-| Country | Number |

-|:--|:-|

-| Croatia | +385 15507766 |

-| Ghana | +233 308250245 |

-| Sri Lanka | +94 117750440 |

-| Ukraine | +380 443332393 |

-Make sure the server that you're using for Azure Multi-Factor Authentication meets the following requirements:

-| Software |<li>Windows Server 2019</li><li>Windows Server 2016</li><li>Windows Server 2012 R2</li><li>Windows Server 2012</li><li>Windows Server 2008/R2 (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Windows 10</li><li>Windows 8.1, all editions</li><li>Windows 8, all editions</li><li>Windows 7, all editions (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Microsoft .NET 4.0 Framework</li><li>IIS 7.0 or greater if installing the user portal or web service SDK</li> |

-description: In this quickstart, you learn how a console application can get an access token and call an API protected by Microsoft identity platform, using the app's own identity

-zone_pivot_groups: console-app-quickstart

-#Customer intent: As an app developer, I want to learn how my console app can get an access token and call an API that's protected by the Microsoft identity platform by using the client credentials flow.

-# Quickstart: Acquire a token and call the Microsoft Graph API by using a console app's identity

-> > [Quickstart: Node.js console app that calls an API](console-app-quickstart.md?pivots=devlang-nodejs)

-> > [Quickstart: Java daemon that calls a protected API](console-app-quickstart.md?pivots=devlang-java)

-> > [Quickstart: .NET Core console that calls an API](console-app-quickstart.md?pivots=devlang-dotnet-core)

-> > [Quickstart: Python console app that calls an API](console-app-quickstart.md?pivots=devlang-python)

-description: In this quickstart, learn how a desktop application can get an access token and call an API protected by the Microsoft identity platform.

-zone_pivot_groups: desktop-app-quickstart

-#Customer intent: As an application developer, I want to learn how my desktop application can get an access token and call an API that's protected by the Microsoft identity platform.

-# Quickstart: Acquire a token and call Microsoft Graph API from a desktop application

-> > [Quickstart: Node.js Electron desktop app with user sign-in](desktop-app-quickstart.md?pivots=devlang-nodejs-electron)

-> > [Quickstart: Universal Windows Platform (UWP) desktop app with user sign-in](desktop-app-quickstart.md?pivots=devlang-uwp)

-> > [Quickstart: Windows Presentation Foundation (WPF) desktop app that signs in users and calls a web API](desktop-app-quickstart.md?pivots=devlang-windows-desktop)

-> > [Quickstart: Android app with user sign-in](mobile-app-quickstart.md?pivots=devlang-android)

-> > [Quickstart: iOS or macOS app that signs in users and calls a web API](mobile-app-quickstart.md?pivots=devlang-ios)

-description: In this quickstart, learn how a mobile app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.

-zone_pivot_groups: mobile-app-quickstart

-#Customer intent: As an application developer, I want to learn how to sign in users and call Microsoft Graph from my mobile application.

-# Quickstart: Sign in users and call the Microsoft Graph API from a mobile application

-> > [Quickstart: Android app with user sign-in](mobile-app-quickstart.md?pivots=devlang-android)

-> > [Quickstart:Protect an ASP.NET Core web API](web-api-quickstart.md?pivots=devlang-aspnet-core)

-> > [Quickstart: ASP.NET Core web app that signs in users and calls a web API](web-app-quickstart.md?pivots=devlang-aspnet-core)

-> > [Quickstart: ASP.NET Core web app with user sign-in](web-app-quickstart.md?pivots=devlang-aspnet-core)

-> > [Quickstart: ASP.NET web app that signs in users](web-app-quickstart.md?pivots=devlang-aspnet)

-> > [Quickstart: Call a protected ASP.NET web API](web-api-quickstart.md?pivots=devlang-aspnet)

-> > [Quickstart: iOS or macOS app that signs in users and calls a web API](mobile-app-quickstart.md?pivots=devlang-ios)

-> > [Quickstart: Java daemon that calls a protected API](console-app-quickstart.md?pivots=devlang-java)

-> > [Quickstart: Java web app with user sign-in](web-app-quickstart.md?pivots=devlang-java)

-> > [Quickstart: Angular single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-angular)

-> > [Quickstart: React single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-react)

-> > [Quickstart: JavaScript single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-javascript)

-> > [Quickstart: .NET Core console that calls an API](console-app-quickstart.md?pivots=devlang-dotnet-core)

-> > [Quickstart: Node.js console app that calls an API](console-app-quickstart.md?pivots=devlang-nodejs)

-> > [Quickstart: Node.js Electron desktop app with user sign-in](desktop-app-quickstart.md?pivots=devlang-nodejs-electron)

-> > [Quickstart: Node.js web app that signs in users with MSAL Node](web-app-quickstart.md?pivots=devlang-nodejs-msal)

-> > [Quickstart: Python console app that calls an API](console-app-quickstart.md?pivots=devlang-python)

-> > [Quickstart: Python web app with user sign-in](web-app-quickstart.md?pivots=devlang-python)

-> > [Quickstart: Universal Windows Platform (UWP) desktop app with user sign-in](desktop-app-quickstart.md?pivots=devlang-uwp)

-> > [Quickstart: Windows Presentation Foundation (WPF) desktop app that signs in users and calls a web API](desktop-app-quickstart.md?pivots=devlang-windows-desktop)

-[Quickstart: Single-page application](./single-page-app-quickstart.md?pivots=devlang-javascript)

-[Quickstart: Use ASP.NET Core to add sign-in with Microsoft to a web app](web-app-quickstart.md?pivots=devlang-aspnet-core)

-[Quickstart: Use ASP.NET to add sign-in with Microsoft to a web app](web-app-quickstart.md?pivots=devlang-aspnet)

-[Quickstart: Use Java to add sign-in with Microsoft to a web app](web-app-quickstart.md?pivots=devlang-java)

-[Quickstart: Use Node.js to add sign-in with Microsoft to a web app](web-app-quickstart.md?pivots=devlang-nodejs-msal)

-[Quickstart: Use Python to add sign-in with Microsoft to a web app](web-app-quickstart.md?pivots=devlang-python)

-description: In this quickstart, learn how a JavaScript single-page application (SPA) can sign in users of personal accounts, work accounts, and school accounts by using the authorization code flow with Proof Key for Code Exchange (PKCE).

-zone_pivot_groups: single-page-app-quickstart

-#Customer intent: As an app developer, I want to learn how to get access tokens and refresh tokens by using the Microsoft identity platform so that my single-page app can sign in users of personal accounts, work accounts, and school accounts.

-# Quickstart: Sign in users in single-page apps (SPA) via the authorization code flow with Proof Key for Code Exchange (PKCE)

-> > [Quickstart: Angular single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-angular)

-> > [Quickstart: React single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-react)

-> > [Quickstart: JavaScript single-page app with user sign-in](single-page-app-quickstart.md?pivots=devlang-javascript)

-> > [Quickstart:Protect an ASP.NET Core web API](web-api-quickstart.md?pivots=devlang-aspnet-core)

-> > [Quickstart: Call a protected ASP.NET web API](web-api-quickstart.md?pivots=devlang-aspnet)

-description: In this quickstart, you download and modify a code sample that demonstrates how to protect a web API by using the Microsoft identity platform for authorization.

-zone_pivot_groups: web-api-quickstart

-#Customer intent: As an app developer, I want to learn how to get access tokens and refresh tokens by using the Microsoft identity platform so that my web app can sign in users of personal accounts, work accounts, and school accounts.

-# Quickstart: Protect a web API with the Microsoft identity platform

-> > [Quickstart: ASP.NET Core web app with user sign-in](web-app-quickstart.md?pivots=devlang-aspnet-core)

-> > [Quickstart: ASP.NET web app that signs in users](web-app-quickstart.md?pivots=devlang-aspnet)

-> > [Quickstart: Java web app with user sign-in](web-app-quickstart.md?pivots=devlang-java)

-> > [Quickstart: Node.js web app that signs in users with MSAL Node](web-app-quickstart.md?pivots=devlang-nodejs-msal)

-> > [Quickstart: Python web app with user sign-in](web-app-quickstart.md?pivots=devlang-python)

-description: In this quickstart, learn how a web app can sign in users of personal accounts, work accounts, and school accounts by using the authorization code flow.

-zone_pivot_groups: web-app-quickstart

-#Customer intent: As an app developer, I want to learn how to get access tokens and refresh tokens by using the Microsoft identity platform so that my web app can sign in users of personal accounts, work accounts, and school accounts.

-# Quickstart: Add sign-in with Microsoft to a web app

-The invitee should check with their ISP or spam filter to ensure that the following address is allowed: Invites@microsoft.com

-When you try to login to your tenant, you might see this error message: "Your network administrator has restricted what organizations can be accessed. Contact your IT department to unblock access." This error is related to tenant restriction settings. To resolve this issue, ask your IT team to follow the instructions in [this article](/azure/active-directory/manage-apps/tenant-restrictions).

-With entitlement management, you can define a policy that allows users from organizations you specify to be able to self-request an access package. That policy includes whether approval is required, whether access reviews are required, and an expiration date for the access. In most cases, you will want to require approval, in order to have appropriate oversight over which users are brought into your directory. If approval is required, then for major external organization partners, you might consider inviting one or more users from the external organization to your directory, designating them as sponsors, and configuring that sponsors are approvers - since they're likely to know which external users from their organization need access. Once you've configured the access package, obtain the access package's request link so you can send that link to your contact person (sponsor) at the external organization. That contact can share with other users in their external organization, and they can use this link to request the access package. Users from that organization who have already been invited into your directory can also use that link.

-You can also use entitlement management for bringing in users from organizations that do not have their own Azure AD directory. You can configure a federated identity provider for their domain, or use email-based authentication. You can also bring in users from social identity providers, including those with Microsoft accounts.

-1. You create an access package in your directory that includes a policy [For users not in your directory](entitlement-management-access-package-create.md#allow-users-not-in-your-directory-to-request-the-access-package) and specifies the connected organizations that can request, the approver and lifecycle settings. If you select in the policy the option of specific connected organizations or the option of all connected organizations, then only users from those organizations that have previously been configured can request. If you select in the policy the option of all users, then any user can request, including those which are not already part of your directory and not part of any connected organization.

-1. You check [the hidden setting on the access package](entitlement-management-access-package-edit.md#change-the-hidden-setting) to ensure the access package is hidden. If it is not hidden, then any user allowed by the policy settings in that access package can browse for the access package in the My Access portal for your tenant.

-1. An external user (**Requestor A** in this example) uses the My Access portal link to [request access](entitlement-management-request-access.md) to the access package. The My access portal will require that the user sign in as part of their connected organization. How the user signs in depends on the authentication type of the directory or domain that's defined in the connected organization and in the external users settings.

- If you are an administrator or catalog owner, you can view the list of catalogs currently enabled for external users in the Azure portal list of catalogs, by changing the filter setting for **Enabled for external users** to **Yes**. If any of those catalogs shown in that filtered view have a non-zero number of access packages, those access packages may have a policy [for users not in your directory](entitlement-management-access-package-request-policy.md#for-users-not-in-your-directory) that allow external users to request.

- 

-1. Look for an email or a message from the project or business manager you're working with. The email should include a link to the access package you'll need access to. The link starts with `myaccess`, includes a directory hint, and ends with an access package ID. (For US Government, the domain may be `https://myaccess.microsoft.us` instead.)

- A pane will open to the right with the request history for the access package.

-* 03/18/2021 - Manager email is now synchronized instead of ID for all new users. For any existing users that were provisioned with a manager as an ID, you can do a restart through [Microsoft Graph](/graph/api/synchronization-synchronizationjob-restart?preserve-view=true&tabs=http&view=graph-rest-beta) with scope "full" to ensure that the email is provisioned. This change only impacts the GSuite provisioning job and not the older provisioning job beginning with Goov2OutDelta. Note, the manager email is provisioned when the user is first created or when the manager changes. The manager email isn't provisioned if the manager changes their email address.

-This tutorial describes the steps you need to perform in both Tanium SSO and Azure Active Directory (Azure AD) to configure automatic user provisioning. When configured, Azure AD automatically provisions and de-provisions users and groups to [Tanium SSO](https://www.tanium.com/) using the Azure AD Provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../app-provisioning/user-provisioning.md).

-## Step 2. Configure Tanium SSO to support provisioning with Azure AD

-Contact Tanium SSO support to configure Tanium SSO to support provisioning with Azure AD.

-Add Tanium SSO from the Azure AD application gallery to start managing provisioning to Tanium SSO. If you have previously setup Tanium SSO for SSO you can use the same application. However it's recommended that you create a separate app when testing out the integration initially. Learn more about adding an application from the gallery [here](../manage-apps/add-application-portal.md).

-This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and/or groups in TestApp based on user and/or group assignments in Azure AD.

