providers marked with **- registered** in the previous section are automatically registered for your subscription. For other resource providers, you need to [register them](resource-providers-and-types.md). However, many resource providers are registered automatically when you perform specific actions. For example, when you create resources through the portal or by deploying an [Azure Resource Manager template](../templates/overview.md), Azure Resource Manager automatically registers any required unregistered resource providers.

+> Register a resource provider only when you're ready to use it. This registration step helps maintain least privileges within your subscription. A malicious user can't use unregistered resource providers.

+> Registering unnecessary resource providers may result in unrecognized apps appearing in your Azure Active Directory tenant. Microsoft adds the app for a resource provider when you register it. These apps are typically added by the Windows Azure Service Management API. To prevent unnecessary apps in your tenant, only register needed resource providers.

+To identify resource providers used for your existing Azure infrastructure, list the deployed resources. Specify the resource group containing the resources.

+az resource list --resource-group examplegroup

+```output

+```output

+The following example uses Python:

+```python

+import os

+from azure.identity import DefaultAzureCredential

+from azure.mgmt.resource import ResourceManagementClient

+subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

+credential = DefaultAzureCredential()

+resource_client = ResourceManagementClient(credential, subscription_id)

+resource_group_name = "examplegroup"

+resources = resource_client.resources.list_by_resource_group(resource_group_name)

+for resource in resources:

+ print(resource.type)

+```

+The results list the resource type. The resource provider namespace is the first part of the resource type. The following example shows the **Microsoft.KeyVault** resource provider.

+```output

+Microsoft.KeyVault/vaults

+```

+* Qatar Central

+* West US 3

+* **Windows**: Display names for services aren't supported. Use `sc.exe query` in the command prompt to explore service names.

+| processName | Name of a process to continuously kill (without the .exe). The process does not need to be running when the fault begins executing. |

+### Limitations

+* The agent-based network faults currently only support IPv4 addresses.

+### Limitations

+* The agent-based network faults currently only support IPv4 addresses.

+* The network disconnect fault only affects new connections. Existing active connections continue to persist. You can restart the service or process to force connections to break.

+* On Windows, the network disconnect fault currently only works with TCP or UDP packets.

+### Limitations

+* The agent-based network faults currently only support IPv4 addresses.

+## Network packet loss

+| Property | Value |

+|-|-|

+| Capability name | NetworkPacketLoss-1.0 |

+| Target type | Microsoft-Agent |

+| Supported OS types | Windows, Linux |

+| Description | Introduces packet loss for outbound traffic at a specified rate, between 0.0 (no packets lost) and 1.0 (all packets lost). This can help simulate scenarios like network congestion or network hardware issues. |

+| Prerequisites | Agent must run as administrator. If the agent is installed as a VM extension, it runs as administrator by default. |

+| Urn | urn:csci:microsoft:agent:networkPacketLoss/1.0 |

+| Parameters (key, value) | |

+| lossRate | The rate at which packets matching the destination filters will be lost, ranging from 0.0 to 1.0. |

+| virtualMachineScaleSetInstances | An array of instance IDs when this fault is applied to a virtual machine scale set. Required for virtual machine scale sets. |

+| destinationFilters | Delimited JSON array of packet filters (parameters below) that define which outbound packets to target for fault injection. Maximum of three.|

+| address | IP address that indicates the start of the IP range. |

+| subnetMask | Subnet mask for the IP address range. |

+| portLow | (Optional) Port number of the start of the port range. |

+| portHigh | (Optional) Port number of the end of the port range. |

+### Sample JSON

+```json

+{

+ "name": "branchOne",

+ "actions": [

+ {

+ "type": "continuous",

+ "name": "urn:csci:microsoft:agent:networkPacketLoss/1.0",

+ "parameters": [

+ {

+ "key": "destinationFilters",

+ "value": "[{\"address\":\"23.45.229.97\",\"subnetMask\":\"255.255.255.224\",\"portLow\":5000,\"portHigh\":5200}]"

+ },

+ {

+ "key": "lossRate",

+ "value": "0.5"

+ },

+ {

+ "key": "virtualMachineScaleSetInstances",

+ "value": "[0,1,2]"

+ }

+ ],

+ "duration": "PT10M",

+ "selectorid": "myResources"

+ }

+ ]

+}

+```

+### Limitations

+* The agent-based network faults currently only support IPv4 addresses.

+This fault has two available versions that you can use, Version 1.0 and Version 2.0. The main difference is that Version 2.0 allows you to filter by availability zones, only shutting down instances within a specified zone or zones.

+ "value": "{\"action\":\"pod-failure\",\"mode\":\"one\",\"selector\":{\"labelSelectors\":{\"app.kubernetes.io\/component\":\"tikv\"}}}"

+ "value": "{\"action\":\"latency\",\"mode\":\"one\",\"selector\":{\"labelSelectors\":{\"app\":\"etcd\"}},\"volumePath\":\"\/var\/run\/etcd\",\"path\":\"\/var\/run\/etcd\/**\/*\",\"delay\":\"100ms\",\"percent\":50}"

+ "value": "{\"mode\":\"all\",\"selector\":{\"labelSelectors\":{\"app\":\"nginx\"}},\"target\":\"Request\",\"port\":80,\"method\":\"GET\",\"path\":\"\/api\",\"abort\":true,\"scheduler\":{\"cron\":\"@every 10m\"}}"

+| sourceAddresses | A string that represents a JSON-delimited array of CIDR-formatted IP addresses. Can also be a [service tag name](../virtual-network/service-tags-overview.md) for an inbound rule, for example, `AppService`. An asterisk `*` can also be used to match all source IPs. |

+| destinationAddresses | A string that represents a JSON-delimited array of CIDR-formatted IP addresses. Can also be a [service tag name](../virtual-network/service-tags-overview.md) for an outbound rule, for example, `AppService`. An asterisk `*` can also be used to match all destination IPs. |

+## App Service Stop

+

+| Property | Value |

+| - | |

+| Capability name | Stop-1.0 |

+| Target type | Microsoft-AppService |

+| Description | Stops the targeted App Service applications, then restarts them at the end of the fault duration. This applies to resources of the "Microsoft.Web/sites" type, including App Service, API Apps, Mobile Apps, and Azure Functions. |

+| Prerequisites | None. |

+| Urn | urn:csci:microsoft:appService:stop/1.0 |

+| Fault type | Continuous. |

+| Parameters (key, value) | None. |

+### Sample JSON

+```json

+{

+ "name": "branchOne",

+ "actions": [

+ {

+ "type": "continuous",

+ "name": "urn:csci:microsoft:appService:stop/1.0",

+ "duration": "PT10M",

+ "parameters":[],

+ "selectorid": "myResources"

+ }

+ ]

+}

+```

+| Microsoft.Web/sites (service-direct) | Microsoft-AppService | Website Contributor |

+JavaScript Chat SDK supports real-time notifications. This feature lets clients listen to Communication Services for real-time updates and incoming messages to a chat thread without having to poll the APIs.

+Use an Event Grid resource to subscribe to chat related events (post operation) which can be plugged into your custom application notification service. You will need to validate(../../how-tos/event-grid/view-events-request-bin.md) and locally test events(../../how-tos/event-grid/local-testing-event-grid.md) once you set up the event grid resource to ensure that events are being sent.

+The client app can subscribe to following events:

+> [!NOTE]

+> Real time notifications are not to be used with server applications.

+For more information, see [Server Events](../../../event-grid/event-schema-communication-services.md?bc=/azure/bread/toc.json&toc=/azure/communication-services/toc.json).

+## Push notifications

+Android and iOS Chat SDKs support push notifications. To send push notifications for messages missed by your users while they were away, connect a Notification Hub resource with Communication Services resource to send push notifications and notify your application users about incoming chats and messages when the mobile app is not running in the foreground.

+IOS and Android SDK support the below event:

+- `chatMessageReceived` - when a new message is sent to a chat thread by a participant.

+Android SDK supports additional events:

+- `chatMessageEdited` - when a message is edited in a chat thread.

+- `chatMessageDeleted` - when a message is deleted in a chat thread.

+- `chatThreadCreated` - when a Communication Services user creates a chat thread.

+- `chatThreadDeleted` - when a Communication Services user deletes a chat thread.

+- `chatThreadPropertiesUpdated` - when chat thread properties are updated; currently, only updating the topic for the thread is supported.

+- `participantsAdded` - when a user is added as a chat thread participant.

+- `participantsRemoved` - when an existing participant is removed from the chat thread.

+- Familiarize yourself with the [Chat SDK](sdk-features.md)

+ az ad sp show --id bc313c14-387c-4e7d-a58e-70417303ee3b --query id -o tsv

+ ContosoIotHub->>ContosoIotHub: Check if certificate thumbprint matches record

+Create and save Log Analytics queries for threat detection centrally in the managing tenant, including [hunting queries](../../sentinel/extend-sentinel-across-workspaces-tenants.md#hunt-across-multiple-workspaces). These queries can be run across all of your customers' Microsoft Sentinel workspaces by using the Union operator and the [workspace() expression](../../azure-monitor/logs/workspace-expression.md).

+For more information, see [Cross-workspace querying](../../sentinel/extend-sentinel-across-workspaces-tenants.md#query-multiple-workspaces).

+You can use automation to manage multiple Microsoft Sentinel workspaces and configure [hunting queries](../../sentinel/hunting.md), playbooks, and workbooks. For more information, see [Cross-workspace management using automation](../../sentinel/extend-sentinel-across-workspaces-tenants.md#manage-multiple-workspaces-using-automation).

+> [!NOTE]

+> In some cases, you might need the identity to have access to the associated resource. For example,

+> suppose you have a managed identity for a logic app that needs access to update the application

+> settings for that same logic app from a workflow. You must give that identity access to the associated logic app.

+### Upgrade Windows OS

+Azure Migrate provides an option to customers to upgrade their Windows Server OS seamlessly during the migration. Azure Migrate OS upgrade allows you to move from an older operating system to a newer one while keeping your settings, server roles, and data intact. [Learn more](how-to-upgrade-windows.md).

+Azure Migrate OS upgrade uses an Azure VM [Custom script extension](../virtual-machines/extensions/custom-script-windows.md) to perform the following activities for an in-place upgrade experience:

+- A data disk containing Windows Server setup files is created and attached to the VM.

+- A Custom Script Extension called `InPlaceOsUpgrade` is enabled on the VM, which downloads a script from the storage account and initiates the upgrade in a quiet mode.

