Docs update tracker

Updates from: 09/05/2024 01:06:37

Service	Microsoft Docs article	Related commit history on GitHub	Change details
advisor	Advisor Reference Reliability Recommendations	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/advisor/advisor-reference-reliability-recommendations.md	description: Full list of available reliability recommendations in Advisor. Previously updated : 08/29/2024 Last updated : 09/03/2024 # Reliability recommendations Azure Advisor helps you ensure and improve the continuity of your business-criti #### Upgrade to the latest ADMA DotNet SDK version We identified calls to an ADMA DotNet SDK version that is scheduled for deprecation. To ensure uninterrupted access to ADMA, latest features, and performance improvements, switch to the latest SDK version. - + +Potential benefits: Ensure uninterrupted access to ADMA + For More information, see [What is Azure Data Manager for Agriculture?](https://aka.ms/FarmBeatsPaaSAzureAdvisorFAQ) -ID: 77f976ab-59e3-474d-ba04-32a7d41c9cb1 <!--77f976ab-59e3-474d-ba04-32a7d41c9cb1_end--> ID: 77f976ab-59e3-474d-ba04-32a7d41c9cb1 #### Upgrade to the latest ADMA Java SDK version We have identified calls to a ADMA Java Sdk version that is scheduled for deprecation. We recommend switching to the latest Sdk version to ensure uninterrupted access to ADMA, latest features, and performance improvements. - + +Potential benefits: Ensure uninterrupted access to ADMA + For More information, see [What is Azure Data Manager for Agriculture?](https://aka.ms/FarmBeatsPaaSAzureAdvisorFAQ) -ID: 1233e513-ac1c-402d-be94-7133dc37cac6 <!--1233e513-ac1c-402d-be94-7133dc37cac6_end--> ID: 1233e513-ac1c-402d-be94-7133dc37cac6 #### Upgrade to the latest ADMA Python SDK version We identified calls to an ADMA Python SDK version that is scheduled for deprecation. To ensure uninterrupted access to ADMA, latest features, and performance improvements, switch to the latest SDK version. - + +Potential benefits: Ensure uninterrupted access to ADMA + For More information, see [What is Azure Data Manager for Agriculture?](https://aka.ms/FarmBeatsPaaSAzureAdvisorFAQ) -ID: c4ec2fa1-19f4-491f-9311-ca023ee32c38 <!--c4ec2fa1-19f4-491f-9311-ca023ee32c38_end--> ID: c4ec2fa1-19f4-491f-9311-ca023ee32c38 #### Upgrade to the latest ADMA JavaScript SDK version We identified calls to an ADMA JavaScript SDK version that is scheduled for deprecation. To ensure uninterrupted access to ADMA, latest features, and performance improvements, switch to the latest SDK version. - + +Potential benefits: Ensure uninterrupted access to ADMA + For More information, see [What is Azure Data Manager for Agriculture?](https://aka.ms/FarmBeatsPaaSAzureAdvisorFAQ) -ID: 9e49a43a-dbe2-477d-9d34-a4f209617fdb <!--9e49a43a-dbe2-477d-9d34-a4f209617fdb_end--> ID: 9e49a43a-dbe2-477d-9d34-a4f209617fdb #### Migrate API Management service to stv2 platform Support for API Management instances hosted on the stv1 platform will be retired by 31 August 2024. Migrate to stv2 based platform before that to avoid service disruption. - + +Potential benefits: Improve service stability and leverage new platform features + For More information, see [API Management stv1 platform retirement - Global Azure cloud (August 2024)](/azure/api-management/breaking-changes/stv1-platform-retirement-august-2024) -ID: 3dd24a8c-af06-49c3-9a04-fb5721d7a9bb <!--3dd24a8c-af06-49c3-9a04-fb5721d7a9bb_end--> ID: 3dd24a8c-af06-49c3-9a04-fb5721d7a9bb #### Hostname certificate rotation failed The API Management service failing to refresh the hostname certificate from the Key Vault can lead to the service using a stale certificate and runtime API traffic being blocked. Ensure that the certificate exists in the Key Vault, and the API Management service identity is granted secret read access. - + +Potential benefits: Ensure service availability + For More information, see [Configure a custom domain name for your Azure API Management instance](https://aka.ms/apimdocs/customdomain) -ID: 8962964c-a6d6-4c3d-918a-2777f7fbdca7 <!--8962964c-a6d6-4c3d-918a-2777f7fbdca7_end--> ID: 8962964c-a6d6-4c3d-918a-2777f7fbdca7 #### The legacy portal was deprecated 3 years ago and retired in October 2023. However, we are seeing active usage of the portal which may cause service disruption soon when we disable it. We highly recommend that you migrate to the new developer portal as soon as possible to continue enjoying our services and take advantage of the new features and improvements. - + +Potential benefits: Ensure business continuity + For More information, see [Migrate to the new developer portal](/previous-versions/azure/api-management/developer-portal-deprecated-migration) -ID: 6124b23c-0d97-4098-9009-79e8c56cbf8c <!--6124b23c-0d97-4098-9009-79e8c56cbf8c_end--> ID: 6124b23c-0d97-4098-9009-79e8c56cbf8c #### Dependency network status check failed Azure API Management service dependency not available. Please, check virtual network configuration. - + +Potential benefits: Improve service stability + For More information, see [Deploy your Azure API Management instance to a virtual network - external mode](https://aka.ms/apim-vnet-common-issues) -ID: 53fd1359-ace2-4712-911c-1fc420dd23e8 <!--53fd1359-ace2-4712-911c-1fc420dd23e8_end--> ID: 53fd1359-ace2-4712-911c-1fc420dd23e8 #### SSL/TLS renegotiation blocked SSL/TLS renegotiation attempt blocked; secure communication might fail. To support client certificate authentication scenarios, enable 'Negotiate client certificate' on listed hostnames. For browser-based clients, this option might result in a certificate prompt being presented to the client. - + +Potential benefits: Ensure service availability + For More information, see [How to secure APIs using client certificate authentication in API Management](/azure/api-management/api-management-howto-mutual-certificates-for-clients) -ID: b7316772-5c8f-421f-bed0-d86b0f128e25 <!--b7316772-5c8f-421f-bed0-d86b0f128e25_end--> ID: b7316772-5c8f-421f-bed0-d86b0f128e25 #### Deploy an Azure API Management instance to multiple Azure regions for increased service availability Azure API Management supports multi-region deployment, which enables API publishers to add regional API gateways to an existing API Management instance. Multi-region deployment helps reduce request latency perceived by geographically distributed API consumers and improves service availability. - + +Potential benefits: Increased resilience against regional failures + For More information, see [Deploy an Azure API Management instance to multiple Azure regions](/azure/api-management/api-management-howto-deploy-multi-region) -ID: 2e4d65a3-1e77-4759-bcaa-13009484a97e <!--2e4d65a3-1e77-4759-bcaa-13009484a97e_end--> ID: 2e4d65a3-1e77-4759-bcaa-13009484a97e #### Enable and configure autoscale for API Management instance on production workloads. API Management instance in production service tiers can be scaled by adding and removing units. The autoscaling feature can dynamically adjust the units of an API Management instance to accommodate a change in load without manual intervention. - + +Potential benefits: Increase scalability and optimize cost. + For More information, see [Automatically scale an Azure API Management instance](https://aka.ms/apimautoscale) -ID: f4c48f42-74f2-41bf-bf99-14e2f9ea9ac9 <!--f4c48f42-74f2-41bf-bf99-14e2f9ea9ac9_end--> ID: f4c48f42-74f2-41bf-bf99-14e2f9ea9ac9 #### Scale out your App Service plan to avoid CPU exhaustion High CPU utilization can lead to runtime issues with applications. Your application exceeded 90% CPU over the last couple of days. To reduce CPU usage and avoid runtime issues, scale out the application. - + +Potential benefits: Keep your app healthy + For More information, see [Best practices for Azure App Service](https://aka.ms/antbc-cpu) -ID: 1294987d-c97d-41d0-8fd8-cb6eab52d87b <!--1294987d-c97d-41d0-8fd8-cb6eab52d87b_end--> ID: 1294987d-c97d-41d0-8fd8-cb6eab52d87b #### Check your app's service health issues We have a recommendation related to your app's service health. Open the Azure Portal, go to the app, click the Diagnose and Solve to see more details. - + +Potential benefits: Keep your app healthy + For More information, see [Best practices for Azure App Service](/azure/app-service/app-service-best-practices) -ID: a85f5f1c-c01f-4926-84ec-700b7624af8c <!--a85f5f1c-c01f-4926-84ec-700b7624af8c_end--> ID: a85f5f1c-c01f-4926-84ec-700b7624af8c #### Fix the backup database settings of your App Service resource When an application has an invalid database configuration, its backups fail. For details, see your application's backup history on your app management page. - + +Potential benefits: Ensure business continuity + For More information, see [Best practices for Azure App Service](https://aka.ms/antbc) -ID: b30897cc-2c2e-4677-a2a1-107ae982ff49 <!--b30897cc-2c2e-4677-a2a1-107ae982ff49_end--> ID: b30897cc-2c2e-4677-a2a1-107ae982ff49 #### Fix the backup storage settings of your App Service resource When an application has invalid storage settings, its backups fail. For details, see your application's backup history on your app management page. - + +Potential benefits: Ensure business continuity + For More information, see [Best practices for Azure App Service](https://aka.ms/antbc) -ID: 80efd6cb-dcee-491b-83a4-7956e9e058d5 <!--80efd6cb-dcee-491b-83a4-7956e9e058d5_end--> ID: 80efd6cb-dcee-491b-83a4-7956e9e058d5 #### Scale up your App Service plan SKU to avoid memory problems The App Service Plan containing your application exceeded 85% memory allocation. High memory consumption can lead to runtime issues your applications. Find the problem application and scale it up to a higher plan with more memory resources. - + +Potential benefits: Keep your app healthy + For More information, see [Best practices for Azure App Service](https://aka.ms/antbc-memory) -ID: 66d3137a-c4da-4c8a-b6b8-e03f5dfba66e <!--66d3137a-c4da-4c8a-b6b8-e03f5dfba66e_end--> ID: 66d3137a-c4da-4c8a-b6b8-e03f5dfba66e #### Scale out your App Service plan Consider scaling out your App Service Plan to at least two instances to avoid cold start delays and service interruptions during routine maintenance. - + +Potential benefits: Optimize user experience and availability + For More information, see [https://aka.ms/appsvcnuminstances](https://aka.ms/appsvcnuminstances) -ID: 45cfc38d-3ffd-4088-bb15-e4d0e1e160fe <!--45cfc38d-3ffd-4088-bb15-e4d0e1e160fe_end--> ID: 45cfc38d-3ffd-4088-bb15-e4d0e1e160fe #### Fix application code, a worker process crashed due to an unhandled exception A worker process in your application crashed due to an unhandled exception. To identify the root cause, collect memory dumps and call stack information at the time of the crash. - + +Potential benefits: Keep your app healthy and highly available + For More information, see [https://aka.ms/appsvcproactivecrashmonitoring](https://aka.ms/appsvcproactivecrashmonitoring) -ID: 3e35f804-52cb-4ebf-84d5-d15b3ab85dfc <!--3e35f804-52cb-4ebf-84d5-d15b3ab85dfc_end--> ID: 3e35f804-52cb-4ebf-84d5-d15b3ab85dfc #### Upgrade your App Service to a Standard plan to avoid request rejects When an application is part of a shared App Service plan and meets its quota multiple times, incoming requests might be rejected. Your web application canΓÇÖt accept incoming requests after meeting a quota. To remove the quota, upgrade to a Standard plan. - + +Potential benefits: Keep your app healthy + For More information, see [Azure App Service plan overview](https://aka.ms/ant-asp) -ID: 78c5ab69-858a-43ca-a5ac-4ca6f9cdc30d <!--78c5ab69-858a-43ca-a5ac-4ca6f9cdc30d_end--> ID: 78c5ab69-858a-43ca-a5ac-4ca6f9cdc30d #### Move your App Service resource to Standard or higher and use deployment slots When an application is deployed multiple times in a week, problems might occur. You deployed your application multiple times last week. To help you reduce deployment impact to your production web application, move your App Service resource to the Standard (or higher) plan, and use deployment slots. - + +Potential benefits: Keep your app healthy while updating + For More information, see [Set up staging environments in Azure App Service](https://aka.ms/ant-staging) -ID: 59a83512-d885-4f09-8e4f-c796c71c686e <!--59a83512-d885-4f09-8e4f-c796c71c686e_end--> ID: 59a83512-d885-4f09-8e4f-c796c71c686e #### Consider upgrading the hosting plan of the Static Web App(s) in this subscription to Standard SKU. The combined bandwidth used by all the Free SKU Static Web Apps in this subscription is exceeding the monthly limit of 100GB. Consider upgrading these applications to Standard SKU to avoid throttling. - + +Potential benefits: Higher availability for the apps by avoiding throttling. + For More information, see [Pricing ΓÇô Static Web Apps ](https://azure.microsoft.com/pricing/details/app-service/static/) -ID: dc3edeee-f0ab-44ae-b612-605a0a739612 <!--dc3edeee-f0ab-44ae-b612-605a0a739612_end--> ID: dc3edeee-f0ab-44ae-b612-605a0a739612 #### Use deployment slots for your App Service resource When an application is deployed multiple times in a week, problems might occur. You deployed your application multiple times over the last week. To help you manage changes and help reduce deployment impact to your production web application, use deployment slots. - + +Potential benefits: Keep your app healthy while updating + For More information, see [Set up staging environments in Azure App Service](https://aka.ms/ant-staging) -ID: 0dc165fd-69bf-468a-aa04-a69377b6feb0 <!--0dc165fd-69bf-468a-aa04-a69377b6feb0_end--> ID: 0dc165fd-69bf-468a-aa04-a69377b6feb0 #### CX Observer Personalized Recommendation CX Observer Personalized Recommendation - -ID: 6d732ac5-82e0-4a66-887e-eccee79a2063 +Potential benefits: NA + + <!--6d732ac5-82e0-4a66-887e-eccee79a2063_end--> ID: 6d732ac5-82e0-4a66-887e-eccee79a2063 #### Consider changing your application architecture to 64-bit Your App Service is configured as 32-bit, and its memory consumption is approaching the limit of 2 GB. If your application supports, consider recompiling your application and changing the App Service configuration to 64-bit instead. - + +Potential benefits: Improve your application reliability + For More information, see [Application performance FAQs for Web Apps in Azure](https://aka.ms/appsvc32bit) -ID: 8be322ab-e38b-4391-a5f3-421f2270d825 <!--8be322ab-e38b-4391-a5f3-421f2270d825_end--> ID: 8be322ab-e38b-4391-a5f3-421f2270d825 #### Domain verification required to issue your App Service Certificate You have an App Service Certificate that's currently in a Pending Issuance status and requires domain verification. Failure to validate domain ownership will result in an unsuccessful certificate issuance. Domain verification isn't automated for App Service Certificates and will require action. If you've recently verified domain ownership and have been issued a certificate, you may disregard this message. - + +Potential benefits: Ensure successful issuance of App Service Certificate. + For More information, see [Add and manage TLS/SSL certificates in Azure App Service](https://aka.ms/ASCDomainVerificationRequired) -ID: a2385343-200c-4eba-bbe2-9252d3f1d6ea <!--a2385343-200c-4eba-bbe2-9252d3f1d6ea_end--> <!--microsoft_certificateregistration_end> ID: a2385343-200c-4eba-bbe2-9252d3f1d6ea #### Upgrade your SKU or add more instances Deploying two or more medium or large sized instances ensures business continuity (fault tolerance) during outages caused by planned or unplanned maintenance. - + +Potential benefits: Ensure business continuity through application gateway resilience + For More information, see [Multi-region load balancing - Azure Reference Architectures ](https://aka.ms/aa_gatewayrec_learnmore) -ID: 6a2b1e70-bd4c-4163-86de-5243d7ac05ee <!--6a2b1e70-bd4c-4163-86de-5243d7ac05ee_end--> ID: 6a2b1e70-bd4c-4163-86de-5243d7ac05ee #### Avoid hostname override to ensure site integrity Avoid overriding the hostname when configuring Application Gateway. Having a domain on the frontend of Application Gateway different than the one used to access the backend, can lead to broken cookies or redirect URLs. Make sure the backend is able to deal with the domain difference, or update the Application Gateway configuration so the hostname doesn't need to be overwritten towards the backend. When used with App Service, attach a custom domain name to the Web App and avoid use of the .azurewebsites.net host name towards the backend. Note that a different frontend domain isn't a problem in all situations, and certain categories of backends like REST APIs, are less sensitive in general. - + +Potential benefits: Ensure site integrity and avoid broken cookies or redirect urls through a resilient Application Gateway configuration. + For More information, see [Troubleshoot App Service issues in Application Gateway](https://aka.ms/appgw-advisor-usecustomdomain) -ID: 52a9d0a7-efe1-4512-9716-394abd4e0ab1 <!--52a9d0a7-efe1-4512-9716-394abd4e0ab1_end--> ID: 52a9d0a7-efe1-4512-9716-394abd4e0ab1 #### Implement ExpressRoute Monitor on Network Performance Monitor When ExpressRoute circuit isn't monitored by ExpressRoute Monitor on Network Performance, you miss notifications of loss, latency, and performance of on-premises to Azure resources, and Azure to on-premises resources. For end-to-end monitoring, implement ExpressRoute Monitor on Network Performance. - + +Potential benefits: Improve time-to-detect and time-to-mitigate issues in your network and provide insights on your network path via ExpressRoute + For More information, see [Configure Network Performance Monitor for ExpressRoute (deprecated)](/azure/expressroute/how-to-npm) -ID: 17454550-1543-4068-bdaf-f3ed7cdd3d86 <!--17454550-1543-4068-bdaf-f3ed7cdd3d86_end--> ID: 17454550-1543-4068-bdaf-f3ed7cdd3d86 #### Implement multiple ExpressRoute circuits in your Virtual Network for cross premises resiliency When an ExpressRoute gateway only has one ExpressRoute circuit associated to it, resiliency issues might occur. To ensure peering location redundancy and resiliency, connect one or more additional circuits to your gateway. - + +Potential benefits: Improve resiliency in case of ExpressRoute peering location failure + For More information, see [Designing for high availability with ExpressRoute](/azure/expressroute/designing-for-high-availability-with-expressroute) -ID: 70f87e66-9b2d-4bfa-ae38-1d7d74837689 <!--70f87e66-9b2d-4bfa-ae38-1d7d74837689_end--> ID: 70f87e66-9b2d-4bfa-ae38-1d7d74837689 #### Add at least one more endpoint to the profile, preferably in another Azure region Profiles need more than one endpoint to ensure availability if one of the endpoints fails. We also recommend that endpoints be in different regions. - + +Potential benefits: Improve resiliency by allowing failover + For More information, see [Traffic Manager endpoints](https://aka.ms/AA1o0x4) -ID: 6cd70072-c45c-4716-bf7b-b35c18e46e72 <!--6cd70072-c45c-4716-bf7b-b35c18e46e72_end--> ID: 6cd70072-c45c-4716-bf7b-b35c18e46e72 #### Add an endpoint configured to "All (World)" For geographic routing, traffic is routed to endpoints in defined regions. When a region fails, there is no pre-defined failover. Having an endpoint where the Regional Grouping is configured to "All (World)" for geographic profiles avoids traffic black holing and guarantees service availablity. - + +Potential benefits: Improve resiliency by avoiding traffic black holes + For More information, see [Add, disable, enable, delete, or move endpoints](https://aka.ms/Rf7vc5) -ID: 0bbe0a49-3c63-49d3-ab4a-aa24198f03f7 <!--0bbe0a49-3c63-49d3-ab4a-aa24198f03f7_end--> ID: 0bbe0a49-3c63-49d3-ab4a-aa24198f03f7 #### Add or move one endpoint to another Azure region All endpoints associated to this proximity profile are in the same region. Users from other regions may experience long latency when attempting to connect. Adding or moving an endpoint to another region will improve overall performance for proximity routing and provide better availability if all endpoints in one region fail. - + +Potential benefits: Improve resiliency by allowing failover to another region + For More information, see [Configure the performance traffic routing method](https://aka.ms/Ldkkdb) -ID: 0db76759-6d22-4262-93f0-2f989ba2b58e <!--0db76759-6d22-4262-93f0-2f989ba2b58e_end--> ID: 0db76759-6d22-4262-93f0-2f989ba2b58e #### Move to production gateway SKUs from Basic gateways The Basic VPN SKU is for development or testing scenarios. If you're using the VPN gateway for production, move to a production SKU, which offers higher numbers of tunnels, Border Gateway Protocol (BGP), active-active configuration, custom IPsec/IKE policy, and increased stability and availability. - + +Potential benefits: Additional available features and higher stability and availability + For More information, see [About VPN Gateway configuration settings](https://aka.ms/aa_basicvpngateway_learnmore) -ID: e070c4bf-afaf-413e-bc00-e476b89c5f3d <!--e070c4bf-afaf-413e-bc00-e476b89c5f3d_end--> ID: e070c4bf-afaf-413e-bc00-e476b89c5f3d #### Enable Active-Active gateways for redundancy In active-active configuration, both instances of the VPN gateway establish site-to-site (S2S) VPN tunnels to your on-premise VPN device. When a planned maintenance or unplanned event happens to one gateway instance, traffic is automatically switched over to the other active IPsec tunnel. - + +Potential benefits: Ensure business continuity through connection resilience + For More information, see [Design highly available gateway connectivity for cross-premises and VNet-to-VNet connections](https://aka.ms/aa_vpnha_learnmore) -ID: c249dc0e-9a17-423e-838a-d72719e8c5dd <!--c249dc0e-9a17-423e-838a-d72719e8c5dd_end--> ID: c249dc0e-9a17-423e-838a-d72719e8c5dd #### Disable health probes when there is only one origin in an origin group If you only have a single origin, Front Door always routes traffic to that origin even if its health probe reports an unhealthy status. The status of the health probe doesn't do anything to change Front Door's behavior. In this scenario, health probes don't provide a benefit. - + +Potential benefits: Ensure service availability by reducing unnecessary health probe traffic + For More information, see [Best practices for Front Door](https://aka.ms/afd-disable-health-probes) -ID: 1c7fc5ab-f776-4aee-8236-ab478519f68f <!--1c7fc5ab-f776-4aee-8236-ab478519f68f_end--> ID: 1c7fc5ab-f776-4aee-8236-ab478519f68f #### Use managed TLS certificates When Front Door manages your TLS certificates, it reduces your operational costs, and helps you to avoid costly outages caused by forgetting to renew a certificate. Front Door automatically issues and rotates the managed TLS certificates. - + +Potential benefits: Ensure service availability by having Front Door manage and rotate your certificates + For More information, see [Best practices for Front Door](https://aka.ms/afd-use-managed-tls) -ID: 5185d64e-46fd-4ed2-8633-6d81f5e3ca59 <!--5185d64e-46fd-4ed2-8633-6d81f5e3ca59_end--> ID: 5185d64e-46fd-4ed2-8633-6d81f5e3ca59 #### Use NAT gateway for outbound connectivity Prevent connectivity failures due to source network address translation (SNAT) port exhaustion by using NAT gateway for outbound traffic from your virtual networks. NAT gateway scales dynamically and provides secure connections for traffic headed to the internet. - + +Potential benefits: Prevent outbound connection failures with NAT gateway + For More information, see [Use Source Network Address Translation (SNAT) for outbound connections](/azure/load-balancer/load-balancer-outbound-connections#2-associate-a-nat-gateway-to-the-subnet) -ID: 56f0c458-521d-4b8b-a704-c0a099483d19 <!--56f0c458-521d-4b8b-a704-c0a099483d19_end--> ID: 56f0c458-521d-4b8b-a704-c0a099483d19 #### Deploy your Application Gateway across Availability Zones Achieve zone redundancy by deploying Application Gateway across Availability Zones. Zone redundancy boosts resilience by enabling Application Gateway to survive various outages, which ensures continuity even if one zone is affected, and enhances overall reliability. - + +Potential benefits: Resiliency of Application Gateways is considerably increased when using Availability Zones. + For More information, see [Scaling Application Gateway v2 and WAF v2](https://aka.ms/appgw/az) -ID: 5c488377-be3e-4365-92e8-09d1e8d9038c <!--5c488377-be3e-4365-92e8-09d1e8d9038c_end--> ID: 5c488377-be3e-4365-92e8-09d1e8d9038c #### Update VNet permission of Application Gateway users To improve security and provide a more consistent experience across Azure, all users must pass a permission check to create or update an Application Gateway in a Virtual Network. The users or service principals minimum permission required is Microsoft.Network/virtualNetworks/subnets/join/action. - + +Potential benefits: Avoid disruptions in management of Application Gateway resource + For More information, see [Application Gateway infrastructure configuration](https://aka.ms/agsubnetjoin) -ID: 6cc8be07-8c03-4bd7-ad9b-c2985b261e01 <!--6cc8be07-8c03-4bd7-ad9b-c2985b261e01_end--> ID: 6cc8be07-8c03-4bd7-ad9b-c2985b261e01 #### Use the same domain name on Front Door and your origin When you rewrite the Host header, request cookies and URL redirections might break. When you use platforms like Azure App Service, features like session affinity and authentication and authorization might not work correctly. Make sure to validate whether your application is going to work correctly. - + +Potential benefits: Ensure application integrity by preserving original host name + For More information, see [Best practices for Front Door](https://aka.ms/afd-same-domain-origin) -ID: 79f543f9-60e6-4ef6-ae42-2095f6149cba <!--79f543f9-60e6-4ef6-ae42-2095f6149cba_end--> ID: 79f543f9-60e6-4ef6-ae42-2095f6149cba #### Implement Site Resiliency for ExpressRoute To ensure maximum resiliency, Microsoft recommends that you connect to two ExpressRoute circuits in two peering locations. The goal of Maximum Resiliency is to enhance availability and ensure the highest level of resilience for critical workloads. - + +Potential benefits: Maximum Resiliency in ExpressRoute is designed to ensure there isnΓÇÖt a single point of failure within the Microsoft network path. This is achieved by offering dual (2) circuits across two different locations for site diversity in ExpressRoute. The goal of Maximum Resiliency is to enhance availability and ensure the highest level of resilience for critical workloads. + For More information, see [Design and architect Azure ExpressRoute for resiliency](https://aka.ms/ersiteresiliency) -ID: 8d61a7d4-5405-4f43-81e3-8c6239b844a6 <!--8d61a7d4-5405-4f43-81e3-8c6239b844a6_end--> ID: 8d61a7d4-5405-4f43-81e3-8c6239b844a6 #### Implement Zone Redundant ExpressRoute Gateways Implement zone-redundant Virtual Network Gateway in Azure Availability Zones. This brings resiliency, scalability, and higher availability to your Virtual Network Gateways. - + +Potential benefits: Provides zonal resiliency and redundancy for ExpressRoute + For More information, see [Create a zone-redundant virtual network gateway in availability zones](/azure/vpn-gateway/create-zone-redundant-vnet-gateway) -ID: c9af1ef6-55bc-48af-bfe4-2c80490159f8 <!--c9af1ef6-55bc-48af-bfe4-2c80490159f8_end--> ID: c9af1ef6-55bc-48af-bfe4-2c80490159f8 #### Ensure autoscaling is used for increased performance and resiliency When configuring the Application Gateway, it's recommended to provision autoscaling to scale in and out in response to changes in demand. This helps to minimize the effects of a single failing component. - + +Potential benefits: Increase performance and resiliency. + For More information, see [Scaling Application Gateway v2 and WAF v2](/azure/application-gateway/application-gateway-autoscaling-zone-redundant) -ID: c9c9750b-9ddb-436f-b19a-9c725539a0b5 <!