-description: Learn how to set up an alert for new recommendations from Azure Advisor using an Azure Resource Manager template (ARM template).

-# Quickstart: Create Azure Advisor alerts on new recommendations using an ARM template

-This article shows you how to set up an alert for new recommendations from Azure Advisor using an Azure Resource Manager template (ARM template).

-Whenever Azure Advisor detects a new recommendation for one of your resources, an event is stored in [Azure Activity log](../azure-monitor/essentials/platform-logs-overview.md). You can set up alerts for these events from Azure Advisor using a recommendation-specific alerts creation experience. You can select a subscription and optionally a resource group to specify the resources that you want to receive alerts on.

-You can also configure the action that will take place when an alert is triggered by:

-> Advisor alerts are currently only available for High Availability, Performance, and Cost recommendations. Security recommendations are not supported.

-Deploy the template using any standard method for [deploying an ARM template](../azure-resource-manager/templates/deploy-portal.md) such as the following examples using CLI and PowerShell. Replace the sample values for **Resource Group**, and **emailAddress** with appropriate values for your environment. The workspace name must be unique among all Azure subscriptions.

-Verify that the workspace has been created using one of the following commands. Replace the sample values for **Resource Group** with the value you used above.

-If you plan to continue working with subsequent quickstarts and tutorials, you might want to leave these resources in place. When no longer needed, delete the resource group, which deletes the alert rule and the related resources. To delete the resource group by using Azure CLI or Azure PowerShell

-## Next steps

-description: Learn how to set up an alert for new recommendations from Azure Advisor using Bicep.

-# Quickstart: Create Azure Advisor alerts on new recommendations using Bicep

-This article shows you how to set up an alert for new recommendations from Azure Advisor using Bicep.

-Whenever Azure Advisor detects a new recommendation for one of your resources, an event is stored in [Azure Activity log](../azure-monitor/essentials/platform-logs-overview.md). You can set up alerts for these events from Azure Advisor using a recommendation-specific alerts creation experience. You can select a subscription and optionally select a resource group to specify the resources that you want to receive alerts on.

-You can also configure the action that will take place when an alert is triggered by:

-> Advisor alerts are currently only available for High Availability, Performance, and Cost recommendations. Security recommendations are not supported.

-1. Save the Bicep file as **main.bicep** to your local computer.

-1. Deploy the Bicep file using either Azure CLI or Azure PowerShell.

- > Replace **\<alert-name\>** with the name of the alert.

- When the deployment finishes, you should see a message indicating the deployment succeeded.

-Use the Azure portal, Azure CLI, or Azure PowerShell to list the deployed resources in the resource group.

-When no longer needed, use the Azure portal, Azure CLI, or Azure PowerShell to delete the resource group.

-## Next steps

-description: Create Azure Advisor alerts for new recommendation

-# Create Azure Advisor alerts on new recommendations using the Azure portal

-This article shows you how to set up an alert for new recommendations from Azure Advisor using the Azure portal.

-Whenever Azure Advisor detects a new recommendation for one of your resources, an event is stored in [Azure Activity log](../azure-monitor/essentials/platform-logs-overview.md). You can set up alerts for these events from Azure Advisor using a recommendation-specific alerts creation experience. You can select a subscription and optionally a resource group to specify the resources that you want to receive alerts on.

-You can also configure the action that will take place when an alert is triggered by:

-* Selecting an existing action group

-* Creating a new action group

-> [!NOTE]

-> Advisor alerts are currently only available for High Availability, Performance, and Cost recommendations. Security recommendations are not supported.

-## Create alert rule

-1. In the **portal**, select **Azure Advisor**.

- 

-2. In the **Monitoring** section of the left menu, select **Alerts**.

- 

-3. Select **New Advisor Alert**.

- 

-4. In the **Scope** section, select the subscription and optionally the resource group that you want to be alerted on.

- 

-5. In the **Condition** section, select the method you want to use for configuring your alert. If you want to alert for all recommendations for a certain category and/or impact level, select **Category and impact level**. If you want to alert for all recommendations of a certain type, select **Recommendation type**.

- 

-6. Depending on the Configure by option that you select, you will be able to specify the criteria. If you want all recommendations, just leave the remaining fields blank.

- 

-7. In the **action groups** section, select **Add existing** to use an action group you already created or select **Create new** to set up a new [action group](../azure-monitor/alerts/action-groups.md).

- 

-8. In the Alert details section, give your alert a name and short description. If you want your alert to be enabled, leave **Enable rule upon creation** selection set to **Yes**. Then select the resource group to save your alert to. This will not impact the targeting scope of the recommendation.

- :::image type="content" source="./media/advisor-alerts/create8.png" alt-text="Screenshot of the Alert details section.":::

-This section shows you how to configure Azure Advisor alerts to send recommendation data through webhooks to your existing systems.

-You can set up alerts to be notified when you have a new Advisor recommendation on one of your resources. These alerts can notify you through email or text message, but they can also be used to integrate with your existing systems through a webhook.

-### Using the Advisor recommendation alert payload

-If you want to integrate Advisor alerts into your own systems using a webhook, you will need to parse the JSON payload that is sent from the notification.

-When you set up your action group for this alert, you select if you would like to use the common alert schema. If you select the common alert schema, your payload will look like:

-If you do not use the common schema, your payload looks like the following:

-In either schema, you can identify Advisor recommendation events by looking for **eventSource** is `Recommendation` and **operationName** is `Microsoft.Advisor/recommendations/available/action`.

-Some of the other important fields that you may want to use are:

-* *alertTargetIDs* (in the common schema) or *resourceId* (legacy schema)

-* *recommendationType*

-* *recommendationName*

-* *recommendationCategory*

-* *recommendationImpact*

-* *recommendationResourceLink*

-## Manage your alerts

-From Azure Advisor, you can edit, delete, or disable and enable your recommendations alerts.

-1. In the **portal**, select **Azure Advisor**.

- :::image type="content" source="./media/advisor-alerts/create1.png" alt-text="Screenshot of the Azure portal menu showing Azure Advisor selected.":::

-2. In the **Monitoring** section of the left menu, select **Alerts**.

- :::image type="content" source="./media/advisor-alerts/create2.png" alt-text="Screenshot of the Azure portal menu showing Alerts selected.":::

-3. To edit an alert, click on the Alert name to open the alert and edit the fields you want to edit.

-4. To delete, enable, or disable an alert, click on the ellipse at the end of the row and then select the action you would like to take.

-

-## Next steps

-Azure Advisor provides best practice recommendations for your workloads. These recommendations are personalized and actionable to help you:

-* Assess your Azure workloads against the five pillars of the [Microsoft Azure Well-Architected Framework](/azure/architecture/framework/).

-As your personalized cloud consultant, Azure Advisor continually assesses your usage telemetry and resource configuration to check for industry best practices. Advisor then aggregates its findings into a single score. With this score, you can tell at a glance if you're taking the necessary steps to build reliable, secure, and cost-efficient solutions.

-1. Sign in to the [**Azure portal**](https://portal.azure.com).

-1. Select **Advisor score** in the left menu pane to open score page.

-The contribution of each recommendation to your category score is shown clearly on the **Advisor score** page in the Azure portal. You can increase each category score by the percentage point listed in the **Potential score increase** column. This value reflects both the weight of the recommendation within the category and the predicted ease of implementation to address the potentially easiest tasks. Focusing on the recommendations with the greatest score impact will help you make the most progress with time.

-If any Advisor recommendations aren't relevant for an individual resource, you can postpone or dismiss those recommendations. They'll be excluded from the score calculation with the next refresh. Advisor will also use this input as feedback to improve the model.

-**Each of the five categories has a highest potential score of 100.** Your overall Advisor score is calculated as a sum of each applicable category score, divided by the sum of the highest potential score from all applicable categories. In most cases this means adding up five Advisor scores for each category and dividing by 500. But *each category score is calculated only if you use resources that are assessed by Advisor*.

-* **Single subscription score:** This example is the simple mean of all Advisor category scores for your subscription. If the Advisor category scores are - **Cost** = 73, **Reliability** = 85, **Operational excellence** = 77, and **Performance** = 100, the Advisor score would be (73 + 85 + 77 + 100)/(4x100) = 0.84% or 84%.

-* **Multiple subscriptions score:** When multiple subscriptions are selected, the overall Advisor score is calculated as an average of aggregated category scores. Each category score is calculated using individual subscription score and subscription consumsumption based weight. Overall score is calculated as sum of aggregated category scores divided by the sum of the highest potential scores.

-## Frequently Asked Questions (FAQs)

-### I implemented a recommendation but my score did not change. Why the score did not increase?

-The score does not reflect adopted recommendations right away. It takes at least 24 hours for the score to change after the recommendation is remediated.

-If you dismiss a recommendation from Advisor, it is excluded from the calculation of your score. Dismissing recommendations also helps Advisor improve the quality of recommendations.

-No. Your score isn't necessarily a reflection of how much you spend. Unnecessary spending will result in a lower **Cost** score.

-## Next steps

-# Configure Azure Advisor recommendations view

-Azure Advisor provides recommendations to help you optimize your Azure deployments. Within Advisor, you have access to a few features that help you to narrow down your recommendations to only those that matter to you.

-Advisor gives you the ability to select Subscriptions and Resource Groups that matter to you and your organization. You only see recommendations for the subscriptions and resource groups that you select. By default, all are selected. Configuration settings apply to the subscription or resource group, so the same settings apply to everyone that has access to that subscription or resource group. Configuration settings can be changed in the Azure portal or programmatically.

- :::image type="content" source="./media/view-recommendations/configuration.png" alt-text="Screenshot of Azure Advisor showing configuration pane.":::

-1. Check the box in the **Include** column for any subscriptions or resource groups to receive Advisor recommendations. If the box is disabled, you may not have permission to make a configuration change on that subscription or resource group. Learn more about [permissions in Azure Advisor](permissions.md).

-1. Click **Apply** at the bottom after you make a change.

-## Filtering your view in the Azure portal

-Configuration settings remain active until changed. If you want to limit the view of recommendations for a single viewing, you can use the drop downs provided at the top of the Advisor panel. You can filter recommendations by subscription, resource group, workload, resource type, recommendation status and impact. These filters are available for Overview, Score, Cost, Security, Reliability, Operational Excellence, Performance and All Recommendations pages.

- :::image type="content" source="./media/view-recommendations/filtering.png" alt-text="Screenshot of Azure Advisor showing filtering options.":::

-> Contact your account team to add new workloads to the workload filter or edit workload names.

-## Dismissing and postponing recommendations

-Azure Advisor allows you to dismiss or postpone recommendations on a single resource. If you dismiss a recommendation, you do not see it again unless you manually activate it. However, postponing a recommendation allows you to specify a duration after which the recommendation is automatically activated again. Postponing can be done in the Azure portal or programmatically.

-1. Select a recommendation category to view your recommendations

-1. Select a recommendation from the list of recommendations

-1. Select Postpone or Dismiss for the recommendation you want to postpone or dismiss

- :::image type="content" source="./media/view-recommendations/postpone-dismiss.png" alt-text="Screenshot of the Use Managed Disks window showing the select column and Postpone and Dismiss actions for a single recommendation highlighted.":::

-1. Select **Postpone** or **Dismiss** at the top left of the table.

- :::image type="content" source="./media/view-recommendations/postpone-dismiss-multiple.png" alt-text="Screenshot of the Use Managed Disks window showing the select column and Postpone and Dismiss actions on the top left of the table highlighted.":::

-> You need contributor or owner permission to dismiss or postpone a recommendation. Learn more about permissions in Azure Advisor.

-> [!NOTE]

-> If the selection boxes are disabled, recommendations may still be loading. Please wait for all recommendations to load before trying to postpone or dismiss.

-You can activate a recommendation that has been postponed or dismissed. This action can be done in the Azure portal or programmatically. In the Azure portal:

-1. Open [Azure Advisor](https://aka.ms/azureadvisordashboard) in the Azure portal.

-1. Change the filter on the Overview panel to **Postponed**. Advisor then displays postponed or dismissed recommendations.

- :::image type="content" source="./media/view-recommendations/activate-postponed.png" alt-text="Screenshot of the Azure Advisor window showing the Postponed drop-down menu selected.":::

-1. Select a recommendation from the list of recommendations. This opens recommendations with the **Postponed & Dismissed** tab already selected to show the resources for which this recommendation has been postponed or dismissed.

-1. Click on **Activate** at the end of the row. Once clicked, the recommendation is active for that resource and so removed from this table. The recommendation is now visible in the **Active** tab.

-

- :::image type="content" source="./media/view-recommendations/activate-postponed-2.png" alt-text="Screenshot of the Enable Soft Delete window showing the Postponed & Dismissed tab with the Activate action highlighted.":::

-## Next steps

-This article explains how you can view recommendations that matter to you in Azure Advisor. To learn more about Advisor, see:

- var endpoint = new Uri(System.Environment.GetEnvironmentVariable("VISION_ENDPOINT"));

- var credential = new AzureKeyCredential(System.Environment.GetEnvironmentVariable("VISION_KEY"));

- String endpoint = System.getenv("VISION_ENDPOINT");

- String accountKey = System.getenv("VISION_KEY");

- endpoint = os.environ["VISION_ENDPOINT"]

- key = os.environ["VISION_KEY"]

- curl --request POST --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectliveness/singlemodal/sessions" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%" ^

- curl --request POST --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectliveness/singlemodal/sessions" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}" \

- curl --request GET --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectliveness/singlemodal/sessions/<session-id>" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%"

- curl --request GET --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectliveness/singlemodal/sessions/<session-id>" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}"

- curl --request DELETE --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectliveness/singlemodal/sessions/<session-id>" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%"

- curl --request DELETE --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectliveness/singlemodal/sessions/<session-id>" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}"

- var endpoint = new Uri(System.Environment.GetEnvironmentVariable("VISION_ENDPOINT"));

- var credential = new AzureKeyCredential(System.Environment.GetEnvironmentVariable("VISION_KEY"));

- String endpoint = System.getenv("VISION_ENDPOINT");

- String accountKey = System.getenv("VISION_KEY");

- endpoint = os.environ["VISION_ENDPOINT"]

- key = os.environ["VISION_KEY"]

- curl --request POST --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%" ^

- curl --request POST --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}" \

- curl --request GET --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions/<session-id>" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%"

- curl --request GET --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions/<session-id>" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}"

- curl --request DELETE --location "%VISION_ENDPOINT%/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions/<session-id>" ^

- --header "Ocp-Apim-Subscription-Key: %VISION_KEY%"

- curl --request DELETE --location "${VISION_ENDPOINT}/face/v1.1-preview.1/detectlivenesswithverify/singlemodal/sessions/<session-id>" \

- --header "Ocp-Apim-Subscription-Key: ${VISION_KEY}"

-This guide demonstrates how to add a large number of persons and faces to a **PersonGroup** object. The same strategy also applies to **LargePersonGroup**, **FaceList**, and **LargeFaceList** objects. This sample is written in C# and uses the Azure AI Face .NET client library.

-## Authorize the API call

-When you use the Face client library, the key and subscription endpoint are passed in through the constructor of the FaceClient class. See the [quickstart](../quickstarts-sdk/identity-client-library.md?pivots=programming-language-csharp&tabs=visual-studio) for instructions on creating a Face client object.

-await faceClient.LargePersonGroup.CreateAsync(personGroupId, personGroupName);

-Person[] persons = new Person[PersonCount];

- persons[i] = await faceClient.PersonGroupPerson.CreateAsync(personGroupId, personName);

- Guid personId = persons[i].PersonId;

- await faceClient.PersonGroupPerson.AddFaceFromStreamAsync(personGroupId, personId, stream);

-The [Find Similar](/rest/api/face/face-recognition-operations/find-similar-from-large-face-list) operation does face matching between a target face and a set of candidate faces, finding a smaller set of faces that look similar to the target face. This is useful for doing a face search by image.

-[!code-csharp[](~/cognitive-services-quickstart-code/dotnet/Face/FaceQuickstart.cs?name=snippet_face_detect_recognize)]

-[!code-csharp[](~/cognitive-services-quickstart-code/dotnet/Face/FaceQuickstart.cs?name=snippet_loadfaces)]

-[!code-csharp[](~/cognitive-services-quickstart-code/dotnet/Face/FaceQuickstart.cs?name=snippet_find_similar)]

-[!code-csharp[](~/cognitive-services-quickstart-code/dotnet/Face/FaceQuickstart.cs?name=snippet_find_similar_print)]

-This guide assumes that you already constructed a [FaceClient](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.faceclient) object, named `faceClient`, using a Face key and endpoint URL. For instructions on how to set up this feature, follow one of the quickstarts.

-To find faces and get their locations in an image, call the [DetectWithUrlAsync](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.faceoperationsextensions.detectwithurlasync) or [DetectWithStreamAsync](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.faceoperationsextensions.detectwithstreamasync) method. **DetectWithUrlAsync** takes a URL string as input, and **DetectWithStreamAsync** takes the raw byte stream of an image as input.

-The service returns a [DetectedFace](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.models.detectedface) object, which you can query for different kinds of information, specified below.

-For information on how to parse the location and dimensions of the face, see [FaceRectangle](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.models.facerectangle). Usually, this rectangle contains the eyes, eyebrows, nose, and mouth. The top of head, ears, and chin aren't necessarily included. To use the face rectangle to crop a complete head or get a mid-shot portrait, you should expand the rectangle in each direction.

-[Face landmarks](../concept-face-detection.md#face-landmarks) are a set of easy-to-find points on a face, such as the pupils or the tip of the nose. To get face landmark data, set the _detectionModel_ parameter to `DetectionModel.Detection01` and the _returnFaceLandmarks_ parameter to `true`.

-To analyze face attributes, set the _detectionModel_ parameter to `DetectionModel.Detection01` and the _returnFaceAttributes_ parameter to a list of [FaceAttributeType Enum](/dotnet/api/microsoft.azure.cognitiveservices.vision.face.models.faceattributetype) values.

-var faces = await client.Face.DetectWithUrlAsync("https://<storage_account_name>.blob.core.windows.net/<container_name>/<file_name>");

-var faces_1 = client.Face.DetectWithUrlAsync("https://www.biography.com/.image/t_share/MTQ1MzAyNzYzOTgxNTE0NTEz/john-f-kennedymini-biography.jpg");

-var faces_2 = client.Face.DetectWithUrlAsync("https://www.biography.com/.image/t_share/MTQ1NDY3OTIxMzExNzM3NjE3/john-f-kennedydebating-richard-nixon.jpg");

-Task.WaitAll (new Task<IList<DetectedFace>>[] { faces_1, faces_2 });

-IEnumerable<DetectedFace> results = faces_1.Result.Concat (faces_2.Result);

-`https://westus.api.cognitive.microsoft.com/face/v1.0/detect[?returnFaceId][&returnFaceLandmarks][&returnFaceAttributes][&recognitionModel][&returnRecognitionModel][&detectionModel]&subscription-key=<Subscription key>`

-var faces = await faceClient.Face.DetectWithUrlAsync(url: imageUrl, returnFaceId: false, returnFaceLandmarks: false, recognitionModel: "recognition_04", detectionModel: "detection_03");

-await faceClient.PersonGroup.CreateAsync(personGroupId, "My Person Group Name", recognitionModel: "recognition_04");

-string personId = (await faceClient.PersonGroupPerson.CreateAsync(personGroupId, "My Person Name")).PersonId;

-await client.PersonGroupPerson.AddFaceFromUrlAsync(personGroupId, personId, imageUrl, detectionModel: "detection_03");

-await faceClient.FaceList.CreateAsync(faceListId, "My face collection", recognitionModel: "recognition_04");

-await client.FaceList.AddFaceFromUrlAsync(faceListId, imageUrl, detectionModel: "detection_03");

-`https://westus.api.cognitive.microsoft.com/face/v1.0/detect[?returnFaceId][&returnFaceLandmarks][&returnFaceAttributes][&recognitionModel][&returnRecognitionModel]&subscription-key=<Subscription key>`

-string imageUrl = "https://news.microsoft.com/ceo/assets/photos/06_web.jpg";

-var faces = await faceClient.Face.DetectWithUrlAsync(url: imageUrl, returnFaceId: true, returnFaceLandmarks: true, recognitionModel: "recognition_01", returnRecognitionModel: true);

-See the following code example for the .NET client library.

-await faceClient.PersonGroup.CreateAsync(personGroupId, "My Person Group Name", recognitionModel: "recognition_04");

-See the following code example for the .NET client library.

-await faceClient.FaceList.CreateAsync(faceListId, "My face collection", recognitionModel: "recognition_04");

-[Find Similar]: /rest/api/face/face-recognition-operations/find-similar-from-large-face-list

-The [Azure AI Face WPF (Windows Presentation Foundation)](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/tree/master/app-samples/Cognitive-Services-Face-WPF) sample app uses the HeadPose attribute to rotate its detected face rectangles.

-You can programmatically rotate the face rectangle by using the HeadPose attribute. If you specify this attribute when detecting faces (see [Call the detect API](identity-detect-faces.md)), you will be able to query it later. The following method from the [Azure AI Face WPF](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/tree/master/app-samples/Cognitive-Services-Face-WPF) app takes a list of **DetectedFace** objects and returns a list of **[Face](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/blob/master/app-samples/Cognitive-Services-Face-WPF/Sample-WPF/Controls/Face.cs)** objects. **Face** here is a custom class that stores face data, including the updated rectangle coordinates. New values are calculated for **top**, **left**, **width**, and **height**, and a new field **FaceAngle** specifies the rotation.

-public static IEnumerable<Face> CalculateFaceRectangleForRendering(IList<DetectedFace> faces, int maxSize, Tuple<int, int> imageInfo)

-From here, you can use the returned **Face** objects in your display. The following lines from [FaceDetectionPage.xaml](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/blob/master/app-samples/Cognitive-Services-Face-WPF/Sample-WPF/Controls/FaceDetectionPage.xaml) show how the new rectangle is rendered from this data:

-* See the [Azure AI Face WPF](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/tree/master/app-samples/Cognitive-Services-Face-WPF) app on GitHub for a working example of rotated face rectangles.

-* Or, see the [Face HeadPose Sample](https://github.com/Azure-Samples/cognitive-services-dotnet-sdk-samples/tree/master/app-samples) app, which tracks the HeadPose attribute in real time to detect head movements.

-The samples are written in C# by using the Azure AI Face client library.

-## Step 1: Initialize the client object

-When you use the Face client library, the key and subscription endpoint are passed in through the constructor of the FaceClient class. See the [quickstart](../quickstarts-sdk/identity-client-library.md?pivots=programming-language-csharp&tabs=visual-studio) for instructions on creating a Face client object.