-1. Under the **Admin Credentials** section, input your Tanium SSO Tenant URL and Secret Token. Click **Test Connection** to ensure Azure AD can connect to Tanium SSO. If the connection fails, ensure your Tanium SSO account has Admin permissions and try again.

- 

-|  | [Secure Personally Identifiable Information | AffinitiQuest](https://affinitiquest.io/) |

-|  | [Avanade Entra Verified ID Consulting Services](https://appsource.microsoft.com/marketplace/consulting-services/avanadeinc.ava_entra_verified_id_fy23?exp=ubp8) |

-|  | [Credivera: Digital Identity Solutions | Verifiable Credentials](https://www.credivera.com/) |

-|  | [Decentralized Identity | Condatis](https://condatis.com/technology/decentralized-identity/) |

-|  | [Digital Identity - Connect with DXC](https://dxc.com/us/en/services/security/digital-identity) |

-|  | [CTC's SELMID offering](https://ctc-insight.com/selmid) |

-|  | [Connect with Kocho. See Verified Identity in Action](https://kocho.co.uk/contact-us/)<br/>[See Verified Identity in Action](https://kocho.co.uk/verified-id-in-action/) |

-|  | [Microsoft Entra Verified ID - Oxford Computer Group](https://oxfordcomputergroup.com/microsoft-entra-verified-id-overview/) |

-|  | [Verified ID - Predica Group](https://www.predicagroup.com/en/verified-id/) |

-|  | [Sphereon supports customers on Microsoft's Entra Verified ID](https://sphereon.com/sphereon-supports-microsofts-entra-verified-id/) |

-|  | [Microsoft Entra Verified ID - UNIFY Solutions](https://unifysolutions.net/entra/verified-id/) |

-|  | [Microsoft Entra Verified ID - WhoIAM](https://www.whoiam.ai/product/microsoft-entra-verified-id/#:~:text=Verifiable%20credentials%20are%20identity%20attestations%2C%20such%20as%20proof,obtain%20and%20manage%20their%20verified%20credentials.%20Let%E2%80%99s%20Talk) |

-Learn more about [Kubernetes service - NodeSubnetIsFull (The AKS node pool subnet is full)](../aks/use-multiple-node-pools.md#add-a-node-pool-with-a-unique-subnet).

-### Migration guide and REST API v3.0

-* Follow our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md) to learn how to use the v3.0 version in your applications and workflows.

-Custom classification models are only available in the [v3.1 API](v3-migration-guide.md) starting with API version ```2023-02-28-preview```. [Document Intelligence Studio](https://formrecognizer.appliedai.azure.com/studio) provides a no-code user interface to interactively train a custom classifier.

-Custom neural models are available in the [v3.0 and v3.1 APIs](v3-migration-guide.md).

-* [Document Intelligence v3.0 migration guide](v3-migration-guide.md): This guide shows you how to use the v3.0 version in your applications and workflows.

-The General document v3.0 model combines powerful Optical Character Recognition (OCR) capabilities with deep learning models to extract key-value pairs, tables, and selection marks from documents. General document is only available with the v3.0 API. For more information on using the v3.0 API, see our [migration guide](v3-migration-guide.md).

-### Key normalization (common name)

-When the service analyzes documents with variations in key names like ```Social Security Number```, ```Social Security Nbr```, ```SSN```, the output normalizes the key variations to a single common name, ```SocialSecurityNumber```. This normalization simplifies downstream processing for documents where you no longer need to account for variations in the key name.

-* Follow our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md) to learn how to use the v3.0 version in your applications and workflows.

-* Follow our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md) to learn how to use the v3.0 version in your applications and workflows.

-| &bullet; English (en) | United States (us), Australia (-au), Canada (-ca), United Kingdom (-uk), India (-in)|

-| &bullet; Spanish (es) |Spain (es)|

-| &bullet; German (de) | Germany (de)|

-| &bullet; French (fr) | France (fr) |

-| &bullet; Italian (it) | Italy (it)|

-| &bullet; Portuguese (pt) | Portugal (pt), Brazil (br)|

-| &bullet; Dutch (nl) | Netherlands (nl)|

-| &bullet; Czech (cs) | Czechoslovakia (cz)|

-| &bullet; Danish (da) | Denmark (dk)|

-| &bullet; Estonian (et) | Estonia (ee)|

-| &bullet; Finnish (fi) | Finland (fl)|

-| &bullet; Croation (hr) | Bosnia and Herzegovina (ba), Croatia (hr), Serbia (rs)|

-| &bullet; Hungarian (hu) | Hungary (hu)|

-| &bullet; Icelandic (is) | Iceland (is)|

-| &bullet; Japanese (ja) | Japan (ja)|

-| &bullet; Korean (ko) | Korea (kr)|

-| &bullet; Lithuanian (lt) | Lithuania (lt)|

-| &bullet; Latvian (lv) | Latvia (lv)|

-| &bullet; Malay (ms) | Malasia (ms)|

-| &bullet; Norwegian (nb) | Norway (no)|

-| &bullet; Polish (pl) | Poland (pl)|

-| &bullet; Romanian (ro) | Romania (ro)|

-| &bullet; Slovak (sk) | Slovakia (sv)|

-| &bullet; Slovenian (sl) | Slovenia (sl)|

-| &bullet; Albanian (sq) | Albania (al)|

-| &bullet; Swedish (sv) | Sweden (se)|

-| &bullet; ARS | United States (us) |

-| &bullet; AUD | Australia (au) |

-| &bullet; BRL | United States (us) |

-| &bullet; CAD | Canada (ca) |

-| &bullet; CLP | United States (us) |

-| &bullet; CNY | United States (us) |

-| &bullet; COP | United States (us) |

-| &bullet; CRC | United States (us) |

-| &bullet; CZK | United States (us) |

-| &bullet; DKK | United States (us) |

-| &bullet; EUR | United States (us) |

-| &bullet; GBP | United Kingdom (uk) |

-| &bullet; HUF | United States (us) |

-| &bullet; IDR | United States (us) |

-| &bullet; INR | United States (us) |

-| &bullet; ISK | United States (us) |

-| &bullet; JPY | Japan (jp) |

-| &bullet; KRW | United States (us) |

-| &bullet; NOK | United States (us) |

-| &bullet; PAB | United States (us) |

-| &bullet; PEN | United States (us) |

-| &bullet; PLN | United States (us) |

-| &bullet; RON | United States (us) |

-| &bullet; RSD | United States (us) |

-| &bullet; SEK | United States (us) |

-| &bullet; TWD | United States (us) |

-| &bullet; USD | United States (us) |

-* Follow our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md) to learn how to use the v3.0 version in your applications and workflows.

-Learn how to use Document Intelligence v3.0 in your applications by following our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md)

- You can learn how to use Document Intelligence v3.0 in your applications by following our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md)

-### Migration guide and REST API v3.0

-* Follow our [**Document Intelligence v3.0 migration guide**](v3-migration-guide.md) to learn how to use the v3.0 version in your applications and workflows.

-> * You can refer to the [API migration guide](v3-migration-guide.md) for detailed information about migrating from v2.1 to v3.0.

-> * You can refer to the [API migration guide](v3-migration-guide.md) for detailed information about migrating from v2.1 to v3.0.

-* Follow our [**Document Intelligence v3.0 migration guide**](../v3-migration-guide.md) to learn the differences from the previous version of the REST API.

-The studio supports Document Intelligence v3.0 models and v3.0 model training. Previously trained v2.1 models with labeled data are supported, but not v2.1 model training. Refer to the [REST API migration guide](v3-migration-guide.md) for detailed information about migrating from v2.1 to v3.0.

-> * You can refer to the [API migration guide](v3-migration-guide.md) for detailed information about migrating from v2.1 to v3.0.

-description: This how-to guide specifies the differences between Document Intelligence API v2.1 and v3.0. You also learn how to move to the newer version of the API.

-monikerRange: '<=doc-intel-3.1.0'

-# Document Intelligence v3.0 migration

-> [!IMPORTANT]

->

-> Document Intelligence REST API v3.0 introduces breaking changes in the REST API request and analyze response JSON.

-## Migrating from a v3.0 preview API version

-Preview APIs are periodically deprecated. If you're using a preview API version, update your application to target the GA API version. To migrate from the 2021-09-30-preview, 2022-01-30-preview or the 2022-06-30-preview API versions to the `2022-08-31` (GA) API version using the SDK, update to the [current version of the language specific SDK](sdk-overview.md).

-> [!IMPORTANT]

->

-> Preview API versions 2021-09-30-preview, 2022-01-30-preview and 2022-06-30-preview are being retired July 31st 2023. All analyze requests that use these API versions will fail. Custom neural models trained with any of these API versions will no longer be usable once the API versions are deprecated. All custom neural models trained with preview API versions will need to be retrained with the GA API version.

-The `2022-08-31` (GA) API has a few updates from the preview API versions:

-* Field rename: boundingBox to polygon to support non quadrilateral polygon regions.

-* Field deleted: entities removed from the result of the general document model.

-* Field rename: documentLanguage.languageCode to locale

-* Added support for HEIF format

-* Added paragraph detection, with role classification for layout and general document models.

-* Added support for parsed address fields.

-## Migrating from v2.1

-Document Intelligence v3.0 introduces several new features and capabilities:

-* [Document Intelligence REST API](quickstarts/get-started-sdks-rest-api.md?view=doc-intel-3.0.0&preserve-view=true) has been redesigned for better usability.

-* [**General document (v3.0)**](concept-general-document.md) model is a new API that extracts text, tables, structure, and key-value pairs, from forms and documents.

-* [**Custom neural model (v3.0)**](concept-custom-neural.md) is a new custom model type to extract fields from structured and unstructured documents.

-* [**Receipt (v3.0)**](concept-receipt.md) model supports single-page hotel receipt processing.

-* [**ID document (v3.0)**](concept-id-document.md) model supports endorsements, restrictions, and vehicle classification extraction from US driver's licenses.

-* [**Custom model API (v3.0)**](concept-custom.md) supports signature detection for custom template models.

-* [**Custom model API (v3.0)**](overview.md) supports analysis of all the newly added prebuilt models. For a complete list of prebuilt models, see the [overview](overview.md) page.

-In this article, we show you the differences between Document Intelligence v2.1 and v3.0 and demonstrate how to move to the newer version of the API.

-> [!CAUTION]

->

-> * REST API **2022-08-31** release includes a breaking change in the REST API analyze response JSON.

-> * The `boundingBox` property is renamed to `polygon` in each instance.

-## Changes to the REST API endpoints

- The v3.0 REST API combines the analysis operations for layout analysis, prebuilt models, and custom models into a single pair of operations by assigning **`documentModels`** and **`modelId`** to the layout analysis (prebuilt-layout) and prebuilt models.

-### POST request

-```http

-https://{your-form-recognizer-endpoint}/formrecognizer/documentModels/{modelId}?api-version=2022-08-31

-```

-### GET request

-```http

-https://{your-form-recognizer-endpoint}/formrecognizer/documentModels/{modelId}/AnalyzeResult/{resultId}?api-version=2022-08-31

-```

-### Analyze operation

-* The request payload and call pattern remain unchanged.

-* The Analyze operation specifies the input document and content-specific configurations, it returns the analyze result URL via the Operation-Location header in the response.

-* Poll this Analyze Result URL, via a GET request to check the status of the analyze operation (minimum recommended interval between requests is 1 second).

-* Upon success, status is set to succeeded and [analyzeResult](#changes-to-analyze-result) is returned in the response body. If errors are encountered, status is set to `failed`, and an error is returned.

-| Model | v2.1 | v3.0 |

-|:--| :--| :--|

-| **Request URL prefix**| **https://{your-form-recognizer-endpoint}/formrecognizer/v2.1** | **https://{your-form-recognizer-endpoint}/formrecognizer** |

-| **General document**|N/A|`/documentModels/prebuilt-document:analyze` |

-| **Layout**| /layout/analyze |`/documentModels/prebuilt-layout:analyze`|

-|**Custom**| /custom/{modelId}/analyze |`/documentModels/{modelId}:analyze` |

-| **Invoice** | /prebuilt/invoice/analyze | `/documentModels/prebuilt-invoice:analyze` |

-| **Receipt** | /prebuilt/receipt/analyze | `/documentModels/prebuilt-receipt:analyze` |

-| **ID document** | /prebuilt/idDocument/analyze | `/documentModels/prebuilt-idDocument:analyze` |

-|**Business card**| /prebuilt/businessCard/analyze| `/documentModels/prebuilt-businessCard:analyze`|

-|**W-2**| /prebuilt/w-2/analyze| `/documentModels/prebuilt-w-2:analyze`|

-### Analyze request body

-The content to be analyzed is provided via the request body. Either the URL or base64 encoded data can be user to construct the request.

