+You can configure Azure AD B2C to allow users to sign in to your application with credentials from external social or enterprise identity providers (IdP). Azure AD B2C supports external identity providers like Facebook, Microsoft account, Google, X, and any identity provider that supports OAuth 1.0, OAuth 2.0, OpenID Connect, and SAML protocols.

+* [X](identity-provider-twitter.md)

+- ROPC supports local accounts only. Users canΓÇÖt sign in with [federated identity providers](add-identity-provider.md) like Microsoft, Google+, X, AD-FS, or Facebook.

+|[X](identity-provider-twitter.md) | GA | GA | |

+|[OAuth1](oauth1-technical-profile.md) | NA | GA | For example, [X](identity-provider-twitter.md). |

+Azure AD B2C offers several sign-up and sign-in methods for users of your applications. When users sign up for your application, you determine whether they'll use a username, email address, or phone number to create local accounts in your Azure AD B2C tenant. You can also federate with social identity providers (like Facebook, LinkedIn, and X) and standard identity protocols (like OAuth 2.0, OpenID Connect, and more).

+| [Customer Identity Management with Azure AD B2C](/Shows/On-NET/Customer-Identity-Management-with-Azure-AD-B2C) | Video (20 minutes) | In this overview of the service, Parakh Jain ([@jainparakh](https://x.com/jainparakh)) from the Azure AD B2C team provides us an overview of how the service works, and also show how we can quickly connect B2C to an ASP.NET Core application. |

+ * **Social identity providers** - You can federate with social providers like Facebook, LinkedIn, or X.

+You can configure Azure AD B2C to allow users to sign in to your application with credentials from social and enterprise identity providers. Azure AD B2C can federate with identity providers that support OAuth 1.0, OAuth 2.0, OpenID Connect, and SAML protocols. For example, Facebook, Microsoft account, Google, X, and Active Directory Federation Service (AD FS).

+The consumer user can sign in to applications secured by Azure AD B2C, but cannot access Azure resources such as the Azure portal. The consumer user can use a local account or federated accounts, such as Facebook or X. A consumer account is created by using a [sign-up or sign-in user flow](user-flow-overview.md), using the Microsoft Graph API, or by using the Azure portal.

+ Title: Used mixed SKU node pools in Azure Kubernetes Services (AKS)

+description: Learn about creating node pools with multiple VM types in an AKS cluster.

+#Customer intent: As a cluster operator or developer, I want to learn how to enable my cluster to create node pools with multiple VM types.

+# Use mixed SKU node pools (preview) in Azure Kubernetes Services (AKS)

+When you deploy a workload onto Azure Kubernetes Services (AKS), each node pool typically can only contain one virtual machine (VM) type or SKU. Mixed SKU node pools allow you to add multiple [VM SKUs][vm-SKU] to a single node pool without losing performance, quality, or certain feature support. Mixed SKU node pools allow you to specify a family of SKUs without the need to maintain one node pool per SKU type, reducing the node pool footprint.

+## Prerequisites

+- You need an Azure subscription. If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free).

+- Currently, the feature is in preview and you need to use API version >= 2023-10-02-preview, or install the az cli extension >= 2.61.0 version.

+- If using the [Azure CLI][install azure cli], register the `aks-preview` extension or update the version of existing `aks-preview` to minimum version 4.0.0b4.

+- The minimum minor Kubernetes version that supports this new node pool type is version 1.26.

+### Install the aks-preview Azure CLI extension

+1. Install the aks-preview extension using the [`az extension add`][az extension add] command:

+ ```azurecli-interactive

+ az extension add --name aks-preview

+ ```

+2. Update to the latest version of the aks-preview extension using the [`az extension update`][az extension update] command.

+ ```azurecli-interactive

+ az extension update --name aks-preview

+ ```

+## Register the `VMsAgentPoolPreview` feature flag

+1. Select the subscription where you want to enable the feature flag using the [`az account set`][az account set] command.

+ ```azurecli-interactive

+ az account set --subscription <subscription-name>

+ ```

+2. Register the `VMsAgentPoolPreview` feature flag using the [`az feature registration create`][az feature registration create] command.

+ ```azurecli-interactive

+ az feature registration create --namespace Microsoft.ContainerService --name VMsAgentPoolPreview

+ ```

+ It takes a few minutes for the status to show *Registered*.

+3. Verify the registration status using the [`az feature show`][az feature show] command.

+ ```azurecli-interactive

+ az feature show --namespace "Microsoft.ContainerService" --name "VMsAgentPoolPreview"

+ ```

+4. When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider using the [`az provider register`][az provider register] command.

+ ```azurecli-interactive

+ az provider register --namespace "Microsoft.ContainerService"

+ ```

+## Limitations

+- [Cluster autoscaler][cluster autoscaler] isn't available.

+- [InifiniBand] isn't available.

+- Windows node pool isn't supported.

+- This feature isn't available in Azure portal. You can only manipulate or manage the pool using [Azure CLI][azure cli] or REST APIs.

+- [Node pool snapshot][node pool snapshot] isn't supported.

+- Certain preview features that work in the [Azure Virtual Machine Scale Sets][VMSS] node might not be supported with this mixed SKU node pool.

+- All VM sizes selected in a node pool need to be from a similar VM family. For example, you can't mix an N-Series VM size with a D-Series VM size in the same node pool.

+## Create an AKS cluster with mixed SKU node pools

+> [!NOTE]

+> Only *one* VM size is allowed in a scale profile, and the maximum limit is *five* VM scale profiles overall for a mixed SKU node pool.

+- Create an AKS cluster with mixed SKU node pools using the [`az aks create`][az aks create] command with the `--vm-set-type` flag set to `"VirtualMachines"`.

+ The following example creates a cluster named *myAKSCluster* with a mixed SKU node pool containing two nodes in the *myResourceGroup*, generates SSH keys, sets the load balancer SKU to *standard*, and sets the Kubernetes version to *1.28.5*:

+ ```azurecli-interactive

+ az aks create \

+ --resource-group myResourceGroup \

+ --name myAKSCluster \

+ --vm-set-type "VirtualMachines" \

+ --node-count 2 \

+ --generate-ssh-keys \

+ --load-balancer-sku standard \

+ --kubernetes-version 1.28.5

+ ```

+## Add a mixed SKU node pool to an existing cluster

+- Add a mixed SKU node pool to an existing cluster using the [`az aks nodepool add`][az aks nodepool add] command with the `--vm-set-type` flag set to `"Virtual Machines"`.

+ The following example creates a mixed SKU node pool named *myvmpool* to the *myAKSCluster* cluster with three nodes and a maximum VM SKU of *Standard_D4s_v3*:

+ ```azurecli-interactive

+ az aks nodepool add \

+ --resource-group myResourceGroup \

+ --cluster-name myAKSCluster \

+ --name myvmpool \

+ --vm-set-type "VirtualMachines" \

+ --vm-sizes "Standard_D4s_v3" \

+ --node-count 3

+ ```

+## Add manual scale profile to a node pool

+- Add a manual scale profile to a node pool using the [`az aks nodepool manual-scale add`][az aks nodepool manual-scale add] with the `--vm-sizes` flag set to `"Standard_D2s_v3"`.

+ The following example adds a manual scale profile to node pool *myvmpool* in cluster *myAKSCluster* in resource group *myResourceGroup* with two nodes with a VM SKU of *Standard_D2s_v3*:

+ ```azurecli-interactive

+ az aks nodepool manual-scale add \

+ --resource-group myResourceGroup \

+ --cluster-name myAKSCluster \

+ --name myvmpool1 \

+ --vm-sizes "Standard_D2s_v3" \

+ --node-count 2

+ ```

+## Update an existing manual scale profile

+- Update an existing manual scale profile in a node pool using the [`az aks nodepool manual-scale update`][az aks nodepool manual-scale update] command with the `--vm-sizes` flag set to `"Standard_D2s_v3"`.