--c9c9750b-9ddb-436f-b19a-9c725539a0b5_end--> ID: c9c9750b-9ddb-436f-b19a-9c725539a0b5 <!--db83b3d4-96e5-4cfe-b736-b3280cadd163_begin--> #### Migrate to supported version of AGC -The version of Application Gateway for Containers was provisioned with a preview version and is not supported for production. Ensure you provision a new gateway using the latest API version. - +The version of Application Gateway for Containers was provisioned with a preview version and isn't supported for production. Ensure you provision a new gateway using the latest API version. + +Potential benefits: Ensure supportability and resiliency for production workloads + For More information, see [What is Application Gateway for Containers?](https://aka.ms/appgwcontainers/docs) -ID: db83b3d4-96e5-4cfe-b736-b3280cadd163 <!--db83b3d4-96e5-4cfe-b736-b3280cadd163_end--> <!--microsoft_servicenetworking_end> ID: db83b3d4-96e5-4cfe-b736-b3280cadd163 #### Create a Standard search service (2GB) When you exceed your storage quota, indexing operations stop working. You're close to exceeding your storage quota of 2GB. If you need more storage, create a Standard search service or add extra partitions. - + +Potential benefits: capability to handle more data + For More information, see [https://aka.ms/azs/search-limits-quotas-capacity](https://aka.ms/azs/search-limits-quotas-capacity) -ID: 97b38421-f88c-4db0-b397-b2d81eff6630 <!--97b38421-f88c-4db0-b397-b2d81eff6630_end--> ID: 97b38421-f88c-4db0-b397-b2d81eff6630 #### Create a Standard search service (50MB) When you exceed your storage quota, indexing operations stop working. You're close to exceeding your storage quota of 50MB. To maintain operations, create a Basic or Standard search service. - + +Potential benefits: capability to handle more data + For More information, see [https://aka.ms/azs/search-limits-quotas-capacity](https://aka.ms/azs/search-limits-quotas-capacity) -ID: 8d31f25f-31a9-4267-b817-20ee44f88069 <!--8d31f25f-31a9-4267-b817-20ee44f88069_end--> ID: 8d31f25f-31a9-4267-b817-20ee44f88069 #### Avoid exceeding your available storage quota by adding more partitions When you exceed your storage quota, you can still query, but indexing operations stop working. You're close to exceeding your available storage quota. If you need more storage, add extra partitions. - + +Potential benefits: Able to index additional data + For More information, see [https://aka.ms/azs/search-limits-quotas-capacity](https://aka.ms/azs/search-limits-quotas-capacity) -ID: b3efb46f-6d30-4201-98de-6492c1f8f10d <!--b3efb46f-6d30-4201-98de-6492c1f8f10d_end--> ID: b3efb46f-6d30-4201-98de-6492c1f8f10d #### Upgrade to the latest agent version of Azure Arc-enabled Kubernetes For the best Azure Arc enabled Kubernetes experience, improved stability and new functionality, upgrade to the latest agent version. - + +Potential benefits: Arc-enabled K8s latest agent version + For More information, see [Upgrade Azure Arc-enabled Kubernetes agents](https://aka.ms/ArcK8sAgentUpgradeDocs) -ID: 6d55ea5b-6e80-4313-9b80-83d384667eaa <!--6d55ea5b-6e80-4313-9b80-83d384667eaa_end--> <!--microsoft_kubernetes_end> ID: 6d55ea5b-6e80-4313-9b80-83d384667eaa #### Upgrade Microsoft Flux extension to the newest major version The Microsoft Flux extension has a major version release. Plan for a manual upgrade to the latest major version for Microsoft Flux for all Azure Arc-enabled Kubernetes and Azure Kubernetes Service (AKS) clusters within 6 months for continued support and new functionality. - + +Potential benefits: Continued support and new functionality + For More information, see [Available extensions for Azure Arc-enabled Kubernetes clusters](https://aka.ms/fluxreleasenotes) -ID: 4bc7a00b-edbb-4963-8800-1b0f8897fecf <!--4bc7a00b-edbb-4963-8800-1b0f8897fecf_end--> ID: 4bc7a00b-edbb-4963-8800-1b0f8897fecf #### Upcoming Breaking Changes for Microsoft Flux Extension The Microsoft Flux extension frequently receives updates for security and stability. The upcoming update, in line with the OSS Flux Project, will modify the HelmRelease and HelmChart APIs by removing deprecated fields. To avoid disruption to your workloads, necessary action is needed. - + +Potential benefits: Improved stability, security, and new functionality + For More information, see [Available extensions for Azure Arc-enabled Kubernetes clusters](https://aka.ms/fluxreleasenotes) -ID: 79cfad72-9b6d-4215-922d-7df77e1ea3bb <!--79cfad72-9b6d-4215-922d-7df77e1ea3bb_end--> ID: 79cfad72-9b6d-4215-922d-7df77e1ea3bb #### Upgrade Microsoft Flux extension to a supported version Current version of Microsoft Flux on one or more Azure Arc enabled clusters and Azure Kubernetes clusters is out of support. To get security patches, bug fixes and Microsoft support, upgrade to a supported version. - + +Potential benefits: Get security patches, bug fixes and Microsoft support + For More information, see [Available extensions for Azure Arc-enabled Kubernetes clusters](https://aka.ms/fluxreleasenotes) -ID: c8e3b516-a0d5-4c64-8a7a-71cfd068d5e8 <!--c8e3b516-a0d5-4c64-8a7a-71cfd068d5e8_end--> ID: c8e3b516-a0d5-4c64-8a7a-71cfd068d5e8 #### Upgrade to the latest version of the Azure Connected Machine agent The Azure Connected Machine agent is updated regularly with bug fixes, stability enhancements, and new functionality. For the best Azure Arc experience, upgrade your agent to the latest version. - + +Potential benefits: Improved stability and new functionality + For More information, see [Managing and maintaining the Connected Machine agent](/azure/azure-arc/servers/manage-agent) -ID: 9d5717d2-4708-4e3f-bdda-93b3e6f1715b <!--9d5717d2-4708-4e3f-bdda-93b3e6f1715b_end--> <!--microsoft_hybridcompute_end> ID: 9d5717d2-4708-4e3f-bdda-93b3e6f1715b #### Increase fragmentation memory reservation Fragmentation and memory pressure can cause availability incidents. To help in reduce cache failures when running under high memory pressure, increase reservation of memory for fragmentation through the maxfragmentationmemory-reserved setting available in the Advanced Settings options. - + +Potential benefits: Avoid availability incidents when your cache has high memory fragmentation + For More information, see [How to configure Azure Cache for Redis](https://aka.ms/redis/recommendations/memory-policies) -ID: 7c380315-6ad9-4fb2-8930-a8aeb1d6241b <!--7c380315-6ad9-4fb2-8930-a8aeb1d6241b_end--> ID: 7c380315-6ad9-4fb2-8930-a8aeb1d6241b #### Configure geo-replication for Cache for Redis instances to increase durability of applications Geo-Replication enables disaster recovery for cached data, even in the unlikely event of a widespread regional failure. This can be essential for mission-critical applications. We recommend that you configure passive geo-replication for Premium Azure Cache for Redis instances. - + +Potential benefits: Geo-Replication enables disaster recovery for cached data. + For More information, see [Configure passive geo-replication for Premium Azure Cache for Redis instances](https://aka.ms/redispremiumgeoreplication) -ID: c9e4a27c-79e6-4e4c-904f-b6612b6cd892 <!--c9e4a27c-79e6-4e4c-904f-b6612b6cd892_end--> ID: c9e4a27c-79e6-4e4c-904f-b6612b6cd892 #### Re-create your your Container Apps environment to avoid DNS issues There's a potential networking issue with your Container Apps environments that might cause DNS issues. We recommend that you create a new Container Apps environment, re-create your Container Apps in the new environment, and delete the old Container Apps environment. - + +Potential benefits: Avoid DNS failures in your Container Apps Environment. + For More information, see [Quickstart: Deploy your first container app using the Azure portal](https://aka.ms/createcontainerapp) -ID: c692e862-953b-49fe-9c51-e5d2792c1cc1 <!--c692e862-953b-49fe-9c51-e5d2792c1cc1_end--> ID: c692e862-953b-49fe-9c51-e5d2792c1cc1 #### Renew custom domain certificate The custom domain certificate you uploaded is near expiration. To prevent possible service downtime, renew your certificate and upload the new certificate for your container apps. - + +Potential benefits: Your service wont fail because of expired certificate. + For More information, see [Custom domain names and bring your own certificates in Azure Container Apps](https://aka.ms/containerappcustomdomaincert) -ID: b9ce2d2e-554b-4391-8ebc-91c570602b04 <!--b9ce2d2e-554b-4391-8ebc-91c570602b04_end--> ID: b9ce2d2e-554b-4391-8ebc-91c570602b04 #### An issue has been detected that is preventing the renewal of your Managed Certificate. We detected the managed certificate used by the Container App has failed to auto renew. Follow the documentation link to make sure that the DNS settings of your custom domain are correct. - + +Potential benefits: Avoid downtime due to an expired certificate. + For More information, see [Custom domain names and free managed certificates in Azure Container Apps](https://aka.ms/containerapps/managed-certificates) -ID: fa6c0880-da2e-42fd-9cb3-e1267ec5b5c2 <!--fa6c0880-da2e-42fd-9cb3-e1267ec5b5c2_end--> ID: fa6c0880-da2e-42fd-9cb3-e1267ec5b5c2 #### Increase the minimal replica count for your containerized application The minimal replica count set for your Azure Container App containerized application might be too low, which can cause resilience, scalability, and load balancing issues. For better availability, consider increasing the minimal replica count. - + +Potential benefits: Better availability for your container app. + For More information, see [Set scaling rules in Azure Container Apps](https://aka.ms/containerappscalingrules) -ID: 9be5f344-6fa5-4abc-a1f2-61ae6192a075 <!--9be5f344-6fa5-4abc-a1f2-61ae6192a075_end--> ID: 9be5f344-6fa5-4abc-a1f2-61ae6192a075 #### Configure Azure Cosmos DB containers with a partition key When Azure Cosmos DB nonpartitioned collections reach their provisioned storage quota, you lose the ability to add data. Your Cosmos DB nonpartitioned collections are approaching their provisioned storage quota. Migrate these collections to new collections with a partition key definition so they can automatically be scaled out by the service. - + +Potential benefits: Scale your containers seamlessly with increase in storage or request rates without running into any limits + For More information, see [Partitioning and horizontal scaling in Azure Cosmos DB](/azure/cosmos-db/partitioning-overview#choose-partitionkey) -ID: 5e4e9f04-9201-4fd9-8af6-a9539d13d8ec <!--5e4e9f04-9201-4fd9-8af6-a9539d13d8ec_end--> ID: 5e4e9f04-9201-4fd9-8af6-a9539d13d8ec #### Use static Cosmos DB client instances in your code and cache the names of databases and collections A high number of metadata operations on an account can result in rate limiting. Metadata operations have a system-reserved request unit (RU) limit. Avoid rate limiting from metadata operations by using static Cosmos DB client instances in your code and caching the names of databases and collections. - + +Potential benefits: Optimize your RU usage and avoid rate limiting + For More information, see [Performance tips for Azure Cosmos DB and .NET SDK v2](/azure/cosmos-db/performance-tips) -ID: bdb595a4-e148-41f9-98e8-68ec92d1932e <!--bdb595a4-e148-41f9-98e8-68ec92d1932e_end--> ID: bdb595a4-e148-41f9-98e8-68ec92d1932e #### Check linked Azure Key Vault hosting your encryption key When an Azure Cosmos DB account can't access its linked Azure Key Vault hosting the encyrption key, data access and security issues might happen. Your Azure Key Vault's configuration is preventing your Cosmos DB account from contacting the key vault to access your managed encryption keys. If you recently performed a key rotation, ensure that the previous key, or key version, remains enabled and available until Cosmos DB completes the rotation. The previous key or key version can be disabled after 24 hours, or after the Azure Key Vault audit logs don't show any activity from Azure Cosmos DB on that key or key version. - + +Potential benefits: Update your configurations to continue using customer-managed keys and access your data + For More information, see [Configure customer-managed keys for your Azure Cosmos DB account with Azure Key Vault](/azure/cosmos-db/how-to-setup-cmk) -ID: 44a0a07f-23a2-49df-b8dc-a1b14c7c6a9d <!--44a0a07f-23a2-49df-b8dc-a1b14c7c6a9d_end--> ID: 44a0a07f-23a2-49df-b8dc-a1b14c7c6a9d #### Configure consistent indexing mode on Azure Cosmos DB containers Azure Cosmos containers configured with the Lazy indexing mode update asynchronously, which improves write performance, but can impact query freshness. Your container is configured with the Lazy indexing mode. If query freshness is critical, use Consistent Indexing Mode for immediate index updates. - + +Potential benefits: Improve query result consistency and reliability + For More information, see [Manage indexing policies in Azure Cosmos DB](/azure/cosmos-db/how-to-manage-indexing-policy) -ID: 213974c8-ed9c-459f-9398-7cdaa3c28856 <!--213974c8-ed9c-459f-9398-7cdaa3c28856_end--> ID: 213974c8-ed9c-459f-9398-7cdaa3c28856 #### Hotfix - Upgrade to 2.6.14 version of the Async Java SDK v2 or to Java SDK v4 There's a critical bug in version 2.6.13 (and lower) of the Azure Cosmos DB Async Java SDK v2 causing errors when a Global logical sequence number (LSN) greater than the Max Integer value is reached. The error happens transparently to you by the service after a large volume of transactions occur in the lifetime of an Azure Cosmos DB container. Note: While this is a critical hotfix for the Async Java SDK v2, we still highly recommend you migrate to the [Java SDK v4](/azure/cosmos-db/sql/sql-api-sdk-java-v4). - + +Potential benefits: If action isnΓÇÖt taken, all create, read, update, and delete operations may begin to fail with NumberFormatException + For More information, see [Azure Cosmos DB Async Java SDK for API for NoSQL (legacy): Release notes and resources](/azure/cosmos-db/sql/sql-api-sdk-async-java) -ID: bc9e5110-a220-4ab9-8bc9-53f92d3eef70 <!--bc9e5110-a220-4ab9-8bc9-53f92d3eef70_end--> ID: bc9e5110-a220-4ab9-8bc9-53f92d3eef70 #### Critical issue - Upgrade to the current recommended version of the Java SDK v4 There's a critical bug in version 4.15 and lower of the Azure Cosmos DB Java SDK v4 causing errors when a Global logical sequence number (LSN) greater than the Max Integer value is reached. This happens transparently to you by the service after a large volume of transactions occur in the lifetime of an Azure Cosmos DB container. Avoid this problem by upgrading to the current recommended version of the Java SDK v4 - + +Potential benefits: If action isnΓÇÖt taken, all create, read, update, and delete operations may begin to fail with NumberFormatException + For More information, see [Azure Cosmos DB Java SDK v4 for API for NoSQL: release notes and resources](/azure/cosmos-db/sql/sql-api-sdk-java-v4) -ID: 38942ae5-3154-4e0b-98d9-23aa061c334b <!--38942ae5-3154-4e0b-98d9-23aa061c334b_end--> ID: 38942ae5-3154-4e0b-98d9-23aa061c334b #### Use the new 3.6+ endpoint to connect to your upgraded Azure Cosmos DB's API for MongoDB account Some of your applications are connecting to your upgraded Azure Cosmos DB's API for MongoDB account using the legacy 3.2 endpoint - [accountname].documents.azure.com. Use the new endpoint - [accountname].mongo.cosmos.azure.com (or its equivalent in sovereign, government, or restricted clouds). - + +Potential benefits: Take advantage of the latest features in version 3.6+ of Azure Cosmos DB's API for MongoDB + For More information, see [Azure Cosmos DB for MongoDB (4.0 server version): supported features and syntax](/azure/cosmos-db/mongodb-feature-support-40) -ID: 123039b5-0fda-4744-9a17-d6b5d5d122b2 <!--123039b5-0fda-4744-9a17-d6b5d5d122b2_end--> ID: 123039b5-0fda-4744-9a17-d6b5d5d122b2 #### Upgrade your Azure Cosmos DB API for MongoDB account to v4.2 to save on query/storage costs and utilize new features Your Azure Cosmos DB API for MongoDB account is eligible to upgrade to version 4.2. Upgrading to v4.2 can reduce your storage costs by up to 55% and your query costs by up to 45% by leveraging a new storage format. Numerous additional features such as multi-document transactions are also included in v4.2. - + +Potential benefits: Improved reliability, query/storage efficiency, performance, and new feature capabilities + For More information, see [Upgrade the API version of your Azure Cosmos DB for MongoDB account](/azure/cosmos-db/mongodb-version-upgrade) -ID: 0da795d9-26d2-4f02-a019-0ec383363c88 <!--0da795d9-26d2-4f02-a019-0ec383363c88_end--> ID: 0da795d9-26d2-4f02-a019-0ec383363c88 #### Enable Server Side Retry (SSR) on your Azure Cosmos DB's API for MongoDB account When an account is throwing a TooManyRequests error with the 16500 error code, enabling Server Side Retry (SSR) can help mitigate the issue. - -ID: ec6fe20c-08d6-43da-ac18-84ac83756a88 +Potential benefits: Prevent throttling and improve your query reliability and performance + + <!--ec6fe20c-08d6-43da-ac18-84ac83756a88_end--> ID: ec6fe20c-08d6-43da-ac18-84ac83756a88 #### Add a second region to your production workloads on Azure Cosmos DB Production workloads on Azure Cosmos DB run in a single region might have availability issues, this appears to be the case with some of your Cosmos DB accounts. Increase their availability by configuring them to span at least two Azure regions. NOTE: Additional regions incur additional costs. - + +Potential benefits: Improve the availability of your production workloads + For More information, see [High availability (Reliability) in Azure Cosmos DB for NoSQL](/azure/cosmos-db/high-availability) -ID: b57f7a29-dcc8-43de-86fa-18d3f9d3764d <!--b57f7a29-dcc8-43de-86fa-18d3f9d3764d_end--> ID: b57f7a29-dcc8-43de-86fa-18d3f9d3764d #### Upgrade old Azure Cosmos DB SDK to the latest version An Azure Cosmos DB account using an old version of the SDK lacks the latest fixes and improvements. Your Azure Cosmos DB account is using an old version of the SDK. For the latest fixes, performance improvements, and new feature capabilities, upgrade to the latest version. - + +Potential benefits: Improved reliability, performance, and new feature capabilities + For More information, see [Azure Cosmos DB documentation](/azure/cosmos-db/) -ID: 51a4e6bd-5a95-4a41-8309-40f5640fdb8b <!--51a4e6bd-5a95-4a41-8309-40f5640fdb8b_end--> ID: 51a4e6bd-5a95-4a41-8309-40f5640fdb8b #### Upgrade outdated Azure Cosmos DB SDK to the latest version An Azure Cosmos DB account using an old version of the SDK lacks the latest fixes and improvements. Your Azure Cosmos DB account is using an outdated version of the SDK. We recommend upgrading to the latest version for the latest fixes, performance improvements, and new feature capabilities. - + +Potential benefits: Improved reliability, performance, and new feature capabilities + For More information, see [Azure Cosmos DB documentation](/azure/cosmos-db/) -ID: 60a55165-9ccd-4536-81f6-e8dc6246d3d2 <!--60a55165-9ccd-4536-81f6-e8dc6246d3d2_end--> ID: 60a55165-9ccd-4536-81f6-e8dc6246d3d2 #### Enable service managed failover for Cosmos DB account Enable service managed failover for Cosmos DB account to ensure high availability of the account. Service managed failover automatically switches the write region to the secondary region in case of a primary region outage. This ensures that the application continues to function without any downtime. - + +Potential benefits: Azure's Service-Managed Failover feature enhances system availability by automating failover processes, reducing downtime, and improving resilience. + For More information, see [High availability (Reliability) in Azure Cosmos DB for NoSQL](/azure/cosmos-db/high-availability) -ID: 5de9f2e6-087e-40da-863a-34b7943beed4 <!--5de9f2e6-087e-40da-863a-34b7943beed4_end--> ID: 5de9f2e6-087e-40da-863a-34b7943beed4 #### Enable HA for your Production workload Many clusters with consistent workloads do not have high availability (HA) enabled. It's recommended to activate HA from the Scale page in the Azure Portal to prevent database downtime in case of unexpected node failures and to qualify for SLA guarantees. - + +Potential benefits: Activate HA to avoid database downtime in case of an unexpected node failure + For More information, see [Scaling and configuring Your Azure Cosmos DB for MongoDB vCore cluster](https://aka.ms/enableHAformongovcore) -ID: 64fbcac1-f652-4b6f-8170-2f97ffeb5631 <!--64fbcac1-f652-4b6f-8170-2f97ffeb5631_end--> ID: 64fbcac1-f652-4b6f-8170-2f97ffeb5631 #### Enable zone redundancy for multi-region Cosmos DB accounts This recommendation suggests enabling zone redundancy for multi-region Cosmos DB accounts to improve high availability and reduce the risk of data loss in case of a regional outage. - + +Potential benefits: Improved high availability and reduced risk of data loss + For More information, see [High availability (Reliability) in Azure Cosmos DB for NoSQL](/azure/cosmos-db/high-availability#replica-outages) -ID: 8034b205-167a-4fd5-a133-0c8cb166103c <!--8034b205-167a-4fd5-a133-0c8cb166103c_end--> ID: 8034b205-167a-4fd5-a133-0c8cb166103c #### Add at least one data center in another Azure region Your Azure Managed Instance for Apache Cassandra cluster is designated as a production cluster but is currently deployed in a single Azure region. For production clusters, we recommend adding at least one more data center in another Azure region to guard against disaster recovery scenarios. - + +Potential benefits: Ensure applications have another region in case of disaster recovery + For More information, see [Best practices for high availability and disaster recovery](/azure/managed-instance-apache-cassandra/resilient-applications) -ID: 92056ca3-8fab-43d1-bebf-f9c377ef20e9 <!--92056ca3-8fab-43d1-bebf-f9c377ef20e9_end--> ID: 92056ca3-8fab-43d1-bebf-f9c377ef20e9 #### Avoid being rate limited for Control Plane operation We found high number of Control Plane operations on your account through resource provider. Request that exceeds the documented limits at sustained levels over consecutive 5-minute periods may experience request being throttling as well failed or incomplete operation on Azure Cosmos DB resources. - + +Potential benefits: Optimize control plane operation and avoid operation failure due to rate limiting + For More information, see [Azure Cosmos DB service quotas](https://docs.microsoft.com/azure/cosmos-db/concepts-limits#control-plane) -ID: a030f8ab-4dd4-4751-822b-f231a0df5f5a <!--a030f8ab-4dd4-4751-822b-f231a0df5f5a_end--> ID: a030f8ab-4dd4-4751-822b-f231a0df5f5a #### Resolve virtual network issues Service failed to install or resume due to virtual network (VNet) issues. To resolve this issue, follow the steps in the troubleshooting guide. - + +Potential benefits: Improve reliability, availability, performance, and new feature capabilities + For More information, see [Troubleshoot access, ingestion, and operation of your Azure Data Explorer cluster in your virtual network](/azure/data-explorer/vnet-deploy-troubleshoot) -ID: fa2649e9-e1a5-4d07-9b26-51c080d9a9ba <!--fa2649e9-e1a5-4d07-9b26-51c080d9a9ba_end--> ID: fa2649e9-e1a5-4d07-9b26-51c080d9a9ba #### Add subnet delegation for 'Microsoft.Kusto/clusters' If a subnet isnΓÇÖt delegated, the associated Azure service wonΓÇÖt be able to operate within it. Your subnet doesnΓÇÖt have the required delegation. Delegate your subnet for 'Microsoft.Kusto/clusters'. - + +Potential benefits: Improve reliability, availability, performance, and new feature capabilities + For More information, see [What is subnet delegation?](/azure/virtual-network/subnet-delegation-overview) -ID: f2bcadd1-713b-4acc-9810-4170a5d01dea <!--f2bcadd1-713b-4acc-9810-4170a5d01dea_end--> ID: f2bcadd1-713b-4acc-9810-4170a5d01dea #### High Availability - Add primary key to the table that currently doesn't have one. Our internal monitoring system has identified significant replication lag on the High Availability standby server. This lag is primarily caused by the standby server replaying relay logs on a table that lacks a primary key. To address this issue and adhere to best practices, it's recommended to add primary keys to all tables. Once this is done, proceed to disable and then re-enable High Availability to mitigate the problem. - + +Potential benefits: By implementing this approach, the standby server will be shielded from the adverse effects of high replication lag caused by the absence of a primary key on any table. This approach can contribute to reduced failover times, ultimately supporting the goal of maintaining business continuity. + For More information, see [Troubleshoot replication latency in Azure Database for MySQL - Flexible Server](/azure/mysql/how-to-troubleshoot-replication-latency#no-primary-key-or-unique-key-on-a-table) -ID: cf388b0c-2847-4ba9-8b07-54c6b23f60fb <!--cf388b0c-2847-4ba9-8b07-54c6b23f60fb_end--> ID: cf388b0c-2847-4ba9-8b07-54c6b23f60fb #### Replication - Add a primary key to the table that currently doesn't have one Our internal monitoring observed significant replication lag on your replica server because the replica server is replaying relay logs on a table that lacks a primary key. To ensure that the replica server can effectively synchronize with the primary and keep up with changes, add primary keys to the tables in the primary server and then recreate the replica server. - + +Potential benefits: By implementing this approach, the replica server will achieve a state of close synchronization with the primary server. + For More information, see [Troubleshoot replication latency in Azure Database for MySQL - Flexible Server](/azure/mysql/how-to-troubleshoot-replication-latency#no-primary-key-or-unique-key-on-a-table) -ID: fb41cc05-7ac3-4b0e-a773-a39b5c1ca9e4 <!--fb41cc05-7ac3-4b0e-a773-a39b5c1ca9e4_end--> ID: fb41cc05-7ac3-4b0e-a773-a39b5c1ca9e4 #### Remove inactive logical replication slots (important) Inactive logical replication slots can result in degraded server performance and unavailability due to write ahead log (WAL) file retention and buildup of snapshot files. Your Azure Database for PostgreSQL flexible server might have inactive logical replication slots. THIS NEEDS IMMEDIATE ATTENTION. Either delete the inactive replication slots, or start consuming the changes from these slots, so that the slots' Log Sequence Number (LSN) advances and is close to the current LSN of the server. - + +Potential benefits: Improve PostgreSQL availability by removing inactive logical replication slots + For More information, see [Logical replication and logical decoding in Azure Database for PostgreSQL - Flexible Server](https://aka.ms/azure_postgresql_flexible_server_logical_decoding) -ID: 33f26810-57d0-4612-85ff-a83ee9be884a <!--33f26810-57d0-4612-85ff-a83ee9be884a_end--> ID: 33f26810-57d0-4612-85ff-a83ee9be884a #### Remove inactive logical replication slots When an Orcas PostgreSQL flexible server has inactive logical replication slots, degraded server performance and unavailability due to write ahead log (WAL) file retention and buildup of snapshot files might occur. THIS NEEDS IMMEDIATE ATTENTION. Either delete the inactive replication slots, or start consuming the changes from these slots, so that the slots' Log Sequence Number (LSN) advances and is close to the current LSN of the server. - + +Potential benefits: Improve PostgreSQL availability by removing inactive logical replication slots + For More information, see [Logical decoding](https://aka.ms/azure_postgresql_logical_decoding) -ID: 6f33a917-418c-4608-b34f-4ff0e7be8637 <!