-## Step 2: Code migration

- await FaceClient.LargeFaceList.TrainAsync(largeFaceListId);

- var status = await faceClient.LargeFaceList.GetTrainingStatusAsyn(largeFaceListId);

- if (status.Status == Status.Running)

- else if (status.Status == Status.Succeeded)

-await faceClient.FaceList.CreateAsync(FaceListId, FaceListName);

- using (Stream stream = File.OpenRead(imagePath))

- await faceClient.FaceList.AddFaceFromStreamAsync(FaceListId, stream);

- });

-var results = new List<SimilarPersistedFace[]>();

- var faces = await faceClient.Face.DetectWithStreamAsync(stream);

- results.Add(await faceClient.Face.FindSimilarAsync(face.FaceId, FaceListId, 20));

-await faceClient.LargeFaceList.CreateAsync(LargeFaceListId, LargeFaceListName);

- using (Stream stream = File.OpenRead(imagePath))

- await faceClient.LargeFaceList.AddFaceFromStreamAsync(LargeFaceListId, stream);

- });

-// Must call it before FindSimilarAsync() to ensure the newly added faces searchable.

-var results = new List<SimilarPersistedFace[]>();

- var faces = await faceClient.Face.DetectWithStreamAsync(stream);

- results.Add(await faceClient.Face.FindSimilarAsync(face.FaceId, largeFaceListId: LargeFaceListId));

-## Step 3: Train suggestions

-### Step 3a: Customize time interval

-### Step 3b: Small-scale buffer

-### Step 3c: Standalone training

- // Create a LargePersonGroup.

- const string LargePersonGroupId = "mylargepersongroupid_001";

- const string LargePersonGroupName = "MyLargePersonGroupDisplayName";

- faceClient.LargePersonGroup.CreateAsync(LargePersonGroupId, LargePersonGroupName).Wait();

- trainTimer.Elapsed += (sender, args) => TrainTimerOnElapsed(LargePersonGroupId, TimeIntervalForStatus);

-var jsSerializer = new JavaScriptSerializer();

-byte[] byteData = Encoding.UTF8.GetBytes(jsSerializer.Serialize(body));

-To find four similar faces, the **matchPerson** mode returns A and B, which show the same person as the target face. The **matchFace** mode returns A, B, C, and D, which is exactly four candidates, even if some aren't the same person as the target or have low similarity. For more information, see the [Facial recognition](concept-face-recognition.md) concepts guide or the [Find Similar API](/rest/api/face/face-recognition-operations/find-similar-from-large-face-list) reference documentation.

- "incidentName": "<text-incident-name>",

- "incidentDefinition": "string"

- "incidentName": "<image-incident-name>"

- * Azure OpenAI requires registration and is currently only available to approved enterprise customers and partners. See [Limited access to Azure OpenAI Service](/legal/cognitive-services/openai/limited-access?context=/azure/ai-services/openai/context/context) for more information. You can apply for access to Azure OpenAI by completing the form at https://aka.ms/oai/access. Open an issue on this repo to contact us if you have an issue.

-**Object grounding**: Azure AI Vision complements GPT-4 Turbo with VisionΓÇÖs text response by identifying and locating salient objects in the input images. This lets the chat model give more accurate and detailed responses about the contents of the image.

-> [!IMPORTANT]

-> To use Vision enhancement, you need a Computer Vision resource. It must be in the paid (S1) tier and in the same Azure region as your GPT-4 Turbo with Vision resource.

-> [!NOTE]

-> In order to use the video prompt enhancement, you need both an Azure AI Vision resource, in the paid (S1) tier, in addition to your Azure OpenAI resource.

-## Deploy to a copilot (preview) or web app

-This gives you the option of deploying a standalone web app for you and your users to interact with chat models using a graphical user interface. See [Use the Azure OpenAI web app](../how-to/use-web-app.md) for more information.

-You can also deploy to a copilot in [Copilot Studio](/microsoft-copilot-studio/fundamentals-what-is-copilot-studio) (preview) directly from Azure OpenAI studio, enabling you to bring conversational experiences to various channels such as: Microsoft Teams, websites, Dynamics 365, and other [Azure Bot Service channels](/microsoft-copilot-studio/publication-connect-bot-to-azure-bot-service-channels). The tenant used in the Azure OpenAI service and Copilot Studio (preview) should be the same. For more information, see [Use a connection to Azure OpenAI On Your Data](/microsoft-copilot-studio/nlu-generative-answers-azure-openai).

-* An Azure subscription. [Create one for free](https://azure.microsoft.com/free/cognitive-services).

-* Access granted to Azure OpenAI in the desired Azure subscription.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by [completing the form](https://aka.ms/oai/access). Open an issue on this repo to contact us if you have a problem.

-* An Azure OpenAI resource with the GPT-4 Turbo with Vision model deployed. For more information about model deployment, see the [resource deployment guide](../how-to/create-resource.md).

- Azure OpenAI requires registration and is currently available only to approved enterprise customers and partners. For more information, see [Limited access to Azure OpenAI Service](/legal/cognitive-services/openai/limited-access?context=/azure/ai-services/openai/context/context). You can apply for access to Azure OpenAI by [completing the form](https://aka.ms/oai/access). Open an issue on this repo to contact us if you have a problem.

- Currently, you must submit an application to access Azure OpenAI Service. To apply for access, complete <a href="https://aka.ms/oai/access" target="_blank">this form</a>. If you need assistance, open an issue on this repo to contact Microsoft.

-More complex security scenarios require Azure role-based access control (Azure RBAC). This document covers how to authenticate to your OpenAI resource using Microsoft Entra ID.

- Currently, access to this service is by application. You can apply for access to Azure OpenAI Service by completing the form at [https://aka.ms/oai/access](https://aka.ms/oai/access?azure-portal=true).

-How do I get access to Azure OpenAI?

-Access is currently limited as we navigate high demand, upcoming product improvements, and <a href="https://www.microsoft.com/ai/responsible-ai?activetab=pivot1:primaryr6" target="_blank">MicrosoftΓÇÖs commitment to responsible AI</a>. For now, we're working with customers with an existing partnership with Microsoft, lower risk use cases, and those committed to incorporating mitigations.

-More specific information is included in the application form. We appreciate your patience as we work to responsibly enable broader access to Azure OpenAI.

-Apply here for access:

-<a href="https://aka.ms/oaiapply" target="_blank">Apply now</a>

-> [!NOTE]

-> Currently, you must submit an application to access Azure OpenAI Service. To apply for access, complete [this form](https://aka.ms/oai/access).

- Azure OpenAI requires registration and is currently only available to approved enterprise customers and partners. [See Limited access to Azure OpenAI Service](/legal/cognitive-services/openai/limited-access?context=/azure/ai-services/openai/context/context) for more information. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

-Create custom content filters for your DALL-E 2 and 3, GPT-4 Turbo with Vision GA (gpt-4-turbo-2024-04-09) and GPT-4o deployments. [Content filtering](/azure/ai-services/openai/concepts/content-filter?tabs=warning%2Cpython-new#configurability-preview)

-> [!NOTE]

-> Currently, you must submit an application to access Azure OpenAI Service. To apply for access, complete [this form](https://aka.ms/oai/access).

- * Azure OpenAI requires registration and is currently only available to approved enterprise customers and partners. See [Limited access to Azure OpenAI Service](/legal/cognitive-services/openai/limited-access?context=/azure/ai-services/openai/context/context) for more information. You can apply for access to Azure OpenAI by completing the form at https://aka.ms/oai/access. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

-description: Learn how to deploy Meta Llama models with Azure AI Studio.

-# How to deploy Meta Llama models with Azure AI Studio

-In this article, you learn about the Meta Llama models. You also learn how to use Azure AI Studio to deploy models from this set either to serverless APIs with pay-as you go billing or to managed compute.

- > Read more about the announcement of Meta Llama 3 models available now on Azure AI Model Catalog: [Microsoft Tech Community Blog](https://aka.ms/Llama3Announcement) and from [Meta Announcement Blog](https://aka.ms/meta-llama3-announcement-blog).

-Meta Llama 3 models and tools are a collection of pretrained and fine-tuned generative text models ranging in scale from 8 billion to 70 billion parameters. The model family also includes fine-tuned versions optimized for dialogue use cases with reinforcement learning from human feedback (RLHF), called Meta-Llama-3-8B-Instruct and Meta-Llama-3-70B-Instruct. See the following GitHub samples to explore integrations with [LangChain](https://aka.ms/meta-llama3-langchain-sample), [LiteLLM](https://aka.ms/meta-llama3-litellm-sample), [OpenAI](https://aka.ms/meta-llama3-openai-sample) and the [Azure API](https://aka.ms/meta-llama3-azure-api-sample).

-## Deploy Meta Llama models as a serverless API

-Certain models in the model catalog can be deployed as a serverless API with pay-as-you-go, providing a way to consume them as an API without hosting them on your subscription while keeping the enterprise security and compliance organizations need. This deployment option doesn't require quota from your subscription.

-Meta Llama 3 models are deployed as a serverless API with pay-as-you-go billing through Microsoft Azure Marketplace, and they might add more terms of use and pricing.

-# [Meta Llama 3](#tab/llama-three)

-The following models are available in Azure Marketplace for Llama 3 when deployed as a service with pay-as-you-go:

-* [Meta Llama-3 8B-Instruct (preview)](https://aka.ms/aistudio/landing/meta-llama-3-8b-chat)

-* [Meta Llama-3 70B-Instruct (preview)](https://aka.ms/aistudio/landing/meta-llama-3-70b-chat)

-1. Choose the model you want to deploy from the Azure AI Studio [model catalog](https://ai.azure.com/explore/models).

-1. On the model's **Details** page, select **Deploy** and then select **Serverless API with Azure AI Content Safety**.

-1. If this is your first time deploying the model in the project, you have to subscribe your project for the particular offering (for example, Meta-Llama-3-70B) from Azure Marketplace. This step requires that your account has the Azure subscription permissions and resource group permissions listed in the prerequisites. Each project has its own subscription to the particular Azure Marketplace offering, which allows you to control and monitor spending. Select **Subscribe and Deploy**.

-To learn about billing for Meta Llama models deployed with pay-as-you-go, see [Cost and quota considerations for Llama 3 models deployed as a service](#cost-and-quota-considerations-for-llama-models-deployed-as-a-service).

-To learn about billing for Llama models deployed with pay-as-you-go, see [Cost and quota considerations for Llama 3 models deployed as a service](#cost-and-quota-considerations-for-llama-models-deployed-as-a-service).

-1. Find and select the deployment you created.

- - For chat models, such as `Meta-Llama-3-8B-Instruct`, use the [`/chat/completions`](#chat-api) API.

- For more information on using the APIs, see the [reference](#reference-for-meta-llama-models-deployed-as-a-service) section.

- For more information on using the APIs, see the [reference](#reference-for-meta-llama-models-deployed-as-a-service) section.

-### Reference for Meta Llama models deployed as a service

-Apart from deploying with the pay-as-you-go managed service, you can also deploy Meta Llama models to managed compute in AI Studio. When deployed to managed compute, you can select all the details about the infrastructure running the model, including the virtual machines to use and the number of instances to handle the load you're expecting. Models deployed to managed compute consume quota from your subscription. All the models in the Llama family can be deployed to managed compute.

-Follow these steps to deploy a model such as `Llama-2-7b-chat` to a real-time endpoint in [Azure AI Studio](https://ai.azure.com).

- :::image type="content" source="../media/deploy-monitor/llama/deploy-real-time-endpoint.png" alt-text="A screenshot showing how to deploy a model with the real-time endpoint option." lightbox="../media/deploy-monitor/llama/deploy-real-time-endpoint.png":::

-# [Meta Llama 3](#tab/llama-three)

-| **Package** | **Sample Notebook** |

-|-|-|

-| OpenAI SDK (experimental) | [openaisdk.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/meta-llama3/openaisdk.ipynb) |

-| LangChain | [langchain.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/meta-llama3/langchain.ipynb) |

-| WebRequests | [webrequests.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/meta-llama3/webrequests.ipynb) |

-| LiteLLM SDK | [litellm.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/meta-llama3/litellm.ipynb) |

-# [Meta Llama 2](#tab/llama-two)

-| OpenAI SDK (experimental) | [openaisdk.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/llama2/openaisdk.ipynb) |

-| LangChain | [langchain.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/llama2/langchain.ipynb) |

-| WebRequests | [webrequests.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/llama2/webrequests.ipynb) |

-| LiteLLM SDK | [litellm.ipynb](https://github.com/Azure/azureml-examples/blob/main/sdk/python/foundation-models/llama2/litellm.ipynb) |

-### Cost and quota considerations for Llama models deployed as a service

-Llama models deployed as a service are offered by Meta through the Azure Marketplace and integrated with Azure AI Studio for use. You can find the Azure Marketplace pricing when deploying or [fine-tuning the models](./fine-tune-model-llama.md).

-Quota is managed per deployment. Each deployment has a rate limit of 200,000 tokens per minute and 1,000 API requests per minute. However, we currently limit one deployment per model per project. Contact Microsoft Azure Support if the current rate limits aren't sufficient for your scenarios.

-### Cost and quota considerations for Llama models deployed as managed compute

-For deployment and inferencing of Llama models with managed compute, you consume virtual machine (VM) core quota that is assigned to your subscription on a per-region basis. When you sign up for Azure AI Studio, you receive a default VM quota for several VM families available in the region. You can continue to create deployments until you reach your quota limit. Once you reach this limit, you can request a quota increase.

-The [Meta Llama family of large language models (LLMs)](./deploy-models-llama.md) is a collection of pretrained and fine-tuned generative text models ranging in scale from 7 billion to 70 billion parameters. The model family also includes fine-tuned versions optimized for dialogue use cases with Reinforcement Learning from Human Feedback (RLHF), called Llama-2-chat.

-# [Meta Llama 3](#tab/llama-three)

-Fine-tuning of Llama 3 models is currently not supported.

-# [Meta Llama 3](#tab/llama-three)

-Fine-tuning of Llama 3 models is currently not supported.

-# [Meta Llama 3](#tab/llama-three)

-Fine-tuning of Llama 3 models is currently not supported.

- Currently, you must apply for access to this service. To apply for access to Azure OpenAI, complete the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

- Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

-2. Make sure you're in the cloned *aks-store-demo* directory, and then open the manifest file with a text editor, such as `vi`.

- ```azurecli-interactive

- vi aks-store-quickstart.yaml

- ```

-4. Save and close the file. In `vi`, use `:wq`.

- (Get-AzContainerRegistry -ResourceGroupName myResourceGroup -Name <acrName>).LoginServer

-2. Make sure you're in the cloned *aks-store-demo* directory, and then open the manifest file with a text editor, such as `vi`.

- ```azurepowershell-interactive

- vi aks-store-quickstart.yaml

- ```

-4. Save and close the file. In `vi`, use `:wq`.

- deployment.apps/rabbitmq created

- deployment.apps/rabbitmq created

- Initially, the `EXTERNAL-IP` for the *store-front* service shows as *pending*:

-2. When the `EXTERNAL-IP` address changes from *pending* to an actual public IP address, use `CTRL-C` to stop the `kubectl` watch process.

-3. View the application in action by opening a web browser to the external IP address of your service.

-1. Copy the External IP shown in the column for store-front

-* Create an AKS cluster using the [`az aks create`][az aks create] command. The following example creates a cluster named *myAKSCluster* in the resource group named *myResourceGroup*. This resource group was created in the [previous tutorial][aks-tutorial-prepare-acr] in the *eastus* region.

- --attach-acr <acrName>

- New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -NodeCount 2 -GenerateSshKey -AcrNameToAttach <acrName>

- aks-nodepool1-19366578-vmss000002 Ready agent 47h v1.25.6

- aks-nodepool1-19366578-vmss000003 Ready agent 47h v1.25.6

- aks-nodepool1-19366578-vmss000002 Ready agent 47h v1.25.6

- aks-nodepool1-19366578-vmss000003 Ready agent 47h v1.25.6

- aks-nodepool1-19366578-vmss000002 Ready agent 47h v1.25.6

- aks-nodepool1-19366578-vmss000003 Ready agent 47h v1.25.6

-2. Navigate to the external IP address of the `store-front` service in your browser.

-[docker-for-linux]: https://docs.docker.com/engine/installation/#supported-platforms

-[docker-for-mac]: https://docs.docker.com/docker-for-mac/

-[docker-for-windows]: https://docs.docker.com/docker-for-windows/

- "dnsPrefix": null,

- "fqdn": null,

- "name": "myAKSCluster",

- "osDiskSizeGb": null,

- "vmSize": "Standard_D2_v2",

- ProvisioningState : Succeeded

- MaxAgentPools : 100

- KubernetesVersion : 1.19.9

- DnsPrefix : myAKSCluster

- Fqdn : myakscluster-000a0aa0.hcp.eastus.azmk8s.io

- PrivateFQDN :

- AgentPoolProfiles : {default}

- WindowsProfile : Microsoft.Azure.Commands.Aks.Models.PSManagedClusterWindowsProfile

- AddonProfiles : {}

- NodeResourceGroup : MC_myresourcegroup_myAKSCluster_eastus

- EnableRBAC : True

- EnablePodSecurityPolicy :

- NetworkProfile : Microsoft.Azure.Commands.Aks.Models.PSContainerServiceNetworkProfile

- AadProfile :

- ApiServerAccessProfile :

- Identity :

- LinuxProfile : Microsoft.Azure.Commands.Aks.Models.PSContainerServiceLinuxProfile

- ServicePrincipalProfile : Microsoft.Azure.Commands.Aks.Models.PSContainerServiceServicePrincipalProfile

- Id : /subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myresourcegroup/providers/Micros

- oft.ContainerService/managedClusters/myAKSCluster

- Name : myAKSCluster

- Type : Microsoft.ContainerService/ManagedClusters

- Location : eastus

- Tags : {}

- The following example output shows the current version as *1.26.6* and lists the available versions under `upgrades`:

- {

- "agentPoolProfiles": null,

- "controlPlaneProfile": {

- "kubernetesVersion": "1.26.6",

- "upgrades": [

- {

- "isPreview": null,

- "kubernetesVersion": "1.27.1"

- },

- {

- "isPreview": null,

- "kubernetesVersion": "1.27.3"

- }

- ]

- },

- ...

- }

- Select-Object -Property Name, KubernetesVersion, Location

- The following example output shows the current version as *1.26.6* and the location as *eastus*:

- Name KubernetesVersion Location

- - -- --

- myAKSCluster 1.26.6 eastus

- Kubernetes 1.27.1

- Kubernetes 1.27.3

- The following example output shows the result of upgrading to *1.27.3*. Notice the `kubernetesVersion` now shows *1.27.3*:

- "vmSize": "Standard_DS1_v2",

- "kubernetesVersion": "1.27.3",

- The following example output shows the result of upgrading to *1.27.3*. Notice the `KubernetesVersion` now shows *1.27.3*:

- ProvisioningState : Succeeded

- MaxAgentPools : 100

- KubernetesVersion : 1.27.3

- PrivateFQDN :

- AgentPoolProfiles : {default}

- Name : myAKSCluster

- Type : Microsoft.ContainerService/ManagedClusters

- Location : eastus

- Tags : {}

- default 2m1s Normal Drain node/aks-nodepool1-96663640-vmss000001 Draining node: [aks-nodepool1-96663640-vmss000001]

- ...

- default 9m22s Normal Surge node/aks-nodepool1-96663640-vmss000002 Created a surge node [aks-nodepool1-96663640-vmss000002 nodepool1] for agentpool %!s(MISSING)

- myAKSCluster eastus myResourceGroup 1.27.3 1.27.3 Succeeded myaksclust-myresourcegroup-19da35-bd54a4be.hcp.eastus.azmk8s.io

- Name Location KubernetesVersion ProvisioningState

- - -- -- --

- myAKSCluster eastus 1.27.3 Succeeded

-> You have 14 days to complete this step. If you don't complete this step in 14 days, your migration is automatically reverted back to an App Service Environment v2. If you need more than 14 days to complete this step, contact support.

-Once you confirm your apps are working as expected, you can finalize the migration by running the following command. This command also deletes your old environment. You have 14 days to complete this step. If you don't complete this step in 14 days, your migration is automatically reverted back to an App Service Environment v2. If you need more than 14 days to complete this step, contact support.

- > - For Python 3.8 packages, use .tar.gz or .whl files targeting cp38-amd64.

-2. On the **Add Python Package** page, select a local package to upload. The package can be a **.whl** or **.tar.gz** file.

- - The maximum number of keys in the cache during the past reporting time period. This number maps to `keyspace` from the Redis INFO command. Because of a limitation in the underlying metrics system for caches with clustering enabled, Total Keys return the maximum number of keys of the shard that had the maximum number of keys during the reporting interval.

-ServiceNow supported versions include Vancouver, Utah, Tokyo, San Diego, Rome, Quebec, Paris, Orlando, New York, Madrid, London, Kingston, Jakarta, Istanbul, Helsinki, and Geneva.

-> * Red Hat Openshift distributions

- > * Windows nodes

-| Azure NetApp Files customer-managed keys | Generally available (GA) | No |

-To deploy a template that moves an existing Azure subscription to a new management group, see [Move subscriptions in ARM template](../../governance/management-groups/manage.md#move-subscriptions-in-arm-template)

- * To move an Azure subscription to a new management group, see [Move subscriptions](../../governance/management-groups/manage.md#move-subscriptions).

-To deploy a template that moves an existing Azure subscription to a new management group, see [Move subscriptions in ARM template](../../governance/management-groups/manage.md#move-subscriptions-in-arm-template)

-This article describes how to enable the older TLS protocols (TLS 1.0 and 1.1) as well as applying legacy cipher suites to support the additional protocols on the Windows Server 2019 cloud service web and worker roles.

-We understand that while we are taking steps to deprecate TLS 1.0 and TLS 1.1, our customers may need to support the older protocols and cipher suites until they can plan for their deprecation. While we don't recommend re-enabling these legacy values, we are providing guidance to help customers. We encourage customers to evaluate the risk of regression before implementing the changes outlined in this article.

-In support of our commitment to use best-in-class encryption, Microsoft announced plans to start migration away from TLS 1.0 and 1.1 in June of 2017. Since that initial announcement, Microsoft announced our intent to disable Transport Layer Security (TLS) 1.0 and 1.1 by default in supported versions of Microsoft Edge and Internet Explorer 11 in the first half of 2020. Similar announcements from Apple, Google, and Mozilla indicate the direction in which the industry is headed.

-The Windows Server 2019 cloud server image is configured with TLS 1.0 and TLS 1.1 disabled at the registry level. This means applications deployed to this version of Windows AND using the Windows stack for TLS negotiation will not allow TLS 1.0 and TLS 1.1 communication.

-Use the following code as an example to create a script that enables the older protocols and cipher suites. For the purposes of this documentation, this script will be named: **TLSsettings.ps1**. Store this script on your local desktop for easy access in later steps.

-Create a CMD file named **RunTLSSettings.cmd** using the below. Store this script on your local desktop for easy access in later steps.