+ > [!NOTE]

+ > Use the `--current-vm-sizes` Azure CLI flag to specify the size of the existing node pool that you want to update. You can update `--vm-sizes` and/or `--node-count`. When using other tools or REST APIs, you need to pass in a full `agentPoolProfiles.virtualMachinesProfile.scale` field when updating the node pool scale profile.

+ The following example updates a manual scale profile to the *myvmpool1* node pool in the *myAKSCluster* cluster in the *myResourceGroup* resource group with five nodes and changes the VM SKU from *Standard_D4s_v3* to *Standard_D8s_v3*:

+ ```azurecli-interactive

+ az aks nodepool manual-scale update \

+ --resource-group myResourceGroup \

+ --cluster-name myAKSCluster \

+ --name myvmpool1 \

+ --current-vm-sizes "Standard_D4s_v3" \

+ --vm-sizes "Standard_D8s_v3" \

+ --node-count 5

+ ```

+## Delete a manual scale profile

+- Delete an existing manual scale profile using the [`az aks nodepool manual-scale delete`][az aks nodepool manual-scale delete] command.

+ > [!NOTE]

+ > Use the `--current-vm-sizes` Azure CLI flag to specify the size of the existing node pool that you want to delete. When using other tools or REST APIs, you need to pass in a full `agentPoolProfiles.virtualMachinesProfile.scale` field when updating the node pool scale profile.

+ The following example deletes the manual scale profile using the *Standard_D8s_v3* VM SKU in the *myvmpool1* node pool in the *myAKSCluster* cluster in the *myResourceGroup* resource group.

+ ```azurecli-interactive

+ az aks nodepool manual-scale delete \

+ --resource-group myResourceGroup \

+ --cluster-name myAKSCluster \

+ --name myvmpool1 \

+ --current-vm-sizes "Standard_D8s_v3"

+ ```

+## Next steps

+In this article, you learned how to use mixed SKU node pools in Azure Kubernetes Services (AKS). To learn more about node pools in AKS, see [Create node pools][create node pools].

+<!-- EXTERNAL LINKS -->

+<!-- INTERNAL LINKS -->

+[install azure cli]: /cli/azure/install-azure-cli#install-azure-cli

+[az provider register]: /cli/azure/provider#az-provider-register

+[az feature show]: /cli/azure/feature#az-feature-show

+[az extension add]: /cli/azure/extension#az-extention-add

+[az feature registration create]: /cli/azure/feature/registration#az-feature-registration-create

+[az aks get credentials]: /cli/azure/aks#az-aks-get-credentials

+[az aks create]: /cli/azure/aks#az-aks-create

+[az aks nodepool add]: /cli/azure/aks/nodepool#az-aks-nodepool-add

+[az aks nodepool manual-scale add]: /cli/azure/aks/nodepool/manual-scale#az-aks-nodepool-manual-scale-add

+[az aks nodepool manual-scale update]: /cli/azure/aks/nodepool/manual-scale#az-aks-nodepool-manual-scale-update

+[az aks nodepool manual-scale delete]: /cli/azure/aks/nodepool/manual-scale#az-aks-nodepool-manual-scale-delete

+[node pool snapshot]: node-pool-snapshot.md

+[cluster autoscaler]: cluster-autoscaler-overview.md

+[InifiniBand]: ../virtual-machines/extensions/enable-infiniband.md

+[vm-SKU]: ../virtual-machines/sizes/overview.md

+[VMSS]: ../virtual-machine-scale-sets/overview.md

+[azure cli]: /cli/azure/get-started-with-azure-cli

+[az extension update]: /cli/azure/extension#az-extension-update

+[az account set]: /cli/azure/account#az-account-set

+[create node pools]: create-node-pools.md

+> It is also possible to configure Diagnostic settings through the CLI. In these cases, it is not guaranteed to work successfully as it doesnt check for the cluster's provisioning state. Please make sure to check the diagnostic settings of the cluster to reflect after configuring it.

+You can optionally migrate back to the original subnet you used in each region after migration to the `stv2` platform. To do so, update the VNet configuration again, this time specifying the original VNet and subnet in each region. As in the preceding migration, expect a long-running operation, and expect the VIP address to change.

+- **Microsoft Authentication Library (MSAL)** - Enables developers to acquire security tokens from the Microsoft identity platform to authenticate users and access secured web APIs. Available for multiple supported platforms and frameworks, these are general purpose libraries that can be used in various hosted environments. Developers can also integrate with multiple sign-in providers, like Microsoft Entra, Facebook, Google, X.

+- **Microsoft.Identity.Web** - A higher-level library wrapping MSAL.NET, it provides a set of ASP.NET Core abstractions that simplify adding authentication support to web apps and web APIs integrating with the Microsoft identity platform. It provides a single-surface API convenience layer that ties together ASP.NET Core, its authentication middleware, and MSAL.NET. This library can be used in apps in various hosted environments. You can integrate with multiple sign-in providers, like Microsoft Entra, Facebook, Google, X.

+App Service authentication and authorization support multiple authentication providers, including Microsoft Entra ID, Microsoft accounts, Facebook, Google, and X. For more information, see [Authentication and authorization in Azure App Service](overview-authentication-authorization.md).

+* **Authentication** - [Authenticate users](overview-authentication-authorization.md) using the built-in authentication component. Authenticate users with [Microsoft Entra ID](configure-authentication-provider-aad.md), [Google](configure-authentication-provider-google.md), [Facebook](configure-authentication-provider-facebook.md), [X](configure-authentication-provider-twitter.md), or [Microsoft account](configure-authentication-provider-microsoft.md).

+* Connect with [@AzureSupport](https://x.com/azuresupport). This is the official Microsoft Azure account for connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport). This is the official Microsoft Azure account for connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects you to the Azure community for answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport). This is the official Microsoft Azure account for connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience.

+Every request to an Azure App Configuration resource must be authenticated. By default, requests can be authenticated with either Microsoft Entra credentials, or by using an access key. Of these two types of authentication schemes, Microsoft Entra ID provides superior security and ease of use over access keys, and is recommended by Microsoft. To require clients to use Microsoft Entra ID to authenticate requests, you can disable the usage of access keys for an Azure App Configuration resource. If you want to use access keys to authenticate the request, it's recommended to rotate access keys periodically to enhance security. See [recommendations for protecting application secrets](/azure/well-architected/security/application-secrets) to learn more.

+To allow access key authentication for an Azure App Configuration resource in the Azure portal, follow these steps:

+To enable access keys for Azure App configuration resource, use the following command. The `--disable-local-auth` option is set to `false` to enable access key-based authentication.

+To verify if access key authentication is enabled, check if you're able to get a list of read-only and read-write access keys. This list will only exist if access key authentication is enabled.

+If access key authentication is enabled, then read-only access keys and read-write access keys will be returned.

+> [!WARNING]

+> If any clients are currently accessing data in your Azure App Configuration resource with access keys, then Microsoft recommends that you migrate those clients to [Microsoft Entra ID](./concept-enable-rbac.md) before disabling access key authentication.

+To disable access keys for Azure App configuration resource, use the following command. The `--disable-local-auth` option is set to `true` to disable access key-based authentication.