--6f33a917-418c-4608-b34f-4ff0e7be8637_end--> ID: 6f33a917-418c-4608-b34f-4ff0e7be8637 #### Configure geo redundant backup storage Configure GRS to ensure that your database meets its availability and durability targets even in the face of failures or disasters. - + +Potential benefits: Ensures recovery from regional failure or disaster. + For More information, see [Backup and restore in Azure Database for PostgreSQL - Flexible Server](https://aka.ms/PGGeoBackup) -ID: 5295ed8a-f7a1-48d3-b4a9-e5e472cf1685 <!--5295ed8a-f7a1-48d3-b4a9-e5e472cf1685_end--> ID: 5295ed8a-f7a1-48d3-b4a9-e5e472cf1685 #### Define custom maintenance windows to occur during low-peak hours When specifying preferences for the maintenance schedule, you can pick a day of the week and a time window. If you don't specify, the system will pick times between 11pm and 7am in your server's region time. Pick a day and time where usage is low. - + +Potential benefits: Configure maintenance window enables avoiding maintenance during system peak. + For More information, see [Scheduled maintenance in Azure Database for PostgreSQL - Flexible Server](https://aka.ms/PGCustomMaintenanceWindow) -ID: eb241cd1-4bdc-4800-945b-4c9c8eeb6f07 <!--eb241cd1-4bdc-4800-945b-4c9c8eeb6f07_end--> ID: eb241cd1-4bdc-4800-945b-4c9c8eeb6f07 #### Upgrade Microsoft Edge device runtime to a supported version for IoT Hub When Edge devices use outdated versions, performance degradation might occur. We recommend you upgrade to the latest supported version of the Azure IoT Edge runtime. - + +Potential benefits: Ensure business continuity with latest supported version for your Edge devices + For More information, see [Update IoT Edge](https://aka.ms/IOTEdgeSDKCheck) -ID: 51b1fad8-4838-426f-9871-107bc089677b <!--51b1fad8-4838-426f-9871-107bc089677b_end--> ID: 51b1fad8-4838-426f-9871-107bc089677b #### Upgrade device client SDK to a supported version for IotHub When devices use an outdated SDK, performance degradation can occur. Some or all of your devices are using an outdated SDK. We recommend you upgrade to a supported SDK version. - + +Potential benefits: Ensure business continuity with supported SDK for your devices + For More information, see [Azure IoT Hub SDKs](https://aka.ms/iothubsdk) -ID: d448c687-b808-4143-bbdc-02c35478198a <!--d448c687-b808-4143-bbdc-02c35478198a_end--> ID: d448c687-b808-4143-bbdc-02c35478198a #### IoT Hub Potential Device Storm Detected This is when two or more devices are trying to connect to the IoT Hub using the same device ID credentials. When the second device (B) connects, it causes the first one (A) to become disconnected. Then (A) attempts to reconnect again, which causes (B) to get disconnected. - + +Potential benefits: Improve connectivity of your devices + For More information, see [Understand and resolve Azure IoT Hub errors](https://aka.ms/IotHubDeviceStorm) -ID: 8d7efd88-c891-46be-9287-0aec2fabd51c <!--8d7efd88-c891-46be-9287-0aec2fabd51c_end--> ID: 8d7efd88-c891-46be-9287-0aec2fabd51c #### Upgrade Device Update for IoT Hub SDK to a supported version When a Device Update for IoT Hub instance uses an outdated version of the SDK, it doesn't get the latest upgrades. For the latest fixes, performance improvements, and new feature capabilities, upgrade to the latest Device Update for IoT Hub SDK version. - + +Potential benefits: Ensure business continuity with supported SDK + For More information, see [What is Device Update for IoT Hub?](/azure/iot-hub-device-update/understand-device-update) -ID: d1ff97b9-44cd-4acf-a9d3-3af500bd79d6 <!--d1ff97b9-44cd-4acf-a9d3-3af500bd79d6_end--> ID: d1ff97b9-44cd-4acf-a9d3-3af500bd79d6 #### Add IoT Hub units or increase SKU level When an IoT Hub exceeds its daily message quota, operation and cost problems might occur. To ensure smooth operation in the future, add units or increase the SKU level. - + +Potential benefits: The IoT Hub can receive messages again. + For More information, see [Understand and resolve Azure IoT Hub errors](/azure/iot-hub/troubleshoot-error-codes#403002-iothubquotaexceeded) -ID: e4bda6ac-032c-44e0-9b40-e0522796a6d2 <!--e4bda6ac-032c-44e0-9b40-e0522796a6d2_end--> ID: e4bda6ac-032c-44e0-9b40-e0522796a6d2 #### Enable Autoscaling for your system node pools To ensure your system pods are scheduled even during times of high load, enable autoscaling on your system node pool. - + +Potential benefits: Enabling Autoscaler for system node pool ensures system pods are scheduled and cluster can function. + For More information, see [Use the cluster autoscaler in Azure Kubernetes Service (AKS)](/azure/aks/cluster-autoscaler?tabs=azure-cli#before-you-begin) -ID: 70829b1a-272b-4728-b418-8f1a56432d33 <!--70829b1a-272b-4728-b418-8f1a56432d33_end--> ID: 70829b1a-272b-4728-b418-8f1a56432d33 #### Have at least 2 nodes in your system node pool Ensure your system node pools have at least 2 nodes for reliability of your system pods. With a single node, your cluster can fail in the event of a node or hardware failure. - + +Potential benefits: Having 2 nodes ensures resiliency against node failures. + For More information, see [Manage system node pools in Azure Kubernetes Service (AKS)](/azure/aks/use-system-pools?tabs=azure-cli#system-and-user-node-pools) -ID: a9228ae7-4386-41be-b527-acd59fad3c79 <!--a9228ae7-4386-41be-b527-acd59fad3c79_end--> ID: a9228ae7-4386-41be-b527-acd59fad3c79 #### Create a dedicated system node pool A cluster without a dedicated system node pool is less reliable. We recommend you dedicate system node pools to only serve critical system pods, preventing resource starvation between system and competing user pods. Enforce this behavior with the CriticalAddonsOnly=true:NoSchedule taint on the pool. - + +Potential benefits: Ensures cluster reliability by preventing resource scarcity for core system pods + For More information, see [Manage system node pools in Azure Kubernetes Service (AKS)](/azure/aks/use-system-pools?tabs=azure-cli#before-you-begin) -ID: f31832f1-7e87-499d-a52a-120f610aba98 <!--f31832f1-7e87-499d-a52a-120f610aba98_end--> ID: f31832f1-7e87-499d-a52a-120f610aba98 #### Ensure B-series Virtual Machine's (VMs) aren't used in production environments When a cluster has one or more node pools using a non-recommended burstable VM SKU, full vCPU capability 100% is unguaranteed. Ensure B-series VM's aren't used in production environments. - + +Potential benefits: Best practice for consistent performance + For More information, see [B-series burstable virtual machine sizes](/azure/virtual-machines/sizes-b-series-burstable) -ID: fac2ad84-1421-4dd3-8477-9d6e605392b4 <!--fac2ad84-1421-4dd3-8477-9d6e605392b4_end--> ID: fac2ad84-1421-4dd3-8477-9d6e605392b4 #### Configure AD DS Site for Azure Netapp Files AD Connector If Azure NetApp Files can't reach assigned AD DS site domain controllers, the domain controller discovery process queries all domain controllers. Unreachable domain controllers may be used, causing issues with volume creation, client queries, authentication, and AD connection modifications. - + +Potential benefits: Optimize DNS Connectivity with Azure Netapp Files + For More information, see [Understand guidelines for Active Directory Domain Services site design and planning for Azure NetApp Files](https://aka.ms/anfsitescoping) -ID: 2e795f35-fce6-48dc-a5ac-6860cb9a0442 <!--2e795f35-fce6-48dc-a5ac-6860cb9a0442_end--> ID: 2e795f35-fce6-48dc-a5ac-6860cb9a0442 #### Ensure Roles assigned to Microsoft.NetApp Delegated Subnet has Subnet Read Permissions Roles that are required for the management of Azure NetApp Files resources, must have "Microsoft.network/virtualNetworks/subnets/read" permissions on the subnet that is delegated to Microsoft.NetApp If the role, whether Custom or Built-In doesn't have this permission, then Volume Creations will fail - -ID: 4e112555-7dc0-4f33-85e7-18398ac41345 +Potential benefits: Prevent volume creation failures by ensuring subnet/read permissions + + <!--4e112555-7dc0-4f33-85e7-18398ac41345_end--> ID: 4e112555-7dc0-4f33-85e7-18398ac41345 #### Review SAP configuration for timeout values used with Azure NetApp Files High availability of SAP while used with Azure NetApp Files relies on setting proper timeout values to prevent disruption to your application. Review the 'Learn more' link to ensure your configuration meets the timeout values as noted in the documentation. - + +Potential benefits: Improve resiliency of SAP Application on ANF + For More information, see [Use Azure to host and run SAP workload scenarios](/azure/sap/workloads/get-started) -ID: 8754f0ed-c82a-497e-be31-c9d701c976e1 <!--8754f0ed-c82a-497e-be31-c9d701c976e1_end--> ID: 8754f0ed-c82a-497e-be31-c9d701c976e1 #### Implement disaster recovery strategies for your Azure NetApp Files resources To avoid data or functionality loss during a regional or zonal disaster, implement common disaster recovery techniques such as cross region replication or cross zone replication for your Azure NetApp Files volumes. - + +Potential benefits: Manage disaster recovery easily with Azure NetApp Files replication features + For More information, see [Understand data protection and disaster recovery options in Azure NetApp Files](https://aka.ms/anfcrr) -ID: cda11061-35a8-4ca3-aa03-b242dcdf7319 <!--cda11061-35a8-4ca3-aa03-b242dcdf7319_end--> ID: cda11061-35a8-4ca3-aa03-b242dcdf7319 #### Azure Netapp Files - Enable Continuous Availability for SMB Volumes For Continuous Availability, we recommend enabling Server Message Block (SMB) volume for your Azure Netapp Files. - + +Potential benefits: Prevent application disruptions by enabling Continuous Availability for SMB volumes + For More information, see [Enable Continuous Availability on existing SMB volumes](https://aka.ms/anfdoc-continuous-availability) -ID: e4bebd74-387a-4a74-b757-475d2d1b4e3e <!--e4bebd74-387a-4a74-b757-475d2d1b4e3e_end--> ID: e4bebd74-387a-4a74-b757-475d2d1b4e3e #### Enable soft delete for your Recovery Services vaults Soft delete helps you retain your backup data in the Recovery Services vault for an additional duration after deletion, giving you an opportunity to retrieve it before it's permanently deleted. - + +Potential benefits: Helps recovery of backup data in cases of accidental deletion + For More information, see [Soft delete for Azure Backup](/azure/backup/backup-azure-security-feature-cloud) -ID: 3ebfaf53-4d8c-4e67-a948-017bbbf59de6 <!--3ebfaf53-4d8c-4e67-a948-017bbbf59de6_end--> ID: 3ebfaf53-4d8c-4e67-a948-017bbbf59de6 #### Enable Cross Region Restore for your recovery Services Vault Cross Region Restore (CRR) allows you to restore Azure VMs in a secondary region (an Azure paired region), helping with disaster recovery. - + +Potential benefits: As one of the restore options, Cross Region Restore (CRR) allows you to restore Azure VMs in a secondary region, which is an Azure paired region. + For More information, see [How to restore Azure VM data in Azure portal](/azure/backup/backup-azure-arm-restore-vms#cross-region-restore) -ID: 9b1308f1-4c25-4347-a061-7cc5cd6a44ab <!--9b1308f1-4c25-4347-a061-7cc5cd6a44ab_end--> ID: 9b1308f1-4c25-4347-a061-7cc5cd6a44ab #### Upgrade Application Configuration Service to Gen 2 We notice you are still using Application Configuration Service Gen1 which will be end of support by April 2024. Application Configuration Service Gen2 provides better performance compared to Gen1 and the upgrade from Gen1 to Gen2 is zero downtime so we recommend to upgrade as soon as possible. - + +Potential benefits: Higher stability and availability + For More information, see [Use Application Configuration Service for Tanzu](https://aka.ms/AsaAcsUpgradeToGen2) -ID: 39d862c8-445c-40c6-ba59-0e86134df606 <!--39d862c8-445c-40c6-ba59-0e86134df606_end--> <!--microsoft_appplatform_end> ID: 39d862c8-445c-40c6-ba59-0e86134df606 #### Enable cross region disaster recovery for SQL Database Enable cross region disaster recovery for Azure SQL Database for business continuity in the event of regional outage. - + +Potential benefits: Enabling disaster recovery creates a continuously synchronized readable secondary database for a primary database. + For More information, see [Overview of business continuity with Azure SQL Database](https://aka.ms/sqldb_dr_overview) -ID: 2ea11bcb-dfd0-48dc-96f0-beba578b989a <!--2ea11bcb-dfd0-48dc-96f0-beba578b989a_end--> ID: 2ea11bcb-dfd0-48dc-96f0-beba578b989a #### Enable zone redundancy for Azure SQL Database to achieve high availability and resiliency. To achieve high availability and resiliency, enable zone redundancy for the SQL database or elastic pool to use availability zones and ensure the database or elastic pool is resilient to zonal failures. - + +Potential benefits: Enabling zone redundancy ensures Azure SQL Database is resilient to zonal hardware and software failures and the recovery is transparent to applications. + For More information, see [Availability through redundancy - Azure SQL Database](/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-powershell#zone-redundant-availability) -ID: 807e58d0-e385-41ad-987b-4a4b3e3fb563 <!--807e58d0-e385-41ad-987b-4a4b3e3fb563_end--> ID: 807e58d0-e385-41ad-987b-4a4b3e3fb563 #### Upgrade to the latest version of AKS enabled by Arc Upgrade to the latest version of API/SDK of AKS enabled by Azure Arc for new functionality and improved stability. - + +Potential benefits: The latest version of AKS enabled by Azure Arc with new functionality and improved stability. + For More information, see [https://azure.github.io/azure-sdk/releases/latest/https://docsupdatetracker.net/index.html](https://azure.github.io/azure-sdk/releases/latest/https://docsupdatetracker.net/index.html) -ID: 09e56b5a-9a00-47a7-82dd-9bd9569eb6ed <!--09e56b5a-9a00-47a7-82dd-9bd9569eb6ed_end--> ID: 09e56b5a-9a00-47a7-82dd-9bd9569eb6ed #### Upgrade to the latest version of AKS enabled by Arc Upgrade to the latest version of API/SDK of AKS enabled by Azure Arc for new functionality and improved stability. - + +Potential benefits: The latest version of AKS enabled by Azure Arc with new functionality and improved stability. + For More information, see [https://azure.github.io/azure-sdk/releases/latest/https://docsupdatetracker.net/index.html](https://azure.github.io/azure-sdk/releases/latest/https://docsupdatetracker.net/index.html) -ID: 2ac72093-309f-41ec-bf9d-55e9fc490563 <!--2ac72093-309f-41ec-bf9d-55e9fc490563_end--> ID: 2ac72093-309f-41ec-bf9d-55e9fc490563 #### Action required: Migrate classic storage accounts by 8/30/2024. Migrate your classic storage accounts to Azure Resource Manager to ensure business continuity. Azure Resource Manager will provide all of the same functionality plus a consistent management layer, resource grouping, and access to new features and updates. - -ID: fd04ff97-d3b3-470a-9544-dfea3a5708db +Potential benefits: Ensure the ability to manage your data by migrating your classic storage account(s) + + <!--fd04ff97-d3b3-470a-9544-dfea3a5708db_end--> <!--microsoft_classicstorage_end> ID: fd04ff97-d3b3-470a-9544-dfea3a5708db #### Migrate off Cloud Services (classic) before 31 August 2024 Cloud Services (classic) is retiring. To avoid any loss of data or business continuity, migrate off before 31 Aug 2024. - + +Potential benefits: Continuity of your service + For More information, see [Migrate Azure Cloud Services (classic) to Azure Cloud Services (extended support)](https://aka.ms/ExternalRetirementEmailMay2022) -ID: 13ff4efb-6c84-4684-8838-52c123e3e3a2 <!--13ff4efb-6c84-4684-8838-52c123e3e3a2_end--> <!--microsoft_classiccompute_end> ID: 13ff4efb-6c84-4684-8838-52c123e3e3a2 #### Upgrade your application to use the latest API version from Azure OpenAI An Azure OpenAI resource with an older API version lacks the latest features and functionalities. We recommend that you use the latest REST API version. - + +Potential benefits: Our new API versions contain the latest and greatest features and capabilities. + For More information, see [Azure OpenAI Service REST API reference](/azure/cognitive-services/openai/reference) -ID: 13fed411-54aa-4923-b830-23b51539d79d <!--13fed411-54aa-4923-b830-23b51539d79d_end--> ID: 13fed411-54aa-4923-b830-23b51539d79d #### Quota exceeded for this resource, wait or upgrade to unblock If the quota for your resource is exceeded your resource becomes blocked. You can wait for the quota to automatically get replenished soon, or, to use the resource again now, upgrade it to a paid SKU. - + +Potential benefits: If you upgrade to a paid SKU you can use the resource again today. + For More information, see [Plan and manage costs for Azure AI Studio](/azure/cognitive-services/plan-manage-costs#pay-as-you-go) -ID: 3f83aee8-222d-445c-9a46-2af5fe5b4777 <!--3f83aee8-222d-445c-9a46-2af5fe5b4777_end--> ID: 3f83aee8-222d-445c-9a46-2af5fe5b4777 #### Use Premium tier for critical production workloads Premium registries provide the highest amount of included storage, concurrent operations and network bandwidth, enabling high-volume scenarios. The Premium tier also adds features such as geo-replication, availability zone support, content-trust, customer-managed keys and private endpoints. - + +Potential benefits: The Premium tier provides the highest amount of performance, scale and resiliency options + For More information, see [Azure Container Registry service tiers](https://aka.ms/AAqwyv6) -ID: af0cdbce-c610-499b-9bd7-b169cdb1bb2e <!--af0cdbce-c610-499b-9bd7-b169cdb1bb2e_end--> ID: af0cdbce-c610-499b-9bd7-b169cdb1bb2e #### Ensure Geo-replication is enabled for resilience Geo-replication enables workloads to use a single image, tag and registry name across regions, provides network-close registry access, reduced data transfer costs and regional Registry resilience if a regional outage occurs. This feature is only available in the Premium service tier. - + +Potential benefits: Improved resilience and pull performance, simplified registry management and reduced data transfer costs + For More information, see [Geo-replication in Azure Container Registry](https://aka.ms/AAqwx90) -ID: dcfa2602-227e-4b6c-a60d-7b1f6514e690 <!--dcfa2602-227e-4b6c-a60d-7b1f6514e690_end--> ID: dcfa2602-227e-4b6c-a60d-7b1f6514e690 #### Azure CDN From Edgio, Managed Certificate Renewal Unsuccessful. Additional Validation Required. Azure CDN from Edgio employs CNAME delegation to renew certificates with DigiCert for managed certificate renewals. It's essential that Custom Domains resolve to an azureedge.net endpoint for the automatic renewal process with DigiCert to be successful. Ensure your Custom Domain's CNAME and CAA records are configured correctly. Should you require further assistance, please submit a support case to Azure to re-attempt the renewal request. - -ID: ceecfd41-89b3-4c64-afe6-984c9cc03126 +Potential benefits: Ensure service availability. + + <!--ceecfd41-89b3-4c64-afe6-984c9cc03126_end--> ID: ceecfd41-89b3-4c64-afe6-984c9cc03126 #### Renew the expired Azure Front Door customer certificate to avoid service disruption When customer certificates for Azure Front Door Standard and Premium profiles expire, you might have service disruptions. To avoid service disruption, renew the certificate before it expires. - + +Potential benefits: Ensure service availability. + For More information, see [Configure HTTPS on an Azure Front Door custom domain by using the Azure portal](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain#use-your-own-certificate) -ID: 4e1c2077-7c73-4ace-b4aa-f11b36c28290 <!--4e1c2077-7c73-4ace-b4aa-f11b36c28290_end--> ID: 4e1c2077-7c73-4ace-b4aa-f11b36c28290 #### Re-validate domain ownership for the Azure Front Door managed certificate renewal Azure Front Door (AFD) can't automatically renew the managed certificate because the domain isn't CNAME mapped to AFD endpoint. For the managed certificate to be automatically renewed, revalidate domain ownership. - + +Potential benefits: undefined + For More information, see [Configure a custom domain on Azure Front Door by using the Azure portal](/azure/frontdoor/standard-premium/how-to-add-custom-domain#domain-validation-state) -ID: bfe85fd2-ee53-4c35-8781-7790da2107e1 <!--bfe85fd2-ee53-4c35-8781-7790da2107e1_end--> ID: bfe85fd2-ee53-4c35-8781-7790da2107e1 #### Switch Secret version to 'Latest' for the Azure Front Door customer certificate Configure the Azure Front Door (AFD) customer certificate secret to 'Latest' for the AFD to refer to the latest secret version in Azure Key Vault, allowing the secret can be automatically rotated. - + +Potential benefits: LatestΓÇÖ version can be automatically rotated. + For More information, see [Configure HTTPS on an Azure Front Door custom domain by using the Azure portal](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain#certificate-renewal-and-changing-certificate-types) -ID: 2c057605-4707-4d3e-bbb0-a7fe9b6a626b <!--2c057605-4707-4d3e-bbb0-a7fe9b6a626b_end--> ID: 2c057605-4707-4d3e-bbb0-a7fe9b6a626b #### Validate domain ownership by adding DNS TXT record to DNS provider Validate domain ownership by adding the DNS TXT record to your DNS provider. Validating domain ownership through TXT records enhances security and ensures proper control over your domain. - + +Potential benefits: Ensure service availability. + For More information, see [Configure a custom domain on Azure Front Door by using the Azure portal](/azure/frontdoor/standard-premium/how-to-add-custom-domain#domain-validation-state) -ID: 9411bc9f-d181-497c-b519-4154ae04fb00 <!--9411bc9f-d181-497c-b519-4154ae04fb00_end--> ID: 9411bc9f-d181-497c-b519-4154ae04fb00 #### Implement BCDR strategy for cross region redundancy in Azure Data Factory Implementing BCDR strategy improves high availability and reduced risk of data loss - + +Potential benefits: Improves high availability and reduced risk of data loss + For More information, see [BCDR for Azure Data Factory and Azure Synapse Analytics pipelines - Azure Architecture Center ](https://aka.ms/AArn7ln) -ID: 617ee02c-be69-441e-8294-dee5a237efff <!--617ee02c-be69-441e-8294-dee5a237efff_end--> ID: 617ee02c-be69-441e-8294-dee5a237efff #### Enable auto upgrade on your SHIR Auto-upgrade of Self-hosted Integration runtime has been disabled. Know that you aren't getting the latest changes and bug fixes on the Self-Hosted Integration runtime. Review them to enable the SHIR auto upgrade - + +Potential benefits: To get the latest changes and bug fixes on the Self-Hosted Integration runtime + For More information, see [Self-hosted integration runtime auto-update and expire notification](https://aka.ms/shirexpirynotification) -ID: 939b97dc-fdca-4324-ba36-6ea7e1ab399b <!--939b97dc-fdca-4324-ba36-6ea7e1ab399b_end--> ID: 939b97dc-fdca-4324-ba36-6ea7e1ab399b #### Azure Fluid Relay client library should be upgraded If the Azure Fluid Relay service is invoked with an old client library, it might cause appplication problems. To ensure your application remains operational, upgrade your Azure Fluid Relay client library to the latest version. Upgrading provides the most up-to-date functionality, and enhancements in performance and stability. - + +Potential benefits: Improved reliability + For More information, see [Version compatibility with Fluid Framework releases](/azure/azure-fluid-relay/concepts/version-compatibility) -ID: a5e8a0f8-2c84-407a-b3d8-f371d684363b <!--a5e8a0f8-2c84-407a-b3d8-f371d684363b_end--> <!--microsoft_fluidrelay_end> ID: a5e8a0f8-2c84-407a-b3d8-f371d684363b #### Apply critical updates by dropping and recreating your HDInsight clusters (certificate rotation round 2) The HDInsight service attempted to apply a critical certificate update on your running clusters. However, due to some custom configuration changes, we're unable to apply the updates on all clusters. To prevent those clusters from becoming unhealthy and unusable, drop and recreate your clusters. - + +Potential benefits: Ensure cluster health and stability + For More information, see [Set up clusters in HDInsight with Apache Hadoop, Apache Spark, Apache Kafka, and more](/azure/hdinsight/hdinsight-hadoop-provision-linux-clusters) -ID: 69740e3e-5b96-4b0e-b9b8-4d7573e3611c <!--69740e3e-5b96-4b0e-b9b8-4d7573e3611c_end--> ID: 69740e3e-5b96-4b0e-b9b8-4d7573e3611c #### Non-ESP ABFS clusters [Cluster Permissions for Word Readable] Plan to introduce a change in non-ESP ABFS clusters, which restricts non-Hadoop group users from running Hadoop commands for storage operations. This change is to improve cluster security posture. Customers need to plan for the updates before September 30, 2023. - + +Potential benefits: This change is to improve cluster security posture + For More information, see [Azure HDInsight release notes](https://aka.ms/hdireleasenotes) -ID: 24acd95e-fc9f-490c-b32d-edc6d747d0bc <!--24acd95e-fc9f-490c-b32d-edc6d747d0bc_end--> ID: 24acd95e-fc9f-490c-b32d-edc6d747d0bc #### Restart brokers on your Kafka Cluster Disks When data disks used by Kafka brokers in HDInsight clusters are almost full, the Apache Kafka broker process can't start and fails. To mitigate, find the retention time for every topic, back up the files that are older, and restart the brokers. - + +Potential benefits: Avoid Kafka broker issues + For More information, see [Scenario: Brokers are unhealthy or can't restart due to disk space full issue](https://aka.ms/kafka-troubleshoot-full-disk) -ID: 35e3a19f-16e7-4bb1-a7b8-49e02a35af2e <!--35e3a19f-16e7-4bb1-a7b8-49e02a35af2e_end--> ID: 35e3a19f-16e7-4bb1-a7b8-49e02a35af2e #### Cluster Name length update The max length of cluster name will be changed to 45 from 59 characters, to improve the security posture of clusters. This change will be implemented by September 30th, 2023. - + +Potential benefits: Security posture improvement for HDInsight + For More information, see [Azure HDInsight release notes](/azure/hdinsight/hdinsight-release-notes) -ID: 41a248ef-50d4-4c48-81fb-13196f957210 <!--41a248ef-50d4-4c48-81fb-13196f957210_end--> ID: 41a248ef-50d4-4c48-81fb-13196f957210 #### Upgrade your cluster to the the latest HDInsight image A cluster created one year ago doesn't have the latest image upgrades. Your cluster was created 1 year ago. As part of the best practices, we recommend you use the latest HDInsight images for the best open source updates, Azure updates, and security fixes. The recommended maximum duration for cluster upgrades is less than six months. - + +Potential benefits: Get the latest fixes and features + For More information, see [Consider the below points before starting to create a cluster.](/azure/hdinsight/hdinsight-overview-before-you-start#keep-your-clusters-up-to-date) -ID: 8f163c95-0029-4139-952a-42bd0d773b93 <!--8f163c95-0029-4139-952a-42bd0d773b93_end--> ID: 8f163c95-0029-4139-952a-42bd0d773b93 <!--97355d8e-59ae-43ff-9214-d4acf728467a_begin--> #### Upgrade your HDInsight Cluster -A cluster not using the latest image doesn't have the latest upgrades. Your cluster is not using the latest image. We recommend you use the latest versions of HDInsight images for the best of open source updates, Azure updates, and security fixes. HDInsight releases happen every 30 to 60 days. - +A cluster not using the latest image doesn't have the latest upgrades. Your cluster isn't using the latest image. We recommend you use the latest versions of HDInsight images for the best of open source updates, Azure updates, and security fixes. HDInsight releases happen every 30 to 60 days. + +Potential benefits: Get the latest fixes and features + For More information, see [Azure HDInsight release notes](/azure/hdinsight/hdinsight-release-notes) -ID: 97355d8e-59ae-43ff-9214-d4acf728467a <!