- To specify a publicly accessible web URL, set  Content-Type to **application/json** and send the following JSON body:

- ```json

- {

- "urlSource": "{urlPath}"

- }

- ```

-Base 64 encoding is also supported in Document Intelligence v3.0:

-```json

-{

- "base64Source": "{base64EncodedContent}"

-}

-```

-### Additionally supported parameters

-Parameters that continue to be supported:

-* `pages` : Analyze only a specific subset of pages in the document. List of page numbers indexed from the number `1` to analyze. Ex. "1-3,5,7-9"

-* `locale` : Locale hint for text recognition and document analysis. Value may contain only the language code (ex. `en`, `fr`) or BCP 47 language tag (ex. "en-US").

-Parameters no longer supported:

-* includeTextDetails

-The new response format is more compact and the full output is always returned.

-## Changes to analyze result

-Analyze response has been refactored to the following top-level results to support multi-page elements.

-* `pages`

-* `tables`

-* `keyValuePairs`

-* `entities`

-* `styles`

-* `documents`

-> [!NOTE]

->

-> The analyzeResult response changes includes a number of changes like moving up from a property of pages to a top lever property within analyzeResult.

-```json

-{

-// Basic analyze result metadata

-"apiVersion": "2022-08-31", // REST API version used

-"modelId": "prebuilt-invoice", // ModelId used

-"stringIndexType": "textElements", // Character unit used for string offsets and lengths:

-// textElements, unicodeCodePoint, utf16CodeUnit // Concatenated content in global reading order across pages.

-// Words are generally delimited by space, except CJK (Chinese, Japanese, Korean) characters.

-// Lines and selection marks are generally delimited by newline character.

-// Selection marks are represented in Markdown emoji syntax (:selected:, :unselected:).

-"content": "CONTOSO LTD.\nINVOICE\nContoso Headquarters...", "pages": [ // List of pages analyzed

-{

-// Basic page metadata

-"pageNumber": 1, // 1-indexed page number

-"angle": 0, // Orientation of content in clockwise direction (degree)

-"width": 0, // Page width

-"height": 0, // Page height

-"unit": "pixel", // Unit for width, height, and polygon coordinates

-"spans": [ // Parts of top-level content covered by page

-{

-"offset": 0, // Offset in content

-"length": 7 // Length in content

-}

-], // List of words in page

-"words": [

-{

-"text": "CONTOSO", // Equivalent to $.content.Substring(span.offset, span.length)

-"boundingBox": [ ... ], // Position in page

-"confidence": 0.99, // Extraction confidence

-"span": { ... } // Part of top-level content covered by word

-}, ...

-], // List of selectionMarks in page

-"selectionMarks": [

-{

-"state": "selected", // Selection state: selected, unselected

-"boundingBox": [ ... ], // Position in page

-"confidence": 0.95, // Extraction confidence

-"span": { ... } // Part of top-level content covered by selection mark

-}, ...

-], // List of lines in page

-"lines": [

-{

-"content": "CONTOSO LTD.", // Concatenated content of line (may contain both words and selectionMarks)

-"boundingBox": [ ... ], // Position in page

-"spans": [ ... ], // Parts of top-level content covered by line

-}, ...

-]

-}, ...

-], // List of extracted tables

-"tables": [

-{

-"rowCount": 1, // Number of rows in table

-"columnCount": 1, // Number of columns in table

-"boundingRegions": [ // Polygons or Bounding boxes potentially across pages covered by table

-{

-"pageNumber": 1, // 1-indexed page number

-"polygon": [ ... ], // Previously Bounding box, renamed to polygon in the 2022-08-31 API

-}

-],

-"spans": [ ... ], // Parts of top-level content covered by table // List of cells in table

-"cells": [

-{

-"kind": "stub", // Cell kind: content (default), rowHeader, columnHeader, stub, description

-"rowIndex": 0, // 0-indexed row position of cell

-"columnIndex": 0, // 0-indexed column position of cell

-"rowSpan": 1, // Number of rows spanned by cell (default=1)

-"columnSpan": 1, // Number of columns spanned by cell (default=1)

-"content": "SALESPERSON", // Concatenated content of cell

-"boundingRegions": [ ... ], // Bounding regions covered by cell

-"spans": [ ... ] // Parts of top-level content covered by cell

-}, ...

-]

-}, ...

-], // List of extracted key-value pairs

-"keyValuePairs": [

-{

-"key": { // Extracted key

-"content": "INVOICE:", // Key content

-"boundingRegions": [ ... ], // Key bounding regions

-"spans": [ ... ] // Key spans

-},

-"value": { // Extracted value corresponding to key, if any

-"content": "INV-100", // Value content

-"boundingRegions": [ ... ], // Value bounding regions

-"spans": [ ... ] // Value spans

-},

-"confidence": 0.95 // Extraction confidence

-}, ...

-],

-"styles": [

-{

-"isHandwritten": true, // Is content in this style handwritten?

-"spans": [ ... ], // Spans covered by this style

-"confidence": 0.95 // Detection confidence

-}, ...

-], // List of extracted documents

-"documents": [

-{

-"docType": "prebuilt-invoice", // Classified document type (model dependent)

-"boundingRegions": [ ... ], // Document bounding regions

-"spans": [ ... ], // Document spans

-"confidence": 0.99, // Document splitting/classification confidence // List of extracted fields

-"fields": {

-"VendorName": { // Field name (docType dependent)

-"type": "string", // Field value type: string, number, array, object, ...

-"valueString": "CONTOSO LTD.",// Normalized field value

-"content": "CONTOSO LTD.", // Raw extracted field content

-"boundingRegions": [ ... ], // Field bounding regions

-"spans": [ ... ], // Field spans

-"confidence": 0.99 // Extraction confidence

-}, ...

-}

-}, ...

-]

-}

-```

-## Build or train model

-The model object has three updates in the new API

-* ```modelId``` is now a property that can be set on a model for a human readable name.

-* ```modelName``` has been renamed to ```description```

-* ```buildMode``` is a new property with values of ```template``` for custom form models or ```neural``` for custom neural models.

-The ```build``` operation is invoked to train a model. The request payload and call pattern remain unchanged. The build operation specifies the model and training dataset, it returns the result via the Operation-Location header in the response. Poll this model operation URL, via a GET request to check the status of the build operation (minimum recommended interval between requests is 1 second). Unlike v2.1, this URL isn't the resource location of the model. Instead, the model URL can be constructed from the given modelId, also retrieved from the resourceLocation property in the response. Upon success, status is set to ```succeeded``` and result contains the custom model info. If errors are encountered, status is set to ```failed```, and the error is returned.

-The following code is a sample build request using a SAS token. Note the trailing slash when setting the prefix or folder path.

-```json

-POST https://{your-form-recognizer-endpoint}/formrecognizer/documentModels:build?api-version=2022-08-31

-{

- "modelId": {modelId},

- "description": "Sample model",

- "buildMode": "template",

- "azureBlobSource": {

- "containerUrl": "https://{storageAccount}.blob.core.windows.net/{containerName}?{sasToken}",

- "prefix": "{folderName/}"

- }

-}

-```

-## Changes to compose model

-Model compose is now limited to single level of nesting. Composed models are now consistent with custom models with the addition of ```modelId``` and ```description``` properties.

-```json

-POST https://{your-form-recognizer-endpoint}/formrecognizer/documentModels:compose?api-version=2022-08-31

-{

- "modelId": "{composedModelId}",

- "description": "{composedModelDescription}",

- "componentModels": [

- { "modelId": "{modelId1}" },

- { "modelId": "{modelId2}" },

- ]

-}

-

-```

-## Changes to copy model

-The call pattern for copy model remains unchanged:

-* Authorize the copy operation with the target resource calling ```authorizeCopy```. Now a POST request.

-* Submit the authorization to the source resource to copy the model calling ```copyTo```

-* Poll the returned operation to validate the operation completed successfully

-The only changes to the copy model function are:

-* HTTP action on the ```authorizeCopy``` is now a POST request.

-* The authorization payload contains all the information needed to submit the copy request.

-***Authorize the copy***

-```json

-POST https://{targetHost}/formrecognizer/documentModels:authorizeCopy?api-version=2022-08-31

-{

- "modelId": "{targetModelId}",

- "description": "{targetModelDescription}",

-}

-```

-Use the response body from the authorize action to construct the request for the copy.

-```json

-POST https://{sourceHost}/formrecognizer/documentModels/{sourceModelId}:copyTo?api-version=2022-08-31

-{

- "targetResourceId": "{targetResourceId}",

- "targetResourceRegion": "{targetResourceRegion}",

- "targetModelId": "{targetModelId}",

- "targetModelLocation": "https://{targetHost}/formrecognizer/documentModels/{targetModelId}",

- "accessToken": "{accessToken}",

- "expirationDateTime": "2021-08-02T03:56:11Z"

-}

-```

-## Changes to list models

-List models have been extended to now return prebuilt and custom models. All prebuilt model names start with ```prebuilt-```. Only models with a status of succeeded are returned. To list models that either failed or are in progress, see [List Operations](https://westus.dev.cognitive.microsoft.com/docs/services/form-recognizer-api-v3-0-preview-1/operations/GetModels).

-***Sample list models request***

-```json

-GET https://{your-form-recognizer-endpoint}/formrecognizer/documentModels?api-version=2022-08-31

-```

-## Change to get model

-As get model now includes prebuilt models, the get operation returns a ```docTypes``` dictionary. Each document type description includes name, optional description, field schema, and optional field confidence. The field schema describes the list of fields potentially returned with the document type.

-```json

-GET https://{your-form-recognizer-endpoint}/formrecognizer/documentModels/{modelId}?api-version=2022-08-31

-```

-## New get info operation

-The ```info``` operation on the service returns the custom model count and custom model limit.

-```json

-GET https://{your-form-recognizer-endpoint}/formrecognizer/info? api-version=2022-08-31

-```

-***Sample response***

-```json

-{

- "customDocumentModels": {

- "count": 5,

- "limit": 100

- }

-}

-```

-## Next steps

-In this migration guide, you've learned how to upgrade your existing Document Intelligence application to use the v3.0 APIs.

-* [Review the new REST API](https://westus.dev.cognitive.microsoft.com/docs/services/form-recognizer-api-2023-07-31/operations/AnalyzeDocument)

-* [What is Document Intelligence?](overview.md)

-* [Document Intelligence quickstart](quickstarts/get-started-sdks-rest-api.md)

-> With the 2022-08-31 API general availability (GA) release, the associated preview APIs are being deprecated. If you are using the 2021-09-30-preview, the 2022-01-30-preview or he 2022-06-30-preview API versions, please update your applications to target the 2022-08-31 API version. There are a few minor changes involved, for more information, _see_ the [migration guide](v3-migration-guide.md).

-* Document Intelligence APIs are now more modular, with support for optional features, you can now customize the output to specifically include the features you need. Learn more about the [optional parameters](v3-migration-guide.md).

-* Prebuilt invoice locale expansion

-* Prebuilt receipt updates

-* [**Common name key normalization**](concept-general-document.md#key-normalization-common-name) capabilities are added to the General Document model to improve processing forms with variations in key names.

- * Most Azure AI servives offer a free tier to try it out.

-* Explore [Azure AI services](./what-are-ai-services.md) and choose a service to get started.

-> Viewing quota and deploying models requires the **Cognitive Services Usages Reader** role. This role provides the minimal access necessary to view quota usage across an Azure subscription.

-* [Multiple node pools](./use-multiple-node-pools.md),

-[aks-multiple-node-pools]: use-multiple-node-pools.md

-For more information about how to use multiple node pools in AKS, see [Create and manage multiple node pools for a cluster in AKS][use-multiple-node-pools].

-[use-multiple-node-pools]: use-multiple-node-pools.md

-While the [Cloud Native Computing Foundation][cloud-native-computing-foundation] (CNCF) owns and maintains most of the code running in AKS, Microsoft takes responsibility for building the open-source packages that we deploy on AKS. With that responsibility, it includes having complete ownership of the build, scan, sign, validate, and hotfix process and control over the binaries in container images. By us having responsibility for building the open-source packages deployed on AKS, it enables us to both establish a software supply chain over the binary, and patch the software as needed.  

-For AKS clusters on the [OS auto upgrade][aks-node-image-upgrade] channel, the unattended upgrade process is disabled, and the OS nodes will receive security updates through the weekly node image upgrade.

-AKS patches CVE's that has a *vendor fix* every week. CVE's without a fix are waiting on a *vendor fix* before it can be remediated. The fixed container images are cached in the next corresponding Virtual Hard Disk (VHD) build, which also contains the updated Ubuntu/Azure Linux/Windows patched CVE's. As long as you're running the updated VHD, you shouldn't be running any container image CVE's with a vendor fix that is over 30 days old.

-For the OS-based vulnerabilities in the VHD, AKS uses **Unattended Update** by default, so any security updates should be applied to the existing VHD's daily. If **Unattended Update** is disabled, then it's a recommended best practice that you apply a Node Image update on a regular cadence to ensure the latest OS and Image security updates are applied.