-Here is an example that shows both the worker role and web role.

-Now that the above steps have been complete, publish the update to your existing Cloud Service.

-[Azure Automation](https://azure.microsoft.com/services/automation/) is an Azure service for simplifying cloud management through process automation. Using Azure Automation, long-running, manual, error-prone, and frequently repeated tasks can be automated to increase reliability, efficiency, and time to value for your organization.

-Azure Automation provides a highly reliable and highly available workflow execution engine that scales to meet your needs as your organization grows. In Azure Automation, processes can be kicked off manually, by third-party systems, or at scheduled intervals so that tasks happen exactly when needed.

-Lower operational overhead and free up IT / DevOps staff to focus on work that adds business value by moving your cloud management tasks to be run automatically by Azure Automation.

-Azure cloud services can be managed in Azure Automation by using the PowerShell cmdlets that are available in the [Azure PowerShell tools](/powershell/). Azure Automation has these cloud service PowerShell cmdlets available out of the box, so that you can perform all of your cloud service management tasks within the service. You can also pair these cmdlets in Azure Automation with the cmdlets for other Azure services, to automate complex tasks across Azure services and third party systems.

-Now that you've learned the basics of Azure Automation and how it can be used to manage Azure cloud services, follow these links to learn more about Azure Automation.

-When you deploy instances to a Cloud Service or add new web or worker role instances, Microsoft Azure allocates compute resources. You may occasionally receive errors when performing these operations even before you reach the Azure subscription limits. This article explains the causes of some of the common allocation failures and suggests possible remediation. The information may also be useful when you plan the deployment of your services.

-The servers in Azure datacenters are partitioned into clusters. A new cloud service allocation request is attempted in multiple clusters. When the first instance is deployed to a cloud service(in either staging or production), that cloud service gets pinned to a cluster. Any further deployments for the cloud service will happen in the same cluster. In this article, we'll refer to this as "pinned to a cluster". Diagram 1 below illustrates the case of a normal allocation which is attempted in multiple clusters; Diagram 2 illustrates the case of an allocation that's pinned to Cluster 2 because that's where the existing Cloud Service CS_1 is hosted.

-When an allocation request is pinned to a cluster, there's a higher chance of failing to find free resources since the available resource pool is limited to a cluster. Furthermore, if your allocation request is pinned to a cluster but the type of resource you requested is not supported by that cluster, your request will fail even if the cluster has free resource. Diagram 3 below illustrates the case where a pinned allocation fails because the only candidate cluster does not have free resources. Diagram 4 illustrates the case where a pinned allocation fails because the only candidate cluster does not support the requested VM size, even though the cluster has free resources.

-See further solutions for the exceptions below:

-|FabricInternalServerError |Operation failed with error code 'InternalError' and errorMessage 'The server encountered an internal error. Please retry the request.'.|[Troubleshoot FabricInternalServerError](cloud-services-troubleshoot-fabric-internal-server-error.md)|

-|ServiceAllocationFailure |Operation failed with error code 'InternalError' and errorMessage 'The server encountered an internal error. Please retry the request.'.|[Troubleshoot ServiceAllocationFailure](cloud-services-troubleshoot-fabric-internal-server-error.md)|

-|LocationNotFoundForRoleSize |The operation '`{Operation ID}`' failed: 'The requested VM tier is currently not available in Region (`{Region ID}`) for this subscription. Please try another tier or deploy to a different location.'.|[Troubleshoot LocationNotFoundForRoleSize](cloud-services-troubleshoot-location-not-found-for-role-size.md)|

-|ConstrainedAllocationFailed |Azure operation '`{Operation ID}`' failed with code Compute.ConstrainedAllocationFailed. Details: Allocation failed; unable to satisfy constraints in request. The requested new service deployment is bound to an Affinity Group, or it targets a Virtual Network, or there is an existing deployment under this hosted service. Any of these conditions constrains the new deployment to specific Azure resources. Please retry later or try reducing the VM size or number of role instances. Alternatively, if possible, remove the aforementioned constraints or try deploying to a different region.|[Troubleshoot ConstrainedAllocationFailed](cloud-services-troubleshoot-constrained-allocation-failed.md)|

-|OverconstrainedAllocationRequest |The VM size (or combination of VM sizes) required by this deployment cannot be provisioned due to deployment request constraints. If possible, try relaxing constraints such as virtual network bindings, deploying to a hosted service with no other deployment in it and to a different affinity group or with no affinity group, or try deploying to a different region.|[Troubleshoot OverconstrainedAllocationRequest](cloud-services-troubleshoot-overconstrained-allocation-request.md)|

-* Deploying to Staging Slot - If a cloud service has a deployment in either slot, then the entire cloud service is pinned to a specific cluster. This means that if a deployment already exists in the production slot, then a new staging deployment can only be allocated in the same cluster as the production slot. If the cluster is nearing capacity, the request may fail.

-* Scaling - Adding new instances to an existing cloud service must allocate in the same cluster. Small scaling requests can usually be allocated, but not always. If the cluster is nearing capacity, the request may fail.

-* Affinity Group - A new deployment to an empty cloud service can be allocated by the fabric in any cluster in that region, unless the cloud service is pinned to an affinity group. Deployments to the same affinity group will be attempted on the same cluster. If the cluster is nearing capacity, the request may fail.

-* Affinity Group vNet - Older Virtual Networks were tied to affinity groups instead of regions, and cloud services in these Virtual Networks would be pinned to the affinity group cluster. Deployments to this type of virtual network will be attempted on the pinned cluster. If the cluster is nearing capacity, the request may fail.

-2. Delete both production and staging slots - This solution will preserve your existing DNS name, but will cause downtime to your application.

- * Create a new deployment in the existing cloud service. This will re-attempt to allocation on all clusters in the region. Ensure the cloud service is not tied to an affinity group.

-3. Reserved IP - This solution will preserve your existing IP address, but will cause downtime to your application.

- * Follow #2 from above, making sure to specify the new ReservedIP in the service's CSCFG.

-4. Remove affinity group for new deployments - Affinity Groups are no longer recommended. Follow steps for #1 above to deploy a new cloud service. Ensure cloud service is not in an affinity group.

-5. Convert to a Regional Virtual Network - See [How to migrate from Affinity Groups to a Regional Virtual Network (VNet)](/previous-versions/azure/virtual-network/virtual-networks-migrate-to-regional-vnet).

-Certificates are used in Azure for cloud services ([service certificates](#what-are-service-certificates)) and for authenticating with the management API ([management certificates](#what-are-management-certificates)). This topic gives a general overview of both certificate types, how to [create](#create) and deploy them to Azure.

-Certificates used in Azure are x.509 v3 certificates and can be signed by another trusted certificate or they can be self-signed. A self-signed certificate is signed by its own creator, therefore it is not trusted by default. Most browsers can ignore this problem. You should only use self-signed certificates when developing and testing your cloud services.

-Certificates used by Azure can contains a public key. Certificates have a thumbprint that provides a means to identify them in an unambiguous way. This thumbprint is used in the Azure [configuration file](cloud-services-configure-ssl-certificate-portal.md) to identify which certificate a cloud service should use.

-You can upload service certificates to Azure either using the Azure portal or by using the classic deployment model. Service certificates are associated with a specific cloud service. They are assigned to a deployment in the service definition file.

-Service certificates can be managed separately from your services, and may be managed by different individuals. For example, a developer may upload a service package that refers to a certificate that an IT manager has previously uploaded to Azure. An IT manager can manage and renew that certificate (changing the configuration of the service) without needing to upload a new service package. Updating without a new service package is possible because the logical name, store name, and location of the certificate is in the service definition file and while the certificate thumbprint is specified in the service configuration file. To update the certificate, it's only necessary to upload a new certificate and change the thumbprint value in the service configuration file.

-Management certificates allow you to authenticate with the classic deployment model. Many programs and tools (such as Visual Studio or the Azure SDK) use these certificates to automate configuration and deployment of various Azure services. These are not really related to cloud services.

-There is a limit of 100 management certificates per subscription. There is also a limit of 100 management certificates for all subscriptions under a specific service administratorΓÇÖs user ID. If the user ID for the account administrator has already been used to add 100 management certificates and there is a need for more certificates, you can add a co-administrator to add the additional certificates.

-Additionally, management certificates can not be used with CSP subscriptions as CSP subscriptions only support the Azure Resource Manager deployment model and management certificates use the classic deployment model. Reference [Azure Resource Manager vs classic deployment model](../azure-resource-manager/management/deployment-models.md) and [Understanding Authentication with the Azure SDK for .NET](/dotnet/azure/sdk/authentication) for more information on your options for CSP subscriptions.

-This utility has been deprecated and is no longer documented here. For more information, see [this MSDN article](/windows/desktop/SecCrypto/makecert).

-There are many pages on the internet that cover how to do this with IIS. [Here](https://www.sslshopper.com/article-how-to-create-a-self-signed-certificate-in-iis-7.html) is a great one I found that I think explains it well.

-[This](../virtual-machines/linux/mac-create-ssh-keys.md?toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json) article describes how to create certificates with SSH.

-description: Learn about what Azure Cloud Services is, specifically that it's designed to support applications that are scalable, reliable, and inexpensive to operate.

-More control also means less ease of use. Unless you need the additional control options, it's typically quicker and easier to get a web application up and running in the Web Apps feature of App Service compared to Azure Cloud Services.

-* **Web role**: Automatically deploys and hosts your app through IIS.

-* **Worker role**: Does not use IIS, and runs your app standalone.

-The PaaS nature of Azure Cloud Services has other implications, too. One of the most important is that applications built on this technology should be written to run correctly when any web or worker role instance fails. To achieve this, an Azure Cloud Services application shouldn't maintain state in the file system of its own VMs. Unlike VMs created with Virtual Machines, writes made to Azure Cloud Services VMs aren't persistent. There's nothing like a Virtual Machines data disk. Instead, an Azure Cloud Services application should explicitly write all state to Azure SQL Database, blobs, tables, or some other external storage. Building applications this way makes them easier to scale and more resistant to failure, which are both important goals of Azure Cloud Services.

-This task uses a production deployment. Information on using a staging deployment is provided at the end of this topic.

-Read [this](cloud-services-how-to-create-deploy-portal.md) first if you have not yet created a cloud service.

-To configure TLS for an application, you first need to get a TLS/SSL certificate that has been signed by a Certificate Authority (CA), a trusted third party who issues certificates for this purpose. If you do not already have one, you need to obtain one from a company that sells TLS/SSL certificates.

-* The certificate's subject name must match the domain used to access the cloud service. You cannot obtain a TLS/SSL certificate from a certificate authority (CA) for the cloudapp.net domain. You must acquire a custom domain name to use when access your service. When you request a certificate from a CA, the certificate's subject name must match the custom domain name used to access your application. For example, if your custom domain name is **contoso.com** you would request a certificate from your CA for ***.contoso.com** or **www\.contoso.com**.

-For test purposes, you can [create](cloud-services-certs-create.md) and use a self-signed certificate. A self-signed certificate is not authenticated through a CA and can use the cloudapp.net domain as the website URL. For example, the following task uses a self-signed certificate in which the common name (CN) used in the certificate is **sslexample.cloudapp.net**.

- The **Certificates** section defines the name of our certificate, its location, and the name of the store where it is located.

- All the required changes to the service definition file have been

- completed; but, you still need to add the certificate information to

- the service configuration file.

-4. In your service configuration file (CSCFG), ServiceConfiguration.Cloud.cscfg, add a **Certificates**

-value with that of your certificate. The following code sample provides

- details of the **Certificates** section, except for the thumbprint value.

-Now that the service definition and service configuration files have

-been updated, package your deployment for uploading to Azure. If

-you are using **cspack**, don't use the

-**/generateConfigurationFile** flag, as that will overwrite the

-certificate information you just inserted.

-2. Click **Certificates**.

-3. Click **Upload** at the top of the certificates area.

-4. Provide the **File**, **Password**, then click **Upload** at the bottom of the data entry area.

-1. Click the **Site URL** to open up the web browser.

-We will first set up a Virtual Network (VNet) in Azure. We will then add an Active Directory Domain Controller (hosted on an Azure Virtual Machine) to the VNet. Next, we will add existing cloud service roles to the pre-created VNet, then connect them to the Domain Controller.

-2. Your AD Domain Controller and Web/Worker Role instances need to be in the VNet.

-Follow this step-by-step guide and if you run into any issues, leave us a comment at the end of the article. Someone will get back to you (yes, we do read comments).

-## Create a Virtual Network

-You can create a Virtual Network in Azure using the Azure portal or PowerShell. For this tutorial, PowerShell is used. To create a virtual network using the Azure portal, see [Create a virtual network](../virtual-network/quick-create-portal.md). The article covers creating a virtual network (Resource Manager), but you must create a virtual network (Classic) for cloud services. To do so, in the portal, select **Create a resource**, type *virtual network* in the **Search** box, and then press **Enter**. In the search results, under **Everything**, select **Virtual network**. Under **Select a deployment model**, select **Classic**, then select **Create**. You can then follow the steps in the article.

-#Create Virtual Network

-Once you have completed setting up the Virtual Network, you will need to create an AD Domain Controller. For this tutorial, we will be setting up an AD Domain Controller on an Azure Virtual Machine.

-To do this, create a virtual machine through PowerShell using the following commands:

-# Create a VM and add it to the Virtual Network

-To configure the Virtual Machine as an AD Domain Controller, you will need to log in to the VM and configure it.

-To log in to the VM, you can get the RDP file through PowerShell, use the following commands:

-Once you are signed in to the VM, set up your Virtual Machine as an AD Domain Controller by following the step-by-step guide on [How to set up your customer AD Domain Controller](https://social.technet.microsoft.com/wiki/contents/articles/12370.windows-server-2012-set-up-your-first-domain-controller-step-by-step.aspx).

-## Add your Cloud Service to the Virtual Network

-Next, you need to add your cloud service deployment to the new VNet. To do this, modify your cloud service cscfg by adding the relevant sections to your cscfg using Visual Studio or the editor of your choice.

-description: Learn how to expose your Azure application or data to the internet on a custom domain by configuring DNS settings. These examples use the Azure portal.

-When you create a Cloud Service, Azure assigns it to a subdomain of **cloudapp.net**. For example, if your Cloud Service is named "contoso", your users will be able to access your application on a URL like `http://contoso.cloudapp.net`. Azure also assigns a virtual IP address.

-CNAME (or alias records) and A records both allow you to associate a domain name with a specific server (or service in this case,) however they work differently. There are also some specific considerations when using A records with Azure Cloud services that you should consider before deciding which to use.

-A CNAME record maps a *specific* domain, such as **contoso.com** or **www\.contoso.com**, to a canonical domain name. In this case, the canonical domain name is the **[myapp].cloudapp.net** domain name of your Azure hosted application. Once created, the CNAME creates an alias for the **[myapp].cloudapp.net**. The CNAME entry will resolve to the IP address of your **[myapp].cloudapp.net** service automatically, so if the IP address of the cloud service changes, you do not have to take any action.

-An *A* record maps a domain, such as **contoso.com** or **www\.contoso.com**, *or a wildcard domain* such as **\*.contoso.com**, to an IP address. In the case of an Azure Cloud Service, the virtual IP of the service. So the main benefit of an A record over a CNAME record is that you can have one entry that uses a wildcard, such as \***.contoso.com**, which would handle requests for multiple sub-domains such as **mail.contoso.com**, **login.contoso.com**, or **www\.contso.com**.

- * Login to the [Azure portal], select your cloud service, look at the **Overview** section and then find the **Site URL** entry.

- Save the domain name used in the URL returned by either method, as you will need it when creating a CNAME record.

-2. Log on to your DNS registrar's website and go to the page for managing DNS. Look for links or areas of the site labeled as **Domain Name**, **DNS**, or **Name Server Management**.

-3. Now find where you can select or enter CNAME's. You may have to select the record type from a drop down, or go to an advanced settings page. You should look for the words **CNAME**, **Alias**, or **Subdomains**.

-> The example above only applies to traffic at the **www** subdomain. Since you cannot use wildcards with CNAME records, you must create one CNAME for each domain/subdomain. If you want to direct traffic from subdomains, such as *.contoso.com, to your cloudapp.net address, you can configure a **URL Redirect** or **URL Forward** entry in your DNS settings, or create an A record.

- * Login to the [Azure portal], select your cloud service, look at the **Overview** section and then find the **Public IP addresses** entry.

- Save the IP address, as you will need it when creating an A record.

-2. Log on to your DNS registrar's website and go to the page for managing DNS. Look for links or areas of the site labeled as **Domain Name**, **DNS**, or **Name Server Management**.

-3. Now find where you can select or enter A record's. You may have to select the record type from a drop down, or go to an advanced settings page.

-4. Select or enter the domain or subdomain that will use this A record. For example, select **www** if you want to create an alias for **www\.customdomain.com**. If you want to create a wildcard entry for all subdomains, enter '*****'. This will cover all sub-domains such as **mail.customdomain.com**, **login.customdomain.com**, and **www\.customdomain.com**.

-5. Enter the IP address of your cloud service in the provided field. This associates the domain entry used in the A record with the IP address of your cloud service deployment.

-* [How to Map CDN Content to a Custom Domain](../cdn/cdn-map-content-to-custom-domain.md)

-You can collect diagnostic data like application logs, performance counters etc. from a Cloud Service using the Azure Diagnostics extension. This article describes how to enable the Azure Diagnostics extension for a Cloud Service using PowerShell. See [How to install and configure Azure PowerShell](/powershell/azure/) for the prerequisites needed for this article.

-If the diagnostics configuration file specifies a `StorageAccount` element with a storage account name, then the `New-AzureServiceDiagnosticsExtensionConfig` cmdlet will automatically use that storage account. For this to work, the storage account needs to be in the same subscription as the Cloud Service being deployed.

-From Azure SDK 2.6 onward the extension configuration files generated by the MSBuild publish target output will include the storage account name based on the diagnostics configuration string specified in the service configuration file (.cscfg). The script below shows you how to parse the Extension configuration files from the publish target output and configure diagnostics extension for each role when deploying the cloud service.

-Visual Studio Online uses a similar approach for automated deployments of Cloud Services with the diagnostics extension. See [Publish-AzureCloudDeployment.ps1](https://github.com/Microsoft/azure-pipelines-tasks/blob/master/Tasks/AzureCloudPowerShellDeploymentV1/Publish-AzureCloudDeployment.ps1) for a complete example.

-If no `StorageAccount` was specified in the diagnostics configuration, then you need to pass in the *StorageAccountName* parameter to the cmdlet. If the *StorageAccountName* parameter is specified, then the cmdlet will always use the storage account that is specified in the parameter and not the one that is specified in the diagnostics configuration file.

-If the diagnostics storage account is in a different subscription from the Cloud Service, then you need to explicitly pass in the *StorageAccountName* and *StorageAccountKey* parameters to the cmdlet. The *StorageAccountKey* parameter is not needed when the diagnostics storage account is in the same subscription, as the cmdlet can automatically query and set the key value when enabling the diagnostics extension. However, if the diagnostics storage account is in a different subscription, then the cmdlet might not be able to get the key automatically and you need to explicitly specify the key through the *StorageAccountKey* parameter.

-* For additional guidance on using Azure diagnostics and other techniques to troubleshoot problems, see [Enabling Diagnostics in Azure Cloud Services and Virtual Machines](cloud-services-dotnet-diagnostics.md).

-description: Learn what to do in the event of an Azure service disruption that impacts Azure Cloud Services.

-# What to do in the event of an Azure service disruption that impacts Azure Cloud Services (classic)

-At Microsoft, we work hard to make sure that our services are always available to you when you need them. Forces beyond our control sometimes impact us in ways that cause unplanned service disruptions.

-This article covers a true disaster recovery scenario, when a whole region experiences an outage due to major natural disaster or widespread service interruption. These are rare occurrences, but you must prepare for the possibility that there is an outage of an entire region. If an entire region experiences a service disruption, the locally redundant copies of your data would temporarily be unavailable. If you have enabled geo-replication, three additional copies of your Azure Storage blobs and tables are stored in a different region. In the event of a complete regional outage or a disaster in which the primary region is not recoverable, Azure remaps all of the DNS entries to the geo-replicated region.

-For the fastest response to the loss of a region, it is important that you configure Traffic Manager's [endpoint monitoring](../traffic-manager/traffic-manager-monitoring.md).

-In this case, no action on your part is required, but your service will be unavailable until the region is restored. You can see the current service status on the [Azure Service Health Dashboard](https://azure.microsoft.com/status/).

-Tracing is a way for you to monitor the execution of your application while it is running. You can use the [System.Diagnostics.Trace](/dotnet/api/system.diagnostics.trace), [System.Diagnostics.Debug](/dotnet/api/system.diagnostics.debug), and [System.Diagnostics.TraceSource](/dotnet/api/system.diagnostics.tracesource) classes to record information about errors and application execution in logs, text files, or other devices for later analysis. For more information about tracing, see [Tracing and Instrumenting Applications](/dotnet/framework/debug-trace-profile/tracing-and-instrumenting-applications).

-Implement tracing in your Cloud Services application by adding the [DiagnosticMonitorTraceListener](/previous-versions/azure/reference/ee758610(v=azure.100)) to the application configuration and making calls to System.Diagnostics.Trace or System.Diagnostics.Debug in your application code. Use the configuration file *app.config* for worker roles and the *web.config* for web roles. When you create a new hosted service using a Visual Studio template, Azure Diagnostics is automatically added to the project and the DiagnosticMonitorTraceListener is added to the appropriate configuration file for the roles that you add.

-By placing [Trace Switches](/dotnet/framework/debug-trace-profile/trace-switches) in your code, you can control whether tracing occurs and how extensive it is. This lets you monitor the status of your application in a production environment. This is especially important in a business application that uses multiple components running on multiple computers. For more information, see [How to: Configure Trace Switches](/dotnet/framework/debug-trace-profile/how-to-create-initialize-and-configure-trace-switches).

-Trace, Debug and TraceSource, require you set up "listeners" to collect and record the messages that are sent. Listeners collect, store, and route tracing messages. They direct the tracing output to an appropriate target, such as a log, window, or text file. Azure Diagnostics uses the [DiagnosticMonitorTraceListener](/previous-versions/azure/reference/ee758610(v=azure.100)) class.

-Before you complete the following procedure, you must initialize the Azure diagnostic monitor. To do this, see [Enabling Diagnostics in Microsoft Azure](cloud-services-dotnet-diagnostics.md).

-Note that if you use the templates that are provided by Visual Studio, the configuration of the listener is added automatically for you.

-2. Add the following code to the file. Change the Version attribute to use the version number of the assembly you are referencing. The assembly version does not necessarily change with each Azure SDK release unless there are updates to it.

- > Make sure you have a project reference to the Microsoft.WindowsAzure.Diagnostics assembly. Update the version number in the xml above to match the version of the referenced Microsoft.WindowsAzure.Diagnostics assembly.