+## Access key rotation

+Microsoft recommends periodic rotation of access keys to mitigate the risk of attack vectors from leaked secrets. Each Azure App Configuration resource includes two read-only access keys and two read-write access keys, designated as primary and secondary keys, to facilitate seamless secret rotation. This setup enables you to alternate access keys in your applications without causing any downtime.

+1. Once the primary key is the only key in use, you can regenerate the secondary key.

+ ### [Azure portal](#tab/portal)

+ Go to your resource's page on the Azure portal, open the **Settings** > **Access settings** menu, and select **Regenerate** under **Secondary key**.

+ :::image type="content" border="true" source="./media/regenerate-secondary-key.png" alt-text="Screenshot showing regenerate secondary key.":::

+ ### [Azure CLI](#tab/azure-cli)

+ To regenerate an access key for an App Configuration store, use the following command.

+ ```azurecli-interactive

+ az appconfig credential regenerate \

+ --name <app-configuration-name> \

+ --resource-group <resource-group> \

+ --id <key-to-be-regenerated>

+ ```

+

+1. Next, update your code to use the newly generated secondary key.

+It is advisable to review your application logs to confirm that all instances of your application have transitioned from using the primary key to the secondary key before proceeding to the next step.

+1. Finally, you can invalidate the primary keys by regenerating them. Next time, you can alternate access keys between the secondary and primary keys using the same process.

+### errorResponse: error getting the vsphere sdk client

+### Cannot retrieve resource

+When Arc resource bridge is deployed, you specify where the appliance VM will be deployed. The appliance VM can't be moved from that location path. If you want to change the path, you need to delete and redeploy the Arc resource bridge. When upgrading Arc resource bridge, if you moved the appliance VM, you may hit an error similar to:

+```

+{\n \"code\": \"PreflightcheckError\",\n \"message\": \"{\\n \\\"code\\\": \\\"InvalidEntityError\\\",\\n \\\"message\\\": \\\"Cannot retrieve <resource> 'resource-name': <resource> 'resource-name' not found\\\"\\n }\"\n }"

+```

+You can either move the appliance VM back to its original location and ensure RBAC credentials are updated for the location change or delete and redeploy the Arc resource bridge.

+* Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+- Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+- Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+| **SCVMM** | You need an SCVMM management server running version 2019 or later.<br/><br/> A private cloud or a host group with a minimum free capacity of 32 GB of RAM, 4 vCPUs with 100 GB of free disk space. <br/><br/> A VM network with internet access, directly or through proxy. Appliance VM will be deployed using this VM network.<br/><br/> Only Static IP allocation is supported; Dynamic IP allocation using DHCP isn't supported. Static IP allocation can be performed by one of the following approaches:<br><br> 1. **VMM IP Pool**: Follow [these steps](/system-center/vmm/network-pool?view=sc-vmm-2022&preserve-view=true) to create a VMM Static IP Pool and ensure that the Static IP Pool has at least three IP addresses. If your SCVMM server is behind a firewall, all the IPs in this IP Pool and the Control Plane IP should be allowed to communicate through WinRM ports. The default WinRM ports are 5985 and 5986. <br> <br> 2. **Custom IP range**: Ensure that your VM network has three continuous free IP addresses. If your SCVMM server is behind a firewall, all the IPs in this IP range and the Control Plane IP should be allowed to communicate through WinRM ports. The default WinRM ports are 5985 and 5986. If the VM network is configured with a VLAN, the VLAN ID is required as an input. Azure Arc Resource Bridge requires internal and external DNS resolution to the required sites and the on-premises management machine for the Static gateway IP and the IP address(es) of your DNS server(s) are needed. <br/><br/> A library share with write permission for the SCVMM admin account through which Resource Bridge deployment is going to be performed.|

+| **SCVMM password** | Password for the SCVMM admin account. |

+| **Resource Bridge IP Inputs** | If you have a VMM IP Pool configured, select the VMM static IP pool that will be used to allot the IP address. </br></br> If you would like to enter Custom IP range, enter the Static IP address prefix, start range IP, end range IP, VM Network VLAN ID, static gateway IP, and the IP address(es) of DNS server(s), in that order. **Note**: If you don't have a VLAN ID configured with the VM Network, enter 0 as the VLAN ID. |

+| **SCVMM** | You need an SCVMM management server running version 2019 or later.<br/><br/> A private cloud or a host group with a minimum free capacity of 32 GB of RAM, 4 vCPUs with 100 GB of free disk space. <br/><br/> A VM network with internet access, directly or through proxy. Appliance VM will be deployed using this VM network.<br/><br/> Only Static IP allocation is supported; Dynamic IP allocation using DHCP isn't supported. Static IP allocation can be performed by one of the following approaches:<br><br> 1. **VMM IP Pool**: Follow [these steps](/system-center/vmm/network-pool?view=sc-vmm-2022&preserve-view=true) to create a VMM Static IP Pool and ensure that the Static IP Pool has at least three IP addresses. If your SCVMM server is behind a firewall, all the IPs in this IP Pool and the Control Plane IP should be allowed to communicate through WinRM ports. The default WinRM ports are 5985 and 5986. <br> <br> 2. **Custom IP range**: Ensure that your VM network has three continuous free IP addresses. If your SCVMM server is behind a firewall, all the IPs in this IP range and the Control Plane IP should be allowed to communicate through WinRM ports. The default WinRM ports are 5985 and 5986. If the VM network is configured with a VLAN, the VLAN ID is required as an input. Azure Arc Resource Bridge requires internal and external DNS resolution to the required sites and the on-premises management machine for the Static gateway IP and the IP address(es) of your DNS server(s) are needed. <br/><br/> A library share with write permission for the SCVMM admin account through which Resource Bridge deployment is going to be performed. |

+- Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+- Connect with [@AzureSupport](https://x.com/azuresupport), the official Microsoft Azure account for improving customer experience. Azure Support connects the Azure community to answers, support, and experts.

+To access the runtime REST APIs (under `/admin/`), you must provide the master key (`_master`) in the `x-functions-key` request header. You can [remove the admin endpoints](./security-concepts.md#disable-administrative-endpoints) using the `functionsRuntimeAdminIsolationEnabled` site property.

+### functionsRuntimeAdminIsolationEnabled

+Determines if the `/admin` endpoints are exposed for the function app. When "false", the app will serve these endpoints, and they can only be accessed using the master key for the function app. When "true", these endpoints are not served by the app.

+Version 4.x of the Functions runtime provides equivalent functionality for .NET 6 and .NET 8. The in-process model does not include additional features or updates that integrate with new .NET 8 capabilities. For example, the runtime doesn't support keyed services. To take full advantage of the latest .NET 8 capabilities and enhancements, you must [migrate to the isolated worker model](./migrate-dotnet-to-isolated-model.md).

+When functions use an HTTP trigger, you can require calls to first be authenticated. App Service supports Microsoft Entra authentication and sign-in with social providers, such as Facebook, Microsoft, and X. For information about configuring specific authentication providers, see [Azure App Service authentication overview](../app-service/overview-authentication-authorization.md).

+### Disable administrative endpoints

+Function apps can serve administrative endpoints under the `/admin` route that can be used for operations such as obtaining host status information and performing test invocations. When exposed, requests against these endpoints must include the app's master key. Administrative operations are also available through the [Azure Resource Manager `Microsoft.Web/sites` API](/rest/api/appservice/web-apps), which offers Azure RBAC. You can disable the `/admin` endpoints by setting the `functionsRuntimeAdminIsolationEnabled` site property to `true`.

+Azure Monitor OpenTelemetry and Application Insights Node.JS supports the credential classes provided by [Azure Identity](https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/identity/identity#credential-classes).