--97355d8e-59ae-43ff-9214-d4acf728467a_end--> ID: 97355d8e-59ae-43ff-9214-d4acf728467a #### Gateway or virtual machine not reachable We have detected a Network prob failure, it indicates unreachable gateway or a virtual machine. Verify all cluster hostsΓÇÖ availability. Restart virtual machine to recover. If you need further assistance, don't hesitate to contact Azure support for help. - -ID: b3bf9f14-c83e-4dd3-8f5c-a6be746be173 +Potential benefits: Improved availability + + <!--b3bf9f14-c83e-4dd3-8f5c-a6be746be173_end--> ID: b3bf9f14-c83e-4dd3-8f5c-a6be746be173 Our records indicate that one or more of your clusters are using images dated February 2022 or older (image versions 2202xxxxxx or older). There is a potential reliability issue on HDInsight clusters that use images dated February 2022 or older.Consider rebuilding your clusters with latest image. - -ID: e4635832-0ab1-48b1-a386-c791197189e6 +Potential benefits: Improved Reliability in Scaling and Network connectivity + + <!--e4635832-0ab1-48b1-a386-c791197189e6_end--> ID: e4635832-0ab1-48b1-a386-c791197189e6 #### Increase Media Services quotas or limits When a media account hits its quota limits, disruption of service might occur. To avoid any disruption of service, review current usage of assets, content key policies, and stream policies and increase quota limits for the entities that are close to hitting the limit. You can request quota limits be increased by opening a ticket and adding relevant details. TIP: Don't create additional Azure Media accounts in an attempt to obtain higher limits. - + +Potential benefits: Avoid any disruption to service due to customer exceeding quota limits. + For More information, see [Azure Media Services quotas and limits](https://aka.ms/ams-quota-recommendation/) -ID: b7c9fd99-a979-40b4-ab48-b1dfab6bb41a <!--b7c9fd99-a979-40b4-ab48-b1dfab6bb41a_end--> <!--microsoft_media_end> ID: b7c9fd99-a979-40b4-ab48-b1dfab6bb41a #### Use Service Bus premium tier for improved resilience When running critical applications, the Service Bus premium tier offers better resource isolation at the CPU and memory level, enhancing availability. It also supports Geo-disaster recovery feature enabling easier recovery from regional disasters without having to change application configurations. - + +Potential benefits: Service Bus premium tier offers better resiliency with CPU and memory resource isolation as well as Geo-disaster recovery + For More information, see [Service Bus premium messaging tier](https://aka.ms/asb-premium) -ID: 29765e2c-5286-4039-963f-f8231e56cc3e <!--29765e2c-5286-4039-963f-f8231e56cc3e_end--> ID: 29765e2c-5286-4039-963f-f8231e56cc3e #### Use Service Bus autoscaling feature in the premium tier for improved resilience When running critical applications, enabling the auto scale feature allows you to have enough capacity to handle the load on your application. Having the right amount of resources running can reduce throttling and provide a better user experience. - + +Potential benefits: Enabling autoscale prevents users from capacity constraints + For More information, see [Automatically update messaging units of an Azure Service Bus namespace](https://aka.ms/asb-autoscale) -ID: 68e62f5c-4ed1-4b78-a2a0-4d9a4cebf106 <!--68e62f5c-4ed1-4b78-a2a0-4d9a4cebf106_end--> ID: 68e62f5c-4ed1-4b78-a2a0-4d9a4cebf106 #### Enable Azure backup for SQL on your virtual machines For the benefits of zero-infrastructure backup, point-in-time restore, and central management with SQL AG integration, enable backups for SQL databases on your virtual machines using Azure backup. - + +Potential benefits: SQL aware backups with no-infra for backup, centralized management, AG integration and point-in-time restore + For More information, see [About SQL Server Backup in Azure VMs](/azure/backup/backup-azure-sql-database) -ID: 77f01e65-e57f-40ee-a0e9-e18c007d4d4c <!--77f01e65-e57f-40ee-a0e9-e18c007d4d4c_end--> <!--microsoft_sqlvirtualmachine_end> ID: 77f01e65-e57f-40ee-a0e9-e18c007d4d4c #### Use Managed Disks for storage accounts reaching capacity limit When Premium SSD unmanaged disks in storage accounts are about to reach their Premium Storage capacity limit, failures might occur. To avoid failures when this limit is reached, migrate to Managed Disks that don't have an account capacity limit. This migration can be done through the portal in less than 5 minutes. - + +Potential benefits: Avoid scale issues when account reaches capacity limit + For More information, see [Scalability and performance targets for standard storage accounts](https://aka.ms/premium_blob_quota) -ID: d42d751d-682d-48f0-bc24-bb15b61ac4b8 <!--d42d751d-682d-48f0-bc24-bb15b61ac4b8_end--> ID: d42d751d-682d-48f0-bc24-bb15b61ac4b8 #### Configure blob backup Azure blob backup helps protect data from accidental or malicious deletion. We recommend that you configure blob backup. - + +Potential benefits: Protect data from accidental or malicious deletion + For More information, see [Overview of Azure Blob backup](/azure/backup/blob-backup-overview) -ID: 8ef907f4-f8e3-4bf1-962d-27e005a7d82d <!--8ef907f4-f8e3-4bf1-962d-27e005a7d82d_end--> ID: 8ef907f4-f8e3-4bf1-962d-27e005a7d82d #### Turn on Azure Backup to get simple, reliable, and cost-effective protection for your data Keep your information and applications safe with robust, one click backup from Azure. Activate Azure Backup to get cost-effective protection for a wide range of workloads including VMs, SQL databases, applications, and file shares. - + +Potential benefits: Ensure your business-critical applications stay protected + For More information, see [Azure Backup Documentation - Azure Backup ](/azure/backup/) -ID: 9e91a63f-faaf-46f2-ac7c-ddfcedf13366 <!--9e91a63f-faaf-46f2-ac7c-ddfcedf13366_end--> ID: 9e91a63f-faaf-46f2-ac7c-ddfcedf13366 #### Create an Azure Service Health alert Azure Service Health alerts keep you informed about issues and advisories in four areas (Service issues, Planned maintenance, Security and Health advisories). These alerts are personalized to notify you about disruptions or potential impacts on your chosen Azure regions and services. - + +Potential benefits: Stay informed about issues and advisories across 4 areas (Service issues, Planned maintenance, Security advisories and Health advisories) + For More information, see [Create activity log alerts on service notifications using the Azure portal](https://aka.ms/aa_servicehealthalert_action) -ID: 242639fd-cd73-4be2-8f55-70478db8d1a5 <!--242639fd-cd73-4be2-8f55-70478db8d1a5_end--> ID: 242639fd-cd73-4be2-8f55-70478db8d1a5 #### Improve data reliability by using Managed Disks Virtual machines in an Availability Set with disks that share either storage accounts or storage scale units aren't resilient to single storage scale unit failures during outages. Migrate to Azure Managed Disks to ensure that the disks of different VMs in the Availability Set are sufficiently isolated to avoid a single point of failure. - + +Potential benefits: Ensure business continuity through data resilience + For More information, see [https://aka.ms/aa_avset_manageddisk_learnmore](https://aka.ms/aa_avset_manageddisk_learnmore) -ID: 02cfb5ef-a0c1-4633-9854-031fbda09946 <!--02cfb5ef-a0c1-4633-9854-031fbda09946_end--> ID: 02cfb5ef-a0c1-4633-9854-031fbda09946 #### Enable virtual machine replication to protect your applications from regional outage Virtual machines are resilient to regional outages when replication to another region is enabled. To reduce adverse business impact during an Azure region outage, we recommend enabling replication of all business-critical virtual machines. - + +Potential benefits: Ensure business continuity in case of any Azure region outage + For More information, see [Quickstart: Set up disaster recovery to a secondary Azure region for an Azure VM](https://aka.ms/azure-site-recovery-dr-azure-vms) -ID: ed651749-cd37-4fd5-9897-01b416926745 <!--ed651749-cd37-4fd5-9897-01b416926745_end--> ID: ed651749-cd37-4fd5-9897-01b416926745 #### Update your outbound connectivity protocol to Service Tags for Azure Site Recovery IP address-based allowlisting is a vulnerable way to control outbound connectivity for firewalls, Service Tags are a good alternative. We highly recommend the use of Service Tags, to allow connectivity to Azure Site Recovery services for the machines. - + +Potential benefits: Ensures better security, stability and resiliency than hard coded IP Addresses + For More information, see [About networking in Azure VM disaster recovery](https://aka.ms/azure-site-recovery-using-service-tags) -ID: bcfeb92b-fe93-4cea-adc6-e747055518e9 <!--bcfeb92b-fe93-4cea-adc6-e747055518e9_end--> ID: bcfeb92b-fe93-4cea-adc6-e747055518e9 #### Upgrade the standard disks attached to your premium-capable VM to premium disks Using Standard SSD disks with premium VMs may lead to suboptimal performance and latency issues. We recommend that you consider upgrading the standard disks to premium disks. For any Single Instance Virtual Machine using premium storage for all Operating System Disks and Data Disks, we guarantee Virtual Machine Connectivity of at least 99.9%. When choosing to upgrade, there are two factors to consider. The first factor is that upgrading requires a VM reboot and that takes 3-5 minutes to complete. The second is if the VMs in the list are mission-critical production VMs, evaluate the improved availability against the cost of premium disks. - + +Potential benefits: Improved availability with single VM SLA available only when all disks are premium + For More information, see [Azure managed disk types](https://aka.ms/aa_storagestandardtopremium_learnmore) -ID: 58d6648d-32e8-4346-827c-4f288dd8ca24 <!--58d6648d-32e8-4346-827c-4f288dd8ca24_end--> ID: 58d6648d-32e8-4346-827c-4f288dd8ca24 #### Upgrade VM from Premium Unmanaged Disks to Managed Disks at no additional cost Azure Managed Disks provide higher resiliency, simplified service management, higher scale target and more choices among several disk types. Your VM is using premium unmanaged disks that can be migrated to managed disks at no additional cost through the portal in less than 5 minutes. - + +Potential benefits: Leverage higher resiliency and other benefits of Managed Disks + For More information, see [Introduction to Azure managed disks](https://aka.ms/md_overview) -ID: 57ecb3cd-f2b4-4cad-8b3a-232cca527a0b <!--57ecb3cd-f2b4-4cad-8b3a-232cca527a0b_end--> ID: 57ecb3cd-f2b4-4cad-8b3a-232cca527a0b #### Upgrade your deprecated Virtual Machine image to a newer image Virtual Machines (VMs) in your subscription are running on images scheduled for deprecation. Once the image is deprecated, new VMs can't be created from the deprecated image. To prevent disruption to your workloads, upgrade to a newer image. (VMRunningDeprecatedImage) - + +Potential benefits: Minimize any potential disruptions to your VM workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 11f04d70-5bb3-4065-b717-1f11b2e050a8 <!--11f04d70-5bb3-4065-b717-1f11b2e050a8_end--> ID: 11f04d70-5bb3-4065-b717-1f11b2e050a8 #### Upgrade to a newer offer of Virtual Machine image Virtual Machines (VMs) in your subscription are running on images scheduled for deprecation. Once the image is deprecated, new VMs can't be created from the deprecated image. To prevent disruption to your workloads, upgrade to a newer image. (VMRunningDeprecatedOfferLevelImage) - + +Potential benefits: Minimize any potential disruptions to your VM workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 937d85a4-11b2-4e13-a6b5-9e15e3d74d7b <!--937d85a4-11b2-4e13-a6b5-9e15e3d74d7b_end--> ID: 937d85a4-11b2-4e13-a6b5-9e15e3d74d7b #### Upgrade to a newer SKU of Virtual Machine image Virtual Machines (VMs) in your subscription are running on images scheduled for deprecation. Once the image is deprecated, new VMs can't be created from the deprecated image. To prevent disruption to your workloads, upgrade to a newer image. - + +Potential benefits: Minimize any potential disruptions to your VM workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 681acf17-11c3-4bdd-8f71-da563c79094c <!--681acf17-11c3-4bdd-8f71-da563c79094c_end--> ID: 681acf17-11c3-4bdd-8f71-da563c79094c #### Upgrade your Virtual Machine Scale Set to alternative image version VMSS in your subscription are running on images that have been scheduled for deprecation. Once the image is deprecated, your Virtual Machine Scale Set workloads would no longer scale out. Upgrade to newer version of the image to prevent disruption to your workload. - + +Potential benefits: Minimize any potential disruptions to your Virtual Machine Scale Set workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 3b739bd1-c193-4bb6-a953-1362ee3b03b2 <!--3b739bd1-c193-4bb6-a953-1362ee3b03b2_end--> ID: 3b739bd1-c193-4bb6-a953-1362ee3b03b2 #### Upgrade your Virtual Machine Scale Set to alternative image offer VMSS in your subscription are running on images that have been scheduled for deprecation. Once the image is deprecated, your Virtual Machine Scale Set workloads would no longer scale out. To prevent disruption to your workload, upgrade to newer offer of the image. - + +Potential benefits: Minimize any potential disruptions to your Virtual Machine Scale Set workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 3d18d7cd-bdec-4c68-9160-16a677d0f86a <!--3d18d7cd-bdec-4c68-9160-16a677d0f86a_end--> ID: 3d18d7cd-bdec-4c68-9160-16a677d0f86a #### Upgrade your Virtual Machine Scale Set to alternative image SKU VMSS in your subscription are running on images that have been scheduled for deprecation. Once the image is deprecated, your Virtual Machine Scale Set workloads would no longer scale out. To prevent disruption to your workload, upgrade to newer SKU of the image. - + +Potential benefits: Minimize any potential disruptions to your Virtual Machine Scale Set workloads + For More information, see [Deprecated Azure Marketplace images - Azure Virtual Machines ](https://aka.ms/DeprecatedImagesFAQ) -ID: 44abb62e-7789-4f2f-8001-fa9624cb3eb3 <!--44abb62e-7789-4f2f-8001-fa9624cb3eb3_end--> ID: 44abb62e-7789-4f2f-8001-fa9624cb3eb3 #### Provide access to mandatory URLs missing for your Azure Virtual Desktop environment For a session host to deploy and register to Windows Virtual Desktop (WVD) properly, you need a set of URLs in the 'allowed list' in case your VM runs in a restricted environment. For specific URLs missing from your allowed list, search your application event log for event 3702. - + +Potential benefits: Ensure successful deployment and session host functionality when using Windows Virtual Desktop service + For More information, see [Required FQDNs and endpoints for Azure Virtual Desktop](/azure/virtual-desktop/safe-url-list) -ID: 53e0a3cb-3569-474a-8d7b-7fd06a8ec227 <!--53e0a3cb-3569-474a-8d7b-7fd06a8ec227_end--> ID: 53e0a3cb-3569-474a-8d7b-7fd06a8ec227 #### Align location of resource and resource group To reduce the impact of region outages, co-locate your resources with their resource group in the same region. This way, Azure Resource Manager stores metadata related to all resources within the group in one region. By co-locating, you reduce the chance of being affected by region unavailability. - + +Potential benefits: Reduce write failures due to region outages + For More information, see [What is Azure Resource Manager?](/azure/azure-resource-manager/management/overview#resource-group-location-alignment) -ID: 00e4ac6c-afa3-4578-a021-5f15e18850a2 <!--00e4ac6c-afa3-4578-a021-5f15e18850a2_end--> ID: 00e4ac6c-afa3-4578-a021-5f15e18850a2 #### Use Availability zones for better resiliency and availability Availability Zones (AZ) in Azure help protect your applications and data from datacenter failures. Each AZ is made up of one or more datacenters equipped with independent power, cooling, and networking. By designing solutions to use zonal VMs, you can isolate your VMs from failure in any other zone. - + +Potential benefits: Usage of zonal VMs protect your apps from zonal outage in any other zones. + For More information, see [What are availability zones?](/azure/reliability/availability-zones-overview) -ID: 066a047a-9ace-45f4-ac50-6325840a6b00 <!--066a047a-9ace-45f4-ac50-6325840a6b00_end--> ID: 066a047a-9ace-45f4-ac50-6325840a6b00 #### Enable Azure Virtual Machine Scale Set (VMSS) application health monitoring Configuring Virtual Machine Scale Set application health monitoring using the Application Health extension or load balancer health probes enables the Azure platform to improve the resiliency of your application by responding to changes in application health. - + +Potential benefits: Increase resiliency by exposing application health to Azure + For More information, see [Using Application Health extension with Virtual Machine Scale Sets](https://aka.ms/vmss-app-health-monitoring) -ID: 3b587048-b04b-4f81-aaed-e43793652b0f <!--3b587048-b04b-4f81-aaed-e43793652b0f_end--> ID: 3b587048-b04b-4f81-aaed-e43793652b0f #### Enable Backups on your Virtual Machines Secure your data by enabling backups for your virtual machines. - + +Potential benefits: Protection of your Virtual Machines + For More information, see [What is the Azure Backup service?](/azure/backup/backup-overview) -ID: 651c7925-17a3-42e5-85cd-73bd095cf27f <!--651c7925-17a3-42e5-85cd-73bd095cf27f_end--> ID: 651c7925-17a3-42e5-85cd-73bd095cf27f #### Enable automatic repair policy on Azure Virtual Machine Scale Sets (VMSS) Enabling automatic instance repairs helps achieve high availability by maintaining a set of healthy instances. If an unhealthy instance is found by the Application Health extension or load balancer health probe, automatic instance repairs attempt to recover the instance by triggering repair actions. - + +Potential benefits: Increase resiliency by automating repair of failed instances + For More information, see [Automatic instance repairs for Azure Virtual Machine Scale Sets](https://aka.ms/vmss-automatic-repair) -ID: b4d988a9-85e6-4179-b69c-549bdd8a55bb <!--b4d988a9-85e6-4179-b69c-549bdd8a55bb_end--> ID: b4d988a9-85e6-4179-b69c-549bdd8a55bb #### Configure Virtual Machine Scale Set automated scaling by metrics Optimize resource utilization, reduce costs, and enhance application performance with custom autoscale based on a metric. Automatically add Virtual Machine instances based on real-time metrics such as CPU, memory, and disk operations. Ensure high availability while maintaining cost-efficiency. - + +Potential benefits: Ensures high availability while maintaining cost-efficiency + For More information, see [Overview of autoscale with Azure Virtual Machine Scale Sets](https://aka.ms/VMSSCustomAutoscaleMetric) -ID: ce8bb934-ce5c-44b3-a94c-1836fa7a269a <!--ce8bb934-ce5c-44b3-a94c-1836fa7a269a_end--> ID: ce8bb934-ce5c-44b3-a94c-1836fa7a269a #### Use Azure Disks with Zone Redundant Storage (ZRS) for higher resiliency and availability Azure Disks with ZRS provide synchronous replication of data across three Availability Zones in a region, making the disk tolerant to zonal failures without disruptions to applications. For higher resiliency and availability, migrate disks from LRS to ZRS. - + +Potential benefits: By designing your applications to use ZRS Disks, your data is replicated across 3 Availability Zones, making your disk resilient to a zonal outage + For More information, see [Convert a disk from LRS to ZRS](https://aka.ms/migratedisksfromLRStoZRS) -ID: d4102c0f-ebe3-4b22-8fe0-e488866a87af <!--d4102c0f-ebe3-4b22-8fe0-e488866a87af_end--> ID: d4102c0f-ebe3-4b22-8fe0-e488866a87af #### Configure an Always On availability group for Multi-purpose SQL servers (MPSQL) MPSQL servers with an Always On availability group have better availability. Your MPSQL servers aren't configured as part of an Always On availability group in the shared infrastructure in your Epic system. Always On availability groups improve database availability and resource use. - + +Potential benefits: Improved Database availability and resource use + For More information, see [What is an Always On availability group?](/sql/database-engine/availability-groups/windows/overview-of-always-on-availability-groups-sql-server?view=sql-server-ver16#Benefits) -ID: 3ca22452-0f8f-4701-a313-a2d83334e3cc <!--3ca22452-0f8f-4701-a313-a2d83334e3cc_end--> ID: 3ca22452-0f8f-4701-a313-a2d83334e3cc #### Configure Local host cache on Citrix VDI servers to ensure seamless connection brokering operations We have observed that your Citrix VDI servers aren't configured Local host Cache. Local Host Cache (LHC) is a feature in Citrix Virtual Apps and Desktops that allows connection brokering operations to continue when an outage occurs.LHC engages when the site database is inaccessible for 90 seconds. - -ID: f3d23f88-aee2-4b5a-bfd6-65b22bd70fc0 +Potential benefits: Seamless connection brokering operations + + <!--f3d23f88-aee2-4b5a-bfd6-65b22bd70fc0_end--> ID: f3d23f88-aee2-4b5a-bfd6-65b22bd70fc0 #### Deploy Hyperspace Web servers as part of a Virtual Machine Scale Set Flex configured for 3 zones We have observed that your Hyperspace Web servers in the Virtual Machine Scale Set Flex set up aren't spread across 3 zones in the selected region. For services like Hyperspace Web in Epic systems that require high availability and large scale, it's recommended that servers are deployed as part of Virtual Machine Scale Set Flex and spread across 3 zones. With Flexible orchestration, Azure provides a unified experience across the Azure VM ecosystem - + +Potential benefits: High availability and on-demand large scale for Hyperspace web servers in Epic DB + For More information, see [Create a Virtual Machine Scale Set that uses Availability Zones](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-use-availability-zones?tabs=cli-1%2Cportal-2) -ID: dfa50c39-104a-418b-873a-c145fe521c9b <!--dfa50c39-104a-418b-873a-c145fe521c9b_end--> ID: dfa50c39-104a-418b-873a-c145fe521c9b #### Set the Idle timeout in Azure Load Balancer to 30 minutes for ASCS HA setup in SAP workloads To prevent load balancer timeout, make sure that all Azure Load Balancing Rules have: 'Idle timeout (minutes)' set to the maximum value of 30 minutes. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable the setting. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: 45c2994f-a01d-4024-843e-a2a84dae48b4 <!--45c2994f-a01d-4024-843e-a2a84dae48b4_end--> ID: 45c2994f-a01d-4024-843e-a2a84dae48b4 #### Enable Floating IP in the Azure Load balancer for ASCS HA setup in SAP workloads For port resuse and better high availability, enable floating IP in the load balancing rules for the Azure Load Balancer for HA set up of ASCS instance in SAP workloads. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: aec9b9fb-145f-4af8-94f3-7fdc69762b72 <!--aec9b9fb-145f-4af8-94f3-7fdc69762b72_end--> ID: aec9b9fb-145f-4af8-94f3-7fdc69762b72 #### Enable HA ports in the Azure Load Balancer for ASCS HA setup in SAP workloads For port resuse and better high availability, enable HA ports in the load balancing rules for HA set up of ASCS instance in SAP workloads. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: c3811f93-a1a5-4a84-8fba-dd700043cc42 <!--c3811f93-a1a5-4a84-8fba-dd700043cc42_end--> ID: c3811f93-a1a5-4a84-8fba-dd700043cc42 #### Disable TCP timestamps on VMs placed behind Azure Load Balancer in ASCS HA setup in SAP workloads Disable TCP timestamps on VMs placed behind AzurEnabling TCP timestamps will cause the health probes to fail due to TCP packets being dropped by the VM's guest OS TCP stack causing the load balancer to mark the endpoint as down - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [https://launchpad.support.sap.com/#/notes/2382421](https://launchpad.support.sap.com/#/notes/2382421) -ID: 27899d14-ac62-41f4-a65d-e6c2a5af101b <!--27899d14-ac62-41f4-a65d-e6c2a5af101b_end--> ID: 27899d14-ac62-41f4-a65d-e6c2a5af101b #### Set the Idle timeout in Azure Load Balancer to 30 minutes for HANA DB HA setup in SAP workloads To prevent load balancer timeout, ensure that all Azure Load Balancing Rules 'Idle timeout (minutes)' parameter is set to the maximum value of 30 minutes. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable the recommended settings. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: 1c1deb1c-ae1b-49a7-88d3-201285ad63b6 <!--1c1deb1c-ae1b-49a7-88d3-201285ad63b6_end--> ID: 1c1deb1c-ae1b-49a7-88d3-201285ad63b6 #### Enable Floating IP in the Azure Load balancer for HANA DB HA setup in SAP workloads For more flexible routing, enable floating IP in the load balancing rules for the Azure Load Balancer for HA set up of HANA DB instance in SAP workloads. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable the recommended settings. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: cca36756-d938-4f3a-aebf-75358c7c0622 <!--cca36756-d938-4f3a-aebf-75358c7c0622_end--> ID: cca36756-d938-4f3a-aebf-75358c7c0622 #### Enable HA ports in the Azure Load Balancer for HANA DB HA setup in SAP workloads For enhanced scalability, enable HA ports in the Load balancing rules for HA set up of HANA DB instance in SAP workloads. Open the load balancer, select 'load balancing rules' and add or edit the rule to enable the recommended settings. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability#:~:text=To%20set%20up%20standard%20load%20balancer%2C%20follow%20these%20configuration%20steps) -ID: a5ac35c2-a299-4864-bfeb-09d2348bda68 <!--a5ac35c2-a299-4864-bfeb-09d2348bda68_end--> ID: a5ac35c2-a299-4864-bfeb-09d2348bda68 #### Disable TCP timestamps on VMs placed behind Azure Load Balancer in HANA DB HA setup in SAP workloads Disable TCP timestamps on VMs placed behind Azure Load Balancer. Enabling TCP timestamps causes the health probes to fail due to TCP packets dropped by the VM's guest OS TCP stack causing the load balancer to mark the endpoint as down. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [Azure Load Balancer health probes](/azure/load-balancer/load-balancer-custom-probe-overview#:~:text=Don%27t%20enable%20TCP,must%20be%20disabled) -ID: 760ba688-69ea-431b-afeb-13683a03f0c2 <!--760ba688-69ea-431b-afeb-13683a03f0c2_end--> ID: 760ba688-69ea-431b-afeb-13683a03f0c2 #### Ensure that stonith is enabled for the Pacemaker configuration in ASCS HA setup in SAP workloads In a Pacemaker cluster, the implementation of node level fencing is done using a STONITH (Shoot The Other Node in the Head) resource. To help manage failed nodes, ensure that 'stonith-enable' is set to 'true' in the HA cluster configuration. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 28a00e1e-d0ad-452f-ad58-95e6c584e594 <!--28a00e1e-d0ad-452f-ad58-95e6c584e594_end--> ID: 28a00e1e-d0ad-452f-ad58-95e6c584e594 #### Set the corosync token in Pacemaker cluster to 30000 for ASCS HA setup in SAP workloads (RHEL) The corosync token setting determines the timeout that is used directly, or as a base, for real token timeout calculation in HA clusters. To allow memory-preserving maintenance, set the corosync token to 30000 for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: deede7ea-68c5-4fb9-8f08-5e706f88ac67 <!--deede7ea-68c5-4fb9-8f08-5e706f88ac67_end--> ID: deede7ea-68c5-4fb9-8f08-5e706f88ac67 #### Set the expected votes parameter to '2' in Pacemaker cofiguration in ASCS HA setup in SAP workloads (RHEL) For a two node HA cluster, set the quorum 'expected-votes' parameter to '2' as recommended for SAP on Azure to ensure a proper quorum, resilience, and data consistency. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 35ef8bba-923e-44f3-8f06-691deb679468 <!