-2. Add the following using directive if it has not already been added:

-3. Add Trace statements where you want to capture information about the state of your application. You can use a variety of methods to format the output of the Trace statement. For more information, see [How to: Add Trace Statements to Application Code](/dotnet/framework/debug-trace-profile/how-to-add-trace-statements-to-application-code).

-This walkthrough describes how to implement an Azure worker role that emits telemetry data using the .NET EventSource class. Azure Diagnostics is used to collect the telemetry data and store it in an Azure storage account. When creating a worker role, Visual Studio automatically enables Diagnostics 1.0 as part of the solution in Azure SDKs for .NET 2.4 and earlier. The following instructions describe the process for creating the worker role, disabling Diagnostics 1.0 from the solution, and deploying Diagnostics 1.2 or 1.3 to your worker role.

-This article assumes you have an Azure subscription and are using Visual Studio with the Azure SDK. If you do not have an Azure subscription, you can sign up for the [Free Trial][Free Trial]. Make sure to [Install and configure Azure PowerShell version 0.8.7 or later][Install and configure Azure PowerShell version 0.8.7 or later].

-2. Create an **Azure Cloud Service** project from the **Cloud** template that targets .NET Framework 4.5. Name the project "WadExample" and click Ok.

-3. Select **Worker Role** and click Ok. The project will be created.

-5. In the **Configuration** tab, un-check **Enable Diagnostics** to disable Diagnostics 1.0 (Azure SDK 2.4 and earlier).

-Replace the contents of WorkerRole.cs with the following code. The class SampleEventSourceWriter, inherited from the [EventSource Class][EventSource Class], implements four logging methods: **SendEnums**, **MessageMethod**, **SetOther** and **HighFreq**. The first parameter to the **WriteEvent** method defines the ID for the respective event. The Run method implements an infinite loop that calls each of the logging methods implemented in the **SampleEventSourceWriter** class every 10 seconds.

-6. Modify any other **Settings** as appropriate and click **Publish**.

-7. After deployment has completed, verify in the Azure portal that your cloud service is in a **Running** state.

-2. Add an XML file to your **WorkerRole1** project by right-clicking on the **WorkerRole1** project and select **Add** -> **New Item…** -> **Visual C# items** -> **Data** -> **XML File**. Name the file "WadExample.xml".

-3. Associate the WadConfig.xsd with the configuration file. Make sure the WadExample.xml editor window is the active window. Press **F4** to open the **Properties** window. Click the **Schemas** property in the **Properties** window. Click the **…** in the **Schemas** property. Click the **Add…** button and navigate to the location where you saved the XSD file and select the file WadConfig.xsd. Click **OK**.

-In the Visual Studio **Server Explorer**, navigate to the wadexample storage account. After the cloud service has been running about five (5) minutes, you should see the tables **WADEnumsTable**, **WADHighFreqTable**, **WADMessageTable**, **WADPerformanceCountersTable** and **WADSetOtherTable**. Double-click one of the tables to view the telemetry that has been collected.

-[See a list of related Azure virtual-machine diagnostic articles](../azure-monitor/agents/diagnostics-extension-overview.md) to change the data you are collecting, troubleshoot problems or learn more about diagnostics in general.

-description: Learn how to create a multi-tier app using ASP.NET MVC and Azure. The app runs in a cloud service, with web role and worker role. It uses Entity Framework, SQL Database, and Azure Storage queues and blobs.

-This tutorial shows how to create a multi-tier .NET application with an ASP.NET MVC front-end, and deploy it to an [Azure cloud service](cloud-services-choose-me.md). The application uses [Azure SQL Database](/previous-versions/azure/ee336279(v=azure.100)), the [Azure Blob service](https://www.asp.net/aspnet/overview/developing-apps-with-windows-azure/building-real-world-cloud-apps-with-windows-azure/unstructured-blob-storage), and the [Azure Queue service](https://www.asp.net/aspnet/overview/developing-apps-with-windows-azure/building-real-world-cloud-apps-with-windows-azure/queue-centric-work-pattern). You can [download the Visual Studio project](https://code.msdn.microsoft.com/Simple-Azure-Cloud-Service-e01df2e4) from the MSDN Code Gallery.

-## What you'll learn

-The tutorial assumes that you understand [basic concepts about Azure cloud services](cloud-services-choose-me.md) such as *web role* and *worker role* terminology. It also assumes that you know how to work with [ASP.NET MVC](https://www.asp.net/mvc/tutorials/mvc-5/introduction/getting-started) or [Web Forms](https://www.asp.net/web-forms/tutorials/aspnet-45/getting-started-with-aspnet-45-web-forms/introduction-and-overview) projects in Visual Studio. The sample application uses MVC, but most of the tutorial also applies to Web Forms.

-You can run the app locally without an Azure subscription, but you'll need one to deploy the application to the cloud. If you don't have an account, you can [activate your MSDN subscriber benefits](https://azure.microsoft.com/pricing/member-offers/msdn-benefits-details/?WT.mc_id=A55E3C668) or [sign up for a free trial](https://azure.microsoft.com/pricing/free-trial/?WT.mc_id=A55E3C668).

-The app stores ads in a SQL database, using Entity Framework Code First to create the tables and access the data. For each ad, the database stores two URLs, one for the full-size image and one for the thumbnail.

-4. Press CTRL+SHIFT+B to build the solution.

- By default, Visual Studio automatically restores the NuGet package content, which was not included in the *.zip* file. If the packages don't restore, install them manually by going to the **Manage NuGet Packages for Solution** dialog box and clicking the **Restore** button at the top right.

-7. Press CTRL+F5 to run the application.

-8. Click **Create an Ad**.

-9. Enter some test data and select a *.jpg* image to upload, and then click **Create**.

- The app goes to the Index page, but it doesn't show a thumbnail for the new ad because that processing hasn't happened yet.

-11. Click **Details** for your ad to see the full-size image.

-In the following section you'll configure the solution to use Azure cloud resources for queues, blobs, and the application database when it runs in the cloud. If you wanted to continue to run locally but use cloud storage and database resources, you could do that. It's just a matter of setting connection strings, which you'll see how to do.

-You'll do the following steps to run the application in the cloud:

-An Azure cloud service is the environment the application will run in.

-2. Click **Create a resource > Compute > Cloud Service**.

-3. In the DNS name input box, enter a URL prefix for the cloud service.

- This URL has to be unique. You'll get an error message if the prefix you choose is already in use.

-4. Specify a new Resource group for the service. Click **Create new** and then type a name in the Resource group input box, such as CS_contososadsRG.

- This field specifies which datacenter your cloud service will be hosted in. For a production application, you'd choose the region closest to your customers. For this tutorial, choose the region closest to you.

-5. Click **Create**.

-When the app runs in the cloud, it will use a cloud-based database.

-1. In the [Azure portal](https://portal.azure.com), click **Create a resource > Databases > SQL Database**.

-3. In the **Resource group**, click **Use existing** and select the resource group used for the cloud service.

-4. In the following image, click **Server - Configure required settings** and **Create a new server**.

- If you selected **Create a new server**, you aren't entering an existing name and password here. You're entering a new name and password that you're defining now to use later when you access the database. If you selected a server that you created previously, you'll be prompted for the password to the administrative user account you already created.

- When the cloud service and database are in different datacenters (different regions), latency will increase and you will be charged for bandwidth outside the data center. Bandwidth within a data center is free.

-9. Click **Select** for the new server.

-10. Click **Create**.

-In a real-world application, you would typically create separate accounts for application data versus logging data, and separate accounts for test data versus production data. For this tutorial, you'll use just one account.

-1. In the [Azure portal](https://portal.azure.com), click **Create a resource > Storage > Storage account - blob, file, table, queue**.

- This prefix plus the text you see under the box will be the unique URL to your storage account. If the prefix you enter has already been used by someone else, you'll have to choose a different prefix.

-5. In the **Resource group**, click **Use existing** and select the resource group used for the cloud service.

- When the cloud service and storage account are in different datacenters (different regions), latency will increase and you will be charged for bandwidth outside the data center. Bandwidth within a data center is free.

- Azure affinity groups provide a mechanism to minimize the distance between resources in a data center, which can reduce latency. This tutorial does not use affinity groups. For more information, see [How to Create an Affinity Group in Azure](/previous-versions/azure/reference/gg715317(v=azure.100)).

-7. Click **Create**.

-You'll use a [Web.config transform](https://www.asp.net/mvc/tutorials/deployment/visual-studio-web-deployment/web-config-transformations) for the web role and a cloud service environment setting for the worker role.

-2. In the [Azure portal](https://portal.azure.com), click **SQL Databases** in the left pane, click the database you created for this tutorial, and then click **Show connection strings**.

-7. In **Solution Explorer**, under **Roles** in the cloud service project, right-click **ContosoAdsWorker** and then click **Properties**.

-8. Click the **Settings** tab.

-Azure storage account connection strings for both the web role project and the worker role project are stored in environment settings in the cloud service project. For each project, there is a separate set of settings to be used when the application runs locally and when it runs in the cloud. You'll update the cloud environment settings for both web and worker role projects.

-1. In **Solution Explorer**, right-click **ContosoAdsWeb** under **Roles** in the **ContosoAdsCloudService** project, and then click **Properties**.

-2. Click the **Settings** tab. In the **Service Configuration** drop-down box, choose **Cloud**.

-3. Select the **StorageConnectionString** entry, and you'll see an ellipsis (**...**) button at the right end of the line. Click the ellipsis button to open the **Create Storage Account Connection String** dialog box.

-4. In the **Create Storage Connection String** dialog box, click **Your subscription**, choose the storage account that you created earlier, and then click **OK**. If you're not already logged in, you'll be prompted for your Azure account credentials.

-The role environment settings that you have configured using the Visual Studio UI are stored in the following files in the ContosoAdsCloudService project:

-The `<Instances>` setting specifies the number of virtual machines that Azure will run the worker role code on. The [Next steps](#next-steps) section includes links to more information about scaling out a cloud service,

-2. In the **Sign in** step of the **Publish Azure Application** wizard, click **Next**.

-3. In the **Settings** step of the wizard, click **Next**.

-4. In the **Summary** step, click **Publish**.

-5. Click the right arrow icon to expand the deployment details.

-6. When the deployment status is complete, click the **Web app URL** to start the application.

-If you haven't already downloaded

-[the completed application](https://code.msdn.microsoft.com/Simple-Azure-Cloud-Service-e01df2e4), do that now. You'll copy files from the downloaded project into the new project.

-3. Name the project and solution ContosoAdsCloudService, and then click **OK**.

-5. When you see the **New ASP.NET Project** dialog box for the web role, choose the MVC template, and then click **Change Authentication**.

-6. In the **Change Authentication** dialog box, choose **No Authentication**, and then click **OK**.

-7. In the **New ASP.NET Project** dialog, click **OK**.

-9. In the **Add New Project** dialog box, choose **Windows** under **Visual C#** in the left pane, and then click the **Class Library** template.

-10. Name the project *ContosoAdsCommon*, and then click **OK**.

-3. Look for the *WindowsAzure.Storage* package, and if it's in the list, select it and select the web and worker projects to update it in, and then click **Update**.

- The storage client library is updated more frequently than Visual Studio project templates, so you'll often find that the version in a newly-created project needs to be updated.

-1. In the ContosoAdsWeb project, set a reference to the ContosoAdsCommon project. Right-click the ContosoAdsWeb project, and then click **References** - **Add References**. In the **Reference Manager** dialog box, select **Solution ΓÇô Projects** in the left pane, select **ContosoAdsCommon**, and then click **OK**.

- ContosoAdsCommon will contain the Entity Framework data model and context class, which will be used by both the front-end and back-end.

-3. In the ContosoAdsCloudService project, right-click ContosoAdsWeb under **Roles**, and then click **Properties**.

-4. In the **ContosoAdsWeb [Role]** properties window, click the **Settings** tab, and then click **Add Setting**.

-8. Still in the **ContosoAdsWorker [Role]** properties window, add another connection string:

-In this section, you copy code files from the downloaded solution into the new solution. The following sections will show and explain key parts of this code.

-To add files to a project or a folder, right-click the project or folder and click **Add** - **Existing Item**. Select the files you want and then click **Add**. If asked whether you want to replace existing files, click **Yes**.

-You can now build and run the application as instructed earlier in the tutorial, and the app will use local database and storage emulator resources.

-The following sections explain the code related to working with the Azure environment, blobs, and queues. This tutorial does not explain how to create MVC controllers and views using scaffolding, how to write Entity Framework code that works with SQL Server databases, or the basics of asynchronous programming in ASP.NET 4.5. For information about these topics, see the following resources:

-The ContosoAdsContext class specifies that the Ad class is used in a DbSet collection, which Entity Framework will store in a SQL database.

-The class has two constructors. The first of them is used by the web project, and specifies the name of a connection string that is stored in the Web.config file. The second constructor enables you to pass in the actual connection string used by the worker role project, since it doesn't have a Web.config file. You saw earlier where this connection string was stored, and you'll see later how the code retrieves the connection string when it instantiates the DbContext class.

-Code that is called from the `Application_Start` method creates an *images* blob container and an *images* queue if they don't already exist. This ensures that whenever you start using a new storage account, or start using the storage emulator on a new computer, the required blob container and queue will be created automatically.

-The `OnStart` method gets the database connection string from the *.cscfg* file and passes it to the Entity Framework DbContext class. The SQLClient provider is used by default, so the provider does not have to be specified.

-After each iteration of the loop, if no queue message was found, the program sleeps for a second. This prevents the worker role from incurring excessive CPU time and storage transaction costs. The Microsoft Customer Advisory Team tells a story about a developer who forgot to include this, deployed to production, and left for vacation. When they got back, their oversight cost more than the vacation.

-Sometimes the content of a queue message causes an error in processing. This is called a *poison message*, and if you just logged an error and restarted the loop, you could endlessly try to process that message. Therefore the catch block includes an if statement that checks to see how many times the app has tried to process the current message, and if it has been more than 5 times, the message is deleted from the queue.

-The `RoleEnvironment` object is provided by Azure when you run an application in Azure or when you run locally using the Azure Compute Emulator. If you get this error when you're running locally, make sure that you have set the ContosoAdsCloudService project as the startup project. This sets up the project to run using the Azure Compute Emulator.

-One of the things the application uses the Azure RoleEnvironment for is to get the connection string values that are stored in the *.cscfg* files, so another cause of this exception is a missing connection string. Make sure that you created the StorageConnectionString setting for both Cloud and Local configurations in the ContosoAdsWeb project, and that you created both connection strings for both configurations in the ContosoAdsWorker project. If you do a **Find All** search for StorageConnectionString in the entire solution, you should see it 9 times in 6 files.

-### Cannot override to port xxx. New port below minimum allowed value 8080 for protocol http

-Try changing the port number used by the web project. Right-click the ContosoAdsWeb project, and then click **Properties**. Click the **Web** tab, and then change the port number in the **Project Url** setting.

-By default new cloud service projects use the Azure Compute Emulator express to simulate the Azure environment. This is a lightweight version of the full compute emulator, and under some conditions the full emulator will work when the express version does not.

-To change the project to use the full emulator, right-click the ContosoAdsCloudService project, and then click **Properties**. In the **Properties** window click the **Web** tab, and then click the **Use Full Emulator** radio button.

-The Contoso Ads application has intentionally been kept simple for a getting-started tutorial. For example, it doesn't implement [dependency injection](https://www.asp.net/mvc/tutorials/hands-on-labs/aspnet-mvc-4-dependency-injection) or the [repository and unit of work patterns](https://www.asp.net/mvc/tutorials/getting-started-with-ef-using-mvc/advanced-entity-framework-scenarios-for-an-mvc-web-application#repo), it doesn't [use an interface for logging](https://www.asp.net/aspnet/overview/developing-apps-with-windows-azure/building-real-world-cloud-apps-with-windows-azure/monitoring-and-telemetry#log), it doesn't use [EF Code First Migrations](https://www.asp.net/mvc/tutorials/getting-started-with-ef-using-mvc/migrations-and-deployment-with-the-entity-framework-in-an-asp-net-mvc-application) to manage data model changes or [EF Connection Resiliency](https://www.asp.net/mvc/tutorials/getting-started-with-ef-using-mvc/connection-resiliency-and-command-interception-with-the-entity-framework-in-an-asp-net-mvc-application) to manage transient network errors, and so forth.

-Here are some cloud service sample applications that demonstrate more real-world coding practices, listed from less complex to more complex:

-* [PhluffyFotos](https://code.msdn.microsoft.com/PhluffyFotos-Sample-7ecffd31). Similar in concept to Contoso Ads but implements more features and more real-world coding practices.

-* [Azure Cloud Service Multi-Tier Application with Tables, Queues, and Blobs](https://code.msdn.microsoft.com/windowsazure/Windows-Azure-Multi-Tier-eadceb36). Introduces Azure Storage tables as well as blobs and queues. Based on an older version of the Azure SDK for .NET, will require some modifications to work with the current version.

-For a video introduction to Azure Storage best practices and patterns, see Microsoft Azure Storage ΓÇô What's New, Best Practices and Patterns.

-When files are added in this way to the role content folder, they're automatically added to your cloud service package. The files are then deployed to a consistent location on the virtual machine. Repeat this process for each web and worker role in your cloud service so that all roles have a copy of the installer.

- The script checks whether the specified version of the .NET Framework is already installed on the machine by querying the registry. If the .NET Framework version is not installed, then the .NET Framework web installer is opened. To help troubleshoot any issues, the script logs all activity to the file startuptasklog-(current date and time).txt that is stored in **InstallLogs** local storage.

-3. Add the install.cmd file to each role by using **Add** > **Existing Item** in **Solution Explorer** as described earlier in this topic.

-When you deploy your cloud service, the startup tasks install the .NET Framework if it's not already installed. Your cloud service roles are in the *busy* state while the framework is being installed. If the framework installation requires a restart, the service roles might also restart.

-## Additional resources

-Cloud service roles communicate through internal and external connections. External connections are called **input endpoints** while internal connections are called **internal endpoints**. This topic describes how to modify the [service definition](cloud-services-model-and-package.md#csdef) to create endpoints.

-The input endpoint is used when you want to expose a port to the outside. You specify the protocol type and the port of the endpoint which then applies for both the external and internal ports for the endpoint. If you want, you can specify a different internal port for the endpoint with the [localPort](/previous-versions/azure/reference/gg557552(v=azure.100)#inputendpoint) attribute.

-Instance input endpoints are similar to input endpoints but allows you map specific public-facing ports for each individual role instance by using port forwarding on the load balancer. You can specify a single public-facing port, or a range of ports.

-Internal endpoints are available for instance-to-instance communication. The port is optional and if omitted, a dynamic port is assigned to the endpoint. A port range can be used. There is a limit of five internal endpoints per role.

-There is one minor difference with endpoints when working with both worker and web roles. The web role must have at minimum a single input endpoint using the **HTTP** protocol.

-The Azure Managed Library provides methods for role instances to communicate at runtime. From code running within a role instance, you can retrieve information about the existence of other role instances and their endpoints, as well as information about the current role instance.

-When you connect to a role instance programmatically through the .NET SDK, it's relatively easy to access the endpoint information. For example, after you've already connected to a specific role environment, you can get the port of a specific endpoint with this code:

-The **Instances** property returns a collection of **RoleInstance** objects. This collection always contains the current instance. If the role does not define an internal endpoint, the collection includes the current instance but no other instances. The number of role instances in the collection will always be 1 in the case where no internal endpoint is defined for the role. If the role defines an internal endpoint, its instances are discoverable at runtime, and the number of instances in the collection will correspond to the number of instances specified for the role in the service configuration file.

-To determine the port number for an internal endpoint on a role instance, you can use the [`InstanceEndpoints`](/previous-versions/azure/reference/ee741917(v=azure.100)) property to return a Dictionary object that contains endpoint names and their corresponding IP addresses and ports. The [`IPEndpoint`](/previous-versions/azure/reference/ee741919(v=azure.100)) property returns the IP address and port for a specified endpoint. The `PublicIPEndpoint` property returns the port for a load balanced endpoint. The IP address portion of the `PublicIPEndpoint` property is not used.

-Here is an example that iterates role instances.

-Here is an example of a worker role that gets the endpoint exposed through the service definition and starts listening for connections.

-An XML schema reference for the elements used above can be found [here](/previous-versions/azure/reference/gg557551(v=azure.100)).

-description: Information about when the Azure Guest OS Family 2, 3, and 4 retirement happened and how to determine if you're affected.

-Your cloud services are impacted by this retirement if the `osFamily` column in the script output contains a `2`, `3`, `4`, or is empty. If empty, the default `osFamily` attribute will point to `osFamily` `5`.

-If you're affected, we recommend you migrate your Cloud Service or [Cloud Services Extended Support](../cloud-services-extended-support/overview.md) roles to one of the supported Guest OS Families:

-description: Provides information about when the Azure Guest OS Family 1 retirement happened and how to determine if you are affected

-**Sept 2, 2014** The Azure Guest operating system (Guest OS) Family 1.x, which is based on the Windows Server 2008 operating system, was officially retired. All attempts to deploy new services or upgrade existing services using Family 1 will fail with an error message informing you that the Guest OS Family 1 has been retired.

-**November 3, 2014** Extended support for Guest OS Family 1 ended and it is fully retired. All services still on Family 1 will be impacted. We may stop those services at any time. There is no guarantee your services will continue to run unless you manually upgrade them yourself.

-If you have additional questions, visit the [Microsoft Q&A question page for Cloud Services](/answers/topics/azure-cloud-services.html) or [contact Azure support](https://azure.microsoft.com/support/options/).

-Your Cloud Services are affected if any one of the following applies:

-2. You do not have a value for osFamily explicitly specified in the ServiceConfiguration.cscfg file for your Cloud Service. Currently, the system uses the default value of "1" in this case.

-Your cloud services will be impacted by OS Family 1 retirement if the osFamily column in the script output is empty or contains a "1".

-## Recommendations if you are affected

-## Extended Support for Guest OS Family 1 ended Nov 3, 2014

-description: This article lists the Microsoft Security Response Center updates applied to different Azure Guest OS. See if an update applies to the Guest OS you are using.

-The following tables show the Microsoft Security Response Center (MSRC) updates applied to the Azure Guest OS. Search this article to determine if a particular update applies to the Guest OS you are using. Updates always carry forward for the particular [family][family-explain] they were introduced in.