+- We recommend `DefaultAzureCredential` for local development.

+- We recommend `ManagedIdentityCredential` for system-assigned and user-assigned managed identities.

+ - For system-assigned, use the default constructor without parameters.

+ - For user-assigned, provide the client ID to the constructor.

+- We recommend `ClientSecretCredential` for service principals.

+ - Provide the tenant ID, client ID, and client secret to the constructor.

+If using @azure/monitor-opentelemetry

+```typescript

+const { useAzureMonitor, AzureMonitorOpenTelemetryOptions } = require("@azure/monitor-opentelemetry");

+const { ManagedIdentityCredential } = require("@azure/identity");

+const credential = new ManagedIdentityCredential();

+const options: AzureMonitorOpenTelemetryOptions = {

+ azureMonitorExporterOptions: {

+ connectionString:

+ process.env["APPLICATIONINSIGHTS_CONNECTION_STRING"] || "<your connection string>",

+ credential: credential

+ }

+};

+useAzureMonitor(options);

+```

+> [!NOTE]

+> Support for Microsoft Entra ID in the Application Insights Node.JS is included starting with [version 2.1.0-beta.1](https://www.npmjs.com/package/applicationinsights/v/2.1.0-beta.1).

+If using applicationinsights npm package.

+```typescript

+const appInsights = require("applicationinsights");

+const { DefaultAzureCredential } = require("@azure/identity");

+#### Environment variable configuration

+When using [Azure App Services autoinstrumentation](./azure-web-apps-nodejs.md) The `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable lets Application Insights authenticate to Microsoft Entra ID and send telemetry.

+- For system-assigned identity:

+| App setting | Value |

+| -- | |

+| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |

+- For user-assigned identity:

+| App setting | Value |

+| - | -- |

+| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |

+ connectionString:

+ process.env["APPLICATIONINSIGHTS_CONNECTION_STRING"] || "<your connection string>",

+Your environment before moving any components into Azure is based on virtual and physical machines located on-premises or with a managed service provider. It relies on SCOM to monitor business applications, server software, and other infrastructure components in your environment such as physical servers and networks. You use standard management packs for server software such as IIS, SQL Server, and various vendor software, and you tune those management packs for your specific requirements. You create custom management packs for your business applications and components that can't be monitored with existing management packs, and you also configure SCOM to support your business processes.

+| Dual-homed agents | SCOM uses the Microsoft Management Agent (MMA), which is the same as [Log Analytics agent](agents/log-analytics-agent.md) used by Azure Monitor. You can configure this agent to have a single machine connect to both SCOM and Azure Monitor simultaneously. This configuration does require that your Azure VMs have a connection to your on-premises management servers.<br><br>The [Log Analytics agent](agents/log-analytics-agent.md) has been replaced with the [Azure Monitor agent](agents/agents-overview.md), which provides significant advantages including simpler management and better control over data collection. The two agents can coexist on the same machine allowing you to connect to both Azure Monitor and SCOM. This configuration is a better option than dual-homing the legacy agent because of the significant [advantages of the Azure Monitor agent](agents/agents-overview.md#benefits). |

+| SCOM Managed instance | [SCOM managed instance (preview)](vm/scom-managed-instance-overview.md) is a full implementation of SCOM in Azure allowing you to continue running the same management packs that you run in your on-premises SCOM environment. You can continue to use the same Operations console for analyzing your health and alerts and can also view alerts in Azure Monitor and analyze SCOM data in Grafana.<br><br>SCOM MI is similar to maintaining your existing SCOM environment and dual-homing agents, although you can consolidate your monitoring configuration in Azure and retire your on-premises components such as database and management servers. Agents from Azure VMs can connect to the SCOM managed instance in Azure rather than connecting to management servers in your own data center. |

+You typically require custom management packs to monitor your business applications with SCOM, using agents installed on each virtual machine. Application Insights in Azure Monitor monitors web-based applications whether they're in Azure, other clouds, or on-premises. It can be used for all of your applications whether or not you migrated them to Azure.

+Following the basic strategy in the other sections of this guide, continue to use SCOM for your business applications, but take advantage of other features provided by Application Insights. As you're able to replace critical functionality with Azure Monitor, you can start to retire your custom management packs.

+Monitoring the software on your virtual machines in a hybrid environment often use a combination of Azure Monitor and SCOM, depending on the requirements of the workloads running on your VMs. As soon as a virtual machine is created in Azure, [platform metrics](essentials/data-platform-metrics.md) and [activity logs](essentials/activity-log.md) for the VM host automatically start being collected. [Enable recommended alerts](vm/tutorial-monitor-vm-alert-recommended.md) to notify you of common errors for the VM host such as server down and high CPU utilization.

+Enable [VM insights](vm/vminsights-overview.md) to install the Azure Monitor agent and begin collecting common performance data from the client operating system. This may overlap with some data that you're already collecting in SCOM, but it allows you to start viewing trends over time and monitor your Azure VMs with other cloud resources. You may also choose to enable the [map feature](vm/vminsights-maps.md), which gives you insight into the processes running on your virtual machines and their dependencies on other services.

+Continue to use management packs for functionality that isn't provided by other features in Azure Monitor. This includes management packs for critical server software like IIS, SQL Server, or Exchange. You may also have custom management packs developed for on-premises infrastructure that can't be reached with Azure Monitor. Also continue to use SCOM if you tightly integrated into your operational processes until you can transition to modernizing your service operations where Azure Monitor and other Azure services can augment or replace.

+> If you enable VM Insights with the Log Analytics agent instead of the Azure Monitor agent, then no additional agent needs to be installed on the VM. Azure Monitor agent is recommended though because of its significant improvements in monitoring the VM in the cloud. The complexity from maintaining multiple agents is offset by the ability to define monitoring in data collection rules, which allow you to configure different data collection for different sets of VMs, similar to your strategy for designing management packs.

+There are no migration tools to convert SCOM management packs to Azure Monitor because their logic is fundamentally different than Azure Monitor data collection. Migrating management pack logic typically focuses on analyzing the data collected by SCOM and identifying those monitoring scenarios that can be replicated by Azure Monitor. As you customize Azure Monitor to meet your requirements for different applications and components, then you can start to retire different management packs and legacy agents in SCOM.

+Management packs in SCOM contain rules and monitors that combine collection of data and the resulting alert into a single end-to-end workflow. Data already collected by SCOM is rarely used for alerting. Azure Monitor separates data collection and alerts into separate processes. Alert rules access data from Azure Monitor Logs and Azure Monitor Metrics collected from agents. Also, rules and monitors are typically focused on specific data such as a particular event or performance counter. Data collection rules in Azure Monitor are typically more broad collecting multiple sets of events and performance counters in a single DCR.

+ Title: Best practices for monitoring Kubernetes with Azure Monitor

+> [!NOTE]

+> The **Reports** tab will not be available if you enable the [Prometheus experience for Container insights](./container-insights-experience-v2.md). You can still access the workbooks from the **Workbooks** page for the cluster.

+>

+> :::image type="content" source="media/container-insights-reports/workbooks-page.png" alt-text="Screenshot of workbook option for a cluster." lightbox="media/container-insights-reports/workbooks-page.png":::

+> [!NOTE]

+> System-assigned managed identity is not supported for remote-write to Azure Monitor workspaces. Use user-assigned managed identity or Microsoft Entra ID application authentication.

+Microsoft Entra ID application authentication can be used in any environment. If your Prometheus service is running in an Azure-managed environment, consider using user-assigned managed identity authentication.