+ Title: Upgrade Windows Operating System

+description: Learn how to upgrade Windows OS during migration.

+ms.

+# Azure Migrate Windows Server upgrade (Preview)ΓÇ»

+This article describes how to upgrade Windows Server OS while migrating to Azure. Azure Migrate OS upgrade allows you to move from an older operating system to a newer one while keeping your settings, server roles, and data intact. You can move your on-premises server to Azure with an upgraded OS version of Windows Server using Windows upgrade.

+> [!NOTE]

+> This feature is currently available only for VMWare agentless migration.

+## Prerequisites

+- Ensure you have an existing Migrate project or [create](create-manage-projects.md) a project.

+- Ensure you have discovered the servers according to [Discover servers in VMware environment](tutorial-discover-vmware.md) and replicated the servers as described in [Migrate VMware VMs](tutorial-migrate-vmware.md#replicate-vms).

+- Verify the operating system disk has enoughΓÇ»[free space](https://learn.microsoft.com/windows-server/get-started/hardware-requirements#storage-controller-and-disk-space-requirements) to perform the in-place upgrade. The minimum disk space requirement is 32 GB.ΓÇ»

+- The upgrade feature only works for Windows Server Standard and Datacenter editions.

+- This feature does not work for Windows Server with an evaluation license and needs a full license. If you have any server with an evaluation license, upgrade to full edition before starting migration to Azure.

+- Disable antivirus and anti-spyware software and firewalls. These types of software can conflict with the upgrade process. Re-enable antivirus and anti-spyware software and firewalls after the upgrade is completed.

+- Ensure that your VM has the capability of adding another data disk as this feature requires the addition of an extra data disk temporarily for a seamless upgrade experience.ΓÇ»

+- For Private Endpoint enabled Azure Migrate projects, follow [these](migrate-servers-to-azure-using-private-link.md?pivots=agentlessvmware#replicate-vms) steps before initiating any Test migration/Migration with OS upgrade.

+> [!NOTE]

+> In case of OS upgrade failure, Azure Migrate may download the Windows SetupDiag for error details. Ensure the VM created in Azure post the migration has access to [SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). In case there is no access to SetupDiag, you may not be able to get detailed OS upgrade failure error codes but the upgrade can still proceed.

+## Overview

+The Windows OS upgrade capability helps you move from an older operating system to a newer one while keeping your settings, server roles, and data intact. Since both upgrade and migration operations are completed at once, this reduces duplicate planning, downtime, and test efforts. The upgrade capability also reduces the risk, as customers can first test their OS upgrade in an isolated environment in Azure using test migration without any impact on their on-premises server.   

+You can upgrade to up to two versions from the current version.  

+**Source** | **Supported target versions**

+ |

+Windows Server 2012 | Windows Server 2016

+Windows Server 2012 R2 | Windows Server 2016, Windows Server 2019

+Windows Server 2016 | Windows Server 2019, Windows Server 2022

+Windows Server 2019 | Windows Server 2022

+## Upgrade Windows OS during test migration

+To upgrade Windows during the test migration, follow these steps:

+1. On the **Get started** page > **Servers, databases and web apps**, select **Replicate**.

+

+ A Start Replication job begins. When the Start Replication job finishes successfully, the machines begin their initial replication to Azure.

+3. Select **Replicating servers** in **Migration and modernization** to monitor the replication status.

+4. InΓÇ»**Migration goals**ΓÇ»>ΓÇ»**Servers, databases and webapps**ΓÇ»>ΓÇ»**Migration and modernization**, selectΓÇ»**Replicated servers** under **Replications**.

+5. In the **Replicating machines** tab, right-click the VM to test and selectΓÇ»**Test migrate**.

+6. Select the **Upgrade available** option. In the pane that appears, select the target OS version that you want to upgrade to and select **Apply**.

+7. Select **Test migration** to initiate the test migration followed by the OS upgrade.

+8. After the migration job is successful, view the migrated Azure VM in **Virtual Machines** in the Azure portal. The machine name has the suffix *-Test*.

+ You can now use this server with upgraded OS to complete any application testing. The original server continues running on-premises without any impact while you test the newly upgraded server in an isolated environment.

+9. After the test is done, right-click the Azure VM inΓÇ»**Replicating machines**, and select **Clean up test migration**. This deletes the test VM and any resources associated with it.

+## Upgrade Windows OS during migration

+After you've verified that the test migration works as expected, you can migrate the on-premises machines. To upgrade Windows during the migration, follow these steps:

+1. On the **Get started** page > **Servers, databases and web apps**, select **Replicate**. A Start Replication job begins.

+2. InΓÇ»**Replicating machines**, right-click the VM and selectΓÇ»**Migrate**.

+3. InΓÇ»**Migrate**ΓÇ»>ΓÇ»**Shut down virtual machines and perform a planned migration with no data loss**, selectΓÇ»**Yes**ΓÇ»> **OK**.

+ - By default, Azure Migrate shuts down the on-premises VM to ensure minimum data loss.

+ - If you don't want to shut down the VM, select No.

+4. Select the **Upgrade available** option.

+5. In the pane that appears, select the target OS version that you want to upgrade to and select **Apply**. The upgrade available option changes to upgrade configured.

+5. Select **Migrate** to start the migration and the upgrade.

+## Next steps

+Investigate the [cloud migration journey](https://learn.microsoft.com/azure/architecture/cloud-adoption/getting-started/migrate) in the Azure Cloud Adoption Framework.

+

+ Title: Troubleshoot Windows upgrade issues

+description: Provides an overview of known issues in the Windows OS upgrade feature

+# Troubleshoot Windows OS upgrade issuesΓÇ»

+This article describes some common issues that you might encounter when you upgrade the Windows OS using the Migration and modernization tool. 

+## Cannot attach the OS setup disk as VM reached maximum disk allowed

+The Test Migration and Migration will fail in the prerequisite stage if the VM already has the maximum number of data disks based on its SKU. Since the workflow creates an additional data disk temporarily, it's mandatory to have n-1 (n represents maximum number of disks supported for the respective SKU of the VM) disks to complete the upgrade successfully.   

+### Recommended action

+Select a different target Azure VM SKU that can attach more data disks and retry the operation. Since Azure Migrate completed the migration and created a VM in Azure, retry the operation by following these steps:   

+1. Clean up the migration:  

+ 1. Test Migration: Right-click the Azure VM in **Replications** and select **Clean up test migration**.ΓÇ»

+ 1. Migration: Since the VM is already migrated to Azure, follow [these](https://learn.microsoft.com/azure/virtual-machines/windows-in-place-upgrade) steps here to upgrade the OS.

+2. Update the target VM SKU settings:   

+ 1. In the Azure portal, select the Azure Migrate project.   

+ 2. Go to **Migration tools** > **Replications** > Azure VM count.   

+ 3. Select the Replicating machine.   

+ 4. Go to **Compute and network**.   

+ 5. In **Compute**, change the VM size to support more data disks.   

+3. Verify that the operating system disk has enough [free space](https://learn.microsoft.com/windows-server/get-started/hardware-requirements#storage-controller-and-disk-space-requirements) to perform the in-place upgrade. The minimum disk space requirement is 32 GB. If more space is needed, follow [these](https://learn.microsoft.com/azure/virtual-machines/windows/expand-os-disk) steps to expand the operating system disk attached to the VM for a successful OS upgrade.   

+## Migration fails for Private endpoint enabled Azure Migrate projectsΓÇ»

+The migration fails if the storage account that you select for replicating VMs doesn't have the Firewall settings of the target VNET.

+### Recommended action

+Add the target VNET into the firewall in the storage account that you select in the above step for replicating VMs: 

+1. Go to **Networking** > **Firewall and Virtual Networks** > **Public Network Access – Enabled from selected Virtual Network and IP address** > **Virtual Network** > Add existing Virtual Network and add your target VNET. Then proceed with the Test Migration/Migration.   

+2. Perform the initial replication by following [these](migrate-servers-to-azure-using-private-link.md?pivots=agentlessvmware#replicate-vms) steps.ΓÇ»

+## Server is migrated without OS upgrade with status ΓÇ£Completed with errorsΓÇ¥ΓÇ»

+If the source OS version and the OS version to be upgraded are the same, the server migrates without an OS upgrade with the status **Completed with errors**. For example, if the source OS version is Windows 2019 and the upgrade option selected is Windows 2019, then the server is migrated without an OS upgrade with the status **Completed with errors**.ΓÇ»

+### Recommended action

+Ensure the current OS version is different from the target OS version.  

+## Next steps

+[Learn more](tutorial-migrate-vmware.md) about migrating VMware VMs.

+> [!NOTE]

+> If you're planning to upgrade your Windows operating system, Azure Migrate may download the Windows SetupDiag for error details in case upgrade fails. Ensure the VM created in Azure post the migration has access to [SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). In case there is no access to SetupDiag, you may not be able to get detailed OS upgrade failure error codes but the upgrade can still proceed.

+After creating the appliance, you check that it can connect to Azure Migrate: Server Assessment, configure it for the first time, and register it with the Azure Migrate project.

+ - **VM size**: If you're using assessment recommendations, the VM size dropdown shows the recommended size. Otherwise, Azure Migrate picks a size based on the closest match in the Azure subscription. Alternatively, pick a manual size in **Azure VM size**.

+1. You have an option to upgrade the Windows Server OS during test migration. To upgrade, select the **Upgrade available** option. In the pane that appears, select the target OS version that you want to upgrade to and select **Apply**. [Learn more](how-to-upgrade-windows.md).

+1. You have an option to upgrade the Windows Server OS during migration. To upgrade, select the **Upgrade available** option. In the pane that appears, select the target OS version that you want to upgrade to and select **Apply**. [Learn more](how-to-upgrade-windows.md).

+## Update (July 2023)

+- Public Preview: Upgrade your Windows OS during Migration using the Migration and modernization tool in your VMware environment. [Learn more](how-to-upgrade-windows.md).

+- Resolve issues impacting the performance data collection and accuracy of Azure VM and Azure VMware Solution assessment recommendation and improve the confidence ratings of assessments. [Learn more](common-questions-discovery-assessment.md).

+- Build a quick business case for servers imported via a .csv file. [Learn more](tutorial-discover-import.md).

+All outbound internet traffic traverses the NAT gateway to the internet. Use the following example to create a NAT gateway for the hub and spoke network.

+1. In the search box at the top of the portal, enter **NAT gateway**. Select **NAT gateways** in the search results.

+1. Select **+ Create**.