-[upgrade-node-pool-in-aks]: use-multiple-node-pools.md#upgrade-a-node-pool

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-You might get unexpected scaling and upgrading errors if you modify or delete Azure-created tags and other resource properties in the node resource group. AKS allows you to create and modify custom tags created by end users, and you can add those tags when [creating a node pool](use-multiple-node-pools.md#specify-a-taint-label-or-tag-for-a-node-pool). You might want to create or modify custom tags, for example, to assign a business unit or cost center. Another option is to create Azure Policies with a scope on the managed resource group.

-FIPS-enabled nodes are now supported on Linux-based node pools. For more information, see [Add a FIPS-enabled node pool](use-multiple-node-pools.md#add-a-fips-enabled-node-pool).

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[multi-node-pools]: ./use-multiple-node-pools.md

-#CustomerIntent: As a developer, I want deploy a simple CRUD Quarkus app on AKS so that can start iterating it into a proper LOB app.

-[unique-subnet]: use-multiple-node-pools.md#add-a-node-pool-with-a-unique-subnet

-* Azure Load Balancer is available in two SKUs: *Basic* and *Standard*. The *Standard* SKU is used by default when you create an AKS cluster. The *Standard* SKU gives you access to added functionality, such as a larger backend pool, [multiple node pools](use-multiple-node-pools.md), [Availability Zones](availability-zones.md), and is [secure by default][azure-lb]. It's the recommended load balancer SKU for AKS. For more information on the *Basic* and *Standard* SKUs, see [Azure Load Balancer SKU comparison][azure-lb-comparison].

-The Azure Load Balancer will be configured with a new public IP that will front the new service. Since the Azure Load Balancer can have multiple frontend IPs, each new service that you deploy will get a new dedicated frontend IP to be uniquely accessed.

-For more detailed information about your service using the following command.

-AKS nodes can be referenced in the load balancer backend pools by either their IP configuration (VMSS based membership) or by their IP address only. Utilizing the IP address based backend pool membership provides higher efficiencies when updating services and provisioning load balancers, especially at high node counts. Provisioning new clusters with IP based backend pools and converting existing clusters is now supported. When combined with NAT Gateway or user-defined routing egress types, provisioning of new nodes and services will be more performant.

-> This operation will cause a temporary disruption to incoming service traffic in the cluster. The impact time will increase with larger clusters that have many nodes.

-> Outbound rule changes made directly on the Load Balancer resource will be removed whenever the cluster is reconciled, such as when it's stopped, started, upgraded, or scaled.

-A public IP created by AKS is an AKS-managed resource, meaning the lifecycle of that public IP is intended to be managed by AKS and requires no user action directly on the public IP resource. Alternatively, you can assign your own custom public IP or public IP prefix at cluster creation time. Your custom IPs can also be updated on an existing cluster's load balancer properties.

-* Custom public IP addresses must be created and owned by the user. Managed public IP addresses created by AKS can't be reused as a "bring your own custom IP" as it can cause management conflicts.

-* Make sure you meet the [pre-requisites and constraints](../virtual-network/ip-services/public-ip-address-prefix.md#limitations) necessary to configure outbound IPs or outbound IP prefixes.

-The following examples show how the number of outbound ports and IP addresses are affected by the values you set:

-* If the default values are used and the cluster has 48 nodes, each node will have 1024 ports available.

-* If the default values are used and the cluster scales from 48 to 52 nodes, each node will be updated from 1024 ports available to 512 ports available.

-When setting *IdleTimeoutInMinutes* to a different value than the default of 30 minutes, consider how long your workloads will need an outbound connection. Also consider that the default timeout value for a *Standard* SKU load balancer used outside of AKS is 4 minutes. An *IdleTimeoutInMinutes* value that more accurately reflects your specific AKS workload can help decrease SNAT exhaustion caused by tying up connections no longer being used.

-This example updates the rule to allow inbound external traffic only from the `MY_EXTERNAL_IP_RANGE` range. If you replace `MY_EXTERNAL_IP_RANGE` with the internal subnet IP address, traffic is restricted to only cluster internal IPs. If traffic is restricted to cluster internal IPs, clients outside your Kubernetes cluster won't be able to access the load balancer.

-By default, a service of type `LoadBalancer` [in Kubernetes](https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer) and in AKS won't persist the client's IP address on the connection to the pod. The source IP on the packet that's delivered to the pod will be the private IP of the node. To maintain the clientΓÇÖs IP address, you must set `service.spec.externalTrafficPolicy` to `local` in the service definition. The following manifest shows an example.

-| `service.beta.kubernetes.io/azure-dns-label-name` | Name of the DNS label on Public IPs | Specify the DNS label name for the **public** service. If it's set to an empty string, the DNS entry in the Public IP won't be used.

-* Atomic requests (one request per connection) generally aren't a good design choice. Such anti-patterns limit scale, reduce performance, and decrease reliability. Instead, reuse HTTP/S connections to reduce the numbers of connections and associated SNAT ports. The application scale will increase and performance will improve because of reduced handshakes, overhead, and cryptographic operation cost when using TLS.

-* Never silently abandon a TCP flow and rely on TCP timers to clean up flow. If you don't let TCP explicitly close the connection, state remains allocated at intermediate systems and endpoints and makes SNAT ports unavailable for other connections. This pattern can trigger application failures and SNAT exhaustion.

-* Don't change OS-level TCP close related timer values without expert knowledge of impact. While the TCP stack will recover, your application performance can be negatively affected when the endpoints of a connection have mismatched expectations. Wishing to change timers is usually a sign of an underlying design problem. Review following recommendations.

- * Specify a number up to 100 to allow the AKS cluster to create that many *Standard* SKU public IPs in the same resource group as the AKS cluster. This resource group is usually named with *MC_* at the beginning. AKS assigns the public IP to the *Standard* SKU load balancer. By default, one public IP will automatically be created in the same resource group as the AKS cluster, if no public IP, public IP prefix, or number of IPs is specified. You also must allow public addresses and avoid creating any Azure policies that ban IP creation.

-* A public IP created by AKS can't be reused as a custom bring your own public IP address. All custom IP addresses must be created and managed by the user.

-[use-multiple-node-pools]: use-multiple-node-pools.md

-AKS releases a new node image weekly and every new cluster, new node pool, or upgrade cluster will always receive the latest image that can make it hard to maintain your environments consistent and to have repeatable environments.

-The snapshot is an Azure resource that will contain the configuration information from the source node pool such as the node image version, kubernetes version, OS type, and OS SKU. You can then reference this snapshot resource and the respective values of its configuration to create any new node pool or cluster based off of it.

-In order to take a snapshot from a node pool first you'll need the node pool resource ID, which you can get from the command below:

-Now, to take a snapshot from the previous node pool you'll use the `az aks snapshot` CLI command.

-First you'll need the resource ID from the snapshot that was previously created, which you can get from the command below:

-Now, we can use the command below to add a new node pool based off of this snapshot.

-First you'll need the resource ID from the snapshot that was previously created, which you can get from the command below:

-> Your node pool image version will be the same contained in the snapshot and will remain the same throughout every scale operation. However, if this node pool is upgraded or a node image upgrade is performed without providing a snapshot-id the node image will be upgraded to latest.

-When you create a cluster from a snapshot, the cluster original system pool will be created from the snapshot configuration.

-First you'll need the resource ID from the snapshot that was previously created, which you can get from the command below:

-[use-multiple-node-pools]: use-multiple-node-pools.md

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[use-multiple-node-pools]: use-multiple-node-pools.md

-When you deploy a pod to an AKS cluster, Kubernetes only schedules pods on nodes whose taint aligns with the toleration. Taints and tolerations work together to ensure that pods are not scheduled onto inappropriate nodes. One or more taints are applied to a node, marking the the node so that it does not accept any pods that do not tolerate the taints.

-With a taint applied to nodes in the node pool, you'll define a toleration in the pod specification that allows scheduling on the nodes. The following example defines the `sku: gpu` and `effect: NoSchedule` to tolerate the taint applied to the node pool in the previous step:

-For more information about how to use multiple node pools in AKS, see [Create and manage multiple node pools for a cluster in AKS][use-multiple-node-pools].

-#### Default clusters that use VM scale sets

-1. Two additional nodes are created: *node3* and *node4*.

-#### Clusters without VM scale set support

-1. An additional node is created: *node3*.

-In essence *node1* becomes *node3*, and *node2* becomes the new *node1*.

-When you scale a node pool in AKS, taints and tolerations do not carry over by design.

-Let's look at an example of nodes with a high amount of memory. These nodes prioritize pods that request a high amount of memory. To ensure the resources don't sit idle, they also allow other pods to run. The following example command adds a node pool with the label *hardware=highmem* to the *myAKSCluster* in the *myResourceGroup*. All nodes in that node pool will have this label.

-[use-multiple-node-pools]: use-multiple-node-pools.md

-[taint-node-pool]: use-multiple-node-pools.md#specify-a-taint-label-or-tag-for-a-node-pool

-> Kubernetes may deprecate APIs (like in version 1.16) that your workloads rely on. When bringing new versions into production, consider using [multiple node pools on separate versions](use-multiple-node-pools.md) and upgrade individual pools one at a time to progressively roll the update across a cluster. If running multiple clusters, upgrade one cluster at a time to progressively monitor for impact or changes.

-Although kubenet doesn't require you to set up the virtual networks before deploying the cluster, there are disadvantages to waiting, such as:

-You can complete most operations in AKS using the Azure management tools or through the Kubernetes API server. AKS nodes are only available on a private network and aren't connected to the public internet. To connect to nodes and provide maintenance and support, route your connections through a bastion host, or jump box. Verify this host lives in a separate, securely-peered management virtual network to the AKS cluster virtual network.

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[use-multiple-node-pools]: use-multiple-node-pools.md

-[use-multiple-node-pools]: use-multiple-node-pools.md

-Note important changes to make, before you upgrade to any of the available minor versions per below.

-AKS allows you to create a cluster without specifying the exact patch version. When you create a cluster without designating a patch, the cluster runs the minor version's latest GA patch. For example, if you create a cluster with **`1.21`**, your cluster will run **`1.21.7`**, which is the latest GA patch version of *1.21*.

-* The latest GA minor version released in AKS (which we'll refer to as *N*).

-Platform support policy is a reduced support plan for certain unsupported kubernetes versions. During platform support, customers will only receive support from Microsoft for AKS/Azure platform related issues. Any issues related to Kubernetes functionality and components will not be supported.

-Platform support policy applies to clusters in an n-3 version (where n is the latest supported AKS GA minor version), before the cluster drops to n-4. For example, kubernetes v1.25 will be considered platform support when v1.28 is the latest GA version. However, during the v1.29 GA release, v1.25 will then be auto-upgraded to v1.26.

-AKS relies on the releases and patches from [kubernetes](https://kubernetes.io/releases/), which is an Open Source project that only supports a sliding window of 3 minor versions. AKS can only guarantee [full support](#kubernetes-version-support-policy) while those versions are being serviced upstream. Since there's no more patches being produced upstream, AKS can either leave those versions unpatched or fork. Due to this limitation, platform support will not support anything from relying on kubernetes upstream.

-| Storage, Networking related issues| Supported | Supported with the exception of bug fixes and retired components |

- > The above table is subject to change and outlines common support scenarios. Any scenarios related to Kubernetes functionality and components will not be supported for N-3. For further support, see [Support and troubleshooting for AKS](./aks-support-help.md).

-* In general, AKS doesn't broadly communicate the release of new patch versions. However, AKS constantly monitors and validates available CVE patches to support them in AKS in a timely manner. If a critical patch is found or user action is required, AKS will notify you to upgrade to the newly available patch.

-The AKS team publishes announcements with planned dates of the new Kubernetes versions in our documentation, our [GitHub](https://github.com/Azure/AKS/releases), and in emails to subscription administrators who own clusters that are going to fall out of support. AKS also uses [Azure Advisor](../advisor/advisor-overview.md) to alert you inside the Azure portal if you're out of support and inform you of deprecated APIs that will affect your application or development process.

-The control plane must be within a window of versions from all node pools. For details on upgrading the control plane or node pools, visit documentation on [upgrading node pools](use-multiple-node-pools.md#upgrade-a-cluster-control-plane-with-multiple-node-pools).

-When performing an upgrade from an _unsupported version_ that skips two or more minor versions, the upgrade is performed without any guarantee of functionality and is excluded from the service-level agreements and limited warranty. If your version is significantly out of date, it's recommended to re-create the cluster.

-No. You won't be allowed to add node pools of the deprecated version to your cluster. You can add node pools of a new version, but this may require you to update the control plane first.