+ Title: Computer groups in Azure Monitor log queries

+> While some classic features are being retired with the Log Analytics agent deprecation, there are no current plans to deprecate computer groups. It's typically more effective though to leverage the capabilities of the KQL language to scope log queries.

+# Tutorial: Create availability alert rule for multiple Azure virtual machines

+If your Azure issue isn't addressed in this article, visit the Azure forums on [the Microsoft Developer Network (MSDN) and Stack Overflow](https://azure.microsoft.com/support/forums/). You can post your issue in these forums, or post to [@AzureSupport on X](https://x.com/AzureSupport). You also can submit an Azure support request. To submit a support request, on the [Azure support](https://azure.microsoft.com/support/options/) page, select *Get support*.

+If your Azure issue isn't addressed in this article, visit the Azure forums on [the Microsoft Developer Network (MSDN) and Stack Overflow](https://azure.microsoft.com/support/forums/). You can post your issue in these forums, or post to [@AzureSupport on X](https://x.com/AzureSupport). You also can submit an Azure support request. To submit a support request, on the [Azure support](https://azure.microsoft.com/support/options/) page, select *Get support*.

+If your Azure issue isn't addressed in this article, visit the Azure forums on [MSDN and Stack Overflow](https://azure.microsoft.com/support/forums/). You can post your issue in these forums, or post to [@AzureSupport on X](https://x.com/AzureSupport). You also can submit an Azure support request. To submit a support request, on the [Azure support](https://azure.microsoft.com/support/options/) page, select **Get support**.

+If your Azure issue isn't addressed in this article, visit the Azure forums on [the Microsoft Developer Network (MSDN) and Stack Overflow](https://azure.microsoft.com/support/forums/). You can post your issue in these forums, or post to [@AzureSupport on X](https://x.com/AzureSupport). You also can submit an Azure support request. To submit a support request, on the [Azure support](https://azure.microsoft.com/support/options/) page, select *Get support*.

+* See a [sample logic app](https://github.com/Azure-Samples/aci-logicapps-integration) that runs a container in Azure Container Instances to analyze the sentiment of e-mail or X text

+ Title: Avoid unused subscriptions

+description: Learn how to avoid having an unused subscription that gets automatically deleted.

+# Avoid unused subscriptions

+Unused and abandoned subscriptions can increase potential security risks to your Azure account. To reduce this risk, Microsoft takes measures to secure, protect, and ultimately delete unused Azure subscriptions.

+## What is an unused subscription?

+Unused subscriptions donΓÇÖt have usage, activity, or open support requests in more than one year (12 months). When a subscription enters the unused state, you receive a notification from Microsoft stating that your unused subscriptions will get blocked in 30 days.

+If you use your subscription within 30 days of the notification, your subscription returns to its normal state and is no longer subject to getting blocked. However, if your subscription remains unused for 30 days after the notification, Azure blocks the unused subscription for your protection.

+## What happens if my subscription is blocked?

+When your subscription is blocked, you canΓÇÖt perform certain subscription actions. You need assistance to unblock your subscription to return to normal use.

+- If you bought your subscription on your own, [create a support request](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest) to contact Microsoft Support.

+- If you acquired your subscription through a partner, contact your partner.

+When your subscription gets blocked, you receive another notification. The notification warns you that your subscription will get deleted in 90 days if you donΓÇÖt take action to unblock it.

+>[!WARNING]

+>Data loss will occur if you donΓÇÖt act to unblock your subscription within the notification period. Your unused subscription gets deleted for your protection. Any resources in the subscription are also deleted.

+## Related content

+- [Create a support request in the Azure portal](../../azure-portal/supportability/how-to-create-azure-support-request.md)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+* [X information about Data Factory](https://x.com/hashtag/DataFactory)

+- [X](https://x.com/AzDataFactory?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)

+- [X](https://x.com/AzDataFactory?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)

+> [!NOTE]

+> The Azure portal lists Event Grid topics from the same subscription as the storage account. The REST API can be used to configure an Event Grid topic from a different subscription of the same tenant, as described below.

+ [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ - [X](https://x.com/msftsecurity)

+ [X](https://x.com/msftsecurity)

+* Connect with [@AzureSupport](https://x.com/azuresupport) on X. This is the official Microsoft Azure account for improving customer experience. It connects the Azure community to the right resources: answers, support, and experts.

+* [Analyze X data using Apache Hive and Apache Hadoop on HDInsight](../hdinsight-analyze-twitter-data-linux.md)

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Build an end-to-end application with [Analyze real-time X sentiment with Apache HBase](./apache-hbase-tutorial-get-started-linux.md)

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+- Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: `answers`, `support`, and `experts`.

+- Connect with [@AzureSupport](https://x.com/azuresupport). This is the official Microsoft Azure account for improving customer experience. It connects the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* [Analyze X data using Apache Hive in HDInsight](hdinsight-analyze-twitter-data-linux.md)

+YouΓÇÖre welcome to add more proposals and ideas and other topics here and vote for them - [HDInsight Community (azure.com)](https://feedback.azure.com/d365community/search/?q=HDInsight) and follow us for more updates on [X](https://x.com/AzureHDInsight)

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+Spark clusters in HDInsight offer a rich support for building real-time analytics solutions. Spark already has connectors to ingest data from many sources like Kafka, Flume, X, ZeroMQ, or TCP sockets. Spark in HDInsight adds first-class support for ingesting data from Azure Event Hubs. Event Hubs is the most widely used queuing service on Azure. Having complete support for Event Hubs makes Spark clusters in HDInsight an ideal platform for building real-time analytics pipeline.

+[Apache Spark](https://spark.apache.org/) Streaming enables you to implement scalable, high-throughput, fault-tolerant applications for data streams processing. You can connect Spark Streaming applications on a HDInsight Spark cluster to different kinds of data sources, such as Azure Event Hubs, Azure IoT Hub, [Apache Kafka](https://kafka.apache.org/), [Apache Flume](https://flume.apache.org/), X, [ZeroMQ](http://zeromq.org/), raw TCP sockets, or by monitoring the [Apache Hadoop HDFS](https://hadoop.apache.org/docs/r1.2.1/hdfs_design.html) filesystem for changes. Spark Streaming supports fault tolerance with the guarantee that any given event is processed exactly once, even with a node failure.

+[Apache Spark](https://spark.apache.org/) Streaming provides data stream processing on HDInsight Spark clusters. With a guarantee that any input event is processed exactly once, even if a node failure occurs. A Spark Stream is a long-running job that receives input data from a wide variety of sources, including Azure Event Hubs. Also: Azure IoT Hub, Apache Kafka, Apache Flume, X, `ZeroMQ`, raw TCP sockets, or from monitoring Apache Hadoop YARN filesystems. Unlike a solely event-driven process, a Spark Stream batches input data into time windows. Such as a 2-second slice, and then transforms each batch of data using map, reduce, join, and extract operations. The Spark Stream then writes the transformed data out to filesystems, databases, dashboards, and the console.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience by connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+- Connect with [@AzureSupport](https://x.com/azuresupport) - the official Microsoft Azure account for improving customer experience. Connecting the Azure community to the right resources: answers, support, and experts.

+* [Tutorial: Create a function that integrates with Azure Logic Apps and Azure AI services to analyze X post sentiment](../azure-functions/functions-twitter-email.md)

+Office 365, Survey Monkey, X, and an

+The workflow that you create monitors a hashtag on X.