-| N/A | [4284826] |June non-security rollup |2.76 |June 12, 2018 |

-| N/A | [4284855] |June non-security rollup |3.63 |June 12, 2018 |

-| N/A | [4284815] |June non-security rollup |4.56 |June 12, 2018 |

-| N/A | [4103718] |May non-security rollup |2.75 |May 8, 2018 |

-| N/A | [4103730] |May non-security rollup |3.62 |May 8, 2018 |

-| N/A | [4103725] |May non-security rollup |4.55 |May 8, 2018 |

-| N/A | [4040980], [4040977] |Sept ΓÇÖ17 .NET non-security rollup |2.75 |November 14, 2017 |

-| N/A | [4095874] |May .NET 3.5 non-security release |2.75 |May 8, 2018 |

-| N/A | [4096495] |May .NET 4.x non-security release |2.75 |May 8, 2018 |

-| N/A | [4040975] |Sept ΓÇÖ17 .NET non-security rollup |3.62 |November 14, 2017 |

-| N/A | [4095872] |May .NET 3.5 non-security release |3.62 |May 8, 2018 |

-| N/A | [4096494] |May .NET 4.x non-security release |3.62 |May 8, 2018 |

-| N/A | [4096416] |May .NET 4.5x non-security release |3.62 |May 8, 2018 |

-| N/A | [4040974], [4040972] |Sept ΓÇÖ17 .NET non-security rollup |4.55 |November 14, 2017 |

-| N/A | [4043763] |Oct ΓÇÖ17 .NET non-security rollup |4.55 |September 12, 2017 |

-| N/A | [4095876] |May .NET 4.x non-security release |4.55 |May 8, 2018 |

-| N/A | [4096417] |May .NET 4.5x non-security release |4.55 |May 8, 2018 |

-| N/A | [4093118] |April non-security rollup |2.73 |April 10, 2018 |

-| N/A | [4093123] |April non-security rollup |3.61 |April 10, 2018 |

-| N/A | [4093114] |April non-security rollup |4.74 |April 10, 2018 |

-| N/A | [4088875] |March non-security rollup |2.73 |March 13, 2018 |

-| N/A | [4099950] |March non-security rollup pre-requisite|2.73 |March 13, 2018 |

-| N/A | [4088877] |March non-security rollup |3.60 |March 13, 2018 |

-| N/A | [4088876] |March non-security rollup |4.53 |March 13, 2018 |

-| N/A | [4074598] |February non-security rollup |2.72 |February 13, 2018 |

-| N/A | [4074593] |February non-security rollup |3.59 |February 13, 2018 |

-| N/A | [4074594] |February non-security rollup |4.52 |February 13, 2018 |

-| N/A | [4056894] |January non-security rollup |2.71 |January 4, 2018 |

-| N/A | [4056896] |January non-security rollup |3.58 |January 4, 2018 |

-| N/A | [4056895] |January non-security rollup |4.51 |January 4, 2018 |

-| N/A | [4054518] |December non-security rollup |2.70 |December 12, 2017 |

-| N/A | [4054520] |December non-security rollup |3.57 |December 12, 2017 |

-| N/A | [4054519] |December non-security rollup |4.50 |December 12, 2017 |

-| N/A | [4048957] |November non-security rollup |2.69 |November 14, 2017 |

-| N/A | [4048959] |November non-security rollup |3.56 |November 14, 2017 |

-| N/A | [4048958] |November non-security rollup |4.49 |November 14, 2017 |

-| N/A | [4041681] |October non-security rollup |2.68 |October 10, 2017 |

-| N/A | [4041690] |October non-security rollup |3.55 |October 10, 2017 |

-| N/A | [4041693] |October non-security rollup |4.48 |October 10, 2017 |

-| N/A | [4038777] |September non-security rollup |2.67 |September 12, 2017 |

-| N/A | [4038799] |September non-security rollup |3.54 |September 12, 2017 |

-| N/A | [4038792] |September non-security rollup |4.47 |September 12, 2017 |

-| N/A | [4040980] |September .NET non-security rollup |2.67 |September 12, 2017 |

-| N/A | [4040979] |September .NET non-security rollup |3.54 |September 12, 2017 |

-| N/A | [4040981] |September .NET non-security rollup |4.47 |September 12, 2017 |

-| N/A | [4034664] |August non-security rollup |2.66 |August 8, 2017 |

-| N/A | [4034665] |August non-security rollup |5.11 |August 8, 2017 |

-| N/A | [4034681] |August non-security rollup |4.46 |August 8, 2017 |

-| Rel 17-07 | [4025341] |July non-security rollup |2.65 |July 11, 2017 |

-| Rel 17-07 | [4025331] |July non-security rollup |3.52 |July 11, 2017 |

-| Rel 17-07 | [4025336] |July non-security rollup |4.45 |July 11, 2017 |

-| N/A | [4022719] |June non-security rollup |2.64 |June 13, 2017 |

-| N/A | [4022724] |June non-security rollup |3.51 |June 13, 2017 |

-| N/A | [4022726] |June non-security rollup |4.44 |June 13, 2017 |

-| N/A | [4019264] |May non-security rollup |2.63 |June 13, 2017 |

-| N/A | [4014545] |May .NET non-security rollup |2.63 |April 11, 2017 |

-| N/A | [4014508] |May .NET non-security rollup |2.63 |May 9, 2017 |

-| N/A | [4014511] |May .NET non-security rollup |2.63 |May 9, 2017 |

-| N/A | [4014514] |May .NET non-security rollup |2.63 |May 9, 2017 |

-| N/A | [4019216] |May non-security rollup |3.50 |May 9, 2017 |

-| N/A | 4014503 |May .NET non-security rollup |3.50 |May 9, 2017 |

-| N/A | [4014506] |May .NET non-security rollup |3.50 |May 9, 2017 |

-| N/A | [4014509] |May .NET non-security rollup |3.50 |May 9, 2017 |

-| N/A | [4014513] |May .NET non-security rollup |3.50 |May 9, 2017 |

-| N/A | [4019215] |May non-security rollup |4.43 |May 9, 2017 |

-| N/A | [4014505] |May .NET non-security rollup |4.43 |May 9, 2017 |

-| N/A | [4014507] |May .NET non-security rollup |4.43 |May 9, 2017 |

-| N/A | [4014510] |May .NET non-security rollup |4.43 |May 9, 2017 |

-| N/A | [4014512] |May .NET non-security rollup |4.43 |May 9, 2017 |

-| N/A | [4014565] |April .NET non-security rollup |2.62 | April 11, 2017 |

-| N/A | [4014559] |April .NET non-security rollup |2.62 | April 11, 2017 |

-| N/A | [4014563] |April .NET non-security rollup |3.49 | April 11, 2017 |

-| N/A | [4014557] |April .NET non-security rollup |3.49 | April 11, 2017 |

-| N/A | [4014545] |April .NET non-security rollup |3.49 | April 11, 2017 |

-| N/A | [4014548] |April .NET non-security rollup |3.49 | April 11, 2017 |

-| N/A | [4015551] |April non-security rollup |3.49 | April 11, 2017 |

-| N/A | [4014555] |April .NET non-security rollup |4.42 | April 11, 2017 |

-| N/A | [4014567] |April .NET non-security rollup |4.42 | April 11, 2017 |

-| N/A | [4015550] |April non-security rollup |4.42 | April 11, 2017 |

-| N/A |[2922223] |You cannot change system time if RealTimeIsUniversal registry entry is enabled in Windows |2.52 |June 14, 2016 |

-| N/A |[2896881] |Long logon time when you use the AddPrinterConnection VBScript command to map printers for users during logon process in Windows |4.15, 3.22, 2.34 |Jan 13 2015 |

-description: Provides information about what Microsoft will support as regards to the Azure Guest OS used by Cloud Services.

-The information on this page relates to the Azure Guest operating system ([Guest OS](cloud-services-guestos-update-matrix.md)) for Cloud Services worker and web roles (PaaS). It does not apply to Virtual Machines (IaaS).

-Microsoft has a published [support policy for the Guest OS](https://support.microsoft.com/gp/azure-cloud-lifecycle-faq). The page you are reading now describes how the policy is implemented.

-The policy is

-1. Microsoft will support **at least the latest two families of the Guest OS**. When a family is retired, customers have 12 months from the official retirement date to update to a newer supported Guest OS family.

-2. Microsoft will support **at least the latest two versions of the supported Guest OS families**.

-3. Microsoft will support **at least the latest two versions of the Azure SDK**. When a version of the SDK is retired, customers will have 12 months from the official retirement date to update to a newer version.

-At times, more than two families or releases may be supported. Official Guest OS support information will appear on the [Azure Guest OS Releases and SDK Compatibility Matrix](cloud-services-guestos-update-matrix.md).

-New Guest OS **versions** are introduced about every month to incorporate the latest MSRC updates. Because of the regular monthly updates, a Guest OS version is normally disabled around 60 days after its release. This activity keeps at least two Guest OS versions for each family available for use.

-Once the retirement is announced, customers have a 12 month "transition" period before the older family is officially removed from service. This transition time may be extended at the discretion of Microsoft. Updates will be posted on the [Azure Guest OS Releases and SDK Compatibility Matrix](cloud-services-guestos-update-matrix.md).

-A gradual retirement process will begin six (6) months into the transition period. During this time:

-1. Microsoft will notify customers of the retirement.

-2. The newer version of the Azure SDK wonΓÇÖt support the retired Guest OS family.

-3. New deployments and redeployments of Cloud Services will not be allowed on the retired family

-Microsoft will continue to introduce new Guest OS version incorporating the latest MSRC updates until the last day of the transition period, known as the "expiration date". On the expiration date, Cloud Services still running will be unsupported under the Azure SLA. Microsoft has the discretion to force upgrade, delete or stop those services after that date.

-If customers set their Guest OS to automatically update, they never have to worry about dealing with Guest OS versions. They will always be using the latest Guest OS version.

-At 60 days into the lifespan, a version is "*disabled*". "Disabled" means that the version is removed from the portal. The version can no longer be set from the CSCFG configuration file. Existing deployments are left running. But new deployments and code and configuration updates to existing deployments will not be allowed.

-Sometime after becoming "disabled", the Guest OS version "expires" and any installations still running that expired version are exposed to security and vulnerability issues. Generally, expiration is done in batches, so the period from disablement to expiration can vary.

-Customers who configure their services to update the Guest OS manually, should ensure that their services are running on a supported Guest OS. If a service is configured to update the Guest OS automatically, the underlying platform will ensure compliance and will upgrade to the latest Guest OS.

-These periods may be made longer at Microsoft's discretion to ease customer transitions. Any changes will be communicated on the [Azure Guest OS Releases and SDK Compatibility Matrix](cloud-services-guestos-update-matrix.md).

-* **Family retirement** <br>Microsoft will use blog posts and portal notification. Customers who are still using a retired Guest OS family will be notified through direct communication (email, portal messages, phone call) to assigned service administrators. All changes will be posted to the [Azure Guest OS Releases and SDK Compatibility Matrix](cloud-services-guestos-update-matrix.md).

-* **Version Retirement** <br>All changes and the dates they occur will be posted to the [Azure Guest OS Releases and SDK Compatibility Matrix](cloud-services-guestos-update-matrix.md), including release, disabled, and expiration. Services admins will receive emails if they have deployments running on a disabled Guest OS version or family. The timing of these emails can vary. Generally they are at least a month before disablement, though this timing is not an official SLA.

-1. Start planning your migration to a newer family early.

-2. Set up temporary test deployments to test your Cloud Service running on the new family.

-3. Set your Guest OS version to **Automatic** (osVersion=* in the [.cscfg](cloud-services-model-and-package.md#cscfg) file) so the migration to new Guest OS versions occurs automatically.

-If your web application architecture depends on underlying features of the operating system, use platform supported capabilities such as [startup tasks](cloud-services-startup-tasks.md) or other extensibility mechanisms. Alternatively, you can also use [Azure Virtual Machines](https://azure.microsoft.com/documentation/scenarios/virtual-machines/) (IaaS ΓÇô Infrastructure as a Service), where you are responsible for maintaining the underlying operating system.

-Provides you with up-to-date information about the latest Azure Guest OS releases for Cloud Services. This information helps you plan your upgrade path before a Guest OS is disabled. If you configure your roles to use *automatic* Guest OS updates as described in [Azure Guest OS Update Settings][Azure Guest OS Update Settings], it is not vital that you read this page.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-The August Guest OS has released.

-The July Guest OS has released.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-The August Guest OS has released.

-The July Guest OS has released.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-The August Guest OS has released.

-The July Guest OS has released.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-The August Guest OS has released.

-The July Guest OS has released.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-The August Guest OS has released.

-The July Guest OS has released.

-The June Guest OS has released.

-The May Guest OS has released.

-The April Guest OS has released.

-The March Guest OS has released.

-The February Guest OS has released.

-The January Guest OS has released.

-Family 6 Guest OS (Windows Server 2019) has released.

-The December Guest OS has released.

-The November Guest OS has released.

-The October Guest OS has released.

-The September Guest OS has released.

-|~~WA-GUEST-OS-4.99_202201-02~~| February 11 , 2022 | March 19, 2022 |

-|~~WA-GUEST-OS-4.97_202112-01~~| January 10 , 2022 | March 2, 2022 |

-There are three dates that are important to Guest OS releases: **release** date, **disabled** date, and **expiration** date. A Guest OS is considered available when it is in the Portal and can be selected as the target Guest OS. When a Guest OS reaches the **disabled** date, it is removed from Azure. However, any Cloud Service targeting that Guest OS will still operate as normal.

-The window between the **disabled** date and the **expiration** date provides you with a buffer to easily transition from one Guest OS to one newer. If you're using *automatic* as your Guest OS, you'll always be on the latest version and you don't have to worry about it expiring.

-When the **expiration** date passes, any Cloud Service still using that Guest OS will be stopped, deleted, or forced to upgrade. You can read more about the retirement policy [here][retirepolicy].

- A rerelease of a Guest OS version. A rerelease occurs if Microsoft finds issues during testing; requiring changes. The latest release always supersedes any previous releases, public or not. The Azure portal will only allow users to pick the latest release for a given version. Deployments running on a previous release are usually not force upgraded depending on the severity of the bug.

-In the example below, 2 is the family, 12 is the version and "rel2" is the release.

-The configuration string for a Guest OS has this same information embedded in it, along with a date showing which MSRC patches were considered for that release. In this example, MSRC patches produced for Windows Server 2008 R2 up to and including August 2012 were considered for inclusion. Only patches specifically applying to that version of Windows Server are included. For example, if an MSRC patch applies to Microsoft Office, it will not be included because that product is not part of the Windows Server base image.

-This page includes information on upcoming Guest OS Releases. Customers have indicated that they want to know when a release occurs because their cloud service roles will reboot if they are set to "Automatic" update. Guest OS releases typically occur 2-3 weeks after the MSRC update release that occurs on the second Tuesday of every month. New releases include all the relevant MSRC patches for each Guest OS family.

-Microsoft Azure is constantly releasing updates. The Guest OS is only one such update in the pipeline. A release can be affected by many factors too numerous to list here. In addition, Azure runs on literally hundreds of thousands of machines. This means that it's impossible to give an exact date and time when your role(s) will reboot. We are working on a plan to limit or time reboots.

-When a new release of the Guest OS is published, it can take time to fully propagate across Azure. As services are updated to the new Guest OS, they are rebooted honoring update domains. Services set to use "Automatic" updates will get a release first. After the update, youΓÇÖll see the new Guest OS version listed for your service in the Azure portal. Rereleases may occur during this period. Some versions may be deployed over longer periods of time and automatic upgrade reboots may not occur for many weeks after the official release date. Once a Guest OS is available, you can then explicitly choose that version from the portal or in your configuration file.

-For a great deal of valuable information on restarts and pointers to more information technical details of Guest and Host OS updates, see the MSDN blog post titled [Role Instance Restarts Due to OS Upgrades][restarts].

-If you manually update your Guest OS, see the [Guest OS retirement policy][retirepolicy] for additional information.

-The **Settings** or **All settings** links will open up **Settings** where you can change the **Properties**, change the **Configuration**, manage the **Certificates**, set up **Alert rules**, and manage the **Users** who have access to this cloud service.

-By default, Azure periodically updates your guest OS to the latest supported image within the OS family that you've specified in your service configuration (.cscfg), such as Windows Server 2016.

-You can add alerts to your cloud service. Click **Settings** > **Alert Rules** > **Add alert**.

-Instead of using **Settings** > **Alert Rules**, you can click on one of the metric tiles in the **Monitoring** section of the cloud service.

-1. Click on the **Settings** icon or the **All settings** link to open up **Settings**.

-2. Click on the **Configuration** item.

-3. Click on the **Download** button.

-5. Select the .cscfg file and click **OK**.

-You can learn more about these and how to create a package [here](cloud-services-model-and-package.md).

-* If you want to configure verbose monitoring for your cloud service, enable Azure Diagnostics for the cloud service. *Minimal monitoring* (the default monitoring level) uses performance counters gathered from the host operating systems for role instances (virtual machines). *Verbose monitoring* gathers additional metrics based on performance data within the role instances to enable closer analysis of issues that occur during application processing. To find out how to enable Azure Diagnostics, see [Enabling diagnostics in Azure](cloud-services-dotnet-diagnostics.md).

-* If you haven't installed the Azure SDK, click **Install Azure SDK** to open the [Azure Downloads page](https://azure.microsoft.com/downloads/), and then download the SDK for the language in which you prefer to develop your code. (You'll have an opportunity to do this later.)

-1. Log in to the [Azure portal](https://portal.azure.com/).

-2. Click **Create a resource > Compute**, and then scroll down to and click **Cloud Service**.

-6. Click **Package**. This opens the **Upload a package** pane. Fill in the required fields. If any of your roles contain a single instance, ensure **Deploy even if one or more roles contain a single instance** is selected.

-8. Click **OK** which will close the **Upload a package** pane.

-9. If you do not have any certificates to add, click **Create**.

-2. Click **Attach certificate**, and then click **OK** on the **Add certificates** pane.

-3. Click **Create** on the **Cloud Service** pane. When the deployment has reached the **Ready** status, you can proceed to the next steps.

-1. Click the cloud service instance.

-2. Under **Essentials**, click the **Site URL** to open your cloud service in a web browser.

-For more information about how to scale your cloud service, see [Configure auto-scaling for a cloud service in the portal](cloud-services-how-to-scale-portal.md).

-6. Select the **Start deployment** check box to apply the update after the upload of the package has finished.

-Note that guest OS updates and service healing operations also can cause deployment swaps to fail. For more information, see [Troubleshoot cloud service deployment problems](cloud-services-troubleshoot-deployment-problems.md).

-As described in the previous section, a deployment swap is typically fast because it's just a configuration change in the Azure load balancer. In some cases, it can take 10 or more seconds and result in transient connection failures. To limit impact to your customers, consider implementing [client retry logic](/azure/architecture/best-practices/transient-faults).

-To save compute costs, you can delete the staging deployment after you verify that your production deployment is working as expected. You are billed for compute costs for deployed role instances that are stopped.

-You can monitor key performance metrics for any cloud service. Every cloud service role collects minimal data: CPU usage, network usage, and disk utilization. If the cloud service has the `Microsoft.Azure.Diagnostics` extension applied to a role, that role can collect additional points of data. This article provides an introduction to Azure Diagnostics for Cloud Services.

-With basic monitoring, performance counter data from role instances is sampled and collected at 3-minute intervals. This basic monitoring data is not stored in your storage account and has no additional cost associated with it.

-With advanced monitoring, additional metrics are sampled and collected at intervals of 5 minutes, 1 hour, and 12 hours. The aggregated data is stored in a storage account, in tables, and is purged after 10 days. The storage account used is configured by role; you can use different storage accounts for different roles. This is configured with a connection string in the [.csdef](cloud-services-model-and-package.md#servicedefinitioncsdef) and [.cscfg](cloud-services-model-and-package.md#serviceconfigurationcscfg) files.

-Basic monitoring does not require a storage account.

-Advanced monitoring involves using the **Azure Diagnostics** extension (and optionally the Application Insights SDK) on the role you want to monitor. The diagnostics extension uses a config file (per role) named **diagnostics.wadcfgx** to configure the diagnostics metrics monitored. The Azure Diagnostic extension collects and stores data in an Azure Storage account. These settings are configured in the **.wadcfgx**, [.csdef](cloud-services-model-and-package.md#servicedefinitioncsdef), and [.cscfg](cloud-services-model-and-package.md#serviceconfigurationcscfg) files. This means that there is an extra cost associated with advanced monitoring.

-* IIS logs

-* Manifest based ETW

-* Crash dumps

-In the **ServiceDefinition.csdef** file, add a new setting named `Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString` for each role that uses advanced diagnostics. Visual Studio adds this value to the file when you create a new project. In case it is missing, you can add it now.

-This defines a new setting that must be added to every **ServiceConfiguration.cscfg** file.

-When you publish the Cloud Service from Visual Studio, you are given the option to send the diagnostic data to Application Insights. You can create the Application Insights Azure resource at that time or send the data to an existing Azure resource. Your cloud service can be monitored by Application Insights for availability, performance, failures, and usage. Custom charts can be added to Application Insights so that you can see the data that matters the most. Role instance data can be collected by using the Application Insights SDK in your cloud service project. For more information on how to integrate Application Insights, see [Application Insights with Cloud Services](../azure-monitor/app/azure-web-apps-net-core.md).

-Note that while you can use Application Insights to display the performance counters (and the other settings) you have specified through the Windows Azure Diagnostics extension, you only get a richer experience by integrating the Application Insights SDK into your worker and web roles.

-Conditions can be set for a cloud service worker role that trigger a scale in or out operation. The conditions for the role can be based on the CPU, disk, or network load of the role. You can also set a condition based on a message queue or the metric of some other Azure resource associated with your subscription.

-* Scaling is affected by core usage.

- Larger role instances use more cores. You can scale an application only within the limit of cores for your subscription. For example, say your subscription has a limit of 20 cores. If you run an application with two medium-sized cloud services (a total of 4 cores), you can only scale up other cloud service deployments in your subscription by the remaining 16 cores. For more information about sizes, see [Cloud Service Sizes](cloud-services-sizes-specs.md).

-* To enable high availability of your application, you should ensure that it is deployed with two or more role instances. For more information, see [Service Level Agreements](https://azure.microsoft.com/support/legal/sla/).

- **IMPORTANT**: Make sure to click the cloud service role, not the role instance that is below the role.

-After you have configured the profile and rules, select the **Save** icon at the top.

-After you have configured the profile, select the **OK** button at the bottom of the profile blade.

-After you have configured the rule, select the **OK** button at the bottom of the rule blade.

-After you have configured the scale settings, select the **Save** icon at the top.

-description: (classic) Learn how to use PowerShell to scale a web role or worker role in or out in Azure.

-## Log in to Azure

-Before you can perform any operations on your subscription through PowerShell, you must log in:

-The cmdlet blocks momentarily while the new instances are provisioned and started. During this time, if you open a new PowerShell window and call **Get-AzureRole** as shown earlier, you will see the new target instance count. And if you inspect the role status in the portal, you should see the new instance starting up:

-Once the new instances have started, the cmdlet will return successfully:

-It is not possible to configure auto-scale for cloud services from PowerShell. To do that, see [How to auto scale a cloud service](cloud-services-how-to-scale-portal.md).