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[azurelinux-node-pool]: use-multiple-node-pools.md#add-an-azure-linux-node-pool

-[ubuntu-to-azurelinux]: use-multiple-node-pools.md#migrate-ubuntu-nodes-to-azure-linux

-description: Learn how to create and manage multiple node pools for a cluster in Azure Kubernetes Service (AKS)

-# Create and manage multiple node pools for a cluster in Azure Kubernetes Service (AKS)

-In Azure Kubernetes Service (AKS), nodes of the same configuration are grouped together into *node pools*. These node pools contain the underlying VMs that run your applications. The initial number of nodes and their size (SKU) is defined when you create an AKS cluster, which creates a [system node pool][use-system-pool]. To support applications that have different compute or storage demands, you can create more *user node pools*. System node pools serve the primary purpose of hosting critical system pods such as CoreDNS and `konnectivity`. User node pools serve the primary purpose of hosting your application pods. However, application pods can be scheduled on system node pools if you wish to only have one pool in your AKS cluster. User node pools are where you place your application-specific pods. For example, use more user node pools to provide GPUs for compute-intensive applications, or access to high-performance SSD storage.

-> [!NOTE]

-> This feature enables higher control over how to create and manage multiple node pools. As a result, separate commands are required for create/update/delete. Previously cluster operations through `az aks create` or `az aks update` used the managedCluster API and were the only options to change your control plane and a single node pool. This feature exposes a separate operation set for agent pools through the agentPool API and require use of the `az aks nodepool` command set to execute operations on an individual node pool.

-This article shows you how to create and manage one or more node pools in an AKS cluster.

-## Before you begin

-* You need the Azure CLI version 2.2.0 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].

-* Review [Storage options for applications in Azure Kubernetes Service][aks-storage-concepts] to plan your storage configuration.

-## Limitations

-The following limitations apply when you create and manage AKS clusters that support multiple node pools:

-* See [Quotas, virtual machine size restrictions, and region availability in Azure Kubernetes Service (AKS)][quotas-skus-regions].

-* You can delete system node pools, provided you have another system node pool to take its place in the AKS cluster.

-* System pools must contain at least one node, and user node pools may contain zero or more nodes.

-* The AKS cluster must use the Standard SKU load balancer to use multiple node pools, the feature isn't supported with Basic SKU load balancers.

-* The AKS cluster must use Virtual Machine Scale Sets for the nodes.

-* You can't change the VM size of a node pool after you create it.

-* The name of a node pool may only contain lowercase alphanumeric characters and must begin with a lowercase letter. For Linux node pools the length must be between 1 and 12 characters, for Windows node pools the length must be between 1 and 6 characters.

-* All node pools must reside in the same virtual network.

-* When creating multiple node pools at cluster create time, all Kubernetes versions used by node pools must match the version set for the control plane. This can be updated after the cluster has been provisioned by using per node pool operations.

-## Create an AKS cluster

-> [!IMPORTANT]

-> If you run a single system node pool for your AKS cluster in a production environment, we recommend you use at least three nodes for the node pool. If one node goes down, you lose control plane resources and redundancy is compromised. You can mitigate this risk by having more control plane nodes.

-To get started, create an AKS cluster with a single node pool. The following example uses the [az group create][az-group-create] command to create a resource group named *myResourceGroup* in the *eastus* region. An AKS cluster named *myAKSCluster* is then created using the [`az aks create`][az-aks-create] command.

-> [!NOTE]

-> The *Basic* load balancer SKU is **not supported** when using multiple node pools. By default, AKS clusters are created with the *Standard* load balancer SKU from the Azure CLI and Azure portal.

-```azurecli-interactive

-# Create a resource group in East US

-az group create --name myResourceGroup --location eastus

-# Create a basic single-node pool AKS cluster

-az aks create \

- --resource-group myResourceGroup \

- --name myAKSCluster \

- --vm-set-type VirtualMachineScaleSets \

- --node-count 2 \

- --generate-ssh-keys \

- --load-balancer-sku standard

-```

-It takes a few minutes to create the cluster.

-> [!NOTE]

-> To ensure your cluster operates reliably, you should run at least 2 (two) nodes in the default node pool, as essential system services are running across this node pool.

-When the cluster is ready, use the [`az aks get-credentials`][az-aks-get-credentials] command to get the cluster credentials for use with `kubectl`:

-```azurecli-interactive

-az aks get-credentials --resource-group myResourceGroup --name myAKSCluster

-```

-## Add a node pool

-The cluster created in the previous step has a single node pool. Let's add a second node pool using the [`az aks nodepool add`][az-aks-nodepool-add] command. The following example creates a node pool named *mynodepool* that runs *3* nodes:

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name mynodepool \

- --node-count 3

-```

-> [!NOTE]

-> The name of a node pool must start with a lowercase letter and can only contain alphanumeric characters. For Linux node pools the length must be between 1 and 12 characters, for Windows node pools the length must be between 1 and 6 characters.

-To see the status of your node pools, use the [`az aks node pool list`][az-aks-nodepool-list] command and specify your resource group and cluster name:

-```azurecli-interactive

-az aks nodepool list --resource-group myResourceGroup --cluster-name myAKSCluster

-```

-The following example output shows that *mynodepool* has been successfully created with three nodes in the node pool. When the AKS cluster was created in the previous step, a default *nodepool1* was created with a node count of *2*.

-```output

-[

- {

- ...

- "count": 3,

- ...

- "name": "mynodepool",

- "orchestratorVersion": "1.15.7",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- },

- {

- ...

- "count": 2,

- ...

- "name": "nodepool1",

- "orchestratorVersion": "1.15.7",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- }

-]

-```

-> [!TIP]

-> If no *VmSize* is specified when you add a node pool, the default size is *Standard_D2s_v3* for Windows node pools and *Standard_DS2_v2* for Linux node pools. If no *OrchestratorVersion* is specified, it defaults to the same version as the control plane.

-### Add an ARM64 node pool

-The ARM64 processor provides low power compute for your Kubernetes workloads. To create an ARM64 node pool, you need to choose a [Dpsv5][arm-sku-vm1], [Dplsv5][arm-sku-vm2] or [Epsv5][arm-sku-vm3] series Virtual Machine.

-#### Limitations

-* ARM64 node pools aren't supported on Defender-enabled clusters

-* FIPS-enabled node pools aren't supported with ARM64 SKUs

-Use `az aks nodepool add` command to add an ARM64 node pool.

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name armpool \

- --node-count 3 \

- --node-vm-size Standard_D2pds_v5

-```

-### Add an Azure Linux node pool

-The Azure Linux container host for AKS is an open-source Linux distribution available as an AKS container host. It provides high reliability, security, and consistency. It only includes the minimal set of packages needed for running container workloads, which improve boot times and overall performance.

-You can add an Azure Linux node pool into your existing cluster using the `az aks nodepool add` command and specifying `--os-sku AzureLinux`.

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name azurelinuxpool \

- --os-sku AzureLinux

-```

-### Migrate Ubuntu nodes to Azure Linux

-Use the following instructions to migrate your Ubuntu nodes to Azure Linux nodes.

-1. Add an Azure Linux node pool into your existing cluster using the `az aks nodepool add` command and specifying `--os-sku AzureLinux`.

-> [!NOTE]

-> When adding a new Azure Linux node pool, you need to add at least one as `--mode System`. Otherwise, AKS won't allow you to delete your existing Ubuntu node pool.

-2. [Cordon the existing Ubuntu nodes][cordon-and-drain].

-3. [Drain the existing Ubuntu nodes][drain-nodes].

-4. Remove the existing Ubuntu nodes using the `az aks delete` command.

-```azurecli-interactive

-az aks nodepool delete \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name myNodePool

-```

-### Add a node pool with a unique subnet

-A workload may require splitting a cluster's nodes into separate pools for logical isolation. This isolation can be supported with separate subnets dedicated to each node pool in the cluster. This can address requirements such as having non-contiguous virtual network address space to split across node pools.

-> [!NOTE]

-> Make sure to use Azure CLI version `2.35.0` or later.

-#### Limitations

-* All subnets assigned to node pools must belong to the same virtual network.

-* System pods must have access to all nodes/pods in the cluster to provide critical functionality such as DNS resolution and tunneling kubectl logs/exec/port-forward proxy.

-* If you expand your VNET after creating the cluster, you must update your cluster (perform any managed cluster operations, but node pool operations don't count) before adding a subnet outside the original CIDR block. While AKS errors-out on the agent pool add, the `aks-preview` Azure CLI extension (version 0.5.66+) now supports running `az aks update -g <resourceGroup> -n <clusterName>` without any optional arguments. This command performs an update operation without making any changes, which can recover a cluster stuck in a failed state.

-* In clusters with Kubernetes version < 1.23.3, kube-proxy will SNAT traffic from new subnets, which can cause Azure Network Policy to drop the packets.

-* Windows nodes will SNAT traffic to the new subnets until the node pool is reimaged.

-* Internal load balancers default to one of the node pool subnets (usually the first subnet of the node pool at cluster creation). To override this behavior, you can [specify the load balancer's subnet explicitly using an annotation][internal-lb-different-subnet].

-To create a node pool with a dedicated subnet, pass the subnet resource ID as another parameter when creating a node pool.

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name mynodepool \

- --node-count 3 \

- --vnet-subnet-id <YOUR_SUBNET_RESOURCE_ID>

-```

-## Upgrade a node pool

-> [!NOTE]

-> Upgrade and scale operations on a cluster or node pool cannot occur simultaneously, if attempted an error is returned. Instead, each operation type must complete on the target resource prior to the next request on that same resource. Read more about this on our [troubleshooting guide](./troubleshooting.md#im-receiving-errors-when-trying-to-upgrade-or-scale-that-state-my-cluster-is-being-upgraded-or-has-failed-upgrade).

-The commands in this section explain how to upgrade a single specific node pool. The relationship between upgrading the Kubernetes version of the control plane and the node pool are explained in the [Upgrade a cluster control plan with multiple node pools](#upgrade-a-cluster-control-plane-with-multiple-node-pools) section.

-> [!NOTE]

-> The node pool OS image version is tied to the Kubernetes version of the cluster. You only get OS image upgrades, following a cluster upgrade.

-Since there are two node pools in this example, we must use [`az aks nodepool upgrade`][az-aks-nodepool-upgrade] to upgrade a node pool. To see the available upgrades use [`az aks get-upgrades`][az-aks-get-upgrades]

-```azurecli-interactive

-az aks get-upgrades --resource-group myResourceGroup --name myAKSCluster

-```

-Let's upgrade the *mynodepool*. Use the [`az aks nodepool upgrade`][az-aks-nodepool-upgrade] command to upgrade the node pool, as shown in the following example:

-```azurecli-interactive

-az aks nodepool upgrade \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name mynodepool \

- --kubernetes-version KUBERNETES_VERSION \

- --no-wait

-```

-List the status of your node pools again using the [`az aks node pool list`][az-aks-nodepool-list] command. The following example shows that *mynodepool* is in the *Upgrading* state to *KUBERNETES_VERSION*:

-```azurecli

-az aks nodepool list -g myResourceGroup --cluster-name myAKSCluster

-```

-```output

-[

- {

- ...

- "count": 3,

- ...

- "name": "mynodepool",

- "orchestratorVersion": "KUBERNETES_VERSION",

- ...

- "provisioningState": "Upgrading",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- },

- {

- ...

- "count": 2,

- ...

- "name": "nodepool1",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Succeeded",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- }

-]

-```

-It takes a few minutes to upgrade the nodes to the specified version.

-As a best practice, you should upgrade all node pools in an AKS cluster to the same Kubernetes version. The default behavior of `az aks upgrade` is to upgrade all node pools together with the control plane to achieve this alignment. The ability to upgrade individual node pools lets you perform a rolling upgrade and schedule pods between node pools to maintain application uptime within the above constraints mentioned.

-## Upgrade a cluster control plane with multiple node pools

-> [!NOTE]

-> Kubernetes uses the standard [Semantic Versioning](https://semver.org/) versioning scheme. The version number is expressed as *x.y.z*, where *x* is the major version, *y* is the minor version, and *z* is the patch version. For example, in version *1.12.6*, 1 is the major version, 12 is the minor version, and 6 is the patch version. The Kubernetes version of the control plane and the initial node pool are set during cluster creation. Other node pools have their Kubernetes version set when they are added to the cluster. The Kubernetes versions may differ between node pools as well as between a node pool and the control plane.

-An AKS cluster has two cluster resource objects with Kubernetes versions associated.

-1. A cluster control plane Kubernetes version.

-2. A node pool with a Kubernetes version.

-A control plane maps to one or many node pools. The behavior of an upgrade operation depends on which Azure CLI command is used.

-Upgrading an AKS control plane requires using `az aks upgrade`. This command upgrades the control plane version and all node pools in the cluster.

-Issuing the `az aks upgrade` command with the `--control-plane-only` flag upgrades only the cluster control plane. None of the associated node pools in the cluster are changed.

-Upgrading individual node pools requires using `az aks nodepool upgrade`. This command upgrades only the target node pool with the specified Kubernetes version

-### Validation rules for upgrades

-Kubernetes upgrades for a cluster's control plane and node pools are validated using the following sets of rules.