+2. In workflow designer, find and add the X trigger that has this action: **When a new tweet is posted**

+ such as the X trigger,

+ ![Example of X trigger.][1]

+|Standard_B1ms | 1 | 2 | 2.2 | 640 | 341 | 0 |

+## 1Password

+- [1Password (using Azure Functions)](data-connectors/1password.md)

+- [Tenable Identity Exposure](data-connectors/tenable-identity-exposure.md)

+- [Tenable Vulnerability Management (using Azure Functions)](data-connectors/tenable-vulnerability-management.md)

+## Transmit Security LTD

+- [Transmit Security Connector (using Azure Functions)](data-connectors/transmit-security-connector.md)

+ Title: "1Password (using Azure Functions) connector for Microsoft Sentinel"

+description: "Learn how to install the connector 1Password (using Azure Functions) to connect your data source to Microsoft Sentinel."

+# 1Password (using Azure Functions) connector for Microsoft Sentinel

+The [1Password](https://www.1password.com) solution for Microsoft Sentinel enables you to ingest sign-in attempts, item usage, and audit events from your 1Password Business account using the [1Password Events Reporting API](https://developer.1password.com/docs/events-api). This allows you to monitor and investigate events in 1Password in Microsoft Sentinel along with the other applications and services your organization uses.

+**Underlying Microsoft Technologies used:**

+This solution depends on the following technologies, and some of which may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or may incur additional ingestion or operational costs:

+[Azure Functions](https://azure.microsoft.com/services/functions/#overview)

+This is autogenerated content. For changes, contact the solution provider.

+## Connector attributes

+| Connector attribute | Description |

+| | |

+| **Log Analytics table(s)** | OnePasswordEventLogs_CL<br/> |

+| **Data collection rules support** | Not currently supported |

+| **Supported by** | [1Password](https://support.1password.com/) |

+## Query samples

+**Top 10 Users**

+ ```kusto

+OnePasswordEventLogs_CL

+

+ | summarize count() by tostring(target_user.name)

+

+ | top 10 by count_

+ ```

+## Prerequisites

+To integrate with 1Password (using Azure Functions) make sure you have:

+- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).

+- **1Password Events API Token**: A 1Password Events API Token is required. [See the documentation to learn more about the 1Password API](https://developer.1password.com/docs/events-api/reference).

+- A 1Password Business account is required.

+## Vendor installation instructions

+> [!NOTE]

+> This connector uses Azure Functions to connect to 1Password to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs from Azure. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.

+**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.

+**STEP 1 - Configuration steps for the 1Password Events Reporting API**

+[Follow these instructions](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens) provided by 1Password to obtain an Events Reporting API Token. A 1Password Business account is required.

+**STEP 2 - Deploy the functionApp using DeployToAzure button to create the table, data collection rule, and the associated Azure Function**

+**IMPORTANT:** Before deploying the 1Password connector, a custom table needs to be created.

+Option 1 - Azure Resource Manager (ARM) Template

+This method provides an automated deployment of the 1Password connector using an ARM Tempate.

+1. Click the **Deploy to Azure** button below.

+ [](https://aka.ms/sentinel-OnePassword-azuredeploy)

+2. Select the preferred **Subscription**, **Resource Group**, and **Location**.

+3. Enter the **Workspace Name**, **Workspace Name**, **1Password Events API Key**, and **URI**.

+ - The default **Time Interval** is set to five (5) minutes. If you'd like to modify the interval, you can adjust the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion.

+ - If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](/azure/app-service/app-service-key-vault-references) for further details.

+4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.

+5. Click **Purchase** to deploy.

+## Next steps

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/1password1617200969773.azure-sentinel-solution-1password?tab=Overview) in the Azure Marketplace.

+ Title: "Tenable Identity Exposure connector for Microsoft Sentinel"

+description: "Learn how to install the connector Tenable Identity Exposure to connect your data source to Microsoft Sentinel."

+# Tenable Identity Exposure connector for Microsoft Sentinel

+Tenable Identity Exposure connector allows Indicators of Exposure, Indicators of Attack and trailflow logs to be ingested into Microsoft Sentinel.The different work books and data parsers allow you to more easily manipulate logs and monitor your Active Directory environment. The analytic templates allow you to automate responses regarding different events, exposures, and attacks.

+This is autogenerated content. For changes, contact the solution provider.

+## Connector attributes

+| Connector attribute | Description |

+| | |

+| **Kusto function alias** | afad_parser |

+| **Log Analytics table(s)** | Tenable_IE_CL<br/> |

+| **Data collection rules support** | Not currently supported |

+| **Supported by** | [Tenable](https://www.tenable.com/support/technical-support) |

+## Query samples

+**Get the number of alerts triggered by each IoE**

+ ```kusto

+afad_parser

+

+ | where MessageType == 0

+

+ | summarize AlertCount = count() by Codename

+ ```

+**Get all IoE alerts with severity superior to the threshold**

+ ```kusto

+let threshold = 2;

+ let SeverityTable=datatable(Severity:string,Level:int) [

+ "low", 1,

+ "medium", 2,

+ "high", 3,

+ "critical", 4

+ ];

+ afad_parser

+

+ | where MessageType == 0

+

+ | lookup kind=leftouter SeverityTable on Severity

+

+ | where Level >= ['threshold']

+ ```

+**Get all IoE alerts for the last 24 hours**

+ ```kusto

+afad_parser

+ | where MessageType == 0 and TimeGenerated > ago(1d)

+ ```

+**Get all IoE alerts for the last 7 days**

+ ```kusto

+afad_parser

+ | where MessageType == 0 and TimeGenerated > ago(7d)

+ ```

+**Get all IoE alerts for the last 30 days**

+ ```kusto

+afad_parser

+ | where MessageType == 0 and TimeGenerated > ago(30d)

+ ```

+**Get all trailflow changes for the last 24 hours**

+ ```kusto

+afad_parser

+ | where MessageType == 1 and TimeGenerated > ago(1d)

+ ```

+**Get all trailflow changes for the last 7 days**

+ ```kusto

+afad_parser

+ | where MessageType == 1 and TimeGenerated > ago(7d)

+ ```

+**Get the number of alerts triggered by each IoA**

+ ```kusto

+afad_parser

+

+ | where MessageType == 2

+

+ | summarize AlertCount = count() by Codename

+ ```

+**Get all IoA alerts for the last 30 days**

+ ```kusto

+afad_parser

+ | where MessageType == 2 and TimeGenerated > ago(30d)

+ ```

+## Prerequisites

+To integrate with Tenable Identity Exposure make sure you have:

+- **Access to TenableIE Configuration**: Permissions to configure syslog alerting engine

+## Vendor installation instructions

+This data connector depends on [afad_parser](https://aka.ms/sentinel-TenableApp-afad-parser) based on a Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.

+1. Configure the Syslog server

+ You will first need a **linux Syslog** server that TenableIE will send logs to. Typically you can run **rsyslog** on **Ubuntu**. You can then configure this server as you wish, but it is recommended to be able to output TenableIE logs in a separate file.

+ Configure rsyslog to accept logs from your TenableIE IP address.:

+ ```shell

+ sudo -i

+

+ # Set TenableIE source IP address

+ export TENABLE_IE_IP={Enter your IP address}

+

+ # Create rsyslog configuration file

+ cat > /etc/rsyslog.d/80-tenable.conf << EOF

+ \$ModLoad imudp

+ \$UDPServerRun 514

+ \$ModLoad imtcp

+ \$InputTCPServerRun 514

+ \$AllowedSender TCP, 127.0.0.1, $TENABLE_IE_IP

+ \$AllowedSender UDP, 127.0.0.1, $TENABLE_IE_IP

+ \$template MsgTemplate,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %programname%[%procid%]:%msg%\n"

+ \$template remote-incoming-logs, "/var/log/%PROGRAMNAME%.log"

+ *.* ?remote-incoming-logs;MsgTemplate

+ EOF

+

+ # Restart rsyslog

+ systemctl restart rsyslog

+ ```

+2. Install and onboard the Microsoft agent for Linux

+ The OMS agent will receive the TenableIE syslog events and publish it in Microsoft Sentinel.