--35ef8bba-923e-44f3-8f06-691deb679468_end--> ID: 35ef8bba-923e-44f3-8f06-691deb679468 #### Enable the 'concurrent-fencing' parameter in Pacemaker cofiguration in ASCS HA setup in SAP workloads (ConcurrentFencingHAASCSRH) Concurrent fencing enables the fencing operations to be performed in parallel, which enhances high availability (HA), prevents split-brain scenarios, and contributes to a robust SAP deployment. Set this parameter to 'true' in the Pacemaker cluster configuration for ASCS HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 0fffcdb4-87db-44f2-956f-dc9638248659 <!--0fffcdb4-87db-44f2-956f-dc9638248659_end--> ID: 0fffcdb4-87db-44f2-956f-dc9638248659 #### Ensure that stonith is enabled for the cluster configuration in ASCS HA setup in SAP workloads In a Pacemaker cluster, the implementation of node level fencing is done using a STONITH (Shoot The Other Node in the Head) resource. To help manage failed nodes, ensure that 'stonith-enable' is set to 'true' in the HA cluster configuration. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 6921340e-baa1-424f-80d5-c07bbac3cf7c <!--6921340e-baa1-424f-80d5-c07bbac3cf7c_end--> ID: 6921340e-baa1-424f-80d5-c07bbac3cf7c #### Set the stonith timeout to 144 for the cluster configuration in ASCS HA setup in SAP workloads The ΓÇÿstonith-timeoutΓÇÖ specifies how long the cluster waits for a STONITH action to complete. Setting it to '144' seconds allows more time for fencing actions to complete. We recommend this setting for HA clusters for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 4eb10096-942e-402d-b4a6-e4e271c87a02 <!--4eb10096-942e-402d-b4a6-e4e271c87a02_end--> ID: 4eb10096-942e-402d-b4a6-e4e271c87a02 #### Set the corosync token in Pacemaker cluster to 30000 for ASCS HA setup in SAP workloads (SUSE) The corosync token setting determines the timeout that is used directly, or as a base, for real token timeout calculation in HA clusters. To allow memory-preserving maintenance, set the corosync token to '30000' for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 9f30eb2b-6a6f-4fa8-89dc-85a395c31233 <!--9f30eb2b-6a6f-4fa8-89dc-85a395c31233_end--> ID: 9f30eb2b-6a6f-4fa8-89dc-85a395c31233 #### Set 'token_retransmits_before_loss_const' to 10 in Pacemaker cluster in ASCS HA setup in SAP workloads The corosync token_retransmits_before_loss_const determines how many token retransmits are attempted before timeout in HA clusters. For stability and reliability, set the 'totem.token_retransmits_before_loss_const' to '10' for ASCS HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: f32b8f89-fb3c-4030-bd4a-0a16247db408 <!--f32b8f89-fb3c-4030-bd4a-0a16247db408_end--> ID: f32b8f89-fb3c-4030-bd4a-0a16247db408 #### The 'corosync join' timeout specifies in milliseconds how long to wait for join messages in the membership protocol so when a new node joins the cluster, it has time to synchronize its state with existing nodes. Set to '60' in Pacemaker cluster configuration for ASCS HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: fed84141-4942-49b3-8b0c-73a8b352f754 <!--fed84141-4942-49b3-8b0c-73a8b352f754_end--> ID: fed84141-4942-49b3-8b0c-73a8b352f754 #### Set the 'corosync consensus' in Pacemaker cluster to '36000' for ASCS HA setup in SAP workloads The corosync 'consensus' parameter specifies in milliseconds how long to wait for consensus before starting a round of membership in the cluster configuration. Set 'consensus' in the Pacemaker cluster configuration for ASCS HA setup to 1.2 times the corosync token for reliable failover behavior. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 73227428-640d-4410-aec4-bac229a2b7bd <!--73227428-640d-4410-aec4-bac229a2b7bd_end--> ID: 73227428-640d-4410-aec4-bac229a2b7bd #### Set the 'corosync max_messages' in Pacemaker cluster to '20' for ASCS HA setup in SAP workloads The corosync 'max_messages' constant specifies the maximum number of messages that one processor can send on receipt of the token. Set it to 20 times the corosync token parameter in the Pacemaker cluster configuration to allow efficient communication without overwhelming the network. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 14a889a6-374f-4bd4-8add-f644e3fe277d <!--14a889a6-374f-4bd4-8add-f644e3fe277d_end--> ID: 14a889a6-374f-4bd4-8add-f644e3fe277d #### Set 'expected votes' to '2' in the cluster configuration in ASCS HA setup in SAP workloads (SUSE) For a two node HA cluster, set the quorum 'expected_votes' parameter to 2 as recommended for SAP on Azure to ensure a proper quorum, resilience, and data consistency. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 89a9ddd9-f9bf-47e4-b5f7-a0a4edfa0cdb <!--89a9ddd9-f9bf-47e4-b5f7-a0a4edfa0cdb_end--> ID: 89a9ddd9-f9bf-47e4-b5f7-a0a4edfa0cdb #### Set the two_node parameter to 1 in the cluster cofiguration in ASCS HA setup in SAP workloads For a two node HA cluster, set the quorum parameter 'two_node' to 1 as recommended for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 2030a15b-ff0b-47c3-b934-60072ccda75e <!--2030a15b-ff0b-47c3-b934-60072ccda75e_end--> ID: 2030a15b-ff0b-47c3-b934-60072ccda75e #### Enable 'concurrent-fencing' in Pacemaker ASCS HA setup in SAP workloads (ConcurrentFencingHAASCSSLE) Concurrent fencing enables the fencing operations to be performed in parallel, which enhances HA, prevents split-brain scenarios, and contributes to a robust SAP deployment. Set this parameter to 'true' in the Pacemaker cluster configuration for ASCS HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: dc19b2c9-0770-4929-8f63-81c07fe7b6f3 <!--dc19b2c9-0770-4929-8f63-81c07fe7b6f3_end--> ID: dc19b2c9-0770-4929-8f63-81c07fe7b6f3 #### Ensure the number of 'fence_azure_arm' instances is one in Pacemaker in HA enabled SAP workloads If you're using Azure fence agent for fencing with either managed identity or service principal, ensure that there's one instance of fence_azure_arm (an I/O fencing agent for Azure Resource Manager) in the Pacemaker configuration for ASCS HA setup for high availability. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: cb56170a-0ecb-420a-b2c9-5c4878a0132a <!--cb56170a-0ecb-420a-b2c9-5c4878a0132a_end--> ID: cb56170a-0ecb-420a-b2c9-5c4878a0132a #### Set stonith-timeout to 900 in Pacemaker configuration with Azure fence agent for ASCS HA setup For reliable function of the Pacemaker for ASCS HA set the 'stonith-timeout' to 900. This setting is applicable if you're using the Azure fence agent for fencing with either managed identity or service principal. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 05747c68-715f-4c8f-b027-f57a931cc07a <!--05747c68-715f-4c8f-b027-f57a931cc07a_end--> ID: 05747c68-715f-4c8f-b027-f57a931cc07a #### Create the softdog config file in Pacemaker configuration for ASCS HA setup in SAP workloads The softdog timer is loaded as a kernel module in linux OS. This timer triggers a system reset if it detects that the system has hung. Ensure that the softdog configuation file is created in the Pacemaker cluster forASCS HA set up - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 88261a1a-6a32-4fb6-8bbd-fcd60fdfcab6 <!--88261a1a-6a32-4fb6-8bbd-fcd60fdfcab6_end--> ID: 88261a1a-6a32-4fb6-8bbd-fcd60fdfcab6 #### Ensure the softdog module is loaded in for Pacemaler in ASCS HA setup in SAP workloads The softdog timer is loaded as a kernel module in linux OS. This timer triggers a system reset if it detects that the system has hung. First ensure that you created the softdog configuration file, then load the softdog module in the Pacemaker configuration for ASCS HA setup - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 3730bc11-c81c-43eb-896a-8fce0bac139d <!--3730bc11-c81c-43eb-896a-8fce0bac139d_end--> ID: 3730bc11-c81c-43eb-896a-8fce0bac139d #### Set PREFER_SITE_TAKEOVER parameter to 'true' in the Pacemaker configuration for HANA DB HA setup The PREFER_SITE_TAKEOVER parameter in SAP HANA defines if the HANA system replication (SR) resource agent prefers to takeover the secondary instance instead of restarting the failed primary locally. For reliable function of HANA DB high availability (HA) setup, set PREFER_SITE_TAKEOVER to 'true'. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 255e9f7b-db3a-4a67-b87e-6fdc36ea070d <!--255e9f7b-db3a-4a67-b87e-6fdc36ea070d_end--> ID: 255e9f7b-db3a-4a67-b87e-6fdc36ea070d #### Enable stonith in the cluster cofiguration in HA enabled SAP workloads for VMs with Redhat OS In a Pacemaker cluster, the implementation of node level fencing is done using STONITH (Shoot The Other Node in the Head) resource. To help manage failed nodes, ensure that 'stonith-enable' is set to 'true' in the HA cluster configuration of your SAP workload. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 4594198b-b114-4865-8ed8-be06db945408 <!--4594198b-b114-4865-8ed8-be06db945408_end--> ID: 4594198b-b114-4865-8ed8-be06db945408 #### Set the corosync token in Pacemaker cluster to 30000 for HA enabled HANA DB for VM with RHEL OS The corosync token setting determines the timeout that is used directly, or as a base, for real token timeout calculation in HA clusters. To allow memory-preserving maintenance, set the corosync token to 30000 for SAP on Azure with Redhat OS. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 604f3822-6a28-47db-b31c-4b0dbe317625 <!--604f3822-6a28-47db-b31c-4b0dbe317625_end--> ID: 604f3822-6a28-47db-b31c-4b0dbe317625 #### Set the expected votes parameter to '2' in HA enabled SAP workloads (RHEL) For a two node HA cluster, set the quorum votes to '2' as recommended for SAP on Azure to ensure a proper quorum, resilience, and data consistency. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 937a1997-fc2d-4a3a-a9f6-e858a80921fd <!--937a1997-fc2d-4a3a-a9f6-e858a80921fd_end--> ID: 937a1997-fc2d-4a3a-a9f6-e858a80921fd #### Enable the 'concurrent-fencing' parameter in the Pacemaker cofiguration for HANA DB HA setup Concurrent fencing enables the fencing operations to be performed in parallel, which enhances high availability (HA), prevents split-brain scenarios, and contributes to a robust SAP deployment. Set this parameter to 'true' in the Pacemaker cluster configuration for HANA DB HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability of SAP HANA on Azure VMs on Red Hat Enterprise Linux](/azure/virtual-machines/workloads/sap/sap-hana-high-availability-rhel) -ID: 6cc63594-c89f-4535-b878-cdd13659cfc5 <!--6cc63594-c89f-4535-b878-cdd13659cfc5_end--> ID: 6cc63594-c89f-4535-b878-cdd13659cfc5 #### Set parameter PREFER_SITE_TAKEOVER to 'true' in the cluster cofiguration in HA enabled SAP workloads The PREFER_SITE_TAKEOVER parameter in SAP HANA topology defines if the HANA SR resource agent prefers to takeover the secondary instance instead of restarting the failed primary locally. For reliable function of HANA DB HA setup, set it to 'true'. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 230fddab-0864-4c5e-bb27-037bec7c46c6 <!--230fddab-0864-4c5e-bb27-037bec7c46c6_end--> ID: 230fddab-0864-4c5e-bb27-037bec7c46c6 #### Enable stonith in the cluster configuration in HA enabled SAP workloads for VMs with SUSE OS In a Pacemaker cluster, the implementation of node level fencing is done using STONITH (Shoot The Other Node in the Head) resource. To help manage failed nodes, ensure that 'stonith-enable' is set to 'true' in the HA cluster configuration. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 210d0895-074c-4cc7-88de-b0a9e00820c6 <!--210d0895-074c-4cc7-88de-b0a9e00820c6_end--> ID: 210d0895-074c-4cc7-88de-b0a9e00820c6 #### Set the stonith timeout to 144 for the cluster configuration in HA enabled SAP workloads The ΓÇÿstonith-timeoutΓÇÖ specifies how long the cluster waits for a STONITH action to complete. Setting it to '144' seconds allows more time for fencing actions to complete. We recommend this setting for HA clusters for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 64e5e17e-640e-430f-987a-721f133dbd5c <!--64e5e17e-640e-430f-987a-721f133dbd5c_end--> ID: 64e5e17e-640e-430f-987a-721f133dbd5c #### Set the corosync token in Pacemaker cluster to 30000 for HA enabled HANA DB for VM with SUSE OS The corosync token setting determines the timeout that is used directly, or as a base, for real token timeout calculation in HA clusters. To allow memory-preserving maintenance, set the corosync token to 30000 for HA enabled HANA DB for VM with SUSE OS. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: a563e3ad-b6b5-4ec2-a444-c4e30800b8cf <!--a563e3ad-b6b5-4ec2-a444-c4e30800b8cf_end--> ID: a563e3ad-b6b5-4ec2-a444-c4e30800b8cf #### Set 'token_retransmits_before_loss_const' to 10 in Pacemaker cluster in HA enabled SAP workloads The corosync token_retransmits_before_loss_const determines how many token retransmits are attempted before timeout in HA clusters. Set the totem.token_retransmits_before_loss_const to 10 as recommended for HANA DB HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 99681175-0124-44de-93ae-edc08f9dc0a8 <!--99681175-0124-44de-93ae-edc08f9dc0a8_end--> ID: 99681175-0124-44de-93ae-edc08f9dc0a8 #### Set the 'corosync join' in Pacemaker cluster to 60 for HA enabled HANA DB in SAP workloads The 'corosync join' timeout specifies in milliseconds how long to wait for join messages in the membership protocol so when a new node joins the cluster, it has time to synchronize its state with existing nodes. Set to '60' in Pacemaker cluster configuration for HANA DB HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: b8ac170f-433e-4d9c-8b75-f7070a2a5c92 <!--b8ac170f-433e-4d9c-8b75-f7070a2a5c92_end--> ID: b8ac170f-433e-4d9c-8b75-f7070a2a5c92 #### Set the 'corosync consensus' in Pacemaker cluster to 36000 for HA enabled HANA DB in SAP workloads The corosync 'consensus' parameter specifies in milliseconds how long to wait for consensus before starting a new round of membership in the cluster. For reliable failover behavior, set 'consensus' in the Pacemaker cluster configuration for HANA DB HA setup to 1.2 times the corosync token. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 63e27ad9-1804-405a-97eb-d784686ffbe3 <!--63e27ad9-1804-405a-97eb-d784686ffbe3_end--> ID: 63e27ad9-1804-405a-97eb-d784686ffbe3 #### Set the 'corosync max_messages' in Pacemaker cluster to 20 for HA enabled HANA DB in SAP workloads The corosync 'max_messages' constant specifies the maximum number of messages that one processor can send on receipt of the token. To allow efficient communication without overwhelming the network, set it to 20 times the corosync token parameter in the Pacemaker cluster configuration. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 7ce9ff70-f684-47a2-b26f-781f80b1bccc <!--7ce9ff70-f684-47a2-b26f-781f80b1bccc_end--> ID: 7ce9ff70-f684-47a2-b26f-781f80b1bccc #### Set the expected votes parameter to 2 in HA enabled SAP workloads (SUSE) Set the expected votes parameter to '2' in the cluster configuration in HA enabled SAP workloads to ensure a proper quorum, resilience, and data consistency. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 37240e75-9493-433a-8671-2e2582584875 <!--37240e75-9493-433a-8671-2e2582584875_end--> ID: 37240e75-9493-433a-8671-2e2582584875 #### Set the two_node parameter to 1 in the cluster configuration in HA enabled SAP workloads For a two node HA cluster, set the quorum parameter 'two_node' to 1 as recommended for SAP on Azure. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 41cd63e2-69a4-4a4f-bb69-1d3f832001f9 <!--41cd63e2-69a4-4a4f-bb69-1d3f832001f9_end--> ID: 41cd63e2-69a4-4a4f-bb69-1d3f832001f9 #### Enable the 'concurrent-fencing' parameter in the cluster configuration in HA enabled SAP workloads Concurrent fencing enables the fencing operations to be performed in parallel, which enhances HA, prevents split-brain scenarios, and contributes to a robust SAP deployment. Set this parameter to 'true' in HA enabled SAP workloads. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: d763b894-7641-4c5d-9bc3-6f2515a6eb67 <!--d763b894-7641-4c5d-9bc3-6f2515a6eb67_end--> ID: d763b894-7641-4c5d-9bc3-6f2515a6eb67 #### Ensure there is one instance of fence_azure_arm in the Pacemaker configuration for HANA DB HA setup If you're using Azure fence agent for fencing with either managed identity or service principal, ensure that one instance of fence_azure_arm (an I/O fencing agent for Azure Resource Manager) is in the Pacemaker configuration for HANA DB HA setup for high availability. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 1f4b5e87-69e9-470a-8245-f337fd0d5528 <!--1f4b5e87-69e9-470a-8245-f337fd0d5528_end--> ID: 1f4b5e87-69e9-470a-8245-f337fd0d5528 #### Set stonith-timeout to 900 in Pacemaker configuration with Azure fence agent for HANA DB HA setup If you're using the Azure fence agent for fencing with either managed identity or service principal, ensure reliable function of the Pacemaker for HANA DB HA setup, by setting the 'stonith-timeout' to 900. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 943f7572-1884-4120-808d-ac2a3e70e33a <!--943f7572-1884-4120-808d-ac2a3e70e33a_end--> ID: 943f7572-1884-4120-808d-ac2a3e70e33a #### Ensure that the softdog config file is in the Pacemaker configuration for HANA DB in SAP workloads The softdog timer is loaded as a kernel module in Linux OS. This timer triggers a system reset if it detects that the system is hung. Ensure that the softdog configuration file is created in the Pacemaker cluster for HANA DB HA setup. - + +Potential benefits: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: 63233341-73a2-4180-b57f-6f83395161b9 <!--63233341-73a2-4180-b57f-6f83395161b9_end--> ID: 63233341-73a2-4180-b57f-6f83395161b9 #### Ensure the softdog module is loaded in Pacemaker in ASCS HA setup in SAP workloads The softdog timer is loaded as a kernel module in Linux OS. This timer triggers a system reset if it detects that the system is hung. First ensure that you created the softdog configuration file, then load the softdog module in the Pacemaker configuration for HANA DB HA setup. - + +Potential benefits*: Reliability of HA setup in SAP workloads + For More information, see [High availability for SAP HANA on Azure VMs on SUSE Linux Enterprise Server](/azure/virtual-machines/workloads/sap/sap-hana-high-availability) -ID: b27248cd-67dc-4824-b162-4563adaa6d70 <!--b27248cd-67dc-4824-b162-4563adaa6d70_end-->
api-management	Workspaces Overview	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/api-management/workspaces-overview.md	Manage gateway capacity by manually adding or removing scale units, similar to t ### Regional availability -Workspace gateways need to be in the same Azure region and subscription as the API Management service. +Workspace gateways are currently available in the following regions: > [!NOTE] > These regions are a subset of those where API Management is available. Workspace gateways need to be in the same Azure region and subscription as the A ### Gateway constraints The following constraints currently apply to workspace gateways: +* A workspace gateway needs to be in the same region as the API Management instance's primary Azure region and in the same subscription. * A gateway can be associated only with one workspace * A workspace can't be associated with a self-hosted gateway * Workspace gateways don't support inbound private endpoints
app-service	Configure Authentication File Based	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/configure-authentication-file-based.md	With [App Service authentication](overview-authentication-authorization.md), the ## Enabling file-based configuration -1. Create a new JSON file for your configuration at the root of your project (deployed to D:\home\site\wwwroot in your web / function app). Fill in your desired configuration according to the [file-based configuration reference](#configuration-file-reference). If modifying an existing Azure Resource Manager configuration, make sure to translate the properties captured in the `authsettings` collection into your configuration file. +1. Create a new JSON file for your configuration at the root of your project (deployed to C:\home\site\wwwroot in your web / function app). Fill in your desired configuration according to the [file-based configuration reference](#configuration-file-reference). If modifying an existing Azure Resource Manager configuration, make sure to translate the properties captured in the `authsettings` collection into your configuration file. 2. Modify the existing configuration, which is captured in the [Azure Resource Manager](../azure-resource-manager/management/overview.md) APIs under `Microsoft.Web/sites/<siteName>/config/authsettingsV2`. To modify it, you can use an [Azure Resource Manager template](../azure-resource-manager/templates/overview.md) or a tool like [Azure Resource Explorer](https://resources.azure.com/). Within the authsettingsV2 collection, set two properties (you may remove others):
app-service	Deploy Local Git	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/deploy-local-git.md	When you push commits to your App Service repository, App Service deploys the fi git push azure main ``` - You can also change the `DEPLOYMENT_BRANCH` app setting in the Azure portal, by selecting Configuration under Settings and adding a new Application Setting with a name of `DEPLOYMENT_BRANCH` and value of `main`. + You can also change the `DEPLOYMENT_BRANCH` app setting in the Azure portal, by selecting Environment variables under Settings and adding a new App setting with a name of `DEPLOYMENT_BRANCH` and value of `main`. ## Troubleshoot deployment
app-service	Deploy Run Package	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/deploy-run-package.md	The command also restarts the app. Because `WEBSITE_RUN_FROM_PACKAGE` is set, Ap ## Run from external URL instead -You can also run a package from an external URL, such as Azure Blob Storage. You can use the [Azure Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md) to upload package files to your Blob storage account. You should use a private storage container with a [Shared Access Signature (SAS)](../vs-azure-tools-storage-manage-with-storage-explorer.md#generate-a-sas-in-storage-explorer) or [use a managed identity](#access-a-package-in-azure-blob-storage-using-a-managed-identity) to enable the App Service runtime to access the package securely. +You can also run a package from an external URL, such as Azure Blob Storage. You can use the [Azure Storage Explorer](../vs-azure-tools-storage-manage-with-storage-explorer.md) to upload package files to your Blob storage account. You should use a private storage container with a [Shared Access Signature (SAS)](../vs-azure-tools-storage-manage-with-storage-explorer.md#generate-a-sas-in-storage-explorer) or [use a managed identity](#access-a-package-in-azure-blob-storage-using-a-managed-identity) to enable the App Service runtime to access the package securely. + +> [!NOTE] +> Currently, an existing App Service resource that runs a local package cannot be migrated to run from a remote package. You will have to create a new App Service resource configured to run from an external URL. Once you upload your file to Blob storage and have an SAS URL for the file, set the `WEBSITE_RUN_FROM_PACKAGE` app setting to the URL. The following example does it by using Azure CLI:
app-service	Overview Hosting Plans	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/overview-hosting-plans.md	Title: App Service plans -description: Learn how App Service plans work in Azure App Service, how they're billed to the customer, and how to scale them for your needs. +description: Learn how App Service plans work in Azure App Service, how they're billed, and how to scale them for your needs. keywords: app service, azure app service, scale, scalable, scalability, app service plan, app service cost ms.assetid: dea3f41e-cf35-481b-a6bc-33d7fc9d01b1 Previously updated : 05/26/2023 Last updated : 08/21/2024 When you create an App Service plan in a certain region (for example, West Europ - Size of VM instances (Small, Medium, Large) - Pricing tier (Free, Shared, Basic, Standard, Premium, PremiumV2, PremiumV3, Isolated, IsolatedV2) -The _pricing tier_ of an App Service plan determines what App Service features you get and how much you pay for the plan. The pricing tiers available to your App Service plan depend on the operating system selected at creation time. There are the following categories of pricing tiers: +The _pricing tier_ of an App Service plan determines what App Service features you get and how much you pay for the plan. The pricing tiers available to your App Service plan depend on the operating system selected at creation time. These are the categories of pricing tiers: -- Shared compute: Free and Shared, the two base tiers, runs an app on the same Azure VM as other App Service apps, including apps of other customers. These tiers allocate CPU quotas to each app that runs on the shared resources, and the resources cannot scale out. These tiers are intended to be used only for development and testing purposes.-- Dedicated compute: The Basic, Standard, Premium, PremiumV2, and PremiumV3 tiers run apps on dedicated Azure VMs. Only apps in the same App Service plan share the same compute resources. The higher the tier, the more VM instances are available to you for scale-out.