-A cloud service is created from three components, the service definition *(.csdef)*, the service config *(.cscfg)*, and a service package *(.cspkg)*. Both the **ServiceDefinition.csdef** and **ServiceConfig.cscfg** files are XML-based and describe the structure of the cloud service and how it's configured; collectively called the model. The **ServicePackage.cspkg** is a zip file that is generated from the **ServiceDefinition.csdef** and among other things, contains all the required binary-based dependencies. Azure creates a cloud service from both the **ServicePackage.cspkg** and the **ServiceConfig.cscfg**.

-Once the cloud service is running in Azure, you can reconfigure it through the **ServiceConfig.cscfg** file, but you cannot alter the definition.

-* I am using Visual Studio and I want to...

-You can refer to the [Service Definition Schema](/previous-versions/azure/reference/ee758711(v=azure.100)) for a better understanding of the XML schema used here, however, here is a quick explanation of some of the elements:

-The service configuration file is not packaged with the application, but is uploaded to Azure as a separate file and is used to configure the cloud service. You can upload a new service configuration file without redeploying your cloud service. The configuration values for the cloud service can be changed while the cloud service is running. The following example shows the configuration settings that can be defined for the Web and Worker roles:

-You can refer to the [Service Configuration Schema](/previous-versions/azure/reference/ee758710(v=azure.100)) for better understanding the XML schema used here, however, here is a quick explanation of the elements:

-Configures the number of running instances for the role. To prevent your cloud service from potentially becoming unavailable during upgrades, it is recommended that you deploy more than one instance of your web-facing roles. By deploying more than one instance, you are adhering to the guidelines in the [Azure Compute Service Level Agreement (SLA)](https://azure.microsoft.com/support/legal/sla/), which guarantees 99.95% external connectivity for Internet-facing roles when two or more role instances are deployed for a service.

-The following sample shows the configuration for a web role with a website and web application. The website is configured as the default entry location on port 80, and the web applications are configured to receive requests from an alternate host header that is called ΓÇ£mail.mysite.cloudapp.netΓÇ¥.

-You can update the configuration of your cloud service while it is running in Azure, without taking the service offline. To change configuration information, you can either upload a new configuration file, or edit the configuration file in place and apply it to your running service. The following changes can be made to the configuration of a service:

- Topology changes do not affect running instances, except where an instance is being removed. All remaining instances generally do not need to be recycled; however, you can choose to recycle role instances in response to a topology change.

- You can only update a certificate when a role instance is offline. If a certificate is added, deleted, or changed while a role instance is online, Azure gracefully takes the instance offline to update the certificate and bring it back online after the change is complete.

-| \[OutputFileName\] |The name for the generated package file. Typically, this is set to the name of the application. If no file name is specified, the application package is created as \[ApplicationName\].cspkg. |

-I am using Visual Studio and I want to...

-A screenshot of the completed application is below:

-The following steps create the cloud service project that will host the Socket.IO application.

- You will see the following response:

-For this project, we will use the chat example from the [Socket.IO

- The highlighted items in the screenshot above are the files copied from the **examples\\chat** directory

-3. In the **C:\\node\\chatapp\\WorkerRole1** directory, delete the **server.js** file, and then rename the **app.js** file to **server.js**. This removes the default **server.js** file created previously by the **Add-AzureNodeWorkerRole** cmdlet and replaces it with the application file from the chat example.

-2. Find the **Module dependencies** section at the beginning of server.js and change the line containing **sio = require('..//..//lib//socket.io')** to **sio = require('socket.io')** as shown below:

- following line by replacing **3000** with **process.env.port** as shown below:

-1. Using **Azure PowerShell**, change directories to the **C:\\node\\chatapp\\WorkerRole1** directory and use the following command to install the modules required by this application:

- This will install the modules listed in the package.json file. After

- following:

- relative path, Socket.IO was not referenced in the package.json

- This will allow you to post messages as a specific nickname. To test

- multi-user functionality, open additional browser windows using the

-In this tutorial you learned how to create a basic chat application hosted in an Azure Cloud Service. To learn how to host this application in an Azure Website, see [Build a Node.js Chat Application with Socket.IO on an Azure Web Site][chatwebsite].

-description: Learn how to create a simple Node.js web application and deploy it to an Azure cloud service.

-This tutorial shows how to create a simple Node.js application running in an Azure Cloud Service. Cloud Services are the building blocks of scalable cloud applications in Azure. They allow the separation and independent management and scale-out of front-end and back-end components of your application. Cloud Services provide a robust dedicated virtual machine for hosting each role reliably.

-For more information on Cloud Services, and how they compare to Azure Websites and Virtual machines, see [Azure Websites, Cloud Services and Virtual Machines comparison].

-> Looking to build a simple website? If your scenario involves just a simple website front-end, consider [using a lightweight web app]. You can easily upgrade to a Cloud Service as your web app grows and your requirements change.

-By following this tutorial, you will build a simple web application hosted inside a web role. You will use the compute emulator to test your application locally, then deploy it using PowerShell command-line tools.

-The application is a simple "hello world" application:

-3. Enter the following PowerShell cmdlet to create to create the project:

-The Node.js app is defined in the file **server.js**, located in the directory for the web role (**WebRole1** by default). Here is the code:

- This will use your browser to navigate to the publish settings download page. You may be prompted to log in with a Microsoft Account. If so, use the account associated with your Azure subscription.

-* **-ServiceName** specifies the name for the deployment. This must be a unique name, otherwise the publish process will fail. The **Get-Date** command tacks on a date/time string that should make the name unique.

-* **-Location** specifies the datacenter that the application will be hosted in. To see a list of available datacenters, use the **Get-AzureLocation** cmdlet.

-* **-Launch** opens a browser window and navigates to the hosted service after deployment has completed.

-After publishing succeeds, you will see a response similar to the following:

-Once the deployment has completed, a browser window will open and navigate to the cloud service.

-2. Creates a new **storage account** if one does not exist. The Azure storage account is used to store the application package during deployment. You can safely delete the storage account after deployment is done.

-3. Creates a new **cloud service** if one does not already exist. A **cloud service** is the container in which your application is hosted when it is deployed to Azure. For more information, see [Overview of Creating a Hosted Service for Azure].

-After deploying your application, you may want to disable it so you can avoid extra costs. Azure bills web role instances per hour of server time consumed. Server time is consumed once your application is deployed, even if the instances are not running and are in the stopped state.

- Stopping the service may take several minutes. When the service is stopped, you receive a message indicating that it has stopped.

- Deleting the service may take several minutes. After the service has been deleted you receive a message indicating that the service was deleted.

-description: Use this tutorial to create a new application using the Express module, which provides an MVC framework for creating Node.js web applications.

-Developers often use 3rd party modules to provide additional

-functionality when developing a Node.js application. In this tutorial

-you'll create a new application using the [Express](https://github.com/expressjs/express) module, which provides an MVC framework for creating Node.js web applications.

-A screenshot of the completed application is below:

- > By default, **Add-AzureNodeWebRole** uses an older version of Node.js. The **Set-AzureServiceProjectRole** statement above instructs Azure to use v0.10.21 of Node. Note the parameters are case-sensitive. You can verify the correct version of Node.js has been selected by checking the **engines** property in **WebRole1\package.json**.

->

->

- The output of the npm command should look similar to the result below.

- You'll be prompted to overwrite your earlier application. Enter **y** or **yes** to continue. Express will generate the app.js file and a folder structure for building your application.

-3. To install additional dependencies defined in the package.json file,

-4. Use the following command to copy the **bin/www** file to **server.js**. This is so the cloud service can find the entry point for this application.

- After making this modification, the line should appear as follows.

-Azure".

-4. Refresh your browser and you'll see your changes.

-Once the deployment operation completes, your browser will open and display the web page.

-A variety of tools and techniques are available for testing the performance of cloud services.

-You can also use diagnostics to track a variety of performance

-This article covers the CPU Sampling method of profiling, which can be done locally in the emulator. CPU sampling is a method of profiling that is not very intrusive. At a designated sampling interval, the profiler takes a snapshot of the call stack. The data is collected over a period of time, and shown in a report. This method of profiling tends to indicate where in a computationally intensive application most of the CPU work is being done. This gives you the opportunity to focus on the "hot path" where your application is spending the most time.

-## 1: Configure Visual Studio for profiling

-First, there are a few Visual Studio configuration options that might be helpful when profiling. To make sense of the profiling reports, you'll need symbols (.pdb files) for your application and also symbols for system libraries. You'll want to make sure that you reference the available symbol servers. To do this, on the **Tools** menu in Visual Studio, choose **Options**, then choose **Debugging**, then **Symbols**. Make sure that Microsoft Symbol Servers is listed under **Symbol file (.pdb) locations**. You can also reference https://referencesource.microsoft.com/symbols, which might have additional symbol files.

-You can use these instructions with an existing project or with a new project. If you create a new project to try the techniques described below, choose a C# **Azure Cloud Service** project, and select a **Web Role** and a **Worker Role**.

-Build and run your cloud service locally without debugging (Ctrl+F5), with the solution configuration set to **Release**. This ensures that all files and folders are created for running the application locally, and ensures that all the emulators are started. Start the Compute Emulator UI from the taskbar to verify that your worker role is running.

-## 2: Attach to a process

-To attach the profiler to a process, on the **Analyze** menu, choose **Profiler** and **Attach/Detach**.

-If your project folder is on a network drive, the profiler will ask you to provide another location to save the profiling reports.

-log in the Compute Emulator UI to know what process to connect to.

-One you've attached, perform the steps in your application's UI (if needed) to reproduce the scenario.

-## 3: View performance reports

-If you see String.wstrcpy in the Hot Path, click on Just My Code to change the view to show user code only. If you see String.Concat, try pressing the Show All Code button.

-If you added the string concatenation code in this article, you should see a warning in the Task List for this. You may also see a warning that there is an excessive amount of garbage collection, which is due to the number of strings that are created and disposed.

-## 4: Make changes and compare performance

-You can also compare the performance before and after a code change. Stop the running process, and edit the code to replace the string concatenation operation with the use of StringBuilder:

-Congratulations! You've gotten started with the profiler.

-* Make sure you are profiling a Release build and start without debugging.

-* If the Attach/Detach option is not enabled on the Profiler menu, run the Performance Wizard.

-* If you have used any of the profiling commands from the

- command line, especially the global settings, make sure that VSPerfClrEnv /globaloff has been called and that VsPerfMon.exe has been shut down.

-* If when sampling, you see the message "PRF0025: No data was collected," check that the process you attached to has CPU activity. Applications that are not doing any computational work might not produce any sampling data. It's also possible that the process exited before any sampling was done. Check to see that the Run method for a role that you are profiling does not terminate.

-Instrumenting Azure binaries in the emulator is not supported in the Visual Studio profiler, but if you want to test memory allocation, you can choose that option when profiling. You can also choose concurrency profiling, which helps you determine whether threads are wasting time competing for locks, or tier interaction profiling, which helps you track down performance problems when interacting between tiers of an application, most frequently between the data tier and a worker role. You can view the database queries that your app generates and use the profiling data to improve your use of the database. For information about tier interaction profiling, see the blog post [Walkthrough: Using the Tier Interaction Profiler in Visual Studio Team System 2010][3].

-This guide will show you how to create PHP web or worker roles in a Windows development environment, choose a specific version of PHP from the "built-in" versions available, change the PHP configuration, enable extensions, and finally, deploy to Azure. It also describes how to configure a web or worker role to use a PHP runtime (with custom configuration and extensions) that you provide.

-Azure provides three compute models for running applications: Azure App Service, Azure Virtual Machines, and Azure Cloud Services. All three models support PHP. Cloud Services, which includes web and worker roles, provides *platform as a service (PaaS)*. Within a cloud service, a web role provides a dedicated Internet Information Services (IIS) web server to host front-end web applications. A worker role can run asynchronous, long-running or perpetual tasks independent of user interaction or input.

-The [Azure SDK for PHP](https://github.com/Azure/azure-sdk-for-php) consists of several components. This article will use two of them: Azure PowerShell and the Azure emulators. These two components can be installed via the Microsoft Web Platform Installer. For more information, see [How to install and configure Azure PowerShell](/powershell/azure/).

-The first step in creating a PHP web or worker role is to create an Azure Service project. an Azure Service project serves as a logical container for web and worker roles, and it contains the project's [service definition (.csdef)] and [service configuration (.cscfg)] files.

-This command will create a new directory (`myProject`) to which you can add web and worker roles.

-In some cases, instead of selecting a built-in PHP runtime and configuring it as described above, you may want to provide your own PHP runtime. For example, you can use the same PHP runtime in a web or worker role that you use in your development environment. This makes it easier to ensure that the application will not change behavior in your production environment.

-1. Create an Azure Service project and add a PHP web role as described previously in this topic.

-3. (OPTIONAL) If your PHP runtime uses the [Microsoft Drivers for PHP for SQL Server][sqlsrv drivers], you will need to configure your web role to install [SQL Server Native Client 2012][sql native client] when it is provisioned. To do this, add the [sqlncli.msi x64 installer] to the `bin` folder in your web role's root directory. The startup script described in the next step will silently run the installer when the role is provisioned. If your PHP runtime does not use the Microsoft Drivers for PHP for SQL Server, you can remove the following line from the script shown in the next step:

-4. Define a startup task that configures [Internet Information Services (IIS)][iis.net] to use your PHP runtime to handle requests for `.php` pages. To do this, open the `setup_web.cmd` file (in the `bin` file of your web role's root directory) in a text editor and replace its contents with the following script:

-5. Add your application files to your web role's root directory. This will be the web server's root directory.

-6. Publish your application as described in the [Publish your application](#publish-your-application) section below.

-> The `download.ps1` script (in the `bin` folder of the web role's root directory) can be deleted after you follow the steps described above for using your own PHP runtime.

->

->

-1. Create an Azure Service project and add a PHP worker role as described previously in this topic.

-3. (OPTIONAL) If your PHP runtime uses [Microsoft Drivers for PHP for SQL Server][sqlsrv drivers], you will need to configure your worker role to install [SQL Server Native Client 2012][sql native client] when it is provisioned. To do this, add the [sqlncli.msi x64 installer] to the worker role's root directory. The startup script described in the next step will silently run the installer when the role is provisioned. If your PHP runtime does not use the Microsoft Drivers for PHP for SQL Server, you can remove the following line from the script shown in the next step:

-4. Define a startup task that adds your `php.exe` executable to the worker role's PATH environment variable when the role is provisioned. To do this, open the `setup_worker.cmd` file (in the worker role's root directory) in a text editor and replace its contents with the following script:

-6. Publish your application as described in the [Publish your application](#publish-your-application) section below.

-The Azure emulators provide a local environment in which you can test your Azure application before you deploy it to the cloud. There are some differences between the emulators and the Azure environment. To understand this better, see [Use the Azure Storage Emulator for development and testing](../storage/common/storage-use-emulator.md).

-Note that you must have PHP installed locally to use the compute emulator. The compute emulator will use your local PHP installation to run your application.

-You will see output similar to this:

-You can see your application running in the emulator by opening a web browser and browsing to the local address shown in the output (`http://127.0.0.1:81` in the example output above).

-This article explains how to quickly create a Cloud Services container using Azure PowerShell cmdlets. Please follow the steps below:

-* To manage the cloud service deployment, refer to the [Get-AzureService](/powershell/module/servicemanagement/azure/Get-AzureService), [Remove-AzureService](/powershell/module/servicemanagement/azure/Remove-AzureService), and [Set-AzureService](/powershell/module/servicemanagement/azure/set-azureservice) commands. You may also refer to [How to configure cloud services](cloud-services-how-to-configure-portal.md) for further information.

-The Azure Service Management API provides programmatic access to much of the service management functionality available through the [Azure portal]. You can use the Azure SDK for Python to manage your cloud services and storage accounts.

-To use the Service Management API, you need to [create an Azure account](https://azure.microsoft.com/pricing/free-trial/).

-The Azure SDK for Python wraps the [Service Management API][svc-mgmt-rest-api], which is a REST API. All API operations are performed over TLS and mutually authenticated by using X.509 v3 certificates. The management service can be accessed from within a service running in Azure. It also can be accessed directly over the Internet from any application that can send an HTTPS request and receive an HTTPS response.

-# Linux VM configuration, you can use WindowsConfigurationSet

-To capture a VM image, you first call the **capture\_vm\_image** method.

-Now that you've learned the basics of service management, you can access the [Complete API reference documentation for the Azure Python SDK](https://azure-sdk-for-python.readthedocs.org/) and perform complex tasks easily to manage your Python application.

-* [Azure SDK Tools for VS 2013][Azure SDK Tools for VS 2013] or

-Azure provides three compute models for running applications: [Web Apps feature in Azure App Service][execution model-web sites], [Azure Virtual Machines][execution model-vms], and [Azure Cloud Services][execution model-cloud services]. All three models support Python. Cloud Services, which include web and worker roles, provide *Platform as a Service (PaaS)*. Within a cloud service, a web role provides a dedicated Internet Information Services (IIS) web server to host front end web applications, while a worker role can run asynchronous, long-running, or perpetual tasks independent of user interaction or input.

-You can add web or worker roles to an existing cloud service at any time. You can choose to add existing projects in your solution, or create new ones.

-Your cloud service can contain roles implemented in different languages. For example, you can have a Python web role implemented using Django, with Python, or with C# worker roles. You can easily communicate between your roles using Service Bus queues or storage queues.

-The main problem with the setup scripts is that they do not install python. First, define two [startup tasks](cloud-services-startup-tasks.md) in the [ServiceDefinition.csdef](cloud-services-model-and-package.md#servicedefinitioncsdef) file. The first task (**PrepPython.ps1**) downloads and installs the Python runtime. The second task (**PipInstaller.ps1**) runs pip to install any dependencies you may have.

-The **bin\LaunchWorker.ps1** was originally created to do a lot of prep work but it doesn't really work. Replace the contents in that file with the following script.

-The Visual Studio templates should have created a **ps.cmd** file in the **./bin** folder. This shell script calls out the PowerShell wrapper scripts above and provides logging based on the name of the PowerShell wrapper called. If this file wasn't created, here is what should be in it.

-Although PTVS supports launching in the emulator, debugging (for example, breakpoints) does not work.

-To debug your web and worker roles, you can set the role project as the startup project and debug that instead. You can also set multiple startup projects. Right-click the solution and then select **Set StartUp Projects**.

-When you are done configuring settings, click **Publish**.

-Some progress appears in the output window, then you'll see the Microsoft Azure Activity Log window.

-ConnctCallResult response = await client.ConnectAsync(serverCallLocator, callbackUri);

-ConnctCallResult response = await client.ConnectAsync(roomCallLocator, callbackUri);

-## Dapr location

-> [!NOTE]

-> You must enroll in the [Azure Cosmos DB NoSQL Vector Index preview feature](nosql/vector-search.md#enroll-in-the-vector-search-preview-feature) to specify a vector indexing policy.>

- Collection<Embedding> collection = new Collection<Embedding>(embeddings);

- ContainerProperties properties = new ContainerProperties(id: "vector-container", partitionKeyPath: "/id")

- {

- VectorEmbeddingPolicy = new(collection),

- IndexingPolicy = new IndexingPolicy()

- {

- VectorIndexes = new()

- {

- new VectorIndexPath()

- {

- Path = "/vector",

- Type = VectorIndexType.QuantizedFlat,

- }

- }

- },

- };

-ExcludedPath excludedPath = new ExcludedPath("/*");

-indexingPolicy.setExcludedPaths(Collections.singletonList(excludedPath));

-IncludedPath includedPath1 = new IncludedPath("/name/?");

-IncludedPath includedPath2 = new IncludedPath("/description/?");

-indexingPolicy.setIncludedPaths(ImmutableList.of(includedPath1, includedPath2));

-> A vector indexing policy must be on the path defined in the container's vector policy. [Learn more about container vector policies](vector-search.md#container-vector-policies).)

-ΓÇ» ΓÇ» ]

-ΓÇ» ΓÇ» ΓÇ» ΓÇ» ΓÇ» ΓÇ» "path": "/\"_etag\"/?"

-### API for MongoDB

-* To change the management group for a subscription, see [Move subscriptions](../../governance/management-groups/manage.md#move-subscriptions).

-* To change the management group for a subscription, see [Move subscriptions](../../governance/management-groups/manage.md#move-subscriptions).

-* To change the management group for a subscription, see [Move subscriptions](../../governance/management-groups/manage.md#move-subscriptions).

-If you need to access data stores that have been configured to use only the strongest cryptography/most secure network protocol (TLS 1.2), including your Azure Blob Storage for staging, you must enable only TLS 1.2 and disable older SSL/TLS versions at the same time on your self-hosted IR. To do so, you can download and run the *main.cmd* script that we provide in the *CustomSetupScript/UserScenarios/TLS 1.2* folder of our public preview blob container. Using [Azure Storage Explorer](https://storageexplorer.com/), you can connect to our public preview blob container by entering the following SAS URI:

-`https://ssisazurefileshare.blob.core.windows.net/publicpreview?sp=rl&st=2020-03-25T04:00:00Z&se=2025-03-25T04:00:00Z&sv=2019-02-02&sr=c&sig=WAD3DATezJjhBCO3ezrQ7TUZ8syEUxZZtGIhhP6Pt4I%3D`

-| [Security recommendations to fix infrastructure as code misconfigurations](iac-vulnerabilities.md#configure-iac-scanning-and-view-the-results-in-azure-devops) |  |  | [Microsoft Security DevOps extension](azure-devops-extension.yml) |

-| [Security recommendations to fix code vulnerabilities](defender-for-devops-introduction.md#manage-your-devops-environments-in-defender-for-cloud)|  |

-| [Security recommendations to fix infrastructure as code misconfigurations](iac-vulnerabilities.md#configure-iac-scanning-and-view-the-results-in-azure-devops) |  |

-| [Code to cloud mapping for Infrastructure as Code templates](iac-template-mapping.md) | |  |

- - master

- # MSDO runs on windows-latest.

- # ubuntu-latest also supported

- - name: Run Microsoft Security DevOps Analysis

- # Upload alerts to the Security tab

- - name: Upload alerts to Security tab

- uses: github/codeql-action/upload-sarif@v2

- with:

- sarif_file: ${{ steps.msdo.outputs.sarifFile }}

- # Upload alerts file as a workflow artifact

- - name: Upload alerts file as a workflow artifact

- uses: actions/upload-artifact@v3

- with:

- name: alerts

- path: ${{ steps.msdo.outputs.sarifFile }}

- > [!NOTE]

- > **For additional tool configuration options and instructions, see [the Microsoft Security DevOps wiki](https://github.com/microsoft/security-devops-action/wiki)**

- :::image type="content" source="media/msdo-github-action/start-commit.png" alt-text="Screenshot showing you where to select start commit.":::

-1. Select **Commit new file**.