-* Rules for valid versions to upgrade node pools:

- * The node pool version must have the same *major* version as the control plane.

- * The node pool *minor* version must be within two *minor* versions of the control plane version.

- * The node pool version can't be greater than the control `major.minor.patch` version.

-* Rules for submitting an upgrade operation:

- * You can't downgrade the control plane or a node pool Kubernetes version.

- * If a node pool Kubernetes version isn't specified, behavior depends on the client being used. Declaration in Resource Manager templates falls back to the existing version defined for the node pool if used, if none is set the control plane version is used to fall back on.

- * You can either upgrade or scale a control plane or a node pool at a given time, you can't submit multiple operations on a single control plane or node pool resource simultaneously.

-## Scale a node pool manually

-As your application workload demands change, you may need to scale the number of nodes in a node pool. The number of nodes can be scaled up or down.

-<!--If you scale down, nodes are carefully [cordoned and drained][kubernetes-drain] to minimize disruption to running applications.-->

-To scale the number of nodes in a node pool, use the [`az aks node pool scale`][az-aks-nodepool-scale] command. The following example scales the number of nodes in *mynodepool* to *5*:

-```azurecli-interactive

-az aks nodepool scale \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name mynodepool \

- --node-count 5 \

- --no-wait

-```

-List the status of your node pools again using the [`az aks node pool list`][az-aks-nodepool-list] command. The following example shows that *mynodepool* is in the *Scaling* state with a new count of *5* nodes:

-```azurecli-interactive

-az aks nodepool list -g myResourceGroup --cluster-name myAKSCluster

-```

-```output

-[

- {

- ...

- "count": 5,

- ...

- "name": "mynodepool",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Scaling",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- },

- {

- ...

- "count": 2,

- ...

- "name": "nodepool1",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Succeeded",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- }

-]

-```

-It takes a few minutes for the scale operation to complete.

-## Scale a specific node pool automatically by enabling the cluster autoscaler

-AKS offers a separate feature to automatically scale node pools with a feature called the [cluster autoscaler](cluster-autoscaler.md). This feature can be enabled per node pool with unique minimum and maximum scale counts per node pool. Learn how to [use the cluster autoscaler per node pool](cluster-autoscaler.md#use-the-cluster-autoscaler-with-multiple-node-pools-enabled).

-## Delete a node pool

-If you no longer need a pool, you can delete it and remove the underlying VM nodes. To delete a node pool, use the [`az aks node pool delete`][az-aks-nodepool-delete] command and specify the node pool name. The following example deletes the *mynodepool* created in the previous steps:

-> [!CAUTION]

-> When you delete a node pool, AKS doesn't perform cordon and drain, and there are no recovery options for data loss that may occur when you delete a node pool. If pods can't be scheduled on other node pools, those applications become unavailable. Make sure you don't delete a node pool when in-use applications don't have data backups or the ability to run on other node pools in your cluster. To minimize the disruption of rescheduling pods currently running on the node pool you are going to delete, perform a cordon and drain on all nodes in the node pool before deleting. For more information, see [cordon and drain node pools][cordon-and-drain].

-```azurecli-interactive

-az aks nodepool delete -g myResourceGroup --cluster-name myAKSCluster --name mynodepool --no-wait

-```

-The following example output from the [`az aks node pool list`][az-aks-nodepool-list] command shows that *mynodepool* is in the *Deleting* state:

-```azurecli-interactive

-az aks nodepool list -g myResourceGroup --cluster-name myAKSCluster

-```

-```output

-[

- {

- ...

- "count": 5,

- ...

- "name": "mynodepool",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Deleting",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- },

- {

- ...

- "count": 2,

- ...

- "name": "nodepool1",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Succeeded",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- }

-]

-```

-It takes a few minutes to delete the nodes and the node pool.

-## Associate capacity reservation groups to node pools (preview)

-As your application workloads demands, you may associate node pools to capacity reservation groups already created. This ensures guaranteed capacity is allocated for your node pools.

-For more information on the capacity reservation groups, review [Capacity Reservation Groups][capacity-reservation-groups].

-### Register preview feature

-To install the aks-preview extension, run the following command:

-```azurecli-interactive

-az extension add --name aks-preview

-```

-Run the following command to update to the latest version of the extension released:

-```azurecli-interactive

-az extension update --name aks-preview

-```

-Register the `CapacityReservationGroupPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:

-```azurecli-interactive

-az feature register --namespace "Microsoft.ContainerService" --name "CapacityReservationGroupPreview"

-```

-It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:

-```azurecli-interactive

-az feature show --namespace "Microsoft.ContainerService" --name "CapacityReservationGroupPreview"

-```

-When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:

-```azurecli-interactive

-az provider register --namespace Microsoft.ContainerService

-```

-### Manage capacity reservations

-Associating a node pool with an existing capacity reservation group can be done using [`az aks nodepool add`][az-aks-nodepool-add] command and specifying a capacity reservation group with the --crg-id flag". The capacity reservation group should already exist, otherwise the node pool is added to the cluster with a warning and no capacity reservation group gets associated.

-```azurecli-interactive

-az aks nodepool add -g MyRG --cluster-name MyMC -n myAP --crg-id {crg_id}

-```

-Associating a system node pool with an existing capacity reservation group can be done using [`az aks create`][az-aks-create] command. If the capacity reservation group specified doesn't exist, then a warning is issued and the cluster gets created without any capacity reservation group association.

-```azurecli-interactive

-az aks create -g MyRG --cluster-name MyMC --crg-id {crg_id}

-```

-Deleting a node pool command implicitly dissociates a node pool from any associated capacity reservation group, before that node pool is deleted.

-```azurecli-interactive

-az aks nodepool delete -g MyRG --cluster-name MyMC -n myAP

-```

-Deleting a cluster command implicitly dissociates all node pools in a cluster from their associated capacity reservation groups.

-```azurecli-interactive

-az aks delete -g MyRG --cluster-name MyMC

-```

-## Specify a VM size for a node pool

-In the previous examples to create a node pool, a default VM size was used for the nodes created in the cluster. A more common scenario is for you to create node pools with different VM sizes and capabilities. For example, you may create a node pool that contains nodes with large amounts of CPU or memory, or a node pool that provides GPU support. In the next step, you [use taints and tolerations](#setting-node-pool-taints) to tell the Kubernetes scheduler how to limit access to pods that can run on these nodes.

-In the following example, create a GPU-based node pool that uses the *Standard_NC6* VM size. These VMs are powered by the NVIDIA Tesla K80 card. For information on available VM sizes, see [Sizes for Linux virtual machines in Azure][vm-sizes].

-Create a node pool using the [`az aks node pool add`][az-aks-nodepool-add] command again. This time, specify the name *gpunodepool*, and use the `--node-vm-size` parameter to specify the *Standard_NC6* size:

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name gpunodepool \

- --node-count 1 \

- --node-vm-size Standard_NC6 \

- --no-wait

-```

-The following example output from the [`az aks node pool list`][az-aks-nodepool-list] command shows that *gpunodepool* is *Creating* nodes with the specified *VmSize*:

-```azurecli-interactive

-az aks nodepool list -g myResourceGroup --cluster-name myAKSCluster

-```

-```output

-[

- {

- ...

- "count": 1,

- ...

- "name": "gpunodepool",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Creating",

- ...

- "vmSize": "Standard_NC6",

- ...

- },

- {

- ...

- "count": 2,

- ...

- "name": "nodepool1",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Succeeded",

- ...

- "vmSize": "Standard_DS2_v2",

- ...

- }

-]

-```

-It takes a few minutes for the *gpunodepool* to be successfully created.

-## Specify a taint, label, or tag for a node pool

-When creating a node pool, you can add taints, labels, or tags to that node pool. When you add a taint, label, or tag, all nodes within that node pool also get that taint, label, or tag.

-> [!IMPORTANT]

-> Adding taints, labels, or tags to nodes should be done for the entire node pool using `az aks nodepool`. Applying taints, labels, or tags to individual nodes in a node pool using `kubectl` is not recommended.

-### Setting node pool taints

-To create a node pool with a taint, use [`az aks nodepool add`][az-aks-nodepool-add]. Specify the name *taintnp* and use the `--node-taints` parameter to specify *sku=gpu:NoSchedule* for the taint.

-```azurecli-interactive

-az aks nodepool add \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name taintnp \

- --node-count 1 \

- --node-taints sku=gpu:NoSchedule \

- --no-wait

-```

-The following example output from the [`az aks nodepool list`][az-aks-nodepool-list] command shows that *taintnp* is *Creating* nodes with the specified *nodeTaints*:

-```azurecli-interactive

-az aks nodepool list -g myResourceGroup --cluster-name myAKSCluster

-```

-```output

-[

- {

- ...

- "count": 1,

- ...

- "name": "taintnp",

- "orchestratorVersion": "1.15.7",

- ...

- "provisioningState": "Creating",

- ...

- "nodeTaints": [

- "sku=gpu:NoSchedule"

- ],

- ...

- },

- ...

-]

-```

-The taint information is visible in Kubernetes for handling scheduling rules for nodes. The Kubernetes scheduler can use taints and tolerations to restrict what workloads can run on nodes.

-* A **taint** is applied to a node that indicates only specific pods can be scheduled on them.

-* A **toleration** is then applied to a pod that allows them to *tolerate* a node's taint.

-For more information on how to use advanced Kubernetes scheduled features, see [Best practices for advanced scheduler features in AKS][taints-tolerations]

-In the previous step, you applied the *sku=gpu:NoSchedule* taint when you created your node pool. The following basic example YAML manifest uses a toleration to allow the Kubernetes scheduler to run an NGINX pod on a node in that node pool.

-Create a file named `nginx-toleration.yaml` and copy in the following example YAML:

-```yaml

-apiVersion: v1

-kind: Pod

-metadata:

- name: mypod

-spec:

- containers:

- - image: mcr.microsoft.com/oss/nginx/nginx:1.15.9-alpine

- name: mypod

- resources:

- requests:

- cpu: 100m

- memory: 128Mi

- limits:

- cpu: 1

- memory: 2G

- tolerations:

- - key: "sku"

- operator: "Equal"

- value: "gpu"

- effect: "NoSchedule"

-```

-Schedule the pod using the `kubectl apply -f nginx-toleration.yaml` command:

-```bash

-kubectl apply -f nginx-toleration.yaml

-```

-It takes a few seconds to schedule the pod and pull the NGINX image. Use the [kubectl describe pod][kubectl-describe] command to view the pod status. The following condensed example output shows the *sku=gpu:NoSchedule* toleration is applied. In the events section, the scheduler has assigned the pod to the *aks-taintnp-28993262-vmss000000* node:

-```bash

-kubectl describe pod mypod

-```

-```output

-[...]

-Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s

- node.kubernetes.io/unreachable:NoExecute for 300s

- sku=gpu:NoSchedule

-Events:

- Type Reason Age From Message

- - - - -

- Normal Scheduled 4m48s default-scheduler Successfully assigned default/mypod to aks-taintnp-28993262-vmss000000

- Normal Pulling 4m47s kubelet pulling image "mcr.microsoft.com/oss/nginx/nginx:1.15.9-alpine"

- Normal Pulled 4m43s kubelet Successfully pulled image "mcr.microsoft.com/oss/nginx/nginx:1.15.9-alpine"

- Normal Created 4m40s kubelet Created container

- Normal Started 4m40s kubelet Started container

-```

-Only pods that have this toleration applied can be scheduled on nodes in *taintnp*. Any other pod would be scheduled in the *nodepool1* node pool. If you create more node pools, you can use taints and tolerations to limit what pods can be scheduled on those node resources.

-### Setting node pool labels

-For more information on using labels with node pools, see [Use labels in an Azure Kubernetes Service (AKS) cluster][use-labels].

-### Setting node pool Azure tags

-For more information on using Azure tags with node pools, see [Use Azure tags in Azure Kubernetes Service (AKS)][use-tags].

-## Add a FIPS-enabled node pool

-For more information on enabling Federal Information Process Standard (FIPS) for your AKS cluster, see [Enable Federal Information Process Standard (FIPS) for Azure Kubernetes Service (AKS) node pools][enable-fips-nodes].

-## Manage node pools using a Resource Manager template

-When you use an Azure Resource Manager template to create and managed resources, you can typically update the settings in your template and redeploy to update the resource. With node pools in AKS, the initial node pool profile can't be updated once the AKS cluster has been created. This behavior means that you can't update an existing Resource Manager template, make a change to the node pools, and redeploy. Instead, you must create a separate Resource Manager template that updates only the node pools for an existing AKS cluster.

-Create a template such as `aks-agentpools.json` and paste the following example manifest. This example template configures the following settings:

-* Updates the *Linux* node pool named *myagentpool* to run three nodes.

-* Sets the nodes in the node pool to run Kubernetes version *1.15.7*.