-- Isolated: The Isolated and IsolatedV2 tiers run dedicated Azure VMs on dedicated Azure Virtual Networks. It provides network isolation on top of compute isolation to your apps. It provides the maximum scale-out capabilities. +- Shared compute: Free and Shared, the two base tiers, run an app on the same Azure VM as other App Service apps, including apps of other customers. These tiers allocate CPU quotas to each app that runs on the shared resources, and the resources cannot scale out. These tiers are intended to be used only for development and testing purposes. +- Dedicated compute: The Basic, Standard, Premium, PremiumV2, and PremiumV3 tiers run apps on dedicated Azure VMs. Only apps in the same App Service plan share the same compute resources. The higher the tier, the more VM instances that are available to you for scale-out. +- Isolated: The Isolated and IsolatedV2 tiers run dedicated Azure VMs on dedicated Azure virtual networks. They provide network isolation on top of compute isolation to your apps. They provide the maximum scale-out capabilities. -Each tier also provides a specific subset of App Service features. These features include custom domains and TLS/SSL certificates, autoscaling, deployment slots, backups, Traffic Manager integration, and more. The higher the tier, the more features are available. To find out which features are supported in each pricing tier, see [App Service plan details](https://azure.microsoft.com/pricing/details/app-service/windows/#pricing). +Each tier also provides a specific subset of App Service features. These features include custom domains and TLS/SSL certificates, autoscaling, deployment slots, backups, Traffic Manager integration, and more. The higher the tier, the more features that are available. To find out which features are supported in each pricing tier, see [App Service plan details](https://azure.microsoft.com/pricing/details/app-service/windows/#pricing). <a name="new-pricing-tier-premiumv3"></a> -## Premium V3 pricing tier +## PremiumV3 pricing tier The PremiumV3 pricing tier guarantees machines with faster processors (minimum 195 [ACU](/azure/virtual-machines/acu) per virtual CPU), SSD storage, memory-optimized options and quadruple memory-to-core ratio compared to Standard tier. PremiumV3 also supports higher scale via increased instance count while still providing all the advanced capabilities found in Standard tier. All features available in the existing PremiumV2 tier are included in PremiumV3. -Multiple VM sizes are available for this tier including 4-to-1 and 8-to-1 memory-to-core ratios: +Multiple VM sizes are available for this tier, including 4-to-1 and 8-to-1 memory-to-core ratios: - P0v3    (1 vCPU, 4 GiB of memory) - P1v3    (2 vCPU, 8 GiB of memory) To get started with the new PremiumV3 pricing tier, see [Configure PremiumV3 In the Free and Shared tiers, an app receives CPU minutes on a shared VM instance and cannot scale out. In other tiers, an app runs and scales as follows. -When you create an app in App Service, it's part of an App Service plan. When the app runs, it runs on all the VM instances configured in the App Service plan. If multiple apps are in the same App Service plan, they all share the same VM instances. If you have multiple deployment slots for an app, all deployment slots also run on the same VM instances. If you enable diagnostic logs, perform backups, or run [WebJobs](), they also use CPU cycles and memory on these VM instances. +When you create an app in App Service, it's part of an App Service plan. When the app runs, it runs on all the VM instances configured in the App Service plan. If multiple apps are in the same App Service plan, they all share the same VM instances. If you have multiple deployment slots for an app, all deployment slots also run on the same VM instances. If you enable diagnostic logs, perform backups, or run [WebJobs](webjobs-create.md), they also use CPU cycles and memory on these VM instances. In this way, the App Service plan is the scale unit of the App Service apps. If the plan is configured to run five VM instances, then all apps in the plan run on all five instances. If the plan is configured for autoscaling, then all apps in the plan are scaled out together based on the autoscale settings. For information on scaling out an app, see [Scale instance count manually or aut This section describes how App Service apps are billed. For detailed, region-specific pricing information, see [App Service Pricing](https://azure.microsoft.com/pricing/details/app-service/). -Except for Free tier, an App Service plan carries a charge on the compute resources it uses. +Except for the Free tier, an App Service plan carries a charge on the compute resources it uses. - In the Shared tier, each app receives a quota of CPU minutes, so _each app_ is charged for the CPU quota. - In the dedicated compute tiers (Basic, Standard, Premium, PremiumV2, PremiumV3), the App Service plan defines the number of VM instances the apps are scaled to, so _each VM instance_ in the App Service plan is charged. These VM instances are charged the same regardless of how many apps are running on them. To avoid unexpected charges, see [Clean up an App Service plan](app-service-plan-manage.md#delete). Except for Free tier, an App Service plan carries a charge on the compute re You don't get charged for using the App Service features that are available to you (configuring custom domains, TLS/SSL certificates, deployment slots, backups, etc.). The exceptions are: -- App Service Domains - you pay when you purchase one in Azure and when you renew it each year.-- App Service Certificates - you pay when you purchase one in Azure and when you renew it each year.-- IP-based TLS connections - There's an hourly charge for each IP-based TLS connection, but some Standard tier or above gives you one IP-based TLS connection for free. SNI-based TLS connections are free. +- App Service Domains - You pay when you purchase one in Azure and when you renew it each year. +- App Service Certificates - You pay when you purchase one in Azure and when you renew it each year. +- IP-based TLS connections - There's an hourly charge for each IP-based TLS connection, but some Standard tiers or above give you one IP-based TLS connection for free. SNI-based TLS connections are free. > [!NOTE] > If you integrate App Service with another Azure service, you may need to consider charges from these other services. For example, if you use Azure Traffic Manager to scale your app geographically, Azure Traffic Manager also charges you based on your usage. To estimate your cross-services cost in Azure, see [Pricing calculator](https://azure.microsoft.com/pricing/calculator/). Want to optimize and save on your cloud spending? ## What if my app needs more capabilities or features? -Your App Service plan can be scaled up and down at any time. It is as simple as changing the pricing tier of the plan. You can choose a lower pricing tier at first and scale up later when you need more App Service features. +Your App Service plan can be scaled up and down at any time. It's as simple as changing the pricing tier of the plan. You can choose a lower pricing tier at first and scale up later when you need more App Service features. For example, you can start testing your web app in a Free App Service plan and pay nothing. When you add your [custom DNS name](app-service-web-tutorial-custom-domain.md) to the web app, just scale your plan up to Shared tier. Later, when you want to [create a TLS binding](configure-ssl-bindings.md), scale your plan up to Basic tier. When you want to have [staging environments](deploy-staging-slots.md), scale up to Standard tier. When you need more cores, memory, or storage, scale up to a bigger VM size in the same tier. -The same works in the reverse. When you feel you no longer need the capabilities or features of a higher tier, you can scale down to a lower tier, which saves you money. +The same works in reverse. When you feel you no longer need the capabilities or features of a higher tier, you can scale down to a lower tier, which saves you money. For information on scaling up the App Service plan, see [Scale up an app in Azure](manage-scale-up.md). -If your app is in the same App Service plan with other apps, you may want to improve the app's performance by isolating the compute resources. You can do it by moving the app into a separate App Service plan. For more information, see [Move an app to another App Service plan](app-service-plan-manage.md#move). +If your app is in the same App Service plan with other apps, you may want to improve the app's performance by isolating the compute resources. You can do this by moving the app into a separate App Service plan. For more information, see [Move an app to another App Service plan](app-service-plan-manage.md#move). ## Should I put an app in a new plan or an existing plan? Since you pay for the computing resources your App Service plan allocates (see [ Isolate your app into a new App Service plan when: -- The app is resource-intensive. The number may actually be lower depending on how resource intensive the hosted applications are, however as a general guidance, you may refer to the table below: +- The app is resource-intensive. The number may actually be lower depending on how resource intensive the hosted applications are. However, for general guidance, refer to the table below: - \| App Service Plan SKU \| Max Apps \| + \| App Service Plan SKU \| Maximum Apps \| \|--\|--\| \| B1, S1, P1v2, I1v1 \| 8 \| \| B2, S2, P2v2, I2v1 \| 16 \| Isolate your app into a new App Service plan when: \| P1v3, I1v2 \| 16 \| \| P2v3, I2v2, P1mv3 \| 32 \| \| P3v3, I3v2, P2mv3 \| 64 \| - \| I4v2, I5v2, I6v2 \| Max density bounded by vCPU usage \| - \| P3mv3, P4mv3, P5mv3 \| Max density bounded by vCPU usage \| + \| I4v2, I5v2, I6v2 \| Maximum density bound by vCPU usage \| + \| P3mv3, P4mv3, P5mv3 \| Maximum density bound by vCPU usage \| - You want to scale the app independently from the other apps in the existing plan.-- The app needs resource in a different geographical region. +- The app needs resources in a different geographical region. -> [!NOTE] -> An active slot is also classified as an active app as it too is competing for resources on the same App Service Plan. + This way you can allocate a new set of resources for your app and gain greater control of your apps. -This way you can allocate a new set of resources for your app and gain greater control of your apps. +> [!NOTE] +> An active slot is also classified as an active app because it too is competing for resources on the same App Service Plan. -## Next steps +## Next step > [!div class="nextstepaction"] > [Manage an App Service plan](app-service-plan-manage.md)
application-gateway	Quick Create Portal	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/application-gateway/quick-create-portal.md	description: In this quickstart, you learn how to use the Azure portal to create Previously updated : 05/30/2024 Last updated : 09/04/2024 Create the application gateway using the tabs on the Create application gatewa 1. On the Frontends tab, verify Frontend IP address type is set to Public. <br>You can configure the Frontend IP to be Public or Private as per your use case. In this example, you'll choose a Public Frontend IP. > [!NOTE] - > For the Application Gateway v2 SKU, there must be a Public** frontend IP configuration. You can still have both a Public and a Private frontend IP configuration, but Private only frontend IP configuration (Only ILB mode) is currently not enabled for the v2 SKU. + > * The [Private-only deployment](application-gateway-private-deployment.md) (with only private IP) for the Application Gateway v2 SKU is currently in Public Preview. + > * Application Gateway frontend now supports dual-stack IP addresses in Public Preview. You can create up to four frontend IP addresses: Two IPv4 addresses (public and private) and two IPv6 addresses (public and private). 2. Select Add new for the Public IP address and enter myAGPublicIPAddress for the public IP address name, and then select OK. ![Screenshot of create new application gateway: frontends.](./media/application-gateway-create-gateway-portal/application-gateway-create-frontends.png) - > [!NOTE] - > Application Gateway frontend now supports dual-stack IP addresses (Public Preview). You can now create up to four frontend IP addresses: Two IPv4 addresses (public and private) and two IPv6 addresses (public and private). 3. Select Next: Backends.
azure-app-configuration	Concept Customer Managed Keys	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-app-configuration/concept-customer-managed-keys.md	When users enable the customer-managed key capability on their Azure App Configu The following components are required to successfully enable the customer-managed key capability for Azure App Configuration: -- Standard tier Azure App Configuration instance.-- Azure Key Vault with soft-delete and purge-protection features enabled. +- A Standard or Premium tier Azure App Configuration instance. +- An Azure Key Vault with soft-delete and purge-protection features enabled. - An RSA or RSA-HSM key within the Key Vault. - The key must not be expired, it must be enabled, and it must have both wrap and unwrap capabilities enabled. After these resources are configured, use the following steps so that the Azure ## Enable customer-managed key encryption for your App Configuration store -1. [Create an App Configuration store](./quickstart-azure-app-configuration-create.md) in the Standard tier if you don't have one. +1. [Create an App Configuration store](./quickstart-azure-app-configuration-create.md) in the Standard or Premium tier if you don't have one. 1. Using the Azure CLI, create an Azure Key Vault with purge protection enabled. Soft delete is enabled by default. Both `vault-name` and `resource-group-name` are user-provided and must be unique. We use `contoso-vault` and `contoso-resource-group` in these examples.
azure-app-configuration	Concept Private Endpoint	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-app-configuration/concept-private-endpoint.md	If you are using a custom DNS server on your network, you need to configure it t ## Pricing -Enabling private endpoints requires a [Standard tier](https://azure.microsoft.com/pricing/details/app-configuration/) App Configuration store. To learn about private link pricing details, see [Azure Private Link pricing](https://azure.microsoft.com/pricing/details/private-link). +Enabling private endpoints requires a [Standard or Premium tier](https://azure.microsoft.com/pricing/details/app-configuration/) App Configuration store. To learn about private link pricing details, see [Azure Private Link pricing](https://azure.microsoft.com/pricing/details/private-link). ## Next steps
azure-app-configuration	Concept Snapshots	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-app-configuration/concept-snapshots.md	For stores that use HMAC authentication, both the "read snapshot" operation (to ## Billing considerations and limits -App Configuration has two tiers, Free and Standard. Check the following details for snapshot quotas in each tier. +App Configuration has three tiers, Free, Standard and Premium. Check the following details for snapshot quotas in each tier. * Free tier: This tier has a snapshot storage quota of 10 MB. One can create as many snapshots as possible as long as the total storage size of all active and archived snapshots is less than 10 MB. * Standard tier: This tier has a snapshot storage quota of 1 GB. One can create as many snapshots as possible as long as the total storage size of all active and archived snapshots is less than 1 GB. +* Premium tier: This tier has a snapshot storage quota of 4 GB. One can create as many snapshots as possible as long as the total storage size of all active and archived snapshots is less than 4 GB. + The maximum size for a snapshot is 1 MB. ## Next steps
azure-app-configuration	Concept Soft Delete	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-app-configuration/concept-soft-delete.md	Last updated 05/13/2024 # Soft delete -Azure App Configuration's Soft delete feature allows recovery of your data such as key-values, feature flags, and revision history of a deleted store. It's automatically enabled for all stores in the standard tier. In this article, learn more about the soft delete feature and its functionality. +Azure App Configuration's Soft delete feature allows recovery of your data such as key-values, feature flags, and revision history of a deleted store. It's automatically enabled for all stores in the Standard and Premium tiers. In this article, learn more about the soft delete feature and its functionality. Learn how to [recover Azure App Configuration stores](./howto-recover-deleted-stores-in-azure-app-configuration.md) using the soft delete feature.
azure-app-configuration	Howto Recover Deleted Stores In Azure App Configuration	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-app-configuration/howto-recover-deleted-stores-in-azure-app-configuration.md	To create a new App Configuration store in the Azure portal, follow these steps \| Resource group \| Your resource group \| Select the Azure resource group for your store \| \| Resource name \| Globally unique name \| Enter a unique resource name to use for the App Configuration store. This name can't be the same name as the previous configuration store. \| \| Location \| Your desired Location \| Select the region you want to create your configuration store in. \| - \| Pricing tier \| Standard \| Select the standard pricing tier. For more information, see the [App Configuration pricing page](https://azure.microsoft.com/pricing/details/app-configuration). \| + \| Pricing tier \| Standard or Premium \| Select the Standard or Premium pricing tier. For more information, see the [App Configuration pricing page](https://azure.microsoft.com/pricing/details/app-configuration). \| \| Days to retain deleted stores \| Retention period for soft deleted stores \| Select the number of days for which you would want the soft deleted stores and their content to be retained. \| \| Enable Purge protection \| Purge protection status \| Check to enable Purge protection on the store so no one can purge it before the retention period expires. \|
azure-arc	Manage Vm Extensions	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/servers/manage-vm-extensions.md	Title: VM extension management with Azure Arc-enabled servers description: Azure Arc-enabled servers can manage deployment of virtual machine extensions that provide post-deployment configuration and automation tasks with non-Azure VMs. Previously updated : 05/17/2024 Last updated : 09/04/2024 Azure Arc-enabled servers enables you to deploy, remove, and update Azure VM ext Azure Arc-enabled servers VM extension support provides the following key benefits: -- Collect log data for analysis with [Logs in Azure Monitor](../../azure-monitor/logs/data-platform-logs.md) by enabling the Log Analytics agent VM extension. Log Analytics makes it useful for doing complex analysis across log data from different kinds of sources. +- Collect log data for analysis with [Logs in Azure Monitor](../../azure-monitor/logs/data-platform-logs.md) by enabling the Azure Monitor agent VM extension. Log data analysis makes it useful for doing complex analysis across log data from different kinds of sources. -- With [VM insights](../../azure-monitor/vm/vminsights-overview.md), it analyzes the performance of your Windows and Linux VMs, and monitors their processes and dependencies on other resources and external processes. This is achieved through enabling both the Log Analytics agent and Dependency agent VM extensions. +- With [VM insights](../../azure-monitor/vm/vminsights-overview.md), it analyzes the performance of your Windows and Linux VMs, and monitors their processes and dependencies on other resources and external processes. This is achieved through enabling both the Azure Monitor agent and Dependency agent VM extensions. - Download and execute scripts on hybrid connected machines using the Custom Script Extension. This extension is useful for post deployment configuration, software installation, or any other configuration or management tasks. Arc-enabled servers support moving machines with one or more VM extensions insta \|Microsoft Defender for Cloud integrated vulnerability scanner \|Qualys \|WindowsAgent.AzureSecurityCenter \|[Microsoft Defender for CloudΓÇÖs integrated vulnerability assessment solution for Azure and hybrid machines](../../security-center/deploy-vulnerability-assessment-vm.md)\| \|Microsoft Antimalware extension \|Microsoft.Azure.Security \|IaaSAntimalware \|[Microsoft Antimalware extension for Windows](/azure/virtual-machines/extensions/iaas-antimalware-windows) \| \|Custom Script extension \|Microsoft.Compute \| CustomScriptExtension \|[Windows Custom Script Extension](/azure/virtual-machines/extensions/custom-script-windows)\| -\|Log Analytics agent \|Microsoft.EnterpriseCloud.Monitoring \|MicrosoftMonitoringAgent \|[Log Analytics VM extension for Windows](/azure/virtual-machines/extensions/oms-windows)\| \|Azure Monitor for VMs (insights) \|Microsoft.Azure.Monitoring.DependencyAgent \|DependencyAgentWindows \| [Dependency agent virtual machine extension for Windows](/azure/virtual-machines/extensions/agent-dependency-windows)\| \|Azure Key Vault Certificate Sync \| Microsoft.Azure.Key.Vault \|KeyVaultForWindows \| [Key Vault virtual machine extension for Windows](/azure/virtual-machines/extensions/key-vault-windows) \| \|Azure Monitor Agent \|Microsoft.Azure.Monitor \|AzureMonitorWindowsAgent \|[Install the Azure Monitor agent](../../azure-monitor/agents/azure-monitor-agent-manage.md) \| Arc-enabled servers support moving machines with one or more VM extensions insta \|-\|-\|--\|--\| \|Microsoft Defender for Cloud integrated vulnerability scanner \|Qualys \|LinuxAgent.AzureSecurityCenter \|[Microsoft Defender for CloudΓÇÖs integrated vulnerability assessment solution for Azure and hybrid machines](../../security-center/deploy-vulnerability-assessment-vm.md)\| \|Custom Script extension \|Microsoft.Azure.Extensions \|CustomScript \|[Linux Custom Script Extension Version 2](/azure/virtual-machines/extensions/custom-script-linux) \| -\|Log Analytics agent \|Microsoft.EnterpriseCloud.Monitoring \|OmsAgentForLinux \|[Log Analytics VM extension for Linux](/azure/virtual-machines/extensions/oms-linux) \| \|Azure Monitor for VMs (insights) \|Microsoft.Azure.Monitoring.DependencyAgent \|DependencyAgentLinux \|[Dependency agent virtual machine extension for Linux](/azure/virtual-machines/extensions/agent-dependency-linux) \| \|Azure Key Vault Certificate Sync \| Microsoft.Azure.Key.Vault \|KeyVaultForLinux \| [Key Vault virtual machine extension for Linux](/azure/virtual-machines/extensions/key-vault-linux) \| \|Azure Monitor Agent \|Microsoft.Azure.Monitor \|AzureMonitorLinuxAgent \|[Install the Azure Monitor agent](../../azure-monitor/agents/azure-monitor-agent-manage.md) \| To deploy an extension to Arc-enabled servers, a user requires the following per The role Azure Connected Machine Resource Administrator includes the permissions required to deploy extensions, however it also includes permission to delete Arc-enabled server resources. -### Log Analytics VM extension +### Azure Monitor agent VM extension -The Log Analytics agent VM extension for Linux requires Python 2.x is installed on the target machine. - -Before you install the extension we suggest you review the [deployment options for the Log Analytics agent](concept-log-analytics-extension-deployment.md) to understand the different methods available and which meets your requirements. +Before you install the extension we suggest you review the [deployment options for the Azure Monitor agent](concept-log-analytics-extension-deployment.md) to understand the different methods available and which meets your requirements. ### Azure Key Vault VM extension The following extensions are available for Windows and Linux machines: ### Windows extension availability -\|Operating system \|Azure Monitor agent \|Log Analytics agent \|Dependency VM Insights \|Qualys \|Custom Script \|Key Vault \|Hybrid Runbook \|Antimalware Extension \|Windows Admin Center \| -\|--\|--\|--\|--\|-\|--\|-\|\|-\|\| -\|Windows Server 2022 \|X \|X \|X \|X \|X \| \|X \| \|X \| -\|Windows Server 2019 \|X \|X \|X \|X \|X \|X \| \| \|X \| -\|Windows Server 2016 \|X \|X \|X \|X \|X \|X \|X \|Built-in \|X \| -\|Windows Server 2012 R2 \|X \|X \|X \|X \|X \| \|X \|X \| \| -\|Windows Server 2012 \|X \|X \|X \|X \|X \|X \|X \|X \| \| -\|Windows Server 2008 R2 SP1 \|X \|X \|X \|X \|X \| \|X \|X \| \| -\|Windows Server 2008 R2 \| \| \| \|X \|X \| \|X \|X \| \| -\|Windows Server 2008 SP2 \| \|X \| \|X \|X \| \|X \| \| \| -\|Windows 11 client OS \|X \| \| \|X \| \| \| \| \| \| -\|Windows 10 1803 (RS4) and higher \|X \| \| \|X \|X \| \| \| \| \| -\|Windows 10 Enterprise (including multi-session) and Pro (Server scenarios only) \|X \|X \|X \|X \|X \| \|X \| \| \| -\|Windows 8 Enterprise and Pro (Server scenarios only) \| \|X \|X \|X \| \| \|X \| \| \| -\|Windows 7 SP1 (Server scenarios only) \| \|X \|X \|X \| \| \|X \| \| \| -\|Azure Stack HCI (Server scenarios only) \| \|X \| \|X \| \| \|X \| \| \| +\|Operating system \|Azure Monitor agent \|Dependency VM Insights \|Qualys \|Custom Script \|Key Vault \|Hybrid Runbook \|Antimalware Extension \|Windows Admin Center \| +\|--\|--\|--\|-\|--\|-\|\|-\|\| +\|Windows Server 2022 \|X \|X \|X \|X \| \|X \| \|X \| +\|Windows Server 2019 \|X \|X \|X \|X \|X \| \| \|X \| +\|Windows Server 2016 \|X \|X \|X \|X \|X \|X \|Built-in \|X \| +\|Windows Server 2012 R2 \|X \|X \|X \|X \| \|X \|X \| \| +\|Windows Server 2012 \|X \|X \|X \|X \|X \|X \|X \| \| +\|Windows Server 2008 R2 SP1 \|X \|X \|X \|X \| \|X \|X \| \| +\|Windows Server 2008 R2 \| \| \|X \|X \| \|X \|X \| \| +\|Windows Server 2008 SP2 \| \| \|X \|X \| \|X \| \| \| +\|Windows 11 client OS \|X \| \|X \| \| \| \| \| \| +\|Windows 10 1803 (RS4) and higher \|X \| \|X \|X \| \| \| \| \| +\|Windows 10 Enterprise (including multi-session) and Pro (Server scenarios only) \|X \|X \|X \|X \| \|X \| \| \| +\|Windows 8 Enterprise and Pro (Server scenarios only) \| \|X \|X \| \| \|X \| \| \| +\|Windows 7 SP1 (Server scenarios only) \| \|X \|X \| \| \|X \| \| \| +\|Azure Stack HCI (Server scenarios only) \| \| \|X \| \| \|X \| \| \| ### Linux extension availability -\|Operating system \|Azure Monitor agent \|Log Analytics agent \|Dependency VM Insights \|Qualys \|Custom Script \|Key Vault \|Hybrid Runbook \|Antimalware Extension \|Connected Machine agent \| -\|--\|--\|--\|--\|-\|--\|-\|\|-\|\| -\|Amazon Linux 2 \| \|X \| \|X \| \| \|X \|X \| -\|CentOS Linux 8 \|X \|X \|X \|X \|X \| \|X \|X \| -\|CentOS Linux 7 \|X \|X \|X \|X \|X \| \|X \|X \| -\|CentOS Linux 6 \| \|X \| \|X \|X \| \|X \| \| -\|Debian 10 \|X \| \| \|X \|X \| \|X \| \| -\|Debian 9 \|X \|X \|X \|X \|X \| \| \| \| -\|Debian 8 \| \|X \|X \|X \| \| \|X \| \| -\|Debian 7 \| \| \| \|X \| \| \|X \| \| -\|OpenSUSE 13.1+ \| \| \| \|X \|X \| \| \| \| -\|Oracle Linux 8 \|X \|X \| \|X \|X \| \|X \|X \| -\|Oracle Linux 7 \|X \|X \| \|X \|X \| \|X \|X \| -\|Oracle Linux 6 \| \|X \| \|X \|X \| \|X \|X \| -\|Red Hat Enterprise Linux Server 8 \|X \|X \| \|X \|X \| \|X \|X \| -\|Red Hat Enterprise Linux Server 7 \|X \|X \|X \|X \|X \| \|X \|X \| -\|Red Hat Enterprise Linux Server 6 \| \|X \|X \|X \| \| \|X \| \| -\|SUSE Linux Enterprise Server 15.2 \|X \| \| \|X \|X \|X \| \|X \| -\|SUSE Linux Enterprise Server 15.1 \|X \|X \| \|X \|X \|X \|X \|X \| -\|SUSE Linux Enterprise Server 15 SP1 \|X \|X \|X \|X \|X \|X \|X \|X \| -\|SUSE Linux Enterprise Server 15 \|X \|X \|X \|X \|X \|X \|X \|X \| -\|SUSE Linux Enterprise Server 15 SP5 \|X \|X \|X \|X \|X \| \|X \|X \| +\|Operating system \|Azure Monitor agent \|Dependency VM Insights \|Qualys \|Custom Script \|Key Vault \|Hybrid Runbook \|Antimalware Extension \|Connected Machine agent \| +\|--\|--\|--\|-\|--\|-\|\|-\|\| +\|Amazon Linux 2 \| \| \|X \| \| \|X \|X \| +\|CentOS Linux 8 \|X \|X \|X \|X \| \|X \|X \| +\|CentOS Linux 7 \|X \|X \|X \|X \| \|X \|X \| +\|CentOS Linux 6 \| \| \|X \|X \| \|X \| \| +\|Debian 10 \|X \| \|X \|X \| \|X \| \| +\|Debian 9 \|X \|X \|X \|X \| \| \| \| +\|Debian 8 \| \|X \|X \| \| \|X \| \| +\|Debian 7 \| \| \|X \| \| \|X \| \| +\|OpenSUSE 13.1+ \| \| \|X \|X \| \| \| \| +\|Oracle Linux 8 \|X \| \|X \|X \| \|X \|X \| +\|Oracle Linux 7 \|X \| \|X \|X \| \|X \|X \| +\|Oracle Linux 6 \| \| \|X \|X \| \|X \|X \| +\|Red Hat Enterprise Linux Server 8 \|X \| \|X \|X \| \|X \|X \| +\|Red Hat Enterprise Linux Server 7 \|X \|X \|X \|X \| \|X \|X \| +\|Red Hat Enterprise Linux Server 6 \| \|X \|X \| \| \|X \| \| +\|SUSE Linux Enterprise Server 15.2 \|X \| \|X \|X \|X \| \|X \| +\|SUSE Linux Enterprise Server 15.1 \|X \| \|X \|X \|X \|X \|X \| +\|SUSE Linux Enterprise Server 15 SP1 \|X \|X \|X \|X \|X \|X \|X \| +\|SUSE Linux Enterprise Server 15 \|X \|X \|X \|X \|X \|X \|X \| +\|SUSE Linux Enterprise Server 15 SP5 \|X \|X \|X \|X \| \|X \|X \| \|SUSE Linux Enterprise Server 12 SP5 \|X \|X \|X \|X \|X \| \|X \|X \| -\|Ubuntu 20.04 LTS \|X \|X \|X \|X \|X \| \|X \|X \| -\|Ubuntu 18.04 LTS \|X \|X \|X \|X \|X \|X \|X \|X \| -\|Ubuntu 16.04 LTS \|X \|X \|X \|X \| \| \|X \|X \| -\|Ubuntu 14.04 LTS \| \|X \| \|X \| \| \|X \| \| +\|Ubuntu 20.04 LTS \|X \|X \|X \|X \| \|X \|X \| +\|Ubuntu 18.04 LTS \|X \|X \|X \|X \|X \|X \|X \| +\|Ubuntu 16.04 LTS \|X \|X \|X \| \| \|X \|X \| +\|Ubuntu 14.04 LTS \| \| \|X \| \| \|X \| \| For the regional availabilities of different Azure services and VM extensions available for Azure Arc-enabled servers, [refer to Azure Global's Product Availability Roadmap](https://global.azure.com/product-availability/roadmap).