+1. In the **Basics** tab of **Create network address translation (NAT) gateway** enter or select the following information:

+ | Resource group | Select **Create new**. </br> Enter **test-rg** in **Name**. </br> Select **OK**. |

+ | NAT gateway name | Enter **nat-gateway**. |

+ | Region | Select **East US 2**. |

+1. Select **Next: Outbound IP**.

+1. In **Outbound IP** in **Public IP addresses**, select **Create a new public IP address**.

+1. Enter **public-ip-nat** in **Name**.

+1. Select **OK**.

+1. Select **Review + create**.

+1. Select **Create**.

+1. Select **+ Create**.

+1. In the **Basics** tab of **Create virtual network**, enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Name | Enter **vnet-hub**. |

+ | Region | Select **East US 2**. |

+1. Select **Next: IP Addresses**.

+1. In the **IP Addresses** tab in **IPv4 address space**, select the trash can to delete the address space that is auto populated.

+1. In **IPv4 address space** enter **10.0.0.0/16**.

+1. Select **+ Add subnet**.

+1. In **Add subnet** enter or select the following information:

+ | Subnet address range | Enter **10.0.0.0/24**. |

+1. Select **Add**.

+1. Select **+ Add subnet**.

+1. In **Add subnet** enter or select the following information:

+ | Subnet address range | Enter **10.0.253.0/28**. |

+ | NAT gateway | Select **nat-gateway**. |

+1. Select **Add**.

+1. Select **Next: Security**.

+1. In the **Security** tab in **BastionHost**, select **Enable**.

+1. Enter or select the following information:

+ | Bastion name | Enter **bastion**. |

+ | AzureBastionSubnet address space | Enter **10.0.1.0/26**. |

+ | Public IP address | Select **Create new**. </br> In **Name** enter **public-ip**. </br> Select **OK**. |

+1. Select **Review + create**.

+1. Select **Create**.

+It takes a few minutes for the bastion host to deploy. When the virtual network is created as part of the deployment, you can proceed to the next steps.

+The simulated NVA acts as a virtual appliance to route all traffic between the spokes and hub and traffic outbound to the internet. An Ubuntu virtual machine is used for the simulated NVA. Use the following example to create the simulated NVA and configure the network interfaces.

+1. Select **+ Create** then **Azure virtual machine**.

+1. In **Create a virtual machine** enter or select the following information in the **Basics** tab:

+ | Resource group | Select **test-rg**. |

+ | Virtual machine name | Enter **vm-nva**. |

+ | Region | Select **(US) East US 2**. |

+ | Image | Select **Ubuntu Server 22.04 LTS - x64 Gen2**. |

+1. Select **Next: Disks** then **Next: Networking**.

+1. In the Networking tab, enter or select the following information:

+ | Virtual network | Select **vnet-hub**. |

+ | Subnet | Select **subnet-public (10.0.253.0/28)**. |

+ | NIC network security group | Select **Advanced**. |

+ | Configure network security group | Select **Create new**. </br> In **Name** enter **nsg-nva**. </br> Select **OK**. |

+1. Leave the rest of the options at the defaults and select **Review + create**.

+1. Select **Create**.

+1. Select **vm-nva**.

+1. In the **Overview** select **Stop** if the virtual machine is running.

+1. Select **Networking** in **Settings**.

+1. In **Networking** select the network interface name next to **Network Interface:**. The interface name is the virtual machine name and random numbers and letters. In this example, the interface name is **vm-nva271**.

+1. In the network interface properties, select **IP configurations** in **Settings**.

+1. In **IP forwarding** select **Enabled**.

+1. Select **Apply**.

+1. When the apply action completes, select **ipconfig1**.

+1. In **Assignment** in **ipconfig1** select **Static**.

+1. In **IP address** enter **10.0.253.10**.

+1. Select **Save**.

+1. When the save action completes, return to the networking configuration for **vm-nva**.

+1. In **Networking** of **vm-nva** select **Attach network interface**.

+1. Select **Create network interface**.

+1. In **Create network interface** enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Name | Enter **nic-private**. |

+ | Subnet | Select **subnet-private (10.0.0.0/24)**. |

+ | Configure network security group | Select **nsg-nva**. |

+ | Private IP address | Enter **10.0.0.10**. |

+1. Select **Create**.

+1. Select **vm-nva**.

+1. Start **vm-nva**.

+1. When the virtual machine is completed booting, continue with the next steps.

+1. Select **Connect** then **Bastion**. Select **Use Bastion**.

+1. Enter the username and password you entered when the virtual machine was created.

+1. Select **Connect**.

+1. Enter the following information at the prompt of the virtual machine to enable IP forwarding:

+1. In the Vim editor, remove the **`#`** from the line **`net.ipv4.ip_forward=1`**:

+1. Enter the following information to enable internal NAT in the virtual machine:

+1. Use Vim to edit the configuration with the following information:

+1. Reboot the virtual machine:

+1. Select **+ Create**.

+1. In **Create Route table** enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Region | Select **East US 2**. |

+ | Name | Enter **route-table-nat-hub**. |

+1. Select **Review + create**.

+1. Select **Create**.

+1. In the search box at the top of the portal, enter **Route table**. Select **Route tables** in the search results.

+1. Select **route-table-nat-hub**.

+1. In **Settings** select **Routes**.

+1. Select **+ Add** in **Routes**.

+1. Enter or select the following information in **Add route**:

+ | Route name | Enter **default-via-nat-hub**. |

+ | Destination type | Select **IP Addresses**. |

+ | Next hop address | Enter **10.0.0.10**. </br> **_This is the IP address you added to the private interface of the NVA in the previous steps._**. |

+1. Select **Add**.

+1. Select **Subnets** in **Settings**.

+1. Select **+ Associate**.

+1. Enter or select the following information in **Associate subnet**:

+ | Virtual network | Select **vnet-hub (test-rg)**. |

+1. Select **OK**.

+1. Select **+ Create**.

+1. In the **Basics** tab of **Create virtual network**, enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Name | Enter **vnet-spoke-1**. |

+ | Region | Select **South Central US**. |

+1. Select **Next: IP Addresses**.

+1. In the **IP Addresses** tab in **IPv4 address space**, select the trash can to delete the address space that is auto populated.

+1. In **IPv4 address space** enter **10.1.0.0/16**.

+1. Select **+ Add subnet**.

+1. In **Add subnet** enter or select the following information:

+ | Subnet address range | Enter **10.1.0.0/24**. |

+1. Select **Add**.

+1. Select **Review + create**.

+1. Select **Create**.

+1. Select **vnet-hub**.

+1. Select **Peerings** in **Settings**.

+1. Select **+ Add**.

+1. Enter or select the following information in **Add peering**:

+ | Peering link name | Enter **vnet-hub-to-vnet-spoke-1**. |

+ | Peering link name | Enter **vnet-spoke-1-to-vnet-hub**. |

+ | Virtual network | Select **vnet-spoke-1**. |

+1. Select **Add**.

+1. Select **Refresh** and verify **Peering status** is **Connected**.

+Create a route table to force all inter-spoke and internet egress traffic through the simulated NVA in the hub virtual network.

+1. Select **+ Create**.

+1. In **Create Route table** enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Region | Select **South Central US**. |

+ | Name | Enter **route-table-nat-spoke-1**. |

+1. Select **Review + create**.

+1. Select **Create**.

+1. In the search box at the top of the portal, enter **Route table**. Select **Route tables** in the search results.

+1. Select **route-table-nat-spoke-1**.

+1. In **Settings** select **Routes**.

+1. Select **+ Add** in **Routes**.

+1. Enter or select the following information in **Add route**:

+ | Route name | Enter **default-via-nat-spoke-1**. |

+ | Destination type | Select **IP Addresses**. |

+ | Next hop address | Enter **10.0.0.10**. </br> **_This is the IP address you added to the private interface of the NVA in the previous steps._**. |

+1. Select **Add**.

+1. Select **Subnets** in **Settings**.

+1. Select **+ Associate**.

+1. Enter or select the following information in **Associate subnet**:

+ | Virtual network | Select **vnet-spoke-1 (test-rg)**. |

+1. Select **OK**.

+1. Select **+ Create** then **Azure virtual machine**.

+1. In **Create a virtual machine** enter or select the following information in the **Basics** tab:

+ | Resource group | Select **test-rg**. |

+ | Virtual machine name | Enter **vm-spoke-1**. |

+ | Region | Select **(US) South Central US**. |

+1. Select **Next: Disks** then **Next: Networking**.

+1. In the Networking tab, enter or select the following information:

+ | Virtual network | Select **vnet-spoke-1**. |

+ | Subnet | Select **subnet-private (10.1.0.0/24)**. |

+ | NIC network security group | Select **Advanced**. |

+ | Configure network security group | Select **Create new**. </br> Enter **nsg-spoke-1**. |

+ | Inbound rules | Select **+ Add an inbound rule**. </br> Select **HTTP** in **Service**. </br> Select **Add**. </br> Select **OK**. |

+1. Select **OK**.

+1. Leave the rest of the options at the defaults and select **Review + create**.

+1. Select **Create**.

+## Install IIS on spoke one test virtual machine

+IIS is installed on the Windows Server 2022 virtual machine to test outbound internet traffic through the NAT gateway and inter-spoke traffic in the hub and spoke network.

+1. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines** in the search results.

+1. Select **vm-spoke-1**.

+1. In **Operations**, select **Run command**.

+1. Select **RunPowerShellScript**.

+1. Enter the following script in **Run Command Script**:

+ ```powershell

+ # Install IIS server role

+ Install-WindowsFeature -name Web-Server -IncludeManagementTools

+

+ # Remove default htm file

+ Remove-Item C:\inetpub\wwwroot\iisstart.htm

+

+ # Add a new htm file that displays server name

+ Add-Content -Path "C:\inetpub\wwwroot\iisstart.htm" -Value $("Hello World from " + $env:computername)

+ ```

+1. Select **Run**.

+1. Wait for the script to complete before continuing to the next step. It can take a few minutes for the script to complete.

+1. When the script completes, the **Output*** displays the following:

+ ```output

+ Success Restart Needed Exit Code Feature Result

+ - -- --

+ True No Success {Common HTTP Features, Default Document, D...

+ ```

+

+1. Select **+ Create**.

+1. In the **Basics** tab of **Create virtual network**, enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Name | Enter **vnet-spoke-2**. |

+1. Select **Next: IP Addresses**.

+1. In the **IP Addresses** tab in **IPv4 address space**, select the trash can to delete the address space that is auto populated.