-* Defines the node size as *Standard_DS2_v2*.

-Edit these values as need to update, add, or delete node pools as needed:

-```json

-{

- "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

- "contentVersion": "1.0.0.0",

- "parameters": {

- "clusterName": {

- "type": "string",

- "metadata": {

- "description": "The name of your existing AKS cluster."

- }

- },

- "location": {

- "type": "string",

- "metadata": {

- "description": "The location of your existing AKS cluster."

- }

- },

- "agentPoolName": {

- "type": "string",

- "defaultValue": "myagentpool",

- "metadata": {

- "description": "The name of the agent pool to create or update."

- }

- },

- "vnetSubnetId": {

- "type": "string",

- "defaultValue": "",

- "metadata": {

- "description": "The Vnet subnet resource ID for your existing AKS cluster."

- }

- }

- },

- "variables": {

- "apiVersion": {

- "aks": "2020-01-01"

- },

- "agentPoolProfiles": {

- "maxPods": 30,

- "osDiskSizeGB": 0,

- "agentCount": 3,

- "agentVmSize": "Standard_DS2_v2",

- "osType": "Linux",

- "vnetSubnetId": "[parameters('vnetSubnetId')]"

- }

- },

- "resources": [

- {

- "apiVersion": "2020-01-01",

- "type": "Microsoft.ContainerService/managedClusters/agentPools",

- "name": "[concat(parameters('clusterName'),'/', parameters('agentPoolName'))]",

- "location": "[parameters('location')]",

- "properties": {

- "maxPods": "[variables('agentPoolProfiles').maxPods]",

- "osDiskSizeGB": "[variables('agentPoolProfiles').osDiskSizeGB]",

- "count": "[variables('agentPoolProfiles').agentCount]",

- "vmSize": "[variables('agentPoolProfiles').agentVmSize]",

- "osType": "[variables('agentPoolProfiles').osType]",

- "storageProfile": "ManagedDisks",

- "type": "VirtualMachineScaleSets",

- "vnetSubnetID": "[variables('agentPoolProfiles').vnetSubnetId]",

- "orchestratorVersion": "1.15.7"

- }

- }

- ]

-}

-```

-Deploy this template using the [`az deployment group create`][az-deployment-group-create] command, as shown in the following example. You're prompted for the existing AKS cluster name and location:

-```azurecli-interactive

-az deployment group create \

- --resource-group myResourceGroup \

- --template-file aks-agentpools.json

-```

-> [!TIP]

-> You can add a tag to your node pool by adding the *tag* property in the template, as shown in the following example.

->

-> ```json

-> ...

-> "resources": [

-> {

-> ...

-> "properties": {

-> ...

-> "tags": {

-> "name1": "val1"

-> },

-> ...

-> }

-> }

-> ...

-> ```

-It may take a few minutes to update your AKS cluster depending on the node pool settings and operations you define in your Resource Manager template.

-## Clean up resources

-In this article, you created an AKS cluster that includes GPU-based nodes. To reduce unnecessary cost, you may want to delete the *gpunodepool*, or the whole AKS cluster.

-To delete the GPU-based node pool, use the [`az aks nodepool delete`][az-aks-nodepool-delete] command as shown in following example:

-```azurecli-interactive

-az aks nodepool delete -g myResourceGroup --cluster-name myAKSCluster --name gpunodepool

-```

-To delete the cluster itself, use the [`az group delete`][az-group-delete] command to delete the AKS resource group:

-```azurecli-interactive

-az group delete --name myResourceGroup --yes --no-wait

-```

-You can also delete the other cluster you created for the public IP for node pools scenario.

-```azurecli-interactive

-az group delete --name myResourceGroup2 --yes --no-wait

-```

-## Next steps

-* Learn more about [system node pools][use-system-pool].

-* In this article, you learned how to create and manage multiple node pools in an AKS cluster. For more information about how to control pods across node pools, see [Best practices for advanced scheduler features in AKS][operator-best-practices-advanced-scheduler].

-* To create and use Windows Server container node pools, see [Create a Windows Server container in AKS][aks-quickstart-windows-cli].

-* Use [proximity placement groups][reduce-latency-ppg] to reduce latency for your AKS applications.

-* Use [instance-level public IP addresses](use-node-public-ips.md) to make your nodes able to serve traffic directly.

-<!-- EXTERNAL LINKS -->

-[kubectl-describe]: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#describe

-[capacity-reservation-groups]:/azure/virtual-machines/capacity-reservation-associate-virtual-machine-scale-set

-<!-- INTERNAL LINKS -->

-[aks-storage-concepts]: concepts-storage.md

-[arm-sku-vm1]: ../virtual-machines/dpsv5-dpdsv5-series.md

-[arm-sku-vm2]: ../virtual-machines/dplsv5-dpldsv5-series.md

-[arm-sku-vm3]: ../virtual-machines/epsv5-epdsv5-series.md

-[aks-quickstart-windows-cli]: ./learn/quick-windows-container-deploy-cli.md

-[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials

-[az-aks-create]: /cli/azure/aks#az_aks_create

-[az-aks-get-upgrades]: /cli/azure/aks#az_aks_get_upgrades

-[az-aks-nodepool-add]: /cli/azure/aks/nodepool#az_aks_nodepool_add

-[az-aks-nodepool-list]: /cli/azure/aks/nodepool#az_aks_nodepool_list

-[az-aks-nodepool-upgrade]: /cli/azure/aks/nodepool#az_aks_nodepool_upgrade

-[az-aks-nodepool-scale]: /cli/azure/aks/nodepool#az_aks_nodepool_scale

-[az-aks-nodepool-delete]: /cli/azure/aks/nodepool#az_aks_nodepool_delete

-[az-feature-register]: /cli/azure/feature#az_feature_register

-[az-provider-register]: /cli/azure/provider#az_provider_register

-[az-group-create]: /cli/azure/group#az_group_create

-[az-group-delete]: /cli/azure/group#az_group_delete

-[az-deployment-group-create]: /cli/azure/deployment/group#az_deployment_group_create

-[enable-fips-nodes]: enable-fips-nodes.md

-[install-azure-cli]: /cli/azure/install-azure-cli

-[operator-best-practices-advanced-scheduler]: operator-best-practices-advanced-scheduler.md

-[quotas-skus-regions]: quotas-skus-regions.md

-[taints-tolerations]: operator-best-practices-advanced-scheduler.md#provide-dedicated-nodes-using-taints-and-tolerations

-[vm-sizes]: ../virtual-machines/sizes.md

-[use-system-pool]: use-system-pools.md

-[reduce-latency-ppg]: reduce-latency-ppg.md

-[use-tags]: use-tags.md

-[use-labels]: use-labels.md

-[cordon-and-drain]: resize-node-pool.md#cordon-the-existing-nodes

-[internal-lb-different-subnet]: internal-lb.md#specify-a-different-subnet

-[drain-nodes]: resize-node-pool.md#drain-the-existing-nodes

-* Learn about [using multiple node pools in AKS](use-multiple-node-pools.md).

-[aks-taints]: use-multiple-node-pools.md#setting-node-pool-taints

-[use-multiple-node-pools]: use-multiple-node-pools.md

-[nodepool-upgrade]: use-multiple-node-pools.md#upgrade-a-node-pool

-[upgrade-cluster-cp]: use-multiple-node-pools.md#upgrade-a-cluster-control-plane-with-multiple-node-pools

-[nodepool-limitations]: use-multiple-node-pools.md#limitations

-|MySQL Database | Yes | No | |

-<a name="filesSP">11</a> - Files in on-premises SharePoint are not supported.

-<a name="tds">12</a> - Azure Analysis Services does not support direct connections to the Dynamics 365 [Dataverse TDS endpoint](/power-apps/developer/data-platform/dataverse-sql-query). When connecting to this data source from Azure Analysis Services, you must use an On-premises Data Gateway, and refresh the tokens manually.

- :::image type="content" source="media/api-management-howto-api-inspector/allow-tracing-1.png" alt-text="Allow tracing for subscription":::

- :::image type="content" source="media/api-management-howto-api-inspector/06-debug-your-apis-01-trace-call-1.png" alt-text="Screenshot showing configure API tracing.":::

-* The service subscription is [suspended](https://github.com/Azure/azure-resource-manager-rpc/blob/master/v1.0/subscription-lifecycle-api-reference.md#subscription-states) or [warned](https://github.com/Azure/azure-resource-manager-rpc/blob/master/v1.0/subscription-lifecycle-api-reference.md#subscription-states) (for example, for nonpayment) and then reinstated.

-If you use Azure Key Vault to manage a custom domain TLS certificate, make sure the certificate is inserted into Key Vault [as a _certificate_](/rest/api/keyvault/certificates/create-certificate/create-certificate), not a _secret_.

-> [!NOTE]

-> When using VNET integration on your web app, the mounted drive will use an RC1918 IP address and not an IP address from your VNET.

->

-This guide shows how to mount Azure Storage Files as a network share in Windows code (non-container) in App Service. Only [Azure Files Shares](../storage/files/storage-how-to-use-files-portal.md) and [Premium Files Shares](../storage/files/storage-how-to-create-file-share.md) are supported. The benefits of custom-mounted storage include:

-The following features are supported for Windows code:

-This guide shows how to mount Azure Storage Files as a network share in a Windows container in App Service. Only [Azure Files Shares](../storage/files/storage-how-to-use-files-portal.md) and [Premium Files Shares](../storage/files/storage-how-to-create-file-share.md) are supported. The benefits of custom-mounted storage include:

-The following features are supported for Windows containers:

-This guide shows how to mount Azure Storage as a network share in a built-in Linux container or a custom Linux container in App Service. See the video [how to mount Azure Storage as a local share](https://www.youtube.com/watch?v=OJkvpWYr57Y). For using Azure Storage in an ARM template, see [Bring your own storage](https://github.com/Azure/app-service-linux-docs/blob/master/BringYourOwnStorage/BYOS_azureFiles.json). The benefits of custom-mounted storage include:

-The following features are supported for Linux containers:

-## Prerequisites

-> [!NOTE]

-> Azure Storage is non-default storage for App Service and billed separately, not included with App Service.

->

-## Limitations

-> [!NOTE]

-> Ensure ports 80 and 445 are open when using Azure Files with VNET integration.

->

-> [!NOTE]

-> When VNET integration is used, ensure the following ports are open:

-> * Azure Files: 80 and 445.

-> * Azure Blobs: 80 and 443.

->

-## Mount storage to Windows code

-## Mount storage to Windows container

-## Mount storage to Linux container

-# [Azure portal](#tab/portal)

-1. In the [Azure portal](https://portal.azure.com), navigate to the app.

-1. From the left navigation, click **Configuration** > **Path Mappings** > **New Azure Storage Mount**.

-1. Configure the storage mount according to the following table. When finished, click **OK**.

- ::: zone pivot="code-windows"

- | Setting | Description |

- |-|-|

- | **Name** | Name of the mount configuration. Spaces are not allowed. |

- | **Configuration options** | Select **Basic** if the storage account is not using [private endpoints](../storage/common/storage-private-endpoints.md). Otherwise, select **Advanced**. |

- | **Storage accounts** | Azure Storage account. It must contain an Azure Files share. |

- | **Share name** | Files share to mount. |

- | **Access key** (Advanced only) | [Access key](../storage/common/storage-account-keys-manage.md) for your storage account. |

- | **Mount path** | Directory inside your app service that you want to mount. Only `/mounts/pathname` is supported.|

- | **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|

- ::: zone-end

- ::: zone pivot="container-windows"

- | Setting | Description |

- |-|-|

- | **Name** | Name of the mount configuration. Spaces are not allowed. |

- | **Configuration options** | Select **Basic** if the storage account is not using [private endpoints](../storage/common/storage-private-endpoints.md). Otherwise, select **Advanced**. |

- | **Storage accounts** | Azure Storage account. It must contain an Azure Files share. |

- | **Share name** | Files share to mount. |

- | **Access key** (Advanced only) | [Access key](../storage/common/storage-account-keys-manage.md) for your storage account. |

- | **Mount path** | Directory inside your Windows container that you want to mount. Do not use a root directory (`[C-Z]:\` or `/`) or the `home` directory (`[C-Z]:\home`, or `/home`) as it's not supported.|

- | **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|

- ::: zone-end

- ::: zone pivot="container-linux"

- | Setting | Description |

- |-|-|

- | **Name** | Name of the mount configuration. Spaces are not allowed. |

- | **Configuration options** | Select **Basic** if the storage account is not using [service endpoints](../storage/common/storage-network-security.md#grant-access-from-a-virtual-network) or [private endpoints](../storage/common/storage-private-endpoints.md). Otherwise, select **Advanced**. |

- | **Storage accounts** | Azure Storage account. |

- | **Storage type** | Select the type based on the storage you want to mount. Azure Blobs only supports read-only access. |

- | **Storage container** or **Share name** | Files share or Blobs container to mount. |

- | **Access key** (Advanced only) | [Access key](../storage/common/storage-account-keys-manage.md) for your storage account. |

- | **Mount path** | Directory inside the Linux container to mount to Azure Storage. Do not use `/` or `/home`.|

- | **Deployment slot setting** | When checked, the storage mount settings also apply to deployment slots.|

- ::: zone-end

-# [Azure CLI](#tab/cli)

-Use the [`az webapp config storage-account add`](/cli/azure/webapp/config/storage-account#az-webapp-config-storage-account-add) command. For example:

-```azurecli-interactive

-az webapp config storage-account add --resource-group <group-name> --name <app-name> --custom-id <custom-id> --storage-type AzureFiles --share-name <share-name> --account-name <storage-account-name> --access-key "<access-key>" --mount-path <mount-path-directory>

-```

-Verify your storage is mounted by running the following command:

-```azurecli-interactive

-az webapp config storage-account list --resource-group <resource-group> --name <app-name>

-```

-> [!NOTE]

-> Adding, editing, or deleting a storage mount causes the app to be restarted.