- :::image type="content" source="media/msdo-github-action/commit-new.png" alt-text="Screenshot showing you how to commit a new file.":::

- The process can take up to one minute to complete.

- :::image type="content" source="media/msdo-github-action/verify-actions.png" alt-text="Screenshot showing you where to navigate to, to see that your new action is running." lightbox="media/msdo-github-action/verify-actions.png":::

-1. Sign in to [GitHub](https://www.github.com).

-1. Navigate to **Security** > **Code scanning alerts** > **Tool**.

-1. From the dropdown menu, select **Filter by tool**.

-Code scanning findings will be filtered by specific MSDO tools in GitHub. These code scanning results are also pulled into Defender for Cloud recommendations.

-## Related content

-<a name="configure-iac-scanning-and-view-the-results-in-github"></a>

-1. To view the results of the scan, go to **Security** > **Code scanning alerts**.

- You can filter by tool to see only the IaC findings.

-<a name="configure-iac-scanning-and-view-the-results-in-azure-devops"></a>

-The IaC scanning tools that are included with Microsoft Security DevOps are [Template Analyzer](https://github.com/Azure/template-analyzer) ([PSRule](https://aka.ms/ps-rule-azure) is included in Template Analyzer) and [Terrascan](https://github.com/tenable/terrascan).

-## Connect your GitHub account

-To connect your GitHub account to Microsoft Defender for Cloud:

-1. Select the organizations to install the GitHub application. It's recommended to grant access to **all repositories** to ensure Defender for Cloud can secure your entire GitHub environment.

- This step grants Defender for Cloud access to the selected organizations.

-1. For Organizations, select one of the following:

- - Select **all existing organizations** to autodiscover all repositories in GitHub organizations where the DevOps security GitHub application is installed.

- - Select **all existing and future organizations** to autodiscover all repositories in GitHub organizations where the DevOps security GitHub application is installed and future organizations where the DevOps security GitHub application is installed.

-description: Important reference material needed when you monitor Azure Event Hubs.

-# Monitoring Azure Event Hubs data reference

-See [Monitoring Azure Event Hubs](monitor-event-hubs.md) for details on collecting and analyzing monitoring data for Azure Event Hubs.

-> Azure Monitor doesn't include dimensions in the exported metrics data, that's sent to a destination like Azure Storage, Azure Event Hubs, Log Analytics, etc.

-## Metrics

-This section lists all the automatically collected platform metrics collected for Azure Event Hubs. The resource provider for these metrics is `Microsoft.EventHub/clusters` or `Microsoft.EventHub/namespaces`.

-### Request metrics

-Counts the number of data and management operations requests.

-| Metric Name | Exportable via diagnostic settings | Unit | Aggregation type | Description | Dimensions |

-| - | - | -- | | | |

-| Incoming Requests| Yes | Count | Count | The number of requests made to the Event Hubs service over a specified period. This metric includes all the data and management plane operations. | Entity name|

-| Successful Requests| No | Count | Count | The number of successful requests made to the Event Hubs service over a specified period. | Entity name<br/><br/>Operation Result |

-| Throttled Requests| No | Count | Count | The number of requests that were throttled because the usage was exceeded. | Entity name<br/><br/>Operation Result |

-The following two types of errors are classified as **user errors**:

-### Message metrics

-| Metric Name | Exportable via diagnostic settings | Unit | Aggregation type | Description | Dimensions |

-| - | - | -- | | | |

-|Incoming Messages| Yes | Count | Count | The number of events or messages sent to Event Hubs over a specified period. | Entity name|

-|Outgoing Messages| Yes | Count | Count | The number of events or messages received from Event Hubs over a specified period. | Entity name |

-| Captured Messages| No | Count| Count | The number of captured messages. | Entity name |

-|Incoming Bytes | Yes | Bytes | Count | Incoming bytes for an event hub over a specified period. | Entity name|

-|Outgoing Bytes | Yes | Bytes | Count | Outgoing bytes for an event hub over a specified period. | Entity name |

-| Size | No | Bytes | Average | Size of an event hub in bytes.|Entity name |

-> [!NOTE]

-> - These values are point-in-time values. Incoming messages that were consumed immediately after that point-in-time may not be reflected in these metrics.

-> - The **Incoming requests** metric includes all the data and management plane operations. The **Incoming messages** metric gives you the total number of events that are sent to the event hub. For example, if you send a batch of 100 events to an event hub, it'll count as 1 incoming request and 100 incoming messages.

-### Capture metrics

-| Metric Name | Exportable via diagnostic settings | Unit | Aggregation type | Description | Dimensions |

-| - | -- | | | | |

-| Captured Messages| No | Count| Count | The number of captured messages. | Entity name |

-| Captured Bytes | No | Bytes | Count | Captured bytes for an event hub | Entity name |

-| Capture Backlog | No | Count| Count | Capture backlog for an event hub | Entity name |

-### Connection metrics

-| Metric Name | Exportable via diagnostic settings | Unit | Aggregation type | Description | Dimensions |

-| - | -- | | | | |

-|Active Connections| No | Count | Average | The number of active connections on a namespace and on an entity (event hub) in the namespace. Value for this metric is a point-in-time value. Connections that were active immediately after that point-in-time may not be reflected in the metric.| Entity name |

-|Connections Opened | No | Count | Average | The number of open connections. | Entity name |

-|Connections Closed | No | Count | Average| The number of closed connections. | Entity name |

-### Error metrics

-| Metric Name | Exportable via diagnostic settings | Unit | Aggregation type | Description | Dimensions |

-| - | -- | | | | |

-|Server Errors| No | Count | Count | The number of requests not processed because of an error in the Event Hubs service over a specified period. | Entity name<br/><br/>Operation Result |

-|User Errors | No | Count | Count | The number of requests not processed because of user errors over a specified period. | Entity name<br/><br/>Operation Result|

-|Quota Exceeded Errors | No |Count | Count | The number of errors caused by exceeding quotas over a specified period. | Entity name<br/><br/>Operation Result|

-> Logic Apps creates epoch receivers and receivers may be moved from one node to another depending on the service load. During those moves, `ReceiverDisconnection` exceptions may occur. They are counted as user errors on the Event Hubs service side. Logic Apps may collect failures from Event Hubs clients so that you can view them in user logs.

-## Metric dimensions

-Azure Event Hubs supports the following dimensions for metrics in Azure Monitor. Adding dimensions to your metrics is optional. If you don't add dimensions, metrics are specified at the namespace level.

-|Dimension name|Description|

-| - | -- |

-|Entity Name| Name of the event hub. With the 'Incoming Requests' metric, the Entity Name dimension has a value of '-NamespaceOnlyMetric-' in addition to all your event hubs. It represents the requests that were made at the namespace level. Examples include a request to list all event hubs in the namespace or requests to entities that failed authentication or authorization.|

-## Resource logs

-Azure Event Hubs now has the capability to dispatch logs to either of two destination tables - Azure Diagnostic or [Resource specific tables](~/articles/azure-monitor/essentials/resource-logs.md) in Log Analytics. You could use the toggle available on Azure portal to choose destination tables.

-## Runtime audit logs

-Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.

-> [!NOTE]

-| - | -| --| --|

-| `TimeGenerated [UTC]`|Time of executed operation (in UTC)| No | Yes |

-| `AuthType` | Type of authentication (Azure Active Directory or SAS Policy). | Yes | Yes |

-| `AuthKey` | Azure Active Directory application ID or SAS policy name that's used to authenticate to a resource. | Yes | Yes |

-| `Category` | Log category | Yes | NO |

-| `Provider`|Name of Service emitting the logs, such as Eventhub | No | Yes |

-AzureDiagnostics :

-## Application metrics logs

-Application metrics logs capture the aggregated information on certain metrics related to data plane operations. The captured information includes the following runtime metrics.

-> [!NOTE]

-> Application metrics logs are available only in **premium** and **dedicated** tiers.

-| - | - |

-## Diagnostic Error Logs

-Diagnostic error logs capture error messages for any client side, throttling and Quota exceeded errors. They provide detailed diagnostics for error identification.

-Diagnostic Error Logs include elements listed in below table:

-| ||| |

-## Azure Monitor Logs tables

-Azure Event Hubs uses Kusto tables from Azure Monitor Logs. You can query these tables with Log Analytics. For a list of Kusto tables the service uses, see [Azure Monitor Logs table reference](/azure/azure-monitor/reference/tables/tables-resourcetype#event-hubs).

-You can view our sample queries to get started with different log categories.

-> [!IMPORTANT]

-> Dimensions aren't exported to a Log Analytics workspace.

-## Next steps

-When you have critical applications and business processes relying on Azure resources, you want to monitor those resources for their availability, performance, and operation. This article describes the monitoring data generated by Azure Event Hubs and how to analyze and alert on this data with Azure Monitor.

-## What is Azure Monitor?

-Azure Event Hubs creates monitoring data using [Azure Monitor](../azure-monitor/overview.md), which is a full stack monitoring service in Azure. Azure Monitor provides a complete set of features to monitor your Azure resources. It can also monitor resources in other clouds and on-premises.

-Start with the article [Monitoring Azure resources with Azure Monitor](../azure-monitor/essentials/monitor-azure-resource.md), which describes the following concepts:

-The following sections build on this article by describing the specific data gathered for Azure Event Hubs. These sections also provide examples for configuring data collection and analyzing this data with Azure tools.

-## Monitoring data from Azure Event Hubs

-Azure Event Hubs collects the same kinds of monitoring data as other Azure resources that are described in [Monitoring data from Azure resources](../azure-monitor/essentials/monitor-azure-resource.md#monitoring-data).

-See [Azure Event Hubs monitoring data reference](monitor-event-hubs-reference.md) for a detailed reference of the logs and metrics created by Azure Event Hubs.

-## Collection and routing

-Platform metrics and the activity log are collected and stored automatically, but can be routed to other locations by using a diagnostic setting.

-Resource Logs aren't collected and stored until you create a diagnostic setting and route them to one or more locations.

-See [Create diagnostic setting to collect platform logs and metrics in Azure](../azure-monitor/essentials/diagnostic-settings.md) for the detailed process for creating a diagnostic setting using the Azure portal, CLI, or PowerShell. When you create a diagnostic setting, you specify which categories of logs to collect. The categories for Azure Event Hubs are listed in [Azure Event Hubs monitoring data reference](monitor-event-hubs-reference.md#resource-logs).

-> [!NOTE]

-> Azure Monitor doesn't include dimensions in the exported metrics data, that's sent to a destination like Azure Storage, Azure Event Hubs, Log Analytics, etc.

-### Azure Storage

-If you use **Azure Storage** to store the diagnostic logging information, the information is stored in containers named **insights-logs-operationlogs** and **insights-metrics-pt1m**. Sample URL for an operation log: `https://<Azure Storage account>.blob.core.windows.net/insights-logs-operationallogs/resourceId=/SUBSCRIPTIONS/<Azure subscription ID>/RESOURCEGROUPS/<Resource group name>/PROVIDERS/MICROSOFT.SERVICEBUS/NAMESPACES/<Namespace name>/y=<YEAR>/m=<MONTH-NUMBER>/d=<DAY-NUMBER>/h=<HOUR>/m=<MINUTE>/PT1H.json`. The URL for a metric log is similar.

-### Azure Event Hubs

-If you use **Azure Event Hubs** to store the diagnostic logging information, the information is stored in Event Hubs instances named **insights-logs-operationlogs** and **insights-metrics-pt1m**. You can also select an existing event hub except for the event hub for which you're configuring diagnostic settings.

-### Log Analytics

-If you use **Log Analytics** to store the diagnostic logging information, the information is stored in tables named **AzureDiagnostics** / **AzureMetrics** or **resource specific tables**

-> Enabling these settings requires additional Azure services (storage account, event hub, or Log Analytics), which may increase your cost. To calculate an estimated cost, visit the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator).

-The metrics and logs you can collect are discussed in the following sections.

-## Analyze metrics

-## Analyze logs

-Using Azure Monitor Log Analytics requires you to create a diagnostic configuration and enable __Send information to Log Analytics__. For more information, see the [Collection and routing](#collection-and-routing) section. Data in Azure Monitor Logs is stored in tables, with each table having its own set of unique properties. Azure Event Hubs has the capability to dispatch logs to either of two destination tables - Azure Diagnostic or Resource specific tables in Log Analytics.For a detailed reference of the logs and metrics, see [Azure Event Hubs monitoring data reference](monitor-event-hubs-reference.md).

-### Sample Kusto queries

-> [!IMPORTANT]

-> When you select **Logs** from the Azure Event Hubs menu, Log Analytics is opened with the query scope set to the current Azure Event Hubs namespace. This means that log queries will only include data from that resource. If you want to run a query that includes data from other workspaces or data from other Azure services, select **Logs** from the **Azure Monitor** menu. See [Log query scope and time range in Azure Monitor Log Analytics](../azure-monitor/logs/scope.md) for details.

-Following are sample queries that you can use to help you monitor your Azure Event Hubs resources:

-### [AzureDiagnostics](#tab/AzureDiagnostics)

-+ Get errors from the past seven days

- ```Kusto

- AzureDiagnostics

- | where TimeGenerated > ago(7d)

- | where ResourceProvider =="MICROSOFT.EVENTHUB"

- | where Category == "OperationalLogs"

- | summarize count() by "EventName"

-+ Get runtime audit logs generated in the last one hour.

- ```Kusto

- AzureDiagnostics

- | where TimeGenerated > ago(1h)

- | where ResourceProvider =="MICROSOFT.EVENTHUB"

- | where Category == "RuntimeAuditLogs"

- ```

-+ Get access attempts to a key vault that resulted in "key not found" error.

- ```Kusto

- AzureDiagnostics

- | where ResourceProvider == "MICROSOFT.EVENTHUB"

- | where Category == "Error" and OperationName == "wrapkey"

- | project Message

- ```

-+ Get operations performed with a key vault to disable or restore the key.

- ```Kusto

- AzureDiagnostics

- | where ResourceProvider == "MICROSOFT.EVENTHUB"

- | where Category == "info" and OperationName == "disable" or OperationName == "restore"

- | project Message

- ```

-+ Get capture failures and their duration in seconds

- ```kusto

- AzureDiagnostics

- | where ResourceProvider == "MICROSOFT.EVENTHUB"

- | where Category == "ArchiveLogs"

- | summarize count() by "failures", "durationInSeconds"

- ```

-

-### [Resource Specific Table](#tab/Resourcespecifictable)

-+ Get Operational Logs for event hub resource for last 7 days

- ```Kusto

- AZMSOperationalLogs

- | where Timegenerated > ago(7d)

- | where Provider == "EVENTHUB"

- | where resourceId == "<Resource Id>" // Replace your resource Id

- ```

-+ Get capture logs for event hub for last 7 days