+1. In **IPv4 address space** enter **10.2.0.0/16**.

+1. Select **+ Add subnet**.

+1. In **Add subnet** enter or select the following information:

+ | Subnet address range | Enter **10.2.0.0/24**. |

+1. Select **Add**.

+1. Select **Review + create**.

+1. Select **Create**.

+1. Select **vnet-hub**.

+1. Select **Peerings** in **Settings**.

+1. Select **+ Add**.

+1. Enter or select the following information in **Add peering**:

+ | Peering link name | Enter **vnet-hub-to-vnet-spoke-2**. |

+ | Peering link name | Enter **vnet-spoke-2-to-vnet-hub**. |

+ | Virtual network | Select **vnet-spoke-2**. |

+1. Select **Add**.

+1. Select **Refresh** and verify **Peering status** is **Connected**.

+1. Select **+ Create**.

+1. In **Create Route table** enter or select the following information:

+ | Resource group | Select **test-rg**. |

+ | Name | Enter **route-table-nat-spoke-2**. |

+1. Select **Review + create**.

+1. Select **Create**.

+1. In the search box at the top of the portal, enter **Route table**. Select **Route tables** in the search results.

+1. Select **route-table-nat-spoke-2**.

+1. In **Settings** select **Routes**.

+1. Select **+ Add** in **Routes**.

+1. Enter or select the following information in **Add route**:

+ | Route name | Enter **default-via-nat-spoke-2**. |

+ | Destination type | Select **IP Addresses**. |

+ | Next hop address | Enter **10.0.0.10**. </br> **_This is the IP address you added to the private interface of the NVA in the previous steps._**. |

+1. Select **Add**.

+1. Select **Subnets** in **Settings**.

+1. Select **+ Associate**.

+1. Enter or select the following information in **Associate subnet**:

+ | Virtual network | Select **vnet-spoke-2 (test-rg)**. |

+1. Select **OK**.

+1. Select **+ Create** then **Azure virtual machine**.

+1. In **Create a virtual machine** enter or select the following information in the **Basics** tab:

+ | Resource group | Select **test-rg**. |

+ | Virtual machine name | Enter **vm-spoke-2**. |

+1. Select **Next: Disks** then **Next: Networking**.

+1. In the Networking tab, enter or select the following information:

+ | Virtual network | Select **vnet-spoke-2**. |

+ | Subnet | Select **subnet-private (10.2.0.0/24)**. |

+ | NIC network security group | Select **Advanced**. |

+ | Configure network security group | Select **Create new**. </br> Enter **nsg-spoke-2**. |

+ | Inbound rules | Select **+ Add an inbound rule**. </br> Select **HTTP** in **Service**. </br> Select **Add**. </br> Select **OK**. |

+1. Leave the rest of the options at the defaults and select **Review + create**.

+1. Select **Create**.

+## Install IIS on spoke two test virtual machine

+IIS is installed on the Windows Server 2022 virtual machine to test outbound internet traffic through the NAT gateway and inter-spoke traffic in the hub and spoke network.

+1. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines** in the search results.

+1. Select **vm-spoke-2**.

+1. In **Operations**, select **Run command**.

+1. Select **RunPowerShellScript**.

+1. Enter the following script in **Run Command Script**:

+ ```powershell

+ # Install IIS server role

+ Install-WindowsFeature -name Web-Server -IncludeManagementTools

+

+ # Remove default htm file

+ Remove-Item C:\inetpub\wwwroot\iisstart.htm

+

+ # Add a new htm file that displays server name

+ Add-Content -Path "C:\inetpub\wwwroot\iisstart.htm" -Value $("Hello World from " + $env:computername)

+ ```

+1. Select **Run**.

+1. Wait for the script to complete before continuing to the next step. It can take a few minutes for the script to complete.

+1. When the script completes, the **Output*** displays the following:

+ ```output

+ Success Restart Needed Exit Code Feature Result

+ - -- --

+ True No Success {Common HTTP Features, Default Document, D...

+ ```

+Connect to the Windows Server 2022 virtual machines you created in the previous steps to verify that the outbound internet traffic is leaving the NAT gateway.

+1. Select **public-ip-nat**.

+1. Make note of value in **IP address**. The example used in this article is **52.153.224.79**.

+1. Select **vm-spoke-1**.

+1. Select **Connect** then **Bastion**. Select **Use Bastion**.

+1. Enter the username and password you entered when the virtual machine was created.

+1. Select **Connect**.

+1. Open **Microsoft Edge** when the desktop finishes loading.

+1. In the address bar, enter **https://whatsmyip.com**.

+1. Verify the outbound IP address displayed is the same as the IP of the NAT gateway you obtained previously.

+1. Leave the bastion connection open to **vm-spoke-1**.

+1. Select **vm-spoke-2**.

+1. Select **Connect** then **Bastion**. Select **Use Bastion**.

+1. Enter the username and password you entered when the virtual machine was created.

+1. Select **Connect**.

+1. Open **Microsoft Edge** when the desktop finishes loading.

+1. In the address bar, enter **https://whatsmyip.com**.

+1. Verify the outbound IP address displayed is the same as the IP of the NAT gateway you obtained previously.

+1. Leave the bastion connection open to **vm-spoke-2**.

+Traffic from spoke one to spoke two and spoke two to spoke one route through the simulated NVA in the hub virtual network. Use the following examples to verify the routing between spokes of the hub and spoke network.

+Use Microsoft Edge to connect to the web server on **vm-spoke-2** you installed in the previous steps.

+1. Return to the open bastion connection to **vm-spoke-1**.

+1. Open **Microsoft Edge** if it's not open.

+1. In the address bar, enter **10.2.0.4**.

+1. Verify the IIS page is displayed from **vm-spoke-2**.

+ :::image type="content" source="./media/tutorial-hub-spoke-route-nat/iis-myvm-spoke-1.png" alt-text="Screenshot of default IIS page on vm-spoke-1.":::

+1. Close the bastion connection to **vm-spoke-1**.

+Use Microsoft Edge to connect to the web server on **vm-spoke-1** you installed in the previous steps.

+1. Return to the open bastion connection to **vm-spoke-2**.

+1. Open **Microsoft Edge** if it's not open.

+1. In the address bar, enter **10.1.0.4**.

+1. Verify the IIS page is displayed from **vm-spoke-1**.

+ :::image type="content" source="./media/tutorial-hub-spoke-route-nat/iis-myvm-spoke-2.png" alt-text="Screenshot of default IIS page on vm-spoke-2.":::

+1. Close the bastion connection to **vm-spoke-1**.

+ | URI, FQDN or IP address | Enter *www\.bing.com*. |

+You can delete a flow log using [PowerShell](/powershell/module/az.network/remove-aznetworkwatcherflowlog), the [Azure CLI](/cli/azure/network/watcher/flow-log#az-network-watcher-flow-log-delete), or the [REST API](/rest/api/network-watcher/flowlogs/delete).

+1. Select **+ Create**.

+ Be sure to use the same embedding model for both indexing and queries. At query time, you must include a step that converts the user's query string into a vector.

+Prior to indexing, assemble a document payload that includes vector data. The document structure must conform to the index schema. Make sure your documents:

+1. Provide a field or a metadata property that uniquely identifies each document. All search indexes require a document key. Your documents must have one field or property that can be mapped to type `Edm.String` and `key=true` in the search index.

+ Vector fields contain vector data generated by embedding models, one embedding per field. We recommend the embedding models in [Azure OpenAI](https://aka.ms/oai/access), such as **text-embedding-ada-002** for text documents or the [Image Retrieval REST API](/rest/api/computervision/2023-02-01-preview/image-retrieval/vectorize-image) for images.

+1. Provide other fields with alphanumeric content for the query response and for hybrid query scenarios that include full text search or semantic ranking in the same request.

+Your search index should include fields and content for all of the query scenarios you want to support. Suppose you want to search or filter over product names, versions, metadata, or addresses. In this case, similarity search isn't especially helpful. Keyword search, geo-search, or filters would be a better choice. A search index that includes a comprehensive field collection of vector and non-vector data provides maximum flexibility for query construction and response composition.

+> + Vectors are added to fields in a search index. Internally, a *vector index* is created for each vector field, but indexing and queries target fields in a search index, and not the vector indexes directly.

+> + Both new and existing search indexes support vector search. However, there is a small subset of older services that don't support vector search. In this case, a new search service must be created to use it.

+1. Use the [Create or Update Index Preview REST API](/rest/api/searchservice/preview-api/create-or-update-index) to create the index.

+1. Add a `vectorSearch` section in the index that specifies the algorithm used to create the embedding space. Currently, only `"hnsw"` is supported. For "metric", valid values are `cosine`, `euclidean`, and `dotProduct`. The `cosine` metric is specified because it's the similarity metric that the Azure OpenAI models use to create embeddings.

+1. Add vector fields to the fields collection. You can store one generated embedding per document field. For each vector field:

+ + Assign the `Collection(Edm.Single)` data type.

+ + For `Collection(Edm.Single)`, the "filterable", "facetable", "sortable" attributes are "false" by default. Don't set them to "true" because those behaviors don't apply within the context of vector fields and the request will fail.

+ + "retrievable" set to "true" allows you to display the raw vectors (for example, as a verification step), but doing so will increase storage. Set to "false" if you don't need to return raw vectors. You don't need to return vectors for a query, but if you're passing a vector result to a downstream app then set "retrievable" to "true".

+1. Add other fields that define the substance and structure of the textual content you're indexing. At a minimum, you need a document key.

+ You should also add fields that are useful in the query or in its response. The example below shows vector fields for title and content ("titleVector", "contentVector") that are equivalent to vectors. It also provides fields for equivalent textual content ("title", "content") useful for sorting, filtering, and reading in a search result.

+ An index definition with the described elements looks like this:

+ "filterable": true,

+ "sortable": true,

+ "kind": "hnsw",

+ "hnswParameters": {

+ "m": 4,

+ "efConstruction": 400,

+ "efSearch": 500,

+ "metric": "cosine"

+ }

+Query execution in Cognitive Search doesn't include vector conversion. Encoding (text-to-vector) of the query string requires that you pass the text to an embedding model for vectorization. You would then pass the output of the call to the embedding model to the search engine for similarity search over vector fields.

+If you aren't sure whether your search index already has vector fields, look for:

+You can also send an empty query (`search=*`) against the index. If the vector field is "retrievable", the response includes a vector field consisting of an array of floating point values.

+The expected response is 202 for a successful call to the deployed model. The body of the response provides the vector representation of the "input". The vector for the query is in the "embedding" field. For testing purposes, you would copy the value of the "embedding" array into "vector.value" in a query request, using syntax shown in the next several sections. The actual response for this call to the deployment model includes 1536 embeddings, trimmed here for brevity.

+The sample vector query for this article is: `"what Azure services support full text search"`. The query targets the "contentVector" field.

+Notice that "select" returns textual fields from the index. Although the vector field is "retrievable" in this example, its content isn't usable as a search result.

+A hybrid query combines full text search and vector search, where the `"search"` parameter takes a query string and `"vectors.value"` takes the vector query. The search engine runs full text and vector queries in parallel. All matches are evaluated for relevance using Reciprocal Rank Fusion (RRF) and a single result set is returned in the response.

+Hybrid queries are useful because they add support for filters, orderby, and [semantic search](semantic-how-to-query-request.md) For example, in addition to the vector query, you could filter by location or search over product names or titles, scenarios for which similarity search isn't a good fit.

+You can set the "vectors.fields" property to multiple vector fields. For example, the Postman collection has vector fields named "titleVector" and "contentVector". Your vector query executes over both the "titleVector" and "contentVector" fields, which must have the same embedding space since they share the same query vector.

+You can issue a search request containing multiple query vectors using the "vectors" query parameter. The queries execute concurrently in the search index, each one looking for similarities in the target vector fields. The result set is a union of the documents that matched both vector queries. A common example of this query request is when using models such as [CLIP](https://openai.com/research/clip) for a multi-modal vector search where the same model can vectorize image and non-image content.

+## Configure a query response

+When you're setting up the vector query, think about the response structure. The response is a flattened rowset. Parameters on the query determine which fields are in each row and how many rows are in the response. The search engine ranks the matching documents and returns the most relevant results.

+### Fields in a response

+Search results are composed of "retrievable" fields from your search index. A result is either:

+The examples in this article used a "select" statement to specify text (non-vector) fields in the response.

+> [!NOTE]

+> Vectors aren't designed for readability, so avoid returning them in the response. Instead, choose non-vector fields that are representative of the search document. For example, if the query targets a "descriptionVector" field, return an equivalent text field if you have one ("description") in the response.

+### Number of results

+A query might match to any number of documents, as many as all of them if the search criteria are weak (for example "search=*" for a null query). Because it's seldom practical to return unbounded results, you should specify a maximum for the response:

+Both "k" and "top" are optional. Unspecified, the default number of results in a response is 50. You can set "top" and "skip" to [page through more results](search-pagination-page-layout.md#paging-results) or change the default.

+### Ranking

+Ranking of results is computed by either:

+Azure OpenAI embedding models use cosine similarity, so if you're using Azure OpenAI embedding models, `cosine` is the recommended metric. Other supported ranking metrics include `euclidean` and `dotProduct`.

+Multiple sets are created if the query targets multiple vector fields, or if the query is a hybrid of vector and full text search, with or without the optional semantic reranking capabilities of [semantic search](semantic-search-overview.md). Within vector search, a vector query can only target one internal vector index. So for [multiple vector fields](#query-syntax-for-vector-query-over-multiple-fields) and [multiple vector queries](#query-syntax-for-multiple-vector-queries), the search engine generates multiple queries that target the respective vector indexes of each field. Output is a set of ranked results for each query, which are fused using RRF. For more information, see [Vector query execution and scoring](vector-search-ranking.md).

+Vector search is a new capability for indexing, storing, and retrieving vector embeddings from a search index. You can use it to power similarity search, multi-modal search, recommendations engines, or applications implementing the [Retrieval Augmented Generation (RAG) architecture](https://arxiv.org/abs/2005.11401).

+Support for vector search is in public preview and available through the [**2023-07-01-Preview REST APIs**](/rest/api/searchservice/index-preview). To use vector search, define a *vector field* in the index definition and index documents with vector data. Then you can issue a search request with a query vector, returning documents with the requested `k` nearest neighbors (kNN) according to the selected vector similarity metric.

+This article is for developers who need a deeper understanding of vector query execution and ranking in Azure Cognitive Search.

+In a vector query, the search query is a vector as opposed to text in full-text queries. Documents that match the vector query are ranked using vector similarity configured on the vector field defined in the index. A vector query specifies the `k` parameter, which determines how many nearest neighbors of the query vector should be returned from the index.

+If a query request is about dogs, the model maps the query into a vector that exists somewhere in the cluster of vectors representing documents about dogs. Identifying which vectors are the most similar to the query, based on a similarity metric, determines which documents are the most relevant.

+For normalized embedding spaces, dotProduct is equivalent to the cosine similarity, but is more efficient.

+Learn how to [prioritize your data connectors](prioritize-data-connectors.md) as part of the Microsoft Sentinel deployment process.

+> Many solutions listed in the following sections require a custom data connector. For more information, see [Resources for creating Microsoft Sentinel custom connectors](create-custom-connector.md).

+|**Requires log filtering** | Use Logstash <br><br>Use Azure Functions <br><br> Use LogicApps <br><br> Use custom code (.NET, Python) | While filtering can lead to cost savings, and ingests only the required data, some Microsoft Sentinel features aren't supported, such as [UEBA](identify-threats-with-entity-behavior-analytics.md), [entity pages](entity-pages.md), [machine learning](bring-your-own-ml.md), and [fusion](fusion.md). <br><br>When configuring log filtering, make updates in resources such as threat hunting queries and analytics rules |

+|**Requires custom logs** | Collect files from specific folder paths <br><br>Use API ingestion <br><br>Use PowerShell <br><br>Use Logstash | You may have issues filtering your logs. <br><br>Custom methods aren't supported. <br><br>Custom connectors may require developer skills. |

+|**Requires log filtering** | Use Syslog-NG <br><br>Use Rsyslog <br><br>Use FluentD configuration for the agent <br><br> Use the Azure Monitor Agent/Microsoft Monitoring Agent <br><br> Use Logstash | Some Linux distributions might not be supported by the agent. <br> <br>Using Syslog or FluentD requires developer knowledge. <br><br>For more information, see [Connect to Windows servers to collect security events](connect-windows-security-events.md) and [Resources for creating Microsoft Sentinel custom connectors](create-custom-connector.md). |

+|**Requires tagging and enrichment at ingestion** | Use Logstash for enrichment, or custom methods, such as API or Event Hubs. | You may have extra effort required for filtering. |

+|**RBAC, tagging, and enrichment at ingestion** | Create custom collection via Logstash or the Log Analytics API. | RBAC isn't supported for custom tables <br><br>Row-level RBAC isn't supported for any tables. |

+To reference data that's held in other Microsoft Sentinel workspaces, such as in [cross-workspace workbooks](extend-sentinel-across-workspaces-tenants.md#use-cross-workspace-workbooks), use [cross-workspace queries](extend-sentinel-across-workspaces-tenants.md#query-multiple-workspaces).

+In this article, you learned about key decision factors to help you determine the right workspace architecture for your organizations.

+> [!div class="nextstepaction"]

+> >[Design your Microsoft Sentinel workspace architecture](design-your-workspace-architecture.md)

+## Learn more

+## Next steps

+In this article, you learned how to plan costs and understand the billing for Microsoft Sentinel.

+> [!div class="nextstepaction"]

+> >[Deploy Microsoft Sentinel](deploy-overview.md)

+ Title: Configure Microsoft Sentinel content

+description: In this step of your deployment, you configure the Microsoft Sentinel security content, like your data connectors, analytics rules, automation rules, and more.

+#Customer intent: As a SOC analyst, I want to configure the Microsoft Sentinel security content, so I can protect my organization against threats.

+# Configure Microsoft Sentinel content

+In the previous deployment step, you enabled Microsoft Sentinel, health monitoring, and the required solutions. In this article, you learn how to configure the different types of Microsoft Sentinel security content, which allow you to detect, monitor, and respond to security threats across your systems.

+## Configure your security content

+|Step |Description |

+|||

+|**Set up data connectors** |Based on the [data sources you selected when you planned your deployment](prioritize-data-connectors.md), and after [enabling the relevant solutions](enable-sentinel-features-content.md), you can now install or set up your data connectors.<br><br>- If you're using an existing connector, [find your connector](data-connectors-reference.md) from this full list of data connectors.<br>- If you're creating a custom connector, use [these resources](create-custom-connector.md).<br>- If you're setting up a connector to ingest CEF or Syslog logs, review these [options](connect-cef-syslog-options.md). |

+|**Set up analytics rules** |After you've set up Microsoft Sentinel to collect data from all over your organization, you can begin using threat detection rules or [analytics rules](detect-threats-built-in.md). Select the steps you need to set up and configure your analytics rules:<br><br>- [Create a scheduled query rule](detect-threats-custom.md): Create custom analytics rules to help discover threats and anomalous behaviors in your environment.<br>- [Map data fields to entities](map-data-fields-to-entities.md): Add or change entity mappings in an existing analytics rule.<br>- [Surface custom details in alerts](surface-custom-details-in-alerts.md): Add or change custom details in an existing analytics rule.<br>- [Customize alert details](customize-alert-details.md): Override the default properties of alerts with content from the underlying query results.<br>- [Export and import analytics rules](import-export-analytics-rules.md): Export your analytics rules to Azure Resource Manager (ARM) template files, and import rules from these files. The export action creates a JSON file in your browser's downloads location, that you can then rename, move, and otherwise handle like any other file.<br>- [Create near-real-time (NRT) detection analytics rules](create-nrt-rules.md): Create near-time analytics rules for up-to-the-minute threat detection out-of-the-box. This type of rule was designed to be highly responsive by running its query at intervals just one minute apart.<br>- [Work with anomaly detection analytics rules](work-with-anomaly-rules.md): Work with built-in anomaly templates that use thousands of data sources and millions of events, or change thresholds and parameters for the anomalies within the user interface.<br>- [Manage template versions for your scheduled analytics rules](manage-analytics-rule-templates.md): Track the versions of your analytics rule templates, and either revert active rules to existing template versions, or update them to new ones.<br>- [Handle ingestion delay in scheduled analytics rules](ingestion-delay.md): Learn how ingestion delay might impact your scheduled analytics rules and how you can fix them to cover these gaps. |

+|**Set up automation rules** |[Create automation rules](create-manage-use-automation-rules.md). Define the triggers and conditions that determine when your [automation rule](automate-incident-handling-with-automation-rules.md) runs, the various actions that you can have the rule perform, and the remaining features and functionalities. |

+|**Set up playbooks** |A [playbook](automate-responses-with-playbooks.md) is a collection of remediation actions that you run from Microsoft Sentinel as a routine, to help automate and orchestrate your threat response. To set up playbooks:<br><br>- Review these [steps for creating a playbook](automate-responses-with-playbooks.md#steps-for-creating-a-playbook)<br>- [Create playbooks from templates](use-playbook-templates.md): A playbook template is a prebuilt, tested, and ready-to-use workflow that can be customized to meet your needs. Templates can also serve as a reference for best practices when developing playbooks from scratch, or as inspiration for new automation scenarios. |

+|**Set up workbooks** |[Workbooks](monitor-your-data.md) provide a flexible canvas for data analysis and the creation of rich visual reports within Microsoft Sentinel. Workbook templates allow you to quickly gain insights across your data as soon as you connect a data source. To set up workbooks:<br><br>- [Create custom workbooks across your data](monitor-your-data.md#create-new-workbook)<br>- [Use existing workbook templates available with packaged solutions](monitor-your-data.md#use-a-workbook-template) |

+|**Set up watchlists** |[Watchlists](watchlists.md) allow you to correlate data from a data source you provide with the events in your Microsoft Sentinel environment. To set up watchlists:<br><br>- [Create watchlists](watchlists-create.md)<br>- [Build queries or detection rules with watchlists](watchlists-queries.md): Query data in any table against data from a watchlist by treating the watchlist as a table for joins and lookups. When you create a watchlist, you define the SearchKey. The search key is the name of a column in your watchlist that you expect to use as a join with other data or as a frequent object of searches. |

+## Next steps

+In this article, you learned how to configure the different types of Microsoft Sentinel security content.

+> [!div class="nextstepaction"]

+>>[Set up multiple workspaces](use-multiple-workspaces.md)

+ Title: Configure data retention and archive in Microsoft Sentinel

+description: Towards the end of your deployment procedure, you set up data retention to suit your organization's needs.

+#Customer intent: As a SOC analyst, I want to set up data retention and archive settings so I can retain the data that's important to my organization in the long term.

+# Configure data retention and archive in Microsoft Sentinel

+In the previous deployment step, you enabled the User and Entity Behavior Analytics (UEBA) feature to streamline your analysis process. In this article, you learn how to set up data retention and archive, to make sure your organization retains the data that's important in the long term.

+## Configure data retention and archive

+Retention policies define when to remove or archive data in a Log Analytics workspace. Archiving lets you keep older, less used data in your workspace at a reduced cost. To set up data retention, use one or both of these methods, depending on your use case:

+- [Configure data retention and archive for one or more tables](../azure-monitor/logs/data-retention-archive.md) (one table at a time)

+- [Configure data retention and archive for multiple tables](https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Archive-Log-Tool) at once

+## Next steps

+In this article, you learned how to set up data retention and archive.

+> [!div class="nextstepaction"]

+>>[Perform post-deployment steps](review-fine-tune-overview.md)

+ Title: Deploy Microsoft Sentinel

+description: Learn about the steps for deploying Microsoft Sentinel.

+# Deploy Microsoft Sentinel

+This article introduces the activities that help you deploy Microsoft Sentinel. To plan for your deployment, review the [plan and prepare overview](prerequisites.md).

+The deployment phase is typically performed by a SOC analyst or related roles.

+## Deployment overview

+| Step | Details |

+| | - |

+| **1. Deployment overview** | **YOU ARE HERE** |

+| [**2. Enable Microsoft Sentinel, health and audit, and content**](enable-sentinel-features-content.md) | Enable Microsoft Sentinel, enable the health and audit feature, and enable the solutions and content you've identified according to your organization's needs. |

+| [**3. Configure content**](configure-content.md) | Configure the different types of Microsoft Sentinel security content, which allow you to detect, monitor, and respond to security threats across your systems: Data connectors, analytics rules, automation rules, playbooks, workbooks, and watchlists. |

+| [**4. Set up a cross-workspace architecture**](use-multiple-workspaces.md) |If your environment requires multiple workspaces, you can now set them up as part of your deployment. In this article, you learn how to set up Microsoft Sentinel to extend across multiple workspaces and tenants. |

+| [**5. Enable User and Entity Behavior Analytics (UEBA)**](enable-entity-behavior-analytics.md) | Enable and use the [UEBA](identify-threats-with-entity-behavior-analytics.md) feature to streamline the analysis process. |

+| [**6. Set up data retention and archive**](configure-data-retention-archive.md) |Set up data retention and archive, to make sure your organization retains the data that's important in the long term. |

+## Next steps

+In this article, you reviewed the activities that help you deploy Microsoft Sentinel.

+> [!div class="nextstepaction"]

+> >[Enable Microsoft Sentinel, health and audit, and content](enable-sentinel-features-content.md)

+ Title: Design your Microsoft Sentinel workspace architecture

+In this article, you reviewed a decision tree to help you make key decisions about how to design your Microsoft Sentinel workspace architecture.

+> [!div class="nextstepaction"]

+> >[Microsoft Sentinel sample workspace designs](sample-workspace-designs.md)

+ Title: Enable entity behavior analytics to detect advanced threats

+In the previous deployment step, you enabled the Microsoft Sentinel security content you need to protect your systems. In this article, you learn how to enable and use the UEBA feature to streamline the analysis process.

+As Microsoft Sentinel collects logs and alerts from all of its connected data sources, it analyzes them and builds baseline behavioral profiles of your organizationΓÇÖs entities (such as users, hosts, IP addresses, and applications) across time and peer group horizon. Using a variety of techniques and machine learning capabilities, Microsoft Sentinel can then identify anomalous activity and help you determine if an asset has been compromised. Learn more about [UEBA](identify-threats-with-entity-behavior-analytics.md).

+In this article, you learned how to enable and configure User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel. For more information about UEBA:

+> [!div class="nextstepaction"]

+>>[Configure data retention and archive](configure-data-retention-archive.md)

+ Title: Enable Microsoft Sentinel and initial features and content

+description: As the first step of your deployment, you enable Microsoft Sentinel, and then enable the health and audit feature, solutions, and content.

+#Customer intent: As a SOC analyst, I want to enable the Microsoft Sentinel service and the key features and content, so I can get started with my deployment.

+# Enable Microsoft Sentinel and initial features and content

+To begin your deployment, you need to enable Microsoft Sentinel and set up key features and content. In this article, you learn how to enable Microsoft Sentinel, enable the health and audit feature, and enable the solutions and content you've identified according to your organization's needs.

+## Enable features and content

+|Step |Description |

+|||

+|1. [Enable the Microsoft Sentinel service](quickstart-onboard.md#enable) | In the Azure portal, enable Microsoft Sentinel to run on the Log Analytics workspace your organization planned as part of your workspace design. |

+|2. [Enable health and audit](enable-monitoring.md) |Enable health and audit at this stage of your deployment to make sure that the service's many moving parts are always functioning as intended and that the service isn't being manipulated by unauthorized actions. Learn more about the [health and audit](health-audit.md) feature. |

+|3. [Enable solutions and content](sentinel-solutions-deploy.md) |When you planned your deployment, you identified which data sources you need to ingest into Microsoft Sentinel. Now, you want to enable the relevant solutions and content so that the data you need can start flowing into Microsoft Sentinel. |

+## Next steps

+In this article, you learned how to enable Microsoft Sentinel, its health and audit feature, and required content.

+> [!div class="nextstepaction"]

+>>[Configure content](configure-content.md)

+When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace. While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants. Learn more about [how Microsoft Sentinel can extend across multiple workspaces](prepare-multiple-workspaces.md).

+## Manage incidents on multiple workspaces

+## Query multiple workspaces

+### Include cross-workspace queries in scheduled analytics rules<a name="scheduled-alerts"></a>

+You can include cross-workspace queries in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse), suitable for MSSPs. This use is subject to the following limitations:

+### Use cross-workspace workbooks<a name="using-cross-workspace-workbooks"></a>

+### Hunt across multiple workspaces

+Cross-workspace hunting capabilities enable your threat hunters to create new hunting queries, or adapt existing ones, to cover multiple workspaces, by using the union operator and the workspace() expression as shown [above](#query-multiple-workspaces).

+## Manage multiple workspaces using automation

+- Learn how to [view and manage incidents in multiple workspaces](./multiple-workspace-view.md) seamlessly.

+The method you choose depends on how each of your customers buys Azure; whether you act as a [Cloud Solutions Provider (CSP)](#cloud-solutions-providers-csp), or the customer has an [Enterprise Agreement (EA)/Pay-as-you-go (PAYG)](#enterprise-agreements-ea--pay-as-you-go-payg) account. The following sections describe each of these methods separately.

+Even with granting access at the resource group level, customers have access to log data for the resources they can access, such as logs from a VM, even without access to Microsoft Sentinel. For more information, see [Manage access to Microsoft Sentinel data by resource](resource-context-rbac.md).

+If your customer is buying directly from Microsoft, the customer already has full access to the Azure environment, and you can't hide anything that's in the customer's Azure subscription.

+Analytics rules and hunting queries are both contained within Microsoft Sentinel, and therefore can't be separated from the Microsoft Sentinel workspace.

+Even if a user only has Microsoft Sentinel Reader permissions, they can view the query. In this case, we recommend hosting your Analytics rules and hunting queries in your own MSSP tenant, instead of the customer tenant.

+To do this, you need a workspace in your own tenant with Microsoft Sentinel enabled, and you also need to see the customer workspace via [Azure Lighthouse](multiple-tenants-service-providers.md).

+- **No alerts in the customer workspace**. Rules created in this manner, don't create alerts or incidents in the customer workspace. Both alerts and incidents exist in your MSSP workspace only.

+- **Create separate alerts for each customer**. When you use this method, we also recommend that you use separate alert rules for each customer and detection, as the workspace statement is different in each case.

+For more information, see [Cross-workspace workbooks](extend-sentinel-across-workspaces-tenants.md#use-cross-workspace-workbooks).

+However, if the playbook needs to access non-Azure resources in the customerΓÇÖs tenant, such as Azure AD, Office 365, or Microsoft 365 Defender, create a service principal with appropriate permissions in the customer tenant, and then add that identity in the playbook.

+ Title: Prepare for multiple workspaces and tenants in Microsoft Sentinel

+description: To prepare for your deployment, learn how Microsoft Sentinel can extend across multiple workspaces and tenants.

+#Customer intent: As a SOC architect, I want to learn about how Microsoft Sentinel can extend across workspaces so I can determine whether I need this capability and prepare accordingly.