-## Test the mounted storage

-To validate that the Azure Storage is mounted successfully for the app:

-1. [Open an SSH session](configure-linux-open-ssh-session.md) into the container.

-1. In the SSH terminal, execute the following command:

- ```bash

- df ΓÇôh

- ```

-1. Check if the storage share is mounted. If it's not present, there's an issue with mounting the storage share.

-1. Check latency or general reachability of the storage mount with the following command:

- ```bash

- tcpping Storageaccount.file.core.windows.net

- ```

-## Best practices

- 1. Regenerate **key2**.

- 1. In the storage mount configuration, update the access the key to use the regenerated **key2**.

- 1. Regenerate **key1**.

-

- - Azure Files: 80 and 445

- 1. Regenerate **key2**.

- 1. In the storage mount configuration, update the access the key to use the regenerated **key2**.

- 1. Regenerate **key1**.

-

- 1. Regenerate **key2**.

- 1. In the storage mount configuration, update the access the key to use the regenerated **key2**.

- 1. Regenerate **key1**.

- - [For Files](../storage/files/storage-files-scale-targets.md)

- - [For Blobs](../storage/blobs/scalability-targets.md)

-## Next steps

-1. Select a runbook. For example, select the **Start Azure V2 VMs** runbook from the list, and then select **Edit**. Or go to **Browse Gallery** and select **Start Azure V2 VMs**.

-1. Add identity support for use in the runbook by adding a new code activity as mentioned in the following step, which leverages the `Connect-AzAccount` cmdlet to connect to the Managed Identity.

- :::image type="content" source="./media/migrate-run-as-account-managed-identity/add-functionality-inline.png" alt-text="Screenshot of adding functionality to a graphical runbook." lightbox="./media/migrate-run-as-account-managed-identity/add-functionality-expanded.png":::

-1. Select **Code**, and then enter the following code to pass the identity:

- ```powershell-interactive

-For example, in the runbook **Start Azure V2 VMs** in the runbook gallery, you must replace the `Get Run As Connection` and `Connect to Azure` activities with the `Connect-AzAccount` cmdlet activity.

-> AzureRM PowerShell modules are retiring on 29 February 2024. If you are using AzureRM PowerShell modules in Graphical runbooks, you must upgrade them to use Az PowerShell modules. [Learn more](/powershell/azure/migrate-from-azurerm-to-az?view=azps-9.4.0&preserve-view=true).

-> Azure Cache for Redis Enterprise requires standard network Load Balancers that are charged separately from cache instances themselves. For more information, see [Load Balancer pricing](https://azure.microsoft.com/pricing/details/load-balancer/).

-> If an Enterprise cache is configured for multiple Availability Zones, data transfer is billed at the [standard network bandwidth rates](https://azure.microsoft.com/pricing/details/bandwidth/)

-> starting from July 1, 2022.

-> The new programming model for authoring Functions in Node.js (V4) is currently in preview. Compared to the current model, this new experience is designed to be more flexible and intuitive for Node developers. Learn more about the differences between the models in the [Node.js upgrade guide](../functions-node-upgrade-v4.md).

->

-> In the following code snippets, Python (PM2) denotes programming model V2, and JavaScript (PM4) denotes programming model V4, the new experiences.

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-# [Java](#tab/java)

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-# [Java](#tab/java)

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-# [Java](#tab/java)

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-# [Java](#tab/java)

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-# [Java](#tab/java)

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-Durable entities are currently not supported in PowerShell.

-# [Java](#tab/java)

-Durable entities are currently not supported in Java.

-# [C# (InProc)](#tab/csharp-inproc)

-# [C# (Isolated)](#tab/csharp-isolated)

-# [JavaScript (PM3)](#tab/javascript-v3)

-# [JavaScript (PM4)](#tab/javascript-v4)

-# [Python](#tab/python)

-# [Python (PM2)](#tab/python-v2)

-# [PowerShell](#tab/powershell)

-Durable entities are currently not supported in PowerShell.

-# [Java](#tab/java)

-Durable entities are currently not supported in Java.

- + East Us 2

- + West US3

-In version 1.x, you can also use the [`func run` command](#func-run) to run a specific function and pass test data to it.

-func azure functionapp publish <FunctionAppName>

-| **`--dotnet-cli-params`** | When publishing compiled C# (.csproj) functions, the core tools calls `dotnet build --output bin/publish`. Any parameters passed to this will be appended to the command line. |

-This command builds your project as a custom container and publishes it to a Kubernetes cluster. Custom containers must have a Dockerfile. To create an app with a Dockerfile, use the `--dockerfile` option with the [`func init` command](#func-init).

-Core Tools uses the local Docker CLI to build and publish the image.

-Make sure your Docker is already installed locally. Run the `docker login` command to connect to your account.

-This article demonstrates the support that Azure Functions provides for working with function apps running in Linux containers. Choose the hosting environment for your containerized function app at the top of the article.

-When you create a function app in the [Azure portal](https://portal.azure.com), you can also create a deployment of the function app from an existing container image. The following steps create and deploy a function app from an [existing container image](#creating-your-function-app-in-a-container).

- | **Function App name** | Globally unique name | Name that identifies your new function app. Valid characters are `a-z` (case insensitive), `0-9`, and `-`. |

- |**Region**| Preferred region | Select a [region](https://azure.microsoft.com/regions/) that's near you or near other services that your functions can access. |

- :::image type="content" source="media/functions-how-to-custom-container/function-app-create-container-functions-premium.png" alt-text="Screenshot of the Basics tab in the Azure portal when creating a function app for hosting a container in a Functions Premium plan.":::

- This creates a new **Azure Container Apps Environment** resource to host your function app container. By default, the environment is created in a Consumption plan without zone redundancy, to minimize costs. You can also choose an existing Container Apps environment. For more information, see [Azure Container Apps hosting of Azure Functions](functions-container-apps-hosting.md).

-# [Windows](#tab/windows)

-# [macOS](#tab/macos)

-# [Linux](#tab/linux)

-If you must use a binding extension or an extension version not in a supported bundle, you'll need to manually install extension. For such rare scenarios, see [Install extensions](#install-extensions).

-# [Portal](#tab/portal)

-# [Core Tools](#tab/azurecli)

-# [Storage Explorer](#tab/storageexplorer)

-To learn more, see the [`func new` command](functions-core-tools-reference.md#func-new).

-# [v4.x](#tab/v2)

-# [v1.x](#tab/v1)

-+ While there is local storage emulation available, it's often best to validate your triggers and bindings against live services in Azure. You can maintain the connections to these services in the local.settings.json project file. For more information, see [Local settings file](functions-develop-local.md#local-settings-file). Make sure to keep test and production data separate when testing against live Azure services.

-# [Bash](#tab/bash)

-# [Cmd](#tab/cmd)

-# [Bash](#tab/bash)

-# [Cmd](#tab/cmd)

-### Before you publish

->[!IMPORTANT]

->You must have the [Azure CLI](/cli/azure/install-azure-cli) or [Azure PowerShell](/powershell/azure/install-azure-powershell) installed locally to be able to publish to Azure from Core Tools.

-A project folder may contain language-specific files and directories that shouldn't be published. Excluded items are listed in a .funcignore file in the root project folder.

-You must have already [created a function app in your Azure subscription](functions-cli-samples.md#create), to which you can deploy your code. Projects that require compilation should be built so that the binaries can be deployed.

-To learn how to create a function app from the command prompt or terminal window using the Azure CLI or Azure PowerShell, see [Create a Function App for serverless execution](./scripts/functions-cli-create-serverless.md).

->[!IMPORTANT]

-> When you create a function app in the Azure portal, it uses version 4.x of the Function runtime by default. To make the function app use version 1.x of the runtime, follow the instructions in [Run on version 1.x](functions-versions.md#creating-1x-apps).

-> You can't change the runtime version for a function app that has existing functions.

-To publish your local code to a function app in Azure, use the `publish` command:

-+ Publishing overwrites existing files in the function app.

-+ Use the [`--publish-local-settings` option][func azure functionapp publish] to automatically create app settings in your function app based on values in the local.settings.json file.

-+ Your project is deployed such that it [runs from the deployment package](run-functions-from-deployment-package.md). To disable this recommended deployment mode, use the [`--nozip` option][func azure functionapp publish].

-+ Java uses Maven to publish your local project to Azure. Instead, use the following command to publish to Azure: `mvn azure-functions:deploy`. Azure resources are created during initial deployment.

-+ You get an error when you try to publish to a `<FunctionAppName>` that doesn't exist in your subscription.

-### Kubernetes cluster

-Functions also lets you define your Functions project to run in a Docker container. Use the [`--docker` option][func init] of `func init` to generate a Dockerfile for your specific language. This file is then used when creating a container to deploy. For more information, see [Working with containers and Azure Functions](functions-how-to-custom-container.md).

-Core Tools can be used to deploy your project as a custom container image to a Kubernetes cluster.

-The following command uses the Dockerfile to generate a container and deploy it to a Kubernetes cluster.

-To learn more, see [Deploying a function app to Kubernetes](functions-kubernetes-keda.md#deploying-a-function-app-to-kubernetes).

-You can use this command to install any compatible NuGet package. To learn more, see the [`func extensions install` command](functions-core-tools-reference.md#func-extensions-install).

-# [.NET 6 (isolated)](#tab/net6-isolated)

-# [.NET 6 (isolated)](#tab/net6-isolated)

-# [.NET 6 (isolated)](#tab/net6-isolated)

-You need it when interacting with the Microsoft Support team. To find your subscription ID, follow these steps:

-2. From the left pane, select **Subscriptions**.

-3. A new blade called ΓÇ£SubscriptionsΓÇ¥ will open to display your subscriptions.

-1. Choose the subscription you have used for Azure Large Instances.

-The Microsoft operations team performs a series of extensive quality checks to ensure that customers' requests to run Azure Large Instances for Epic<sup>®</sup> are fulfilled accurately, and that infrastructure is healthy before handover.

-| Modify settings for collection of metric data. | You can reduce your costs by modifying the default collection settings Container insights uses for the collection of metric data. See [Enable cost optimization settings (preview)](containers/container-insights-cost-config.md) for details on modifying both the frequency that metric data is collected and the namespaces that are collected. |

-> Container insights in Azure Monitor now supports alerts based on Prometheus metrics, and metric rules will be retired on March 14, 2026. If you already use alerts based on custom metrics, you should migrate to Prometheus alerts and disable the equivalent custom metric alerts.

-> Metric alerts (preview) are retiring and no longer recommended. Please refer to the migration guidance at [Migrate from Container insights recommended alerts to Prometheus recommended alert rules (preview)](#migrate-from-metric-rules-to-prometheus-rules-preview).

-After authenticating the request, Azure Resource Manager sends it to the resource provider, which completes the operation.

-* Distributed across regions. Although Azure Resource Manager is distributed across regions, some services are regional. This distinction means that while the initial handling of the control plane operation is resilient, the request may be susceptible to regional outages when forwarded to the service.

-* Distributed across Availability Zones (and regions) in locations that have multiple Availability Zones.

-* To view the operations for a resource provider, see [Azure REST API](/rest/api/).

-| Microsoft.ServiceBus/namespaces/authorizationRules | [listKeys](/rest/api/servicebus/stable/namespaces-authorization-rules/list-keys) |

-| Microsoft.ServiceBus/namespaces/disasterRecoveryConfigs/authorizationRules | [listKeys](/rest/api/servicebus/stable/disasterrecoveryconfigs/listkeys) |

-| Microsoft.ServiceBus/namespaces/queues/authorizationRules | [listKeys](/rest/api/servicebus/stable/queues-authorization-rules/list-keys) |

-| Microsoft.ServiceBus/namespaces/topics/authorizationRules | [listKeys](/rest/api/servicebus/stable/topics%20%E2%80%93%20authorization%20rules/list-keys) |