azure-arc	Quick Start Connect Vcenter To Arc Using Script	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/vmware-vsphere/quick-start-connect-vcenter-to-arc-using-script.md	Title: Connect VMware vCenter Server to Azure Arc by using the helper script description: In this quickstart, you learn how to use the helper script to connect your VMware vCenter Server instance to Azure Arc. Previously updated : 05/15/2024 Last updated : 09/04/2024 First, the script deploys a virtual appliance called [Azure Arc resource bridge] - At least three free static IP addresses on the above network. -- A resource pool or a cluster with a minimum capacity of 16 GB of RAM and four vCPUs. +- A resource pool or a cluster with a minimum capacity of 8 GB of RAM and 4 vCPUs. -- A datastore with a minimum of 200 GB of free disk space available through the resource pool or cluster. +- A datastore with a minimum of 200 GB of free disk space or 400 GB for High Availability deployment, available through the resource pool or cluster. > [!NOTE] > Azure Arc-enabled VMware vSphere supports vCenter Server instances with a maximum of 9,500 virtual machines (VMs). If your vCenter Server instance has more than 9,500 VMs, we don't recommend that you use Azure Arc-enabled VMware vSphere with it at this point.
azure-arc	Support Matrix For Arc Enabled Vmware Vsphere	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-arc/vmware-vsphere/support-matrix-for-arc-enabled-vmware-vsphere.md	Title: Plan for deployment description: Learn about the support matrix for Arc-enabled VMware vSphere including vCenter Server versions supported, network requirements, and more. Previously updated : 04/23/2024 Last updated : 09/04/2024 You need a vSphere account that can: For Arc-enabled VMware vSphere, resource bridge has the following minimum virtual hardware requirements: -- 16 GB of memory +- 8 GB of memory - 4 vCPUs - An external virtual switch that can provide access to the internet directly or through a proxy. If internet access is through a proxy or firewall, ensure [these URLs](#resource-bridge-networking-requirements) are allow-listed.
azure-functions	Azfd0013	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/errors-diagnostics/diagnostic-events/azfd0013.md	+ + Title: "AZFD0013: The configured runtime does not match the worker runtime metadata found in the deployed function app artifacts." + +description: "Learn how to troubleshoot the event 'AZFD0013: The configured runtime does not match the worker runtime metadata found in the deployed function app artifacts' in Azure Functions." + Last updated : 09/03/2024+++ +# AZFD0013: The configured runtime does not match the worker runtime metadata found in the deployed function app artifacts + +This event occurs when a function app has a `FUNCTIONS_WORKER_RUNTIME` setting specifying a language stack, but a payload for a different stack is deployed to it. + +\| \| Value \| +\|-\|-\| +\| Event ID \|AZFD0013\| +\| Severity \|Warning or Error\| + +## Event description + +The `FUNCTIONS_WORKER_RUNTIME` application setting indicates the language or language stack on which the function app runs, such as `python`. For more information on valid values, see the [`FUNCTIONS_WORKER_RUNTIME`][fwr] reference. The deployed application must correspond with the provided value. If there is a mismatch, it means that either the value of `FUNCTIONS_WORKER_RUNTIME` is incorrect, or that an unexpected payload was deployed to the application. + +This event may appear for apps that were previously using inconsistent and undefined behavior to continue running while in a mismatch state. Follow the instructions in this article to resolve the event for these applications. Doing so allows these apps to take advantage of performance enhancements and ensure that they can continue to operate as expected. + +.NET apps undergoing a [migration from the in-process model to the isolated worker][isolated-migration] may encounter this event temporarily during that process. When `FUNCTIONS_WORKER_RUNTIME` is updated to "dotnet-isolated", but the application is still using an in-process model payload, this event may appear until the migration is completed. See the migration guidance for instructions on using deployment slots to prevent this event from appearing in your production environment. + +## How to resolve the event + +The event message indicates the current value of `FUNCTIONS_WORKER_RUNTIME` and the detected runtime metadata from the app payload. The values must be aligned, either by deploying an application of the appropriate type or by updating the value of `FUNCTIONS_WORKER_RUNTIME` to match. + +For most applications, the correct resolution is to update the value of [`FUNCTIONS_WORKER_RUNTIME`][fwr]. To do so, on your function app in Azure, set the `FUNCTIONS_WORKER_RUNTIME` [application setting][app-settings] to the [expected value][fwr] for your application payload. When running locally in the Azure Functions Core Tools, you should also add `FUNCTIONS_WORKER_RUNTIME` to the [local.settings.json file](../../functions-develop-local.md#local-settings-file). + +For apps following a migration guide, see that guide for relevant instructions. [Migrating .NET applications to the isolated worker model][isolated-migration] involves first setting `FUNCTIONS_WORKER_RUNTIME` to "dotnet-isolated" before deploying the updated application payload, and this event may appear temporarily between those steps. + +## When to suppress the event + +This event shouldn't be suppressed. + +[app-settings]: ../../functions-how-to-use-azure-function-app-settings.md#settings +[fwr]: ../../functions-app-settings.md#functions_worker_runtime +[isolated-migration]:../../migrate-dotnet-to-isolated-model.md
azure-functions	Functions Create Maven Intellij	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/functions-create-maven-intellij.md	To run the project locally, follow these steps: > [!IMPORTANT] > You must have the JAVA_HOME environment variable set correctly to the JDK directory that is used during code compiling using Maven. Make sure that the version of the JDK is at least as high as the `Java.version` setting. -1. Navigate to src/main/java/org/example/functions/HttpTriggerFunction.java to see the code generated. Beside line 17, you should see a green Run button. Select it and then select Run 'Functions-azur...'. You should see your function app running locally with a few logs. +1. Navigate to src/main/java/org/example/functions/HttpTriggerJava.java to see the code generated. Beside line 17, you should see a green Run button. Select it and then select Run 'Functions-azur...'. You should see your function app running locally with a few logs. :::image type="content" source="media/functions-create-first-java-intellij/local-run-functions-project.png" alt-text="Local run project." lightbox="media/functions-create-first-java-intellij/local-run-functions-project.png"::: :::image type="content" source="media/functions-create-first-java-intellij/local-run-functions-output.png" alt-text="Local run project output." lightbox="media/functions-create-first-java-intellij/local-run-functions-output.png"::: -1. You can try the function by accessing the displayed endpoint from browser, such as `http://localhost:7071/api/HttpExample?name=Azure`. +1. You can try the function by accessing the displayed endpoint from browser, such as `http://localhost:7071/api/HttpTriggerJava?name=Azure`. :::image type="content" source="media/functions-create-first-java-intellij/local-run-functions-test.png" alt-text="Local run function test result." lightbox="media/functions-create-first-java-intellij/local-run-functions-test.png"::: To debug the project locally, follow these steps: :::image type="content" source="media/functions-create-first-java-intellij/local-debug-functions-button.png" alt-text="Local debug function app button." lightbox="media/functions-create-first-java-intellij/local-debug-functions-button.png"::: -1. Select line 20 of the file src/main/java/org/example/functions/HttpTriggerFunction.java to add a breakpoint. Access the endpoint `http://localhost:7071/api/HttpTrigger-Java?name=Azure` again and you should find that the breakpoint is hit. You can then try more debug features like Step, Watch, and Evaluation. Stop the debug session by selecting Stop. +1. Select line 20 of the file src/main/java/org/example/functions/HttpTriggerJava.java to add a breakpoint. Access the endpoint `http://localhost:7071/api/HttpTriggerJava?name=Azure` again and you should find that the breakpoint is hit. You can then try more debug features like Step, Watch, and Evaluation. Stop the debug session by selecting Stop. :::image type="content" source="media/functions-create-first-java-intellij/local-debug-functions-break.png" alt-text="Local debug function app break." lightbox="media/functions-create-first-java-intellij/local-debug-functions-break.png":::
azure-functions	Migrate Dotnet To Isolated Model	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-functions/migrate-dotnet-to-isolated-model.md	This guide assumes that your app is running on version 4.x of the Functions runt - [Migrate apps from Azure Functions version 2.x and 3.x to version 4.x](./migrate-version-3-version-4.md) - [Migrate apps from Azure Functions version 1.x to version 4.x](./migrate-version-1-version-4.md) -These host version migration guides will also help you migrate to the isolated worker model as you work through them. +These host version migration guides also help you migrate to the isolated worker model as you work through them. ## Identify function apps to migrate This guide doesn't present specific examples for .NET 7 or .NET 6. If you need t If you haven't already, identify the list of apps that need to be migrated in your current Azure Subscription by using the [Azure PowerShell](#identify-function-apps-to-migrate). -Before you migrate an app to the isolated worker model, you should thoroughly review the contents of this guide and familiarize yourself with the features of the [isolated worker model][isolated-guide] and the [differences between the two models](./dotnet-isolated-in-process-differences.md). +Before you migrate an app to the isolated worker model, you should thoroughly review the contents of this guide. You should also familiarize yourself with the features of the [isolated worker model][isolated-guide] and the [differences between the two models](./dotnet-isolated-in-process-differences.md). To migrate the application, you will: -1. Complete the steps in [Migrate your local project](#migrate-your-local-project) to migrate your local project to the isolated worker model. +1. Migrate your local project to the isolated worker model by following the steps in [Migrate your local project](#migrate-your-local-project). 1. After migrating your project, fully test the app locally using version 4.x of the [Azure Functions Core Tools](functions-run-local.md). 1. [Update your function app in Azure](#update-your-function-app-in-azure) to the isolated model. ## Migrate your local project -The section outlines the various changes that you need to make to your local project to move it to the isolated worker model. Some of the steps change based on your target version of .NET. Use the tabs to select the instructions which match your desired version. These steps assume a local C# project, and if your app is instead using C# script (`.csx` files), you should [convert to the project model](./functions-reference-csharp.md#convert-a-c-script-app-to-a-c-project) before continuing. +The section outlines the various changes that you need to make to your local project to move it to the isolated worker model. Some of the steps change based on your target version of .NET. Use the tabs to select the instructions that match your desired version. These steps assume a local C# project, and if your app is instead using C# script (`.csx` files), you should [convert to the project model](./functions-reference-csharp.md#convert-a-c-script-app-to-a-c-project) before continuing. > [!TIP] > If you are moving to an LTS or STS version of .NET, the [.NET Upgrade Assistant] can be used to automatically make many of the changes mentioned in the following sections. -First, you'll convert the project file and update your dependencies. As you do, you will see build errors for the project. In subsequent steps, you'll make the corresponding changes to remove these errors. +First, convert the project file and update your dependencies. As you do, you will see build errors for the project. In subsequent steps, you'll make the corresponding changes to remove these errors. ### Project file Some key types change between the in-process model and the isolated worker model - How the function obtains an `ILogger`/`ILogger<T>` - Trigger and binding attributes and parameters -The rest of this section will walk you through each of these steps. +The rest of this section walks you through each of these steps. #### Function attributes -The `FunctionName` attribute is replaced by the `Function` attribute in the isolated worker model. The new attribute has the same signature, and the only difference is in the name. You can therefore just perform a string replacement across your project. +The `Function` attribute in the isolated worker model replaces the `FunctionName` attribute. The new attribute has the same signature, and the only difference is in the name. You can therefore just perform a string replacement across your project. #### Logging -In the in-process model, you could include an additional `ILogger` parameter to your function, or you could use dependency injection to get an `ILogger<T>`. If you were already using dependency injection, the same mechanisms work in the isolated worker model. +In the in-process model, you could include an optional `ILogger` parameter to your function, or you could use dependency injection to get an `ILogger<T>`. If your app already used dependency injection, the same mechanisms work in the isolated worker model. -However, for any Functions that relied on the `ILogger` method parameter, you will need to make a change. It is recommended that you use dependency injection to obtain an `ILogger<T>`. Use the following steps to migrate the function's logging mechanism: +However, for any Functions that relied on the `ILogger` method parameter, you need to make a change. It is recommended that you use dependency injection to obtain an `ILogger<T>`. Use the following steps to migrate the function's logging mechanism: 1. In your function class, add a `private readonly ILogger<MyFunction> _logger;` property, replacing `MyFunction` with the name of your function class. 1. Create a constructor for your function class that takes in the `ILogger<T>` as a parameter: However, for any Functions that relied on the `ILogger` method parameter, you wi } ``` - Replace both instances of `MyFunction` in the code snippet above with the name of your function class. + Replace both instances of `MyFunction` in the preceding code snippet with the name of your function class. 1. For logging operations in your function code, replace references to the `ILogger` parameter with `_logger`. 1. Remove the `ILogger` parameter from your function signature. When you [changed your package references in a previous step](#package-reference 1. For each binding attribute, change the attribute's name as specified in its reference documentation, which you can find in the [Supported bindings](./functions-triggers-bindings.md#supported-bindings) index. In general, the attribute names change as follows: - Triggers typically remain named the same way. For example, `QueueTrigger` is the attribute name for both models. - - Input bindings typically need "Input" added to their name. For example, if you used the `CosmosDB` input binding attribute in the in-process model, this would now be `CosmosDBInput`. - - Output bindings typically need "Output" added to their name. For example, if you used the `Queue` output binding attribute in the in-process model, this would now be `QueueOutput`. + - Input bindings typically need "Input" added to their name. For example, if you used the `CosmosDB` input binding attribute in the in-process model, the attribute would now be `CosmosDBInput`. + - Output bindings typically need "Output" added to their name. For example, if you used the `Queue` output binding attribute in the in-process model, this attribute would now be `QueueOutput`. 1. Update the attribute parameters to reflect the isolated worker model version, as specified in the binding's reference documentation. When migrating from running in-process to running in an isolated worker process, } ``` -The value you have configured for `AzureWebJobsStorage`` might be different. You do not need to change its value as part of the migration. +The value you have for `AzureWebJobsStorage`` might be different. You do not need to change its value as part of the migration. ### host.json file namespace Company.Function ## Update your function app in Azure -Upgrading your function app to the isolated model consists of two steps: +Updating your function app to the isolated model involves two changes that should be completed together, because if you only complete one, the app is in an error state. Both of these changes also cause the app process to restart. For these reasons, you should perform the update using a [staging slot](./functions-deployment-slots.md). Staging slots help minimize downtime for your app and allow you to test and verify your migrated code with your updated configuration in Azure. You can then deploy your fully migrated app to the production slot through a swap operation. -1. Change the configuration of the function app to use the isolated model by setting the `FUNCTIONS_WORKER_RUNTIME` application setting to `dotnet-isolated`. Make sure that any deployment automation is similarly updated. -2. Publish your migrated project to the updated function app. +> [!IMPORTANT] +> [When an app's deployed payload doesn't match the configured runtime, it will be in an error state](./errors-diagnostics/diagnostic-events/azfd0013.md). During the migration process, you will put the app into this state, ideally only temporarily. Deployment slots help mitigate the impact of this, because the error state will be resolved in your staging (non-production) environment before the changes are applied as single update to your production environment. Slots also defend against any mistakes and allow you to detect any other issues before reaching production. +> +> During the process, you might still see errors in logs coming from your staging (non-production) slot. This is expected, though these should go away as you proceed through the steps. Before you perform the slot swap operation, you should confirm that these errors stop being raised and that your application is working as expected. + +Use the following steps to use deployment slots to update your function app to the isolated worker model: + +1. [Create a deployment slot](./functions-deployment-slots.md#add-a-slot) if you haven't already. You might also want to familiarize yourself with the slot swap process and ensure that you can make updates to the existing application with minimal disruption. +1. Change the configuration of the staging (non-production) slot to use the isolated worker model by setting the `FUNCTIONS_WORKER_RUNTIME` application setting to `dotnet-isolated`. `FUNCTIONS_WORKER_RUNTIME` should not be marked as a "slot setting". + + If you are also targeting a different version of .NET as part of your update, you should also change the stack configuration. To do so, see the [instructions to update the stack configuration for the isolated worker model](./update-language-versions.md?pivots=programming-language-csharp#update-the-stack-configuration). You will use the same instructions for any future .NET version updates you make. + + If you have any automated infrastructure provisioning such as a CI/CD pipeline, make sure that the automations are also updated to keep `FUNCTIONS_WORKER_RUNTIME` set to `dotnet-isolated` and to target the correct .NET version. -When you use Visual Studio to publish an isolated worker model project to an existing function app that uses the in-process model, you're prompted to let Visual Studio update the function app during deployment. This accomplishes both steps at once. +1. Publish your migrated project to the staging (non-production) slot of your function app. + + If you use Visual Studio to publish an isolated worker model project to an existing app or slot that uses the in-process model, it can also complete the previous step for you at the same time. If you did not complete the previous step, Visual Studio prompts you to update the function app during deployment. Visual Studio presents this as a single operation, but these are still two separate operations. You might still see errors in your logs from the staging (non-production) slot during the interim state. -If you need to minimize downtime, consider using a [staging slot](functions-deployment-slots.md) to test and verify your migrated code with your updated configuration in Azure. You can then deploy your fully migrated app to the production slot through a swap operation. +1. Confirm that your application is working as expected within the staging (non-production) slot. +1. Perform a [slot swap operation](./functions-deployment-slots.md#swap-slots). This applies the changes you made in your staging (non-production) slot to the production slot. A slot swap happens as a single update, which avoids introducing the interim error state in your production environment. +1. Confirm that your application is working as expected within the production slot. -Once you've completed these steps, your app has been fully migrated to the isolated model. Congratulations! Repeat the steps from this guide as necessary for [any other apps needing migration](#identify-function-apps-to-migrate). +Once you complete these steps, the migration is complete, and your app runs on the isolated model. Congratulations! Repeat the steps from this guide as necessary for [any other apps needing migration](#identify-function-apps-to-migrate). ## Next steps
azure-government	Documentation Government Impact Level 5	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-government/documentation-government-impact-level-5.md	For AI and machine learning services availability in Azure Government, see [Prod Azure AI Language Understanding (LUIS) is part of [Azure AI Language](/azure/ai-services/language-service/). +<a name='cognitive-services-azure-openai'></a> + +### [Azure AI + +- Configure encryption at rest of content in Azure OpenAI [using customer-managed keys in Azure Key Vault](/azure/ai-services/openai/encrypt-data-at-rest#use-customer-managed-keys-with-azure-key-vault). + <a name='cognitive-services-personalizer'></a> ### [Azure AI
azure-monitor	Azure Monitor Workspace Overview	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/essentials/azure-monitor-workspace-overview.md	When you create a new Azure Monitor workspace, you provide a region which sets t \|Australia\|Australia Central, Australia East, Australia Southeast\| \|Brazil\|Brazil South, Brazil Southeast\| \|Canada\|Canada Central, Canada East\| +\|China\|China North 3 (Preview), China East 3 (Preview)\| \|Europe\|North Europe, West Europe\| \|France\|France Central, France South\| \|Germany\|Germany West Central\|
backup	Backup Azure Restore Key Secret	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-azure-restore-key-secret.md	Once the JSON file is generated in the destination path mentioned above, generat ```powershell $keyDestination = 'C:\keyDetails.blob' [io.file]::WriteAllBytes($keyDestination, [System.Convert]::FromBase64String($encryptionObject.OsDiskKeyAndSecretDetails.KeyBackupData)) -Restore-AzureKeyVaultKey -VaultName '<target_key_vault_name>' -InputFile $keyDestination +Restore-AzKeyVaultKey -VaultName '<target_key_vault_name>' -InputFile $keyDestination ``` ## Restore secret
backup	Backup Support Matrix	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-support-matrix.md	Title: Azure Backup support matrix description: Provides a summary of support settings and limitations for the Azure Backup service. Previously updated : 06/18/2024 Last updated : 09/04/2024 Other support matrices are available: ## Vault support +Azure Backup supports both Recovery Services vault and Backup vault, and enables you to back up and restore different datasources. You need to create the appropriate vault based on the datasource type that you want to protect. Learn more about [the supported vaults](/azure/backup/backup-azure-backup-faq#what-are-the-various-vaults-supported-for-backup-and-restore-). + Azure Backup uses Recovery Services vaults to orchestrate and manage backups for the following workload types - Azure VMs, SQL in Azure VMs, SAP HANA in Azure VMs, Azure File shares and on-premises workloads using Azure Backup Agent, Azure Backup Server and System Center DPM. It also uses Recovery Services vaults to store backed-up data for these workloads. The following table describes the features of Recovery Services vaults:
communication-services	Delay Issue	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/communication-services/resources/troubleshooting/voice-video-calling/audio-issues/delay-issue.md	A high jitter buffer delay can cause audio delays that are noticeable to the use ## How to detect using the SDK You can use the [User Facing Diagnostics API](../../../../concepts/voice-video-calling/user-facing-diagnostics.md) to detect the network condition changes. +For the network quality of the audio sending end, check UFD events with the values of `networkSendQuality`. +For the network quality of the receiving end, check UFD events with the values of `networkReceiveQuality`. -For the network quality of the audio sending end, you can check events with the values of `networkSendQuality`. +In addition, you can use the [Media Stats API](../../../../concepts/voice-video-calling/media-quality-sdk.md) to monitor and track real-time network performance from the Web client. +There are two metrics related to the audio delay: `rttInMs` and `jitterBufferDelayInMs`. -For the network quality of the receiving end, you can check events with the values of `networkReceiveQuality`. +The [rttInMs](../../../../concepts/voice-video-calling/media-quality-sdk.md?pivots=platform-web#audio-send-metrics) has a direct impact on the audio delay, as the metric indicates the round trip time of packets. High latency can result in perceptible delays in audio. +We recommend a round-trip time of 200 ms or less. +If the round-trip time is larger than 500 ms, users may experience significant delays that can lead to frustration and hinder effective communication. In such cases, the conversation flow can be disrupted, making it difficult to have a smooth and natural interaction. -In addition, you can use the [Media Stats API](../../../../concepts/voice-video-calling/media-quality-sdk.md) as a method to monitor and track real time the network performance from the Web client. - -For the quality of the audio sending end, you can check the metrics `rttInMs`. - -For the quality of the receiving end, you can check the metrics `jitterInMs`, `jitterBufferDelayInMs`. +In [jitterBufferDelayInMs](../../../../concepts/voice-video-calling/media-quality-sdk.md?pivots=platform-web#audio-receive-metrics) shows how long the audio samples stay in the jitter buffer. +This value can be affected by various factors, such as late arrival of packets, out-of-order, packet loss, etc. +Normally, it's less than 200 ms. Users may notice audio delays in the call if this value is high. ## How to mitigate or resolve From the perspective of the ACS Calling SDK, network issues are considered external problems.