+# Prepare for multiple workspaces and tenants in Microsoft Sentinel

+To prepare for your deployment, you need to determine whether a multiple workspace architecture is relevant for your environment. In this article, you learn how Microsoft Sentinel can extend across multiple workspaces and tenants so you can determine whether this capability suits your organization's needs.

+If you've determined and set up your environment to extend across workspaces, you can [manage and monitor cross-workspace architecture](extend-sentinel-across-workspaces-tenants.md) or [manage multiple workspaces with workspace manager](workspace-manager.md).

+## The need to use multiple Microsoft Sentinel workspaces

+When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace. While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants.

+This table lists some of these scenarios and, when possible, suggests how you may use a single workspace for the scenario.

+| Requirement | Description | Ways to reduce workspace count |

+|-|-|--|

+| Sovereignty and regulatory compliance | A workspace is tied to a specific region. To keep data in different [Azure geographies](https://azure.microsoft.com/global-infrastructure/geographies/) to satisfy regulatory requirements, split up the data into separate workspaces. | |

+| Data ownership | The boundaries of data ownership, for example by subsidiaries or affiliated companies, are better delineated using separate workspaces. | |

+| Multiple Azure tenants | Microsoft Sentinel supports data collection from Microsoft and Azure SaaS resources only within its own Azure Active Directory (Azure AD) tenant boundary. Therefore, each Azure AD tenant requires a separate workspace. | |

+| Granular data access control | An organization may need to allow different groups, within or outside the organization, to access some of the data collected by Microsoft Sentinel. For example:<br><ul><li>Resource owners' access to data pertaining to their resources</li><li>Regional or subsidiary SOCs' access to data relevant to their parts of the organization</li></ul> | Use [resource Azure RBAC](resource-context-rbac.md) or [table level Azure RBAC](https://techcommunity.microsoft.com/t5/azure-sentinel/table-level-rbac-in-azure-sentinel/ba-p/965043) |

+| Granular retention settings | Historically, multiple workspaces were the only way to set different retention periods for different data types. This is no longer needed in many cases, thanks to the introduction of table level retention settings. | Use [table level retention settings](https://techcommunity.microsoft.com/t5/azure-sentinel/new-per-data-type-retention-is-now-available-for-azure-sentinel/ba-p/917316) or automate [data deletion](../azure-monitor/logs/personal-data-mgmt.md#exporting-and-deleting-personal-data) |

+| Split billing | By placing workspaces in separate subscriptions, they can be billed to different parties. | Usage reporting and cross-charging |

+| Legacy architecture | The use of multiple workspaces may stem from a historical design that took into consideration limitations or best practices which don't hold true anymore. It might also be an arbitrary design choice that can be modified to better accommodate Microsoft Sentinel.<br><br>Examples include:<br><ul><li>Using a per-subscription default workspace when deploying Microsoft Defender for Cloud</li><li>The need for granular access control or retention settings, the solutions for which are relatively new</li></ul> | Re-architect workspaces |

+### Managed Security Service Provider (MSSP)

+In case of an MSSP, many if not all of the above requirements apply, making multiple workspaces, across tenants, the best practice. The MSSP can use [Azure Lighthouse](../lighthouse/overview.md) to extend Microsoft Sentinel cross-workspace capabilities across tenants.

+## Microsoft Sentinel multiple workspace architecture

+As implied by the requirements above, there are cases where a single SOC needs to centrally manage and monitor multiple Microsoft Sentinel workspaces, potentially across Azure Active Directory (Azure AD) tenants.

+- An MSSP Microsoft Sentinel Service.

+- A global SOC serving multiple subsidiaries, each having its own local SOC.

+- A SOC monitoring multiple Azure AD tenants within an organization.

+To address these cases, Microsoft Sentinel offers multiple-workspace capabilities that enable central monitoring, configuration, and management, providing a single pane of glass across everything covered by the SOC. This diagram shows an example architecture for such use cases.

+This model offers significant advantages over a fully centralized model in which all data is copied to a single workspace:

+- Flexible role assignment to the global and local SOCs, or to the MSSP its customers.

+- Fewer challenges regarding data ownerships, data privacy and regulatory compliance.

+- Minimal network latency and charges.

+- Easy onboarding and offboarding of new subsidiaries or customers.

+In the following sections, we'll explain how to operate this model, and particularly how to:

+- Centrally monitor multiple workspaces, potentially across tenants, providing the SOC with a single pane of glass.

+- Centrally configure and manage multiple workspaces, potentially across tenants, using automation.

+## Next steps

+In this article, you learned how Microsoft Sentinel can extend across multiple workspaces and tenants.

+> [!div class="nextstepaction"]

+>>[Prioritize data connectors](prioritize-data-connectors.md)

+ Title: Plan and prepare for your Microsoft Sentinel deployment

+# Plan and prepare for your Microsoft Sentinel deployment

+This article introduces the activities and prerequisites that help you plan and prepare before deploying Microsoft Sentinel.

+The plan and prepare phase is typically performed by a SOC architect or related roles.

+## Plan and prepare overview

+| Step | Details |

+| | - |

+| **1. Plan and prepare overview and prerequisites** | **YOU ARE HERE**<br><br>Review the [Azure tenant prerequisites](#azure-tenant-prerequisites). |

+| **2. Plan workspace architecture** | Design your Microsoft Sentinel workspace. Consider parameters such as:<br><br>- Whether you'll use a single tenant or multiple tenants<br>- Any compliance requirements you have for data collection and storage<br>- How to control access to Microsoft Sentinel data<br><br>Review these articles:<br><br>1. [Review best practices](best-practices-workspace-architecture.md)<br>2. [Design workspace architecture](design-your-workspace-architecture.md)<br>3. [Review sample workspace designs](sample-workspace-designs.md)<br>4. [Prepare for multiple workspaces](prepare-multiple-workspaces.md) |

+| **3. [Prioritize data connectors](prioritize-data-connectors.md)** | Determine which data sources you need and the data size requirements to help you accurately project your deployment's budget and timeline.<br><br>You might determine this information during your business use case review, or by evaluating a current SIEM that you already have in place. If you already have a SIEM in place, analyze your data to understand which data sources provide the most value and should be ingested into Microsoft Sentinel. |

+| **4. [Plan roles and permissions](roles.md)** |Use Azure role based access control (RBAC) to create and assign roles within your security operations team to grant appropriate access to Microsoft Sentinel. The different roles give you fine-grained control over what Microsoft Sentinel users can see and do. Azure roles can be assigned in the Microsoft Sentinel workspace directly, or in a subscription or resource group that the workspace belongs to, which Microsoft Sentinel inherits. |

+| **5. [Plan costs](billing.md)** |Start planning your budget, considering cost implications for each planned scenario.<br><br> Make sure that your budget covers the cost of data ingestion for both Microsoft Sentinel and Azure Log Analytics, any playbooks that will be deployed, and so on. |

+## Azure tenant prerequisites

+- We recommend that when you set up your Microsoft Sentinel workspace, [create a resource group](../azure-resource-manager/management/manage-resource-groups-portal.md) that's dedicated to Microsoft Sentinel and the resources that Microsoft Sentinel uses, including the Log Analytics workspace, any playbooks, workbooks, and so on.

+ A dedicated resource group allows for permissions to be assigned once, at the resource group level, with permissions automatically applied to any relevant resources. Managing access via a resource group helps to ensure that you're using Microsoft Sentinel efficiently without potentially issuing improper permissions. Without a resource group for Microsoft Sentinel, where resources are scattered among multiple resource groups, a user or service principal may find themselves unable to perform a required action or view data due to insufficient permissions.

+ To implement more access control to resources by tiers, use extra resource groups to house the resources that should be accessed only by those groups. Using multiple tiers of resource groups enables you to separate access between those tiers.

+In this article, you reviewed the activities and prerequisites that help you plan and prepare before deploying Microsoft Sentinel.

+> [!div class="nextstepaction"]

+> >[Review workspace architecture best practices](best-practices-workspace-architecture.md)

+ Title: Prioritize data connectors for Microsoft Sentinel

+description: Learn how to plan and prioritize which data sources to use for your Microsoft Sentinel deployment.

+# Prioritize your data connectors for Microsoft Sentinel

+In this article, you learn how to plan and prioritize which data sources to use for your Microsoft Sentinel deployment.

+## Determine which connectors you need

+Check which data connectors are relevant to your environment, in the following order:

+1. Review this list of [free data connectors](billing.md#free-data-sources). The free data connectors will start showing value from Microsoft Sentinel as soon as possible, while you continue to plan other data connectors and budgets.

+1. Review the [custom](create-custom-connector.md) data connectors.

+1. Review the [partner](data-connectors-reference.md) data connectors.

+For the custom and partner connectors, we recommend that you start by setting up [CEF/Syslog](connect-cef-syslog-options.md) connectors, with the highest priority first, as well as any Linux-based devices.

+If your data ingestion becomes too expensive, too quickly, stop or filter the logs forwarded using the [Azure Monitor Agent](../azure-monitor/agents/azure-monitor-agent-overview.md).

+> [!TIP]

+> Custom data connectors enable you to ingest data into Microsoft Sentinel from data sources not currently supported by built-in functionality, such as via agent, Logstash, or API. For more information, see [Resources for creating Microsoft Sentinel custom connectors](create-custom-connector.md).

+>

+## Alternative data ingestion requirements

+If the standard configuration for data collection doesn't work well for your organization, review these and possible [alternative solutions and considerations](best-practices-data.md#alternative-data-ingestion-requirements).

+## Filter your logs

+If you choose to filter your collected logs or log content before the data is ingested into Microsoft Sentinel, [review these best practices](best-practices-data.md#filter-your-logs-before-ingestion).

+## Next steps

+In this article, you learned how to prioritize data connectors to prepare for your Microsoft Sentinel deployment.

+> [!div class="nextstepaction"]

+>>[Plan roles and permissions](roles.md)

+ Title: Fine tune and review your Microsoft Sentinel deployment process and content

+description: This article includes a checklist to help you fine tune and review your deployed content and deployment process.

+# Fine tune and review your Microsoft Sentinel deployment process and content

+In previous steps, you planned and prepared for your deployment, and then you enabled the Microsoft solution and deployed key security content. In this article, you review a post-deployment checklist that helps you make sure that your deployment process is working as expected, and that the security content you deployed is working and protecting your organization according to your needs and use cases.

+The fine tune and review phase is typically performed by a SOC engineer or related roles.