+3. Check agent logs on the Syslog server

+ ```shell

+ tail -f /var/opt/microsoft/omsagent/log/omsagent.log

+ ```

+4. Configure TenableIE to send logs to your Syslog server

+ On your **TenableIE** portal, go to *System*, *Configuration* and then *Syslog*.

+ From there you can create a new Syslog alert toward your Syslog server.

+ Once this is done, check that the logs are correctly gathered on your server in a separate file (to do this, you can use the *Test the configuration* button in the Syslog alert configuration in TenableIE).

+ If you used the Quickstart template, the Syslog server will by default listen on port 514 in UDP and 1514 in TCP, without TLS.

+5. Configure the custom logs

+Configure the agent to collect the logs.

+1. In Microsoft Sentinel, go to **Configuration** -> **Settings** -> **Workspace settings** -> **Custom logs**.

+2. Click **Add custom log**.

+3. Upload a sample TenableIE.log Syslog file from the **Linux** machine running the **Syslog** server and click **Next**

+4. Set the record delimiter to **New Line** if not already the case and click **Next**.

+5. Select **Linux** and enter the file path to the **Syslog** file, click **+** then **Next**. The default location of the file is `/var/log/TenableIE.log` if you have a Tenable version <3.1.0, you must also add this linux file location `/var/log/AlsidForAD.log`.

+6. Set the **Name** to *Tenable_IE_CL* (Azure automatically adds *_CL* at the end of the name, there must be only one, make sure the name is not *Tenable_IE_CL_CL*).

+7. Click **Next**, you will see a resume, then click **Create**.

+6. Enjoy!

+You should now be able to receive logs in the *Tenable_IE_CL* table, logs data can be parse using the **afad_parser()** function, used by all query samples, workbooks, and analytic templates.

+## Next steps

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/tenable.tenable-sentinel-integration?tab=Overview) in the Azure Marketplace.

+ Title: "Tenable Vulnerability Management (using Azure Functions) connector for Microsoft Sentinel"

+description: "Learn how to install the connector Tenable Vulnerability Management (using Azure Functions) to connect your data source to Microsoft Sentinel."

+# Tenable Vulnerability Management (using Azure Functions) connector for Microsoft Sentinel

+The TVM data connector provides the ability to ingest Asset and Vulnerability data into Microsoft Sentinel using TVM REST APIs. Refer to [API documentation](https://developer.tenable.com/reference) for more information. The connector provides the ability to get data which helps to examine potential security risks, get insight into your computing assets, diagnose configuration problems and more

+This is autogenerated content. For changes, contact the solution provider.

+## Connector attributes

+| Connector attribute | Description |

+| | |

+| **Application settings** | TenableAccessKey<br/>TenableSecretKey<br/>WorkspaceID<br/>WorkspaceKey<br/>logAnalyticsUri (optional) |

+| **Azure function app code** | https://aka.ms/sentinel-TenableVMAzureSentinelConnector-functionapp |

+| **Log Analytics table(s)** | Tenable_VM_Assets_CL<br/> Tenable_VM_Vuln_CL<br/> |

+| **Data collection rules support** | Not currently supported |

+| **Supported by** | [Tenable](https://www.tenable.com/support/technical-support) |

+## Query samples

+**Tenable VM Report - All Assets**

+ ```kusto

+Tenable_VM_Assets_CL

+

+ | sort by TimeGenerated desc

+ ```

+**Tenable VM Report - All Vulns**

+ ```kusto

+Tenable_VM_Vuln_CL

+

+ | sort by TimeGenerated desc

+ ```

+**Select unique vulnerabilities by a specific asset.**

+ ```kusto

+Tenable_VM_Vuln_CL

+

+ | where asset_fqdn_s has "one.one.one.one"

+

+ | summarize any(asset_fqdn_s, plugin_id_d, plugin_cve_s) by plugin_id_d

+ ```

+**Select all Azure assets.**

+ ```kusto

+Tenable_VM_Assets_CL

+

+ | where isnotempty(azure_resource_id_s) or isnotempty(azure_vm_id_g)

+ ```

+## Prerequisites

+To integrate with Tenable Vulnerability Management (using Azure Functions) make sure you have:

+- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).

+- **REST API Credentials/permissions**: Both a **TenableAccessKey** and a **TenableSecretKey** is required to access the Tenable REST API. [See the documentation to learn more about API](https://developer.tenable.com/reference#vulnerability-management). Check all [requirements and follow the instructions](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) for obtaining credentials.

+## Vendor installation instructions

+> [!NOTE]

+ > This connector uses Azure Durable Functions to connect to the TenableVM API to pull [assets](https://developer.tenable.com/reference#exports-assets-download-chunk) and [vulnerabilities](https://developer.tenable.com/reference#exports-vulns-request-export) at a regular interval into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.

+**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.

+> [!NOTE]

+ > This data connector depends on a [**TenableVM parser for vulnerabilities**](https://aka.ms/sentinel-TenableApp-TenableVMVulnerabilities-parser) and a [**TenableVM parser for assets**](https://aka.ms/sentinel-TenableApp-TenableVMAssets-parser) based on a Kusto Function to work as expected which is deployed with the Microsoft Sentinel Solution.

+**STEP 1 - Configuration steps for TenableVM**

+[Follow the instructions](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) to obtain the required API credentials.

+**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function App**

+Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).

+Option 1 - Azure Resource Manager (ARM) Template

+Use this method for automated deployment of the TenableVM Vulnerability Management Report data connector using an ARM Template.

+1. Click the **Deploy to Azure** button below.

+ [](https://aka.ms/sentinel-TenableVM-azuredeploy)

+2. Select the preferred **Subscription**, **Resource Group**, and **Location**.

+3. Enter the **TenableAccessKey** and **TenableSecretKey** and deploy.

+4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.

+5. Click **Purchase** to deploy.

+Option 2 - Manual Deployment of Azure Functions

+Use the following step-by-step instructions to deploy the TenableVM Vulnerability Management Report data connector manually with Azure Functions (Deployment via Visual Studio Code).

+**1. Deploy a Function App**

+You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.

+1. Download the [Azure Function App](https://aka.ms/sentinel-TenableVMAzureSentinelConnector-functionapp) file. Extract archive to your local development computer.

+2. Start VS Code. Choose File in the main menu and select Open Folder.

+3. Select the top level folder from extracted files.

+4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.

+If you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**

+If you're already signed in, go to the next step.

+5. Provide the following information at the prompts:

+ a. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.

+ b. **Select Subscription:** Choose the subscription to use.

+ c. Select **Create new Function App in Azure** (Don't choose the Advanced option)

+ d. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. TenableVMXXXXX).

+ e. **Select a runtime:** Choose Python 3.8.

+ f. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.

+6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.

+7. Go to Azure Portal for the Function App configuration.

+**2. Configure the Function App**

+1. In the Function App, select the Function App Name and select **Configuration**.

+2. In the **Application settings** tab, select **New application setting**.

+3. Add each of the following application settings individually, with their respective string values (case-sensitive):

+ - TenableAccessKey

+ - TenableSecretKey

+ - WorkspaceID

+ - WorkspaceKey

+ - logAnalyticsUri (optional)

+ - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<WorkspaceID>.ods.opinsights.azure.us`.

+1. Once all application settings have been entered, click **Save**.

+## Next steps

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/tenable.tenable-sentinel-integration?tab=Overview) in the Azure Marketplace.

+ Title: "Transmit Security Connector (using Azure Functions) connector for Microsoft Sentinel"

+description: "Learn how to install the connector Transmit Security Connector (using Azure Functions) to connect your data source to Microsoft Sentinel."

+# Transmit Security Connector (using Azure Functions) connector for Microsoft Sentinel

+The Transmit Security data connector provides the capability to ingest common Transmit Security API events into Microsoft Sentinel through the REST API. [Refer to API documentation for more information](https://developer.transmitsecurity.com/). The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.

+This is autogenerated content. For changes, contact the solution provider.

+## Connector attributes

+| Connector attribute | Description |

+| | |

+| **Application settings** | TransmitSecurityClientID<br/>TransmitSecurityClientSecret<br/>TransmitSecurityAdminActivityEndpoint<br/>TransmitSecurityUserActivityEndpoint<br/>TransmitSecurityTokenEndpoint<br/>WorkspaceID<br/>WorkspaceKey<br/>logAnalyticsUri (optional) |

+| **Azure function app code** | https://aka.ms/sentinel-TransmitSecurityAPI-functionapp |

+| **Log Analytics table(s)** | TransmitSecurityAdminActivity_CL<br/> TransmitSecurityUserActivity_CL<br/> |

+| **Data collection rules support** | Not currently supported |

+| **Supported by** | [Transmit Security](https://transmitsecurity.com/support) |

+## Query samples

+****

+ ```kusto

+TransmitSecurityAdminActivity_CL

+

+ | sort by TimeGenerated desc

+ ```

+****

+ ```kusto

+TransmitSecurityUserActivity_CL

+

+ | sort by TimeGenerated desc

+ ```

+## Prerequisites

+To integrate with Transmit Security Connector (using Azure Functions) make sure you have:

+- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](/azure/azure-functions/).

+- **REST API Client ID**: **TransmitSecurityClientID** is required. See the documentation to learn more about API on the `https://developer.transmitsecurity.com/`.

+- **REST API Client Secret**: **TransmitSecurityClientSecret** is required. See the documentation to learn more about API on the `https://developer.transmitsecurity.com/`.

+## Vendor installation instructions

+> [!NOTE]

+ > This connector uses Azure Functions to connect to the Transmit Security API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.

+**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.

+**STEP 1 - Configuration steps for the Transmit Security API**

+Follow the instructions to obtain the credentials.

+1. Log in to the Transmit Security Portal.

+2. Configure a [management app](https://developer.transmitsecurity.com/guides/user/management_apps/). Give the app a suitable name, for example, MyAzureSentinelCollector.

+3. Save credentials of the new user for using in the data connector.

+**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**

+Before deploying the Transmit Security data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).

+Option 1 - Azure Resource Manager (ARM) Template

+Use this method for automated deployment of the Transmit Security Audit data connector using an ARM Tempate.

+1. Click the **Deploy to Azure** button below.

+ [](https://aka.ms/sentinel-TransmitSecurityAPI-azuredeploy) [](https://aka.ms/sentinel-TransmitSecurityAPI-azuredeploy-gov)

+2. Select the preferred **Subscription**, **Resource Group** and **Location**.

+

+ Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.

+3. Enter the **TransmitSecurityClientID**, **TransmitSecurityClientSecret**, **TransmitSecurityUserActivityEndpoint**, **TransmitSecurityAdminActivityEndpoint**, **TransmitSecurityTokenEndpoint** and deploy.

+4. Mark the checkbox labeled **I agree to the terms and conditions stated above**.

+5. Click **Purchase** to deploy.

+Option 2 - Manual Deployment of Azure Functions

+Use the following step-by-step instructions to deploy the TransmitSecurity Reports data connector manually with Azure Functions (Deployment via Visual Studio Code).

+**1. Deploy a Function App**

+You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.

+1. Download the [Azure Function App](https://aka.ms/sentinel-TransmitSecurityAPI-functionapp) file. Extract archive to your local development computer.

+2. Start VS Code. Choose File in the main menu and select Open Folder.

+3. Select the top level folder from extracted files.

+4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.

+If you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**

+If you're already signed in, go to the next step.

+5. Provide the following information at the prompts:

+ a. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.

+ b. **Select Subscription:** Choose the subscription to use.

+ c. Select **Create new Function App in Azure** (Don't choose the Advanced option)

+ d. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions.

+ e. **Select a runtime:** Choose Python 3.8.

+ f. Select a location for new resources. For better performance and lower costs, choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.

+6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.

+7. Go to Azure portal for the Function App configuration.

+**2. Configure the Function App**

+ 1. In the Function App, select the Function App Name and select **Configuration**.

+ 2. Select **Environment variables**.

+ 3. Add each of the following application settings individually, with their respective string values (case-sensitive):

+ - TransmitSecurityClientID

+ - TransmitSecurityClientSecret

+ - TransmitSecurityAdminActivityEndpoint

+ - TransmitSecurityUserActivityEndpoint

+ - TransmitSecurityTokenEndpoint

+ - WorkspaceID

+ - WorkspaceKey

+ - logAnalyticsUri (optional)

+ - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.

+ 4. Once all application settings have been entered, click **Apply**.

+## Next steps

+For more information, go to the [related solution](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/transmitsecurity.microsoft-sentinel-solution-transmitsecurity?tab=Overview) in the Azure Marketplace.

+| Number of tasks | 40 tasks | None |

+- **Allows source agnostic content**: Covering built-in and custom content by using ASIM automatically expands to any source that supports ASIM, even if the source was added after the content was created. For example, process event analytics support any source that a customer might use to bring in the data, including Microsoft Defender for Endpoint, Windows Events, and Sysmon. We're ready to add [Sysmon for Linux](https://x.com/markrussinovich/status/1283039153920368651?lang=en) and WEF when it has been released.

+The following sections explain how to enable central DNS resolution for Azure Storage blobs by using [Azure Policy](../../governance/policy/overview.md), assuming you already have the private DNS zone `privatelink.blob.core.windows.net` set up in the central virtual network. The same principles apply to Azure Storage files and other Azure services that support Private Link.

+In addition to the private DNS zone, you need to create a custom Azure Policy definition. For more information, see [Tutorial: Create a custom policy definition](../../governance/policy/tutorials/create-custom-policy-definition.md). This definition automatically creates the required DNS record in the central private DNS zone when you create a private endpoint.

+The central private DNS zone and Azure Spring Apps service instance might be hosted in the different subscriptions. In this case, remember to assign the [Private DNS Zone Contributor role](../../dns/dns-protect-private-zones-recordsets.md#the-private-dns-zone-contributor-role) in the subscription and resource group where the private DNS zones are hosted to the managed identity created by the `DeployIfNotExists` policy assignment that's responsible to create and manage the private endpoint DNS record in the private DNS zone. For more information, see the [Configure the managed identity](../../governance/policy/how-to/remediate-resources.md?tabs=azure-portal#configure-the-managed-identity) section of [Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md?tabs=azure-portal).

+* Analyzing real-time sentiment on streaming X data.

+* A CSV file with some X data in it. You can download a sample file from [GitHub](https://github.com/Azure/azure-stream-analytics/blob/master/Sample%20Data/sampleinput.csv), or you can create your own file. In a real-world scenario, you would get the data directly from a X data stream.

+- [X](https://x.com/hashtag/SQLDW)

+- [X](https://x.com/hashtag/SQLDW)

+- [X](https://x.com/hashtag/SQLDW)