- ```Kusto

- AZMSArchiveLogs

- | where EventhubName == "<Event Hub Name>" //Enter event hub entity name

- | where TimeGenerated > ago(7d)

- ```

-## Use runtime logs

-Azure Event Hubs allows you to monitor and audit data plane interactions of your client applications using runtime audit logs and application metrics logs.

-Using *Runtime audit logs* you can capture aggregated diagnostic information for all data plane access operations such as publishing or consuming events.

-*Application metrics logs* capture the aggregated data on certain runtime metrics (such as consumer lag and active connections) related to client applications are connected to Event Hubs.

-> [!NOTE]

-> Runtime audit logs are available only in **premium** and **dedicated** tiers.

-### Enable runtime logs

-You can enable either runtime audit or application metrics logging by selecting *Diagnostic settings* from the *Monitoring* section on the Event Hubs namespace page in Azure portal. Select **Add diagnostic setting** as shown in the following image.

-Then you can enable log categories *RuntimeAuditLogs* or *ApplicationMetricsLogs* as needed.

-Once runtime logs are enabled, Event Hubs start collecting and storing them according to the diagnostic setting configuration.

-### Publish and consume sample data

-To collect sample runtime audit logs in your Event Hubs namespace, you can publish and consume sample data using client applications, which are based on [Event Hubs SDK](../event-hubs/event-hubs-dotnet-standard-getstarted-send.md), which uses Advanced Message Queuing Protocol (AMQP) or using any [Apache Kafka client application](../event-hubs/event-hubs-quickstart-kafka-enabled-event-hubs.md).

-You can analyze the collected runtime audit logs using the following sample query.

-Up on the execution of the query you should be able to obtain corresponding audit logs in the following format.

-By analyzing these logs, you should be able to audit how each client application interacts with Event Hubs. Each field associated with runtime audit logs is defined in [runtime audit logs reference](../event-hubs/monitor-event-hubs-reference.md#runtime-audit-logs).

-### Analyze application metrics

-You can analyze the collected application metrics logs using the following sample query.

-Application metrics include the following runtime metrics.

-Therefore you can use application metrics to monitor runtime metrics such as consumer lag or active connection from a given client application. Fields associated with runtime audit logs are defined in [application metrics logs reference](../event-hubs/monitor-event-hubs-reference.md#runtime-audit-logs).

-## Alerts

-## Next steps

- 1. For **SAS key name**, select the SAS policy that can be used as a security context for this application group.You can select **Add SAS Policy** to add a new policy and then associate with the application group.

-Azure Event Hubs supports [Application Metric Logs ](monitor-event-hubs-reference.md#application-metrics-logs) functionality to observe usual throughput within your system and accordingly decide on the threshold value for application group. You can follow these steps to decide on a threshold value:

-1. Turn on [diagnostic settings](monitor-event-hubs.md#collection-and-routing) in Event Hubs with **Application Metric logs** as selected category and choose **Log Analytics** as destination.

-Due to restrictions at protocol level, throttled request logs are not generated for consumer operations within event hub ( `OutgoingMessages` or `OutgoingBytes`). when requests are throttled at consumer side, you would observe sluggish egress throughput.

-[Setup monitoring](expressroute-monitoring-metrics-alerts.md#expressroute-gateways) using Azure Monitor for ExpressRoute Gateway availability, performance, and scalability. When you deploy an ExpressRoute gateway, Azure manages the compute and functions of your gateway. There are multiple [gateway metrics](expressroute-monitoring-metrics-alerts.md#expressroute-virtual-network-gateway-metrics) available to you to better understand the performance of your gateway.

-These scenarios are Generally Available for limited scenarios with connections associated to 100 Gbps ExpressRoute Direct circuits. To enable, follow the below guidance:

-description: Learn about Azure ExpressRoute monitoring, metrics, and alerts using Azure Monitor, the one stop shop for all metrics, alerting, diagnostic logs across Azure.

-# ExpressRoute monitoring, metrics, and alerts

-This article helps you understand ExpressRoute monitoring, metrics, and alerts using Azure Monitor. Azure Monitor is one stop shop for all metrics, alerting, diagnostic logs across all of Azure.

-

-> [!NOTE]

-> Using **Classic Metrics** is not recommended.

->

-## ExpressRoute metrics

-To view **Metrics**, go to the *Azure Monitor* page and select *Metrics*. To view **ExpressRoute** metrics, filter by Resource Type *ExpressRoute circuits*. To view **Global Reach** metrics, filter by Resource Type *ExpressRoute circuits* and select an ExpressRoute circuit resource that has Global Reach enabled. To view **ExpressRoute Direct** metrics, filter Resource Type by *ExpressRoute Ports*.

-Once a metric is selected, the default aggregation is applied. Optionally, you can apply splitting, which shows the metric with different dimensions.

-> [!IMPORTANT]

-> When viewing ExpressRoute metrics in the Azure portal, select a time granularity of **5 minutes or greater** for best possible results.

->

-> :::image type="content" source="./media/expressroute-monitoring-metrics-alerts/metric-granularity.png" alt-text="Screenshot of time granularity options.":::

-### Aggregation Types:

-Metrics explorer supports sum, maximum, minimum, average and count as [aggregation types](../azure-monitor/essentials/metrics-charts.md#aggregation). You should use the recommended Aggregation type when reviewing the insights for each ExpressRoute metric.

-* Sum: The sum of all values captured during the aggregation interval.

-* Count: The number of measurements captured during the aggregation interval.

-* Average: The average of the metric values captured during the aggregation interval.

-* Min: The smallest value captured during the aggregation interval.

-* Max: The largest value captured during the aggregation interval.

-### ExpressRoute circuit

-| Metric | Category | Unit | Aggregation Type | Description | Dimensions | Exportable via Diagnostic Settings? |

-| | | | | | | |

-| [ARP Availability](#arp) | Availability | Percent | Average | ARP Availability from MSEE towards all peers. | Peering Type, Peer | Yes |

-| [BGP Availability](#bgp) | Availability | Percent | Average | BGP Availability from MSEE towards all peers. | Peering Type, Peer | Yes |

-| [BitsInPerSecond](#circuitbandwidth) | Traffic | BitsPerSecond | Average | Bits ingressing Azure per second | Peering Type | Yes |

-| [BitsOutPerSecond](#circuitbandwidth) | Traffic | BitsPerSecond | Average | Bits egressing Azure per second | Peering Type | Yes |

-| DroppedInBitsPerSecond | Traffic | BitsPerSecond | Average | Ingress bits of data dropped per second | Peering Type | Yes |

-| DroppedOutBitsPerSecond | Traffic | BitPerSecond | Average | Egress bits of data dropped per second | Peering Type | Yes |

-| GlobalReachBitsInPerSecond | Traffic | BitsPerSecond | Average | Bits ingressing Azure per second | PeeredCircuitSKey | Yes |

-| GlobalReachBitsOutPerSecond | Traffic | BitsPerSecond | Average | Bits egressing Azure per second | PeeredCircuitSKey | Yes |

-| [FastPathRoutesCount](#fastpath-routes-count-at-circuit-level) | Fastpath | Count | Maximum | Count of FastPath routes configured on the circuit | None | Yes |

->[!NOTE]

->Using *GlobalGlobalReachBitsInPerSecond* and *GlobalGlobalReachBitsOutPerSecond* will only be visible if at least one Global Reach connection is established.

->

-### ExpressRoute gateways

-| Metric | Category | Unit | Aggregation Type | Description | Dimensions | Exportable via Diagnostic Settings? |

-| | | | | | | |

-| [Bits received per second](#gwbits) | Performance | BitsPerSecond | Average | Total bits received on ExpressRoute gateway per second | roleInstance | Yes |

-| [CPU utilization](#cpu) | Performance | Count | Average | CPU Utilization of the ExpressRoute Gateway | roleInstance | Yes |

-| [Packets per second](#packets) | Performance | CountPerSecond | Average | Total Packets received on ExpressRoute Gateway per second | roleInstance | Yes |

-| [Count of routes advertised to peer](#advertisedroutes) | Availability | Count | Maximum | Count Of Routes Advertised To Peer by ExpressRouteGateway | roleInstance | Yes |

-| [Count of routes learned from peer](#learnedroutes)| Availability | Count | Maximum | Count Of Routes Learned From Peer by ExpressRouteGateway | roleInstance | Yes |

-| [Frequency of routes changed](#frequency) | Availability | Count | Total | Frequency of Routes change in ExpressRoute Gateway | roleInstance | Yes |

-| [Number of VMs in virtual network](#vm) | Availability | Count | Maximum | Estimated number of VMs in the virtual network | No Dimensions | Yes |

-| [Active flows](#activeflows) | Scalability | Count | Average | Number of active flows on ExpressRoute Gateway | roleInstance | Yes |

-| [Max flows created per second](#maxflows) | Scalability | FlowsPerSecond | Maximum | Maximum number of flows created per second on ExpressRoute Gateway | roleInstance, direction | Yes |

-### ExpressRoute Gateway connections

-| Metric | Category | Unit | Aggregation Type | Description | Dimensions | Exportable via Diagnostic Settings? |

-| | | | | | | |

-| [BitsInPerSecond](#connectionbandwidth) | Traffic | BitsPerSecond | Average | Bits ingressing Azure per second through ExpressRoute gateway | ConnectionName | Yes |

-| [BitsOutPerSecond](#connectionbandwidth) | Traffic | BitsPerSecond | Average | Bits egressing Azure per second through ExpressRoute gateway | ConnectionName | Yes |

-### ExpressRoute Direct

-| Metric | Category | Unit | Aggregation Type | Description | Dimensions | Exportable via Diagnostic Settings? |

-| | | | | | | |

-| [BitsInPerSecond](#directin) | Traffic | BitsPerSecond | Average | Bits ingressing Azure per second | Link | Yes |

-| [BitsOutPerSecond](#directout) | Traffic | BitsPerSecond | Average | Bits egressing Azure per second | Link | Yes |

-| DroppedInBitsPerSecond | Traffic | BitsPerSecond | Average | Ingress bits of data dropped per second | Link | Yes |

-| DroppedOutBitsPerSecond | Traffic | BitPerSecond | Average | Egress bits of data dropped per second | Link | Yes |

-| [AdminState](#admin) | Physical Connectivity | Count | Average | Admin state of the port | Link | Yes |

-| [LineProtocol](#line) | Physical Connectivity | Count | Average | Line protocol status of the port | Link | Yes |

-| [RxLightLevel](#rxlight) | Physical Connectivity | Count | Average | Rx Light level in dBm | Link, Lane | Yes |

-| [TxLightLevel](#txlight) | Physical Connectivity | Count | Average | Tx light level in dBm | Link, Lane | Yes |

-| [FastPathRoutesCount](#fastpath-routes-count-at-port-level) | FastPath | Count | Maximum | Count of FastPath routes configured on the port | None | Yes |

-### ExpressRoute Traffic Collector

-| Metric | Category | Unit | Aggregation Type | Description | Dimensions | Exportable via Diagnostic Settings? |

-| | | | | | | |

-| CPU utilization | Performance | Count | Average | CPU Utilization of the ExpressRoute Traffic Collector | roleInstance | Yes |

-| Memory Utilization | Performance | CountPerSecond | Average | Memory Utilization of the ExpressRoute Traffic Collector | roleInstance | Yes |

-| Count of flow records processed | Availability | Count | Maximum | Count of number of flow records processed or ingested | roleInstance, ExpressRoute Circuit | Yes |

-## Circuits metrics

-### <a name = "circuitbandwidth"></a>Bits In and Out - Metrics across all peerings

-Aggregation type: *Avg*

-You can view metrics across all peerings on a given ExpressRoute circuit.

-### Bits In and Out - Metrics per peering

-Aggregation type: *Avg*

-You can view metrics for private, public, and Microsoft peering in bits/second.

-### <a name = "bgp"></a>BGP Availability - Split by Peer

-Aggregation type: *Avg*

-You can view near to real-time availability of BGP (Layer-3 connectivity) across peerings and peers (Primary and Secondary ExpressRoute routers). This dashboard shows the Primary BGP session status is up for private peering and the Second BGP session status is down for private peering.

->[!NOTE]

->During maintenance between the Microsoft edge and core network, BGP availability will appear down even if the BGP session between the customer edge and Microsoft edge remains up. For information about maintenance between the Microsoft edge and core network, make sure to have your [maintenance alerts turned on and configured](./maintenance-alerts.md).

->

-### FastPath routes count (at circuit level)

-Aggregation type: *Max*

-This metric shows the number of FastPath routes configured on a circuit. Set an alert for when the number of FastPath routes on a circuit goes beyond the threshold limit. For more information, see [ExpressRoute FastPath limits](about-fastpath.md#ip-address-limits).

-### <a name = "arp"></a>ARP Availability - Split by Peering

-Aggregation type: *Avg*

-You can view near to real-time availability of [ARP](./expressroute-troubleshooting-arp-resource-manager.md) (Layer-2 connectivity) across peerings and peers (Primary and Secondary ExpressRoute routers). This dashboard shows the Private Peering ARP session status is up across both peers, but down for Microsoft peering for both peers. The default aggregation (Average) was utilized across both peers.

-## ExpressRoute Direct Metrics

-### <a name = "admin"></a>Admin State - Split by link

-Aggregation type: *Avg*

-You can view the Admin state for each link of the ExpressRoute Direct port pair. The Admin state represents if the physical port is on or off. This state is required to pass traffic across the ExpressRoute Direct connection.

-### <a name = "directin"></a>Bits In Per Second - Split by link

-Aggregation type: *Avg*

-You can view the bits in per second across both links of the ExpressRoute Direct port pair. Monitor this dashboard to compare inbound bandwidth for both links.

-### <a name = "directout"></a>Bits Out Per Second - Split by link

-Aggregation type: *Avg*

-You can also view the bits out per second across both links of the ExpressRoute Direct port pair. Monitor this dashboard to compare outbound bandwidth for both links.

-### <a name = "line"></a>Line Protocol - Split by link

-Aggregation type: *Avg*

-You can view the line protocol across each link of the ExpressRoute Direct port pair. The Line Protocol indicates if the physical link is up and running over ExpressRoute Direct. Monitor this dashboard and set alerts to know when the physical connection goes down.

-### <a name = "rxlight"></a>Rx Light Level - Split by link

-Aggregation type: *Avg*

-You can view the Rx light level (the light level that the ExpressRoute Direct port is **receiving**) for each port. Healthy Rx light levels generally fall within a range of -10 dBm to 0 dBm. Set alerts to be notified if the Rx light level falls outside of the healthy range.

->[!NOTE]

-> ExpressRoute Direct connectivity is hosted across different device platforms. Some ExpressRoute Direct connections will support a split view for Rx light levels by lane. However, this is not supported on all deployments.

->

-### <a name = "txlight"></a>Tx Light Level - Split by link

-Aggregation type: *Avg*

-You can view the Tx light level (the light level that the ExpressRoute Direct port is **transmitting**) for each port. Healthy Tx light levels generally fall within a range of -10 dBm to 0 dBm. Set alerts to be notified if the Tx light level falls outside of the healthy range.

->[!NOTE]

-> ExpressRoute Direct connectivity is hosted across different device platforms. Some ExpressRoute Direct connections will support a split view for Tx light levels by lane. However, this is not supported on all deployments.

->

-### FastPath routes count (at port level)

-Aggregation type: *Max*

-This metric shows the number of FastPath routes configured on an ExpressRoute Direct port.

-*Guidance:* Set an alert for when the number of FastPath routes on the port goes beyond the threshold limit. For more information, see [ExpressRoute FastPath limits](about-fastpath.md#ip-address-limits).

-## ExpressRoute Virtual Network Gateway Metrics

-Aggregation type: *Avg*

-When you deploy an ExpressRoute gateway, Azure manages the compute and functions of your gateway. There are six gateway metrics available to you to better understand the performance of your gateway:

-* Bits received per second

-* CPU Utilization

-* Packets per seconds

-* Count of routes advertised to peers

-* Count of routes learned from peers

-* Frequency of routes changed

-* Number of VMs in the virtual network

-* Active flows

-* Max flows created per second

-We highly recommended you set alerts for each of these metrics so that you're aware of when your gateway could be seeing performance issues.

-### <a name = "gwbits"></a>Bits received per second - Split by instance

-Aggregation type: *Avg*

-This metric captures inbound bandwidth utilization on the ExpressRoute virtual network gateway instances. Set an alert for how frequent the bandwidth utilization exceeds a certain threshold. If you need more bandwidth, increase the size of the ExpressRoute virtual network gateway.

-### <a name = "cpu"></a>CPU Utilization - Split by instance

-Aggregation type: *Avg*

-You can view the CPU utilization of each gateway instance. The CPU utilization might spike briefly during routine host maintenance but prolong high CPU utilization could indicate your gateway is reaching a performance bottleneck. Increasing the size of the ExpressRoute gateway might resolve this issue. Set an alert for how frequent the CPU utilization exceeds a certain threshold.

-### <a name = "packets"></a>Packets Per Second - Split by instance

-Aggregation type: *Avg*

-This metric captures the number of inbound packets traversing the ExpressRoute gateway. You should expect to see a consistent stream of data here if your gateway is receiving traffic from your on-premises network. Set an alert for when the number of packets per second drops below a threshold indicating that your gateway is no longer receiving traffic.

-### <a name = "advertisedroutes"></a>Count of Routes Advertised to Peer - Split by instance

-Aggregation type: *Max*

-This metric shows the number of routes the ExpressRoute gateway is advertising to the circuit. The address spaces might include virtual networks that are connected using virtual network peering and uses remote ExpressRoute gateway. You should expect the number of routes to remain consistent unless there are frequent changes to the virtual network address spaces. Set an alert for when the number of advertised routes drop below the threshold for the number of virtual network address spaces you're aware of.

-### <a name = "learnedroutes"></a>Count of routes learned from peer - Split by instance

-Aggregation type: *Max*

-This metric shows the number of routes the ExpressRoute gateway is learning from peers connected to the ExpressRoute circuit. These routes can be either from another virtual network connected to the same circuit or learned from on-premises. Set an alert for when the number of learned routes drop below a certain threshold. This metric can indicate either the gateway is seeing a performance problem or remote peers are no longer advertising routes to the ExpressRoute circuit.

-### <a name = "frequency"></a>Frequency of routes change - Split by instance

-Aggregation type: *Sum*

-This metric shows the frequency of routes being learned from or advertised to remote peers. You should first investigate your on-premises devices to understand why the network is changing so frequently. A high frequency in routes change could indicate a performance problem on the ExpressRoute gateway where scaling the gateway SKU up might resolve the problem. Set an alert for a frequency threshold to be aware of when your ExpressRoute gateway is seeing abnormal route changes.

-### <a name = "vm"></a>Number of VMs in the virtual network

-Aggregation type: *Max*

-This metric shows the number of virtual machines that are using the ExpressRoute gateway. The number of virtual machines might include VMs from peered virtual networks that use the same ExpressRoute gateway. Set an alert for this metric if the number of VMs goes above a certain threshold that could affect the gateway performance.

->[!NOTE]

-> To maintain reliability of the service, Microsoft often performs platform or OS maintenance on the gateway service. During this time, this metric may fluctuate and report inaccurately.

->

-## <a name = "activeflows"></a>Active flows

-Aggregation type: *Avg*

-Split by: Gateway Instance

-This metric displays a count of the total number of active flows on the ExpressRoute Gateway. Only inbound traffic from on-premises is captured for active flows. Through split at instance level, you can see active flow count per gateway instance. For more information, see [understand network flow limits](../virtual-network/virtual-machine-network-throughput.md#network-flow-limits).

-## <a name = "maxflows"></a>Max flows created per second

-Aggregation type: *Max*

-Split by: Gateway Instance and Direction (Inbound/Outbound)

-This metric displays the maximum number of flows created per second on the ExpressRoute Gateway. Through split at instance level and direction, you can see max flow creation rate per gateway instance and inbound/outbound direction respectively. For more information, see [understand network flow limits](../virtual-network/virtual-machine-network-throughput.md#network-flow-limits).

-## <a name = "connectionbandwidth"></a>ExpressRoute gateway connections in bits/seconds

-Aggregation type: *Avg*

-This metric shows the bits per second for ingress and egress to Azure through the ExpressRoute gateway. You can split this metric further to see specific connections to the ExpressRoute circuit.

-## ExpressRoute Traffic Collector metrics

-### CPU Utilization - Split by instance

-Aggregation type:ΓÇ»*Avg* (of percentage of total utilized CPU)

-*Granularity: 5 min*

-You can view the CPU utilization of each ExpressRoute Traffic Collector instance. The CPU utilization might spike briefly during routine host maintenance, but prolonged high CPU utilization could indicate your ExpressRoute Traffic Collector is reaching a performance bottleneck.

-**Guidance:** Set an alert for when avg CPU utilization exceeds a certain threshold.

-### Memory Utilization - Split by instance

-Aggregation type:ΓÇ»*Avg* (of percentage of total utilized Memory)

-*Granularity: 5 min*

-You can view the memory utilization of each ExpressRoute Traffic Collector instance. Memory utilization might spike briefly during routine host maintenance, but prolonged high memory utilization could indicate your Azure Traffic Collector is reaching a performance bottleneck.

-**Guidance:** Set an alert for when avg memory utilization exceeds a certain threshold.

-### Count of flow records processed - Split by instances or ExpressRoute circuit

-Aggregation type: *Count*

-*Granularity: 5 min*

-You can view the count of number of flow records processed by ExpressRoute Traffic Collector, aggregated across ExpressRoute Circuits. Customer can split the metrics across each ExpressRoute Traffic Collector instance or ExpressRoute circuit when multiple circuits are associated to the ExpressRoute Traffic Collector. Monitoring this metric helps you understand if you need to deploy more ExpressRoute Traffic Collector instances or migrate ExpressRoute circuit association from one ExpressRoute Traffic Collector deployment to another.

-**Guidance:** Splitting by circuits is recommended when multiple ExpressRoute circuits are associated with an ExpressRoute Traffic Collector deployment. This metric helps determine the flow count of each ExpressRoute circuit and ExpressRoute Traffic Collector utilization by each ExpressRoute circuit.

-## Alerts for ExpressRoute gateway connections

-1. To configure alerts, navigate to **Azure Monitor**, then select **Alerts**.

- :::image type="content" source="./media/expressroute-monitoring-metrics-alerts/monitor-overview.png" alt-text="Screenshot of the alerts option from the monitor overview page.":::

-1. Select **+ Create > Alert rule** and select the ExpressRoute gateway connection resource. Select **Next: Condition >** to configure the signal.

- :::image type="content" source="./media/expressroute-monitoring-metrics-alerts/select-expressroute-gateway.png" alt-text="Screenshot of the selecting ExpressRoute virtual network gateway from the select a resource page.":::

-1. On the *Select a signal* page, select a metric, resource health, or activity log that you want to be alerted. Depending on the signal you select, you might need to enter additional information such as a threshold value. You can also combine multiple signals into a single alert. Select **Next: Actions >** to define who and how they get notify.

- :::image type="content" source="./media/expressroute-monitoring-metrics-alerts/signal.png" alt-text="Screenshot of list of signals that can be alerted for ExpressRoute gateways.":::

-1. Select **+ Select action groups** to choose an existing action group you previously created or select **+ Create action group** to define a new one. In the action group, you determine how notifications get sent and who receives them.

- :::image type="content" source="./media/expressroute-monitoring-metrics-alerts/action-group.png" alt-text="Screenshot of add action groups page.":::

-1. Select **Review + create** and then **Create** to deploy the alert into your subscription.

-### Alerts based on each peering

-After you select a metric, certain metric allow you to set up dimensions based on peering or a specific peer (virtual networks).

-### Configure alerts for activity logs on circuits

-When selecting signals to be alerted on, you can select **Activity Log** signal type.

-## More metrics in Log Analytics

-You can also view ExpressRoute metrics by going to your ExpressRoute circuit resource and selecting the *Logs* tab. For any metrics you query, the output contains the following columns.

-| **Column** | **Type** | **Description** |

-| | | |

-| TimeGrain | string | PT1M (metric values are pushed every minute) |

-| Count | real | Usually is 2 (each MSEE pushes a single metric value every minute) |

-| Minimum | real | The minimum of the two metric values pushed by the two MSEEs |

-| Maximum | real | The maximum of the two metric values pushed by the two MSEEs |

-| Average | real | Equal to (Minimum + Maximum)/2 |

-| Total | real | Sum of the two metric values from both MSEEs (the main value to focus on for the metric queried) |

-

-## Next steps

-Set up your ExpressRoute connection.

-

-* [Create and modify a circuit](expressroute-howto-circuit-arm.md)

-* [Create and modify peering configuration](expressroute-howto-routing-arm.md)

-* [Link a virtual network to an ExpressRoute circuit](expressroute-howto-linkvnet-arm.md)

-description: Important reference material needed when you monitor ExpressRoute

-# Monitoring ExpressRoute data reference

-This article provides a reference of log and metric data collected to analyze the performance and availability of ExpressRoute.

-See [Monitoring ExpressRoute](monitor-expressroute.md) for details on collecting and analyzing monitoring data for ExpressRoute.

-## Metrics

-This section lists all the automatically collected platform metrics for ExpressRoute. For more information, see a list of [all platform metrics supported in Azure Monitor](../azure-monitor/essentials/metrics-supported.md).

-| Metric Type | Resource Provider / Type Namespace<br/> and link to individual metrics |

-|-|--|

-| ExpressRoute circuit | [Microsoft.Network/expressRouteCircuits](../azure-monitor/essentials/metrics-supported.md#microsoftnetworkexpressroutecircuits) |

-| ExpressRoute circuit peering | [Microsoft.Network/expressRouteCircuits/peerings](../azure-monitor/essentials/metrics-supported.md#microsoftnetworkexpressroutecircuitspeerings) |

-| ExpressRoute Gateways | [Microsoft.Network/expressRouteGateways](../azure-monitor/essentials/metrics-supported.md#microsoftnetworkexpressroutegateways) |

-| ExpressRoute Direct | [Microsoft.Network/expressRoutePorts](../azure-monitor/essentials/metrics-supported.md#microsoftnetworkexpressrouteports) |

->[!NOTE]

-## Metric dimensions

-For more information on what metric dimensions are, see [Multi-dimensional metrics](../azure-monitor/essentials/data-platform-metrics.md#multi-dimensional-metrics).

-ExpressRoute has the following dimensions associated with its metrics.

-### Dimension for ExpressRoute circuit

-| - | -- |

-| **PeeringType** | The type of peering configured. The supported values are Microsoft and Private peering. |

-| **Peering** | The supported values are Primary and Secondary. |

-| **PeeredCircuitSkey** | The remote ExpressRoute circuit service key connected using Global Reach. |

-### Dimension for ExpressRoute gateway

-| - | -- |

-| **roleInstance** | The gateway instance. Each ExpressRoute gateway is comprised of multiple instances, and the supported values are GatewayTenantWork_IN_X (where X is a minimum of 0 and a maximum of the number of gateway instances -1). |

-### Dimension for Express Direct

-| - | -- |

-| **Link** | The physical link. Each ExpressRoute Direct port pair is comprised of two physical links for redundancy, and the supported values are link1 and link2. |

-## Resource logs

-This section lists the types of resource logs you can collect for ExpressRoute.

-|Resource Log Type | Resource Provider / Type Namespace<br/> and link to individual metrics |

-|-|--|

-| ExpressRoute Circuit | [Microsoft.Network/expressRouteCircuits](../azure-monitor/essentials/resource-logs-categories.md#microsoftnetworkexpressroutecircuits) |

-For reference, see a list of [all resource logs category types supported in Azure Monitor](../azure-monitor/essentials/resource-logs-schema.md).

-## Azure Monitor Logs tables

-Azure ExpressRoute uses Kusto tables from Azure Monitor Logs. You can query these tables with Log analytics. For a reference of all Azure Monitor Logs / Log Analytics tables, see the [Azure Monitor Log Table Reference](/azure/azure-monitor/reference/tables/tables-resourcetype).

-## Activity log

-The following table lists the operations related to ExpressRoute that may be created in the Activity log.

-| All Administrative operations | All administrative operations including create, update and delete of an ExpressRoute circuit. |

-For more information on the schema of Activity Log entries, see [Activity Log schema](../azure-monitor/essentials/activity-log-schema.md).

-When reviewing any metrics through Log Analytics, the output will contain the following columns:

-|**Column**|**Type**|**Description**|

-| | | |

-|TimeGrain|string|PT1M (metric values are pushed every minute)|

-|Count|real|Usually equal to 2 (each MSEE pushes a single metric value every minute)|

-|Minimum|real|The minimum of the two metric values pushed by the two MSEEs|

-|Maximum|real|The maximum of the two metric values pushed by the two MSEEs|

-|Average|real|Equal to (Minimum + Maximum)/2|

-|Total|real|Sum of the two metric values from both MSEEs (the main value to focus on for the metric queried)|

-## See also

-description: Start here to learn how to monitor Azure ExpressRoute.

-# Monitoring Azure ExpressRoute

-When you have critical applications and business processes relying on Azure resources, you want to monitor those resources for their availability, performance, and operation.

-This article describes the monitoring data generated by Azure ExpressRoute. Azure ExpressRoute uses [Azure Monitor](../azure-monitor/overview.md). If you're unfamiliar with the features of Azure Monitor common to all Azure services that use it, read [Monitoring Azure resources with Azure Monitor](../azure-monitor/essentials/monitor-azure-resource.md).

-

-## ExpressRoute insights

-Some services in Azure have a special focused prebuilt monitoring dashboard in the Azure portal that provides a starting point for monitoring your service. These special dashboards are called *insights*.

-## Monitoring data

-Azure ExpressRoute collects the same kinds of monitoring data as other Azure resources that are described in [Monitoring data from Azure resources](../azure-monitor/essentials/monitor-azure-resource.md#monitoring-data).

-See [Monitoring Azure ExpressRoute data reference](monitor-expressroute-reference.md) for detailed information on the metrics and logs metrics created by Azure ExpressRoute.

-## Collection and routing

-Platform metrics and the Activity log are collected and stored automatically, but can be routed to other locations by using a diagnostic setting.

-The metrics and logs you can collect are discussed in the following sections.

-You can analyze metrics for *Azure ExpressRoute* with metrics from other Azure services using metrics explorer by opening **Metrics** from the **Azure Monitor** menu. See [Analyze metrics with Azure Monitor metrics explorer](../azure-monitor/essentials/analyze-metrics.md) for details on using this tool.

-* To view **ExpressRoute** metrics, filter by Resource Type *ExpressRoute circuits*.

-* To view **Global Reach** metrics, filter by Resource Type *ExpressRoute circuits* and select an ExpressRoute circuit resource that has Global Reach enabled.

-* To view **ExpressRoute Direct** metrics, filter Resource Type by *ExpressRoute Ports*.