+## Fine tune and review: Checklist for post-deployment

+|Step |Actions |

+| | - |

+|&#x2705; **Review incidents and incident process** |- Check whether the incidents and the number of incidents you're seeing reflect what's actually happening in your environment.<br>- Check whether your SOC's incident process is working to efficiently handle incidents: Have you assigned different types of incidents to different layers/tiers of the SOC?<br><br>Learn more about how to [navigate and investigate](investigate-incidents.md) incidents and how to [work with incident tasks](work-with-tasks.md). |

+|&#x2705; **Review and fine-tune analytics rules** | - Based on your incident review, check whether your analytics rules are triggered as expected, and whether the rules reflect the types of incidents you're interested in.<br>- [Handle false positives](false-positives.md), either by using automation or by modifying scheduled analytics rules.<br>- Microsoft Sentinel provides built-in fine-tuning capabilities to help you analyze your analytics rules. [Review these built-in insights and implement relevant recommendations](detection-tuning.md). |

+|&#x2705; **Review automation rules and playbooks** |- Similar to analytics rules, check that your automation rules are working as expected, and reflect the incidents you're concerned about and are interested in.<br>- Check whether your playbooks are responding to alerts and incidents as expected. |

+|&#x2705; **Add data to watchlists** |Check that your watchlists are up to date. If any changes have occurred in your environment, such as new users or use cases, [update your watchlists accordingly](watchlists-manage.md). |

+|&#x2705; **Review commitment tiers** | [Review the commitment tiers](billing.md#analytics-logs) you initially set up, and verify that these tiers reflect your current configuration. |

+|&#x2705; **Keep track of ingestion costs** |To keep track of ingestion costs, use one of these workbooks:<br>- The [**Workspace Usage Report** workbook](billing-monitor-costs.md#deploy-a-workbook-to-visualize-data-ingestion) provides your workspace's data consumption, cost, and usage statistics. The workbook gives the workspace's data ingestion status and amount of free and billable data. You can use the workbook logic to monitor data ingestion and costs, and to build custom views and rule-based alerts.<br>- The **Microsoft Sentinel Cost** workbook gives a more focused view of Microsoft Sentinel costs, including ingestion and retention data, ingestion data for eligible data sources, Logic Apps billing information, and more. |

+|&#x2705; **Fine-tune Data Collection Rules (DCRs)** |- Check that your [DCRs](../azure-monitor/essentials/data-collection-rule-overview.md) reflect your data ingestion needs and use cases.<br>- If needed, [implement ingestion-time transformation](data-transformation.md#filtering) to filter out irrelevant data even before it's first stored in your workspace. |

+|&#x2705; **Check analytics rules against MITRE framework** |[Check your MITRE coverage in the Microsoft Sentinel MITRE page](mitre-coverage.md): View the detections already active in your workspace, and those available for you to configure, to understand your organization's security coverage, based on the tactics and techniques from the MITRE ATT&CK® framework. |

+|&#x2705; **Hunt for suspicious activity** |Make sure that your SOC has a process in place for [proactive threat hunting](hunts.md). Hunting is a process where security analysts seek out undetected threats and malicious behaviors. By creating a hypothesis, searching through data, and validating that hypothesis, they determine what to act on. Actions can include creating new detections, new threat intelligence, or spinning up a new incident. |

+## Next steps

+In this article, you reviewed a checklist of post-deployment steps. You're now finished your deployment of Microsoft Sentinel.

+To continue exploring Microsoft Sentinel capabilities, review these tutorials with common Microsoft Sentinel tasks:

+- [Forward Syslog data to a Log Analytics workspace with Microsoft Sentinel by using Azure Monitor Agent](forward-syslog-monitor-agent.md)

+- [Configure data retention policy](configure-data-retention.md)

+- [Detect threats using analytics rules](tutorial-log4j-detection.md)

+- [Automatically check and record IP address reputation information in incidents](tutorial-enrich-ip-information.md)

+- [Respond to threats using automation](tutorial-respond-threats-playbook.md)

+- [Extract incident entities with non-native action](tutorial-extract-incident-entities.md)

+- [Investigate with UEBA](investigate-with-ueba.md)

+- [Build and monitor Zero Trust](sentinel-solution.md)

+## Resource-based access control

+You may have some users who need to access only specific data in your Microsoft Sentinel workspace, but shouldn't have access to the entire Microsoft Sentinel environment. For example, you may want to provide a non-security operations (non-SOC) team with access to the Windows event data for the servers they own.

+In such cases, we recommend that you configure your role-based access control (RBAC) based on the resources that are allowed to your users, instead of providing them with access to the Microsoft Sentinel workspace or specific Microsoft Sentinel features. This method is also known as setting up resource-context RBAC. [Learn more about RBAC](resource-context-rbac.md)

+> [!div class="nextstepaction"]

+> >[Plan costs](billing.md)

+ContosoΓÇÖs Azure environment already has a single existing Log Analytics workspace used by the Operations team to monitor the infrastructure. This workspace is located in Contoso Azure AD tenant, within EU North region, and is being used to collect logs from Azure VMs in all regions. They currently ingest around 50 GB/day.

+The Contoso Operations team needs to have access to all the logs that they currently have in the workspace, which include several data types not needed by the SOC, such as **Perf**, **InsightsMetrics**, **ContainerLog**, and more. The Operations team must *not* have access to the new logs that are collected in Microsoft Sentinel.

+1. Contoso doesn't need [charge-back](design-your-workspace-architecture.md#step-4-splitting-billing--charge-back), so we can continue with [step 5](design-your-workspace-architecture.md#step-5-collecting-any-non-soc-data).

+1. Most Contoso's VMs are the EU North region, where they already have a workspace. Therefore, in this case, bandwidth costs aren't a concern.

+Fabrikam has no compliance requirements. Fabrikam has resources in several Azure regions located in the US, but bandwidth costs across regions aren't a major concern.

+- Azure AD Sign-in and Audit logs

+ The Fabrikam Operations team needs to collect performance data, from both VMs and AKS. Since AKS is based on diagnostic settings, they can select specific logs to send to specific workspaces. Fabrikam can choose to send AKS audit logs to the Microsoft Sentinel workspace, and all AKS logs to a separate workspace, where Microsoft Sentinel isn't enabled. In the workspace where Microsoft Sentinel isn't enabled, Fabrikam will enable the Container Insights solution.

+1. Bandwidth costs aren't a major concern for Fabrikam, so continue with [step 7](design-your-workspace-architecture.md#step-7-segregating-data-or-defining-boundaries-by-ownership).

+1. Fabrikam does need to control access for overlapping data, including security events and Azure activity events, but there's no row-level requirement.

+ Security events and Azure activity events aren't custom logs, so Fabrikam can use table-level RBAC to grant access to these two tables for the Operations team.

+Adventure Works is a multinational company with headquarters in Tokyo. Adventure Works has 10 different sub-entities , based in different countries/regions around the world.

+Azure VMs are scattered across the three continents, but bandwidth costs aren't a concern.

+Adventure Works also has three independent SOC teams, one for each of the continents. Each continent's SOC team should be able to access only the data generated within its region, without seeing data from other continents. For example, the Asia SOC team should only access data from Azure resources deployed in Asia, Azure AD Sign-ins from the Asia tenant, and Defender for Endpoint logs from itΓÇÖs the Asia tenant.

+1. Adventure Works' Operations team has its own workspaces, so continue to [step 2](design-your-workspace-architecture.md#step-2-keeping-data-in-different-azure-geographies).

+1. Bandwidth costs aren't a major concern for Adventure Works, so continue with [step 7](design-your-workspace-architecture.md#step-7-segregating-data-or-defining-boundaries-by-ownership).

+1. Adventure Works doesn't need to control data access by table.

+- The central SOC team can still operate from a separate Azure AD tenant, using Azure Lighthouse to access each of the different Microsoft Sentinel environments. If there's no other tenant, the central SOC team can still use Azure Lighthouse to access the remote workspaces.

+- The central SOC team can also create another workspace if it needs to store artifacts that remain hidden from the continent SOC teams, or if it wants to ingest other data that isn't relevant to the continent SOC teams.

+In this article, you reviewed a set of suggested workspace designs for organizations.

+>>[Prepare for multiple workspaces](prepare-multiple-workspaces.md)

+ Title: Set up multiple workspaces and tenants in Microsoft Sentinel

+description: If you've defined that your environment needs multiple workspaces, you now set up your multiple workspace architecture in Microsoft Sentinel.

+#Customer intent: As a SOC architect, I want to learn about how Microsoft Sentinel can extend across workspaces so I can determine whether I need this capability and prepare accordingly.

+# Set up multiple workspaces and tenants in Microsoft Sentinel

+When you planned your deployment, you [determined whether a multiple workspace architecture is relevant for your environment](prepare-multiple-workspaces.md). If your environment requires multiple workspaces, you can now set them up as part of your deployment. In this article, you learn how to set up Microsoft Sentinel to extend across multiple workspaces and tenants.

+## Options for using multiple workspaces

+If you've determined and set up your environment to extend across workspaces, you can:

+- [Manage and monitor cross-workspace architecture](extend-sentinel-across-workspaces-tenants.md): Query and analyze your data across workspaces and tenants.

+- [Manage multiple workspaces with workspace manager](workspace-manager.md): Centrally manage multiple workspaces within one or more Azure tenants.

+## Next steps

+In this article, you learned how to set up Microsoft Sentinel to extend across multiple workspaces and tenants.

+> [!div class="nextstepaction"]

+>>[Enable User and Entity Behavior Analytics (UEBA)](enable-entity-behavior-analytics.md)

+1. From the left portal menu, select **Storage accounts** to display a list of your storage accounts. If the portal menu isn't visible, select the menu button to toggle it on.

+1. Select **Delete**.

+> In order to enable AES-256 encryption, the domain object that represents your storage account must be a computer account (default) or service logon account in the on-premises AD domain. If your domain object doesn't meet this requirement, delete it and create a new domain object that does. Also, you must have write access to the `msDS-SupportedEncryptionTypes` attribute of the object.

+Additional things to note:

+* The user will need to have an **owner** or **contributor** role to see an accurate status of the hub router version. If a user is assigned a **reader** role to the Virtual WAN resource and subscription, then Azure portal will display to that user that the hub router needs to be upgraded to the latest version, even if the hub is already on the latest version.

+* If you change your spoke virtual network's subscription status from disabled to enabled and then upgrade the virtual hub, you will need to update your virtual network connection after the virtual hub upgrade (Ex: you can configure the virtual network connection to propagate to a dummy label).