connectors	Connectors Create Api Servicebus	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/connectors/connectors-create-api-servicebus.md	ms.suite: integration Previously updated : 08/26/2024 Last updated : 09/03/2024 In Standard workflows, to read a message from a dead-letter queue in a queue or If a Service Bus trigger's polling interval is small, such as 10 seconds, updates to your workflow might not take effect for up to 10 minutes. To work around this problem, you can disable the logic app resource, make the changes, and then enable the logic app resource again. -### No session available +### No session available or might be locked by another receiver Occasionally, operations such as completing a message or renewing a session produce the following error: ``` json { "status": 400, - "message": "No session available to complete the message with the lock token 'ce440818-f26f-4a04-aca8-555555555555'. clientRequestId: facae905-9ba4-44f4-a42a-888888888888", "error": { "message": "No session available to complete the message with the lock token 'ce440818-f26f-4a04-aca8-555555555555'." } } ``` +Occasionally, a session-based trigger might fail with the following error: + +``` json +{ + "status": 400, + "error": { + "message": "Communication with the Service Bus namespace 'xxxx' and 'yyyy' entity failed. The requested session 'zzzz' cannot be accepted. It may be locked by another receiver." + } +} +``` + The Service Bus connector uses in-memory cache to support all operations associated with the sessions. The Service Bus message receiver is cached in the memory of the role instance (virtual machine) that receives the messages. To process all requests, all calls for the connection get routed to this same role instance. This behavior is required because all the Service Bus operations in a session require the same receiver that receives the messages for a specific session. -The chance exists that requests might not get routed to the same role instance, due to reasons such as an infrastructure update, connector deployment, and so on. If this event happens, requests fail because the receiver that performs the operations in the session isn't available in the role instance that serves the request. +Due to reasons such as an infrastructure update, connector deployment, and so on, the possibility exists for requests to not get routed to the same role instance. If this event happens, requests fail for one of the following reasons: + +- The receiver that performs the operations in the session isn't available in the role instance that serves the request. + + - The new role instance tries to obtain the session, which either timed out in the old role instance or wasn't closed. As long as this error happens only occasionally, the error is expected. When the error happens, the message is still preserved in the service bus. The next trigger or workflow run tries to process the message again.
cost-management-billing	Cancel Azure Subscription	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/cancel-azure-subscription.md	The following table describes the permission required to cancel a subscription. \|Subscription type \|Who can cancel \| \|\|\| \|Subscriptions created when you sign up for Azure through the Azure website. For example, when you sign up for an [Azure Free Account](https://azure.microsoft.com/offers/ms-azr-0044p/), [account with pay-as-you-go rates](https://azure.microsoft.com/offers/ms-azr-0003p/) or as a [Visual studio subscriber](https://azure.microsoft.com/pricing/member-offers/credit-for-visual-studio-subscribers/). \| Service administrator and subscription owner \| -\|[Microsoft Enterprise Agreement](https://azure.microsoft.com/pricing/enterprise-agreement/) and [Enterprise Dev/Test](https://azure.microsoft.com/offers/ms-azr-0148p/) \| Service administrator and subscription owner \| +\|[Microsoft Enterprise Agreement](https://azure.microsoft.com/pricing/enterprise-agreement/) and [Enterprise Dev/Test](https://azure.microsoft.com/offers/ms-azr-0148p/) \| Subscription owner \| \|[Azure plan](https://azure.microsoft.com/offers/ms-azr-0017g/) and [Azure plan for DevTest](https://azure.microsoft.com/offers/ms-azr-0148g/) \| Subscription owners \| An account administrator without the service administrator or subscription owner role canΓÇÖt cancel an Azure subscription. For more information, see [Azure classic subscription administrators](../../role-based-access-control/classic-administrators.md).
cost-management-billing	Direct Ea Administration	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/direct-ea-administration.md	Title: EA Billing administration on the Azure portal description: This article explains the common tasks that an enterprise administrator accomplishes in the Azure portal. Previously updated : 06/07/2024 Last updated : 09/04/2024 Transferring one or more subscriptions from one EA enrollment to another EA enro Before starting the ownership transfer, get familiar with the following Azure role-based access control (RBAC) policies: -- When doing a subscription or account ownership transfers between two organizational IDs within the same tenant, the following items are preserved: - - Azure RBAC policies - - Existing service administrator - - Coadministrator roles +- When doing a subscription or account ownership transfers between two organizational IDs within the same tenant Azure RBAC policies and role assignments are preserved. - Cross-tenant subscription or account ownership transfers result in losing your Azure RBAC policies and role assignments.-- Policies and administrator roles don't transfer across different directories. Service administrators are updated to the owner of destination account. +- Policies and administrator roles don't transfer across different directories. The destination enrollment account owner is assigned as the Subscription Owner role on the subscription. - To avoid losing Azure RBAC policies and role assignments when transferring subscription between tenants, ensure that the Move the subscriptions to the recipient's Microsoft Entra tenant selection remains cleared. This selection keeps the services, Azure roles, and policies on the current Microsoft Entra tenant and only transfers the billing ownership for the account. Before changing an account owner: When a user is added as an account owner, any Azure subscriptions associated wit ## Create a subscription -You can use subscriptions to give teams in your organization access to development environments and projects. For example: +You can use subscriptions to give teams in your organization access to development environments and projects. For example: - Test - Production - Development - Staging -When you create different subscriptions for each application environment, you help secure each environment. --- You can also assign a different service administrator account for each subscription.-- You can associate subscriptions with any number of services.-- The account owner creates subscriptions and assigns a service administrator account to each subscription in their account. +When you create different subscriptions for each application environment, you help secure each environment. As an account owner, you can create multiple subscriptions and assign different Subscription Owners for each subscription. Check out the [EA admin manage subscriptions](https://www.youtube.com/watch?v=KFfcg2eqPo8) video. It's part of the [Enterprise Customer Billing Experience in the Azure portal](https://www.youtube.com/playlist?list=PLeZrVF6SXmsoHSnAgrDDzL0W5j8KevFIm) series of videos. For either option, you must submit a [support request](https://support.microsoft An organizational unit used to administer subscriptions and for reporting. Account owner<br> -The person who manages subscriptions and service administrators on Azure. They can view usage data on this account and its associated subscriptions. +The person who manages subscriptions and developoment projects. Amendment subscription<br> A one-year, or coterminous subscription under the enrollment amendment. An amendment signed by an enterprise, which provides them with access to Azure a Resource quantity consumed<br> The quantity of an individual Azure service that was used in a month. -Service administrator<br> +Subscription<br> +Represents an Azure EA subscription and is a container of Azure services. + +Subscription owner<br> The person who accesses and manages subscriptions and development projects. -Subscription<br> -Represents an Azure EA subscription and is a container of Azure services managed by the same service administrator. Work or school account<br> For organizations that set up Microsoft Entra ID with federation to the cloud and all accounts are on a single tenant.
cost-management-billing	Understand Ea Roles	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/cost-management-billing/manage/understand-ea-roles.md	Previously updated : 02/16/2024 Last updated : 09/04/2024 The Azure portal hierarchy for Cost Management consists of: - Accounts are organizational units in the Azure portal for Cost Management. You can use accounts to manage subscriptions and access reports. -- Subscriptions are the smallest unit in the Azure portal for Cost Management. They're containers for Azure services managed by the Account Owner role, also known as the Subscription's service administrator. +- Subscriptions are the smallest unit in the Azure portal for Cost Management. They're containers for Azure services. The following diagram illustrates simple Azure EA hierarchies. The following administrative user roles are part of your enterprise enrollment: - EA purchaser - Department administrator - Account owner-- Service administrator - Notification contact Use Cost Management in the [Azure portal](https://portal.azure.com) so you can manage Azure Enterprise Agreement roles. You can grant department administrators read-only access when you edit or create Users with this role can: - Create and manage subscriptions.-- Manage service administrators. +- Manage subscription role assignments. - View usage for subscriptions. Each account requires a unique work, school, or Microsoft account. For more information about Azure portal administrative roles, see [Understand Azure Enterprise Agreement administrative roles in Azure](understand-ea-roles.md). There can be only one account owner per account. However, there can be multiple For different Microsoft Entra accounts, it can take more than 30 minutes for permission settings to take effect. -### Service administrator - -The service administrator role has permissions to manage services in the Azure portal and assign users to the coadministrator role. - ### Notification contact The notification contact receives usage notifications related to the enrollment.
data-factory	Whats New Archive	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/whats-new-archive.md	This archive page retains updates from older months. Check out our [What's New video archive](https://www.youtube.com/playlist?list=PLt4mCx89QIGS1rQlNt2-7iuHHAKSomVLv) for all of our monthly updates. +## September 2023 + +### Pipelines + +Added support for metadata driven pipelines for dynamic full and incremental processing in Azure SQL [Learn more](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/metadata-driven-pipelines-for-dynamic-full-and-incremental/ba-p/3925362) + ## August 2023 ### Change Data Capture
data-factory	Whats New	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/whats-new.md	This page is updated monthly, so revisit it regularly. For older months' update Check out our [What's New video archive](https://www.youtube.com/playlist?list=PLt4mCx89QIGS1rQlNt2-7iuHHAKSomVLv) for all of our monthly update videos. +## August 2024 + +## Data movement + +- Azure Table Storage connector now supports two more authentication types: system-assigned managed identity authentication and user-assigned managed identity authentication. [Learn more](connector-azure-table-storage.md) +- Azure Files connector now supports two more authentication types: system-assigned managed identity authenticatino and user-assigned managed identity authentication. [Learn more](connector-azure-file-storage.md) + ## June 2024 ### Data movement General Availability of Time to Live (TTL) for Managed Virtual Network [Learn mo Azure Data Factory is generally available in Poland Central [Learn more](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/continued-region-expansion-azure-data-factory-is-generally/ba-p/3965769) -## September 2023 - -### Pipelines - -Added support for metadata driven pipelines for dynamic full and incremental processing in Azure SQL [Learn more](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/metadata-driven-pipelines-for-dynamic-full-and-incremental/ba-p/3925362) - ## Related content - [What's new archive](whats-new-archive.md)
event-hubs	Event Hubs Dedicated Overview	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/event-hubs/event-hubs-dedicated-overview.md	Approximately one CU in a self-serve scalable cluster provides *ingress capacity With self-serve scalable clusters, you can purchase up to 10 CUs for a cluster in the Azure portal. In contrast to traditional clusters, these clusters can be scaled incrementally with CUs ranging from 1 to 10. If you need a cluster larger than 10 CUs, you can [submit a support request](event-hubs-dedicated-cluster-create-portal.md#submit-a-support-request) to scale up your cluster after its creation. > [!IMPORTANT] -> You can deploy self-serve scalable dedicated clusters with [availability zones](../availability-zones/az-overview.md#azure-regions-with-availability-zones) that are enabled with three CUs. However, you can't use the self-serve scaling capability to scale the cluster. To create or scale an AZ-enabled self-serve cluster, you must [submit a support request](event-hubs-dedicated-cluster-create-portal.md#submit-a-support-request). - +> To create or scale an AZ-enabled self-serve cluster, you must [submit a support request](event-hubs-dedicated-cluster-create-portal.md#submit-a-support-request) requesting three CUs or greater. A three CU (or greater) self-serve cluster created via Portal is NOT AZ-enabled. ### Legacy clusters Event Hubs dedicated clusters created before the availability of self-serve scalable clusters are referred to as legacy clusters.
governance	Supported Tables Resources	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/governance/resource-graph/reference/supported-tables-resources.md	For sample queries for this table, see [Resource Graph sample queries for resour - microsoft.compute/virtualmachines/runcommands - Microsoft.Compute/virtualMachineScaleSets (Virtual machine scale sets) - Sample query: [Get virtual machine scale set capacity and size](../samples/samples-by-category.md#get-virtual-machine-scale-set-capacity-and-size) +- microsoft.compute/virtualmachinescalesets/virtualmachines +- microsoft.compute/virtualmachinescalesets/virtualmachines/networkinterfaces - microsoft.compute/virtualmachinescalesets/virtualmachines/networkinterfaces/ipconfigurations/publicipaddresses - Microsoft.ConfidentialLedger/ledgers (Confidential Ledgers) - Microsoft.Confluent/organizations (Confluent organizations)
openshift	Howto Deploy Java Jboss Enterprise Application Platform App	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/openshift/howto-deploy-java-jboss-enterprise-application-platform-app.md	Use the following steps to deploy the app to the cluster. The app is hosted in t ```bash git clone https://github.com/Azure/rhel-jboss-templates.git cd rhel-jboss-templates - git checkout 20230615 + git checkout 20240904 cd .. oc new-project ${PROJECT_NAME} oc adm policy add-scc-to-user privileged -z default --namespace ${PROJECT_NAME}
operator-service-manager	Safe Upgrade Practices	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/operator-service-manager/safe-upgrade-practices.md	# Get started with safe upgrade practices+ +## Overview This article introduces Azure Operator Service Manager (AOSM) safe upgrade practices (SUP). This feature set enables an end user to safely execute complex upgrades of CNF workloads hosted on Azure Operator Nexus, in compliance with partner ISSU requirements, where applicable. Look for future articles in these services to expand on SUP features and capabilities. ## Introduction A given network service supported by Azure Operator Service Manager will be comp * Single Chart Test Validation - Running a helm test operation after a create or update. * Refactored SNS Reput - Improved methods, adds update order and cleanup check. -## Overview +## Upgrade approach To update an existing Azure Operator Service Manager site network service (SNS), the Operator executes a reput update request against the deployed SNS resource. Where the SNS contains CNFs with multiple NfApps, the request is fanned out across all NfApps defined in the network function definition version (NFDV). By default, in the order, which they appear, or optionally in the order defined by UpdateDependsOn parameter. For each NfApp, the reput update request supports increasing a helm chart version, adding/removing helm values and/or adding/removing any NfApps. Timeouts can be set per NfApp, based on known allowable runtimes, but NfApps can only be processed in serial order, one after the other. The reput update implements the following processing logic:
quotas	How To Guide Monitoring Alerting	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/quotas/how-to-guide-monitoring-alerting.md	Title: Create alerts for quotas description: Learn how to create alerts for quotas Previously updated : 09/03/2024 Last updated : 09/04/2024 The simplest way to create a quota alert is to use the Azure portal. Follow thes \| [Dimensions](../azure-monitor/alerts/alerts-types.md#monitor-the-same-condition-on-multiple-resources-using-splitting-by-dimensions-1) \| Here are the options for selecting multiple Quotas and regions within a single alert rule. Adding dimensions is a cost-effective approach compared to creating a new alert for each quota or region.\| > [!TIP] - > Within the same subscription, we advise using the same Resource group, Log Analytics workspace, and Managed identity values for all alert rules. + > Within the same subscription, we advise using the same Resource Group and Managed identity values for all alert rules. 1. After you've made your selections, select Create Alert. You'll see a confirmation if the rule was successfully created, or a message if any problems occurred. For a sample request body, see the [API documentation](/rest/api/monitor/schedul You can use the Azure Monitor Alerts pane to [create alerts using a query](../azure-monitor/alerts/alerts-create-new-alert-rule.md?tabs=log). Resource Graph Explorer lets you run and test queries before using them to create an alert. To learn more, see the [Configure Azure alerts](/training/modules/configure-azure-alerts/) training module. -For quota alerts, make sure the Scope is your Log analytics workspace and the Signal type is the customer query log. Add a sample query for quota usages. Follow the remaining steps as described in the [Create or edit an alert rule](../azure-monitor/alerts/alerts-create-new-alert-rule.md?tabs=log). +For quota alerts, make sure the Scope is your Subscription and the Signal type is the customer query log. Add a sample query for quota usages. Follow the remaining steps as described in the [Create or edit an alert rule](../azure-monitor/alerts/alerts-create-new-alert-rule.md?tabs=log). The following example shows a query that creates quota alerts.
role-based-access-control	Integration	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/role-based-access-control/permissions/integration.md	Azure service: [Service Bus](/azure/service-bus-messaging/) > \| Microsoft.ServiceBus/namespaces/eventGridFilters/write \| Creates or Updates the Event Grid filter associated with the namespace. \| > \| Microsoft.ServiceBus/namespaces/eventGridFilters/read \| Gets the Event Grid filter associated with the namespace. \| > \| Microsoft.ServiceBus/namespaces/eventGridFilters/delete \| Deletes the Event Grid filter associated with the namespace. \| -> \| Microsoft.ServiceBus/namespaces/eventhubs/read \| Get list of EventHub Resource Descriptions \| > \| Microsoft.ServiceBus/namespaces/ipFilterRules/read \| Get IP Filter Resource \| > \| Microsoft.ServiceBus/namespaces/ipFilterRules/write \| Create IP Filter Resource \| > \| Microsoft.ServiceBus/namespaces/ipFilterRules/delete \| Delete IP Filter Resource \| Azure service: [Services Hub](/services-hub/) ## Next steps -- [Azure resource providers and types](/azure/azure-resource-manager/management/resource-providers-and-types) +- [Azure resource providers and types](/azure/azure-resource-manager/management/resource-providers-and-types)
sap	Get Started	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/get-started.md	Previously updated : 07/29/2024 Last updated : 09/03/2024 In the SAP workload documentation space, you can find the following areas: ## Change Log +- September 03, 2024: Included Mv3 High Memory and Very High Memory in HANA storage configuration in [SAP HANA Azure virtual machine Premium SSD storage configurations](./hana-vm-premium-ssd-v1.md), [SAP HANA Azure virtual machine Premium SSD v2 storage configurations](./hana-vm-premium-ssd-v2.md), and [SAP HANA Azure virtual machine Ultra Disk storage configurations](./hana-vm-ultra-disk.md) - August 22, 2024: Added documentation option for SAPHanaSR-angi as separate tab in [High availability for SAP HANA on Azure VMs on SLES](./sap-hana-high-availability.md) and [High availability of SAP HANA scale-up with Azure NetApp Files on SLES](./sap-hana-high-availability-netapp-files-suse.md). - July 29, 2024: Changes in [Azure VMs high availability for SAP NetWeaver on SLES for SAP Applications with simple mount and NFS](./high-availability-guide-suse-nfs-simple-mount.md), [Azure VMs high availability for SAP NW on SLES with NFS on Azure Files](./high-availability-guide-suse-nfs-azure-files.md), [Azure VMs high availability for SAP NW on SLES with NFS on Azure Files](./high-availability-guide-suse-netapp-files.md), [Azure VMs high availability for SAP NetWeaver on SLES](./high-availability-guide-suse.md), [Azure VMs high availability for SAP NetWeaver on SLES multi-SID guide](./high-availability-guide-suse-multi-sid.md) with the instructions of managing SAP ASCS and ERS instances SAP startup framework when configured with systemd. - July 24, 2024: Release of SBD STONITH support using iSCSI target server or Azure shared disk in [Configuring Pacemaker on RHEL in Azure](./high-availability-guide-rhel-pacemaker.md).
sap	Hana Vm Premium Ssd V1	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/hana-vm-premium-ssd-v1.md	keywords: 'SAP, Azure HANA, Storage Ultra disk, Premium storage' Previously updated : 06/28/2024 Last updated : 09/03/2024 Configuration for SAP /hana/data volume: \| M192i(d)ms_v2 \| 4,096 GiB \| 2,000 MBps \| 4 x P30 \| 800 MBps \| no bursting \| 20,000 \| no bursting \| \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 4 x P30 \| 800 MBps \| no bursting \| 20,000\| no bursting \| \| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 4,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| -\| M416s_8_v2 \| 7,600 \| 2,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| +\| M416(d)s_8_v2 \| 7,600 \| 2,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| +\| M416(d)s_8_v3 \| 7,600 \| 4,000 MBps \| 4 x P40 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 4 x P50 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| -\| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 4 x P60<sup>1</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| -\| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \| 4 x P60<sup>1</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| +\| M624(d)s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 4 x P50 \| 1,000 MBps \| no bursting \| 30,000 \| no bursting \| +\| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 4 x P60<sup>2</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 4 x P60<sup>2</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| +\| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \| 4 x P60<sup>2</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 4 x P60<sup>2</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 6 x P60<sup>2</sup> \| 2,000 MBps \| no bursting \| 64,000 \| no bursting \| <sup>1</sup> VM type not available by default. Contact your Microsoft account team For the /hana/log volume. the configuration would look like: \| M176(d)s_4_v3 \| 3,892 GiB \| 4,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M192i(d)ms_v2 \| 4,096 GiB \| 2,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| -\| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| +\| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 2,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M416s_8_v2 \| 7,600 GiB \| 2,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| +\| M416(d)s_8_v3 \| 7,600 GiB \| 4,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| +\| M624s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 3 x P15 \| 375 MBps \| 510 MBps \| 3,300 \| 10,500 \| \| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 4 x P20 \| 600 MBps \| 680 MBps \| 9,200 \| 14,000 \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 4 x P20 \| 600 MBps \| 680 MBps \| 9,200 \| 14,000 \| \| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \| 4 x P20 \| 600 MBps \| 680 MBps \| 9,200 \| 14,000 \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 4 x P20 \| 600 MBps \| 680 MBps \| 9,200 \| 14,000 \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 4 x P20 \| 600 MBps \| 680 MBps \| 9,200 \| 14,000 \| + <sup>1</sup> VM type not available by default. Contact your Microsoft account team For the other volumes, the configuration would look like: \| M192i(d)ms_v2 \| 4,096 GiB \| 2,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| \| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 2,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| \| M416s_8_v2 \| 7,600 GiB \| 2,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M416(d)s_8_v3 \| 7,600 GiB \| 4,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| -\| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| -\| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \|1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M624s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \|1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \|1 x P30 \| 1 x P10 \| 1 x P6 \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \|1 x P30 \| 1 x P10 \| 1 x P6 \| <sup>1</sup> VM type not available by default. Contact your Microsoft account team <sup>2</sup> Review carefully the [considerations for sizing **/han#considerations-for-the-hana-shared-file-system)
sap	Hana Vm Premium Ssd V2	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/hana-vm-premium-ssd-v2.md	keywords: 'SAP, Azure HANA, Storage Ultra disk, Premium storage, Premium SSD v2' Previously updated : 06/28/2024 Last updated : 09/03/2024 Configuration for SAP /hana/data volume: \| M192i(d)ms_v2 \| 4,096 GiB \| 2,000 MBps \| 80,000 \| 4,912 GB \| 800 MBps \| 12,000 \| \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 40,000 \| 3,424 GB \| 1,000 MBps\| 15,000 \| \| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 40,000 \| 6,848 GB \| 1,000 MBps \| 15,000 \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 4,000 MBps \| 130,000 \| 6,848 GB \| 1,200 MBps\| 30,000 \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 80,000 \| 6,848 GB \| 1,200 MBps\| 17,000 \| \| M416s_8_v2 \| 7,600 GiB \| 2,000 MBps \| 80,000 \| 9,120 GB \| 1,250 MBps\| 20,000 \| +\| M416(d)s_8_v3 \| 7,600 GiB \| 4,000 MBps \| 130,000 \| 9,120 GB \| 1,250 MBps\| 30,000 \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 80,000 \| 13,680 GB \| 1,300 MBps\| 25,000 \| +\| M624s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 130,000 \| 13,680 GB \| 1,300 MBps\| 40,000 \| \| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 80,000 \| 19,200 GB \| 2,000 MBps<sup>2</sup> \| 40,000 \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 130,000 \| 19,200 GB \| 4,000 MBps<sup>2</sup> \| 60,000 \| \| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \| 80,000 \| 28,400 GB \| 2,000 MBps<sup>2</sup> \| 60,000 \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 130,000/260,000<sup>3</sup> \| 36,0000 GB \| 2,000 MBps<sup>2</sup> \| 80,000 \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 130,000/260,000<sup>3</sup> \| 36,0000 GB \| 2,000 MBps<sup>2</sup> \| 80,000 \| <sup>1</sup> VM type not available by default. Contact your Microsoft account team <sup>2</sup> Maximum throughput provided by the VM and throughput requirement by SAP HANA workload, especially savepoint activity, can force you to deploy significant more throughput and IOPS +<sup>3</sup> Larger number with using NVMe interface usage + For the /hana/log volume. the configuration would look like: For the /hana/log volume. the configuration would look like: \| M192i(d)ms_v2 \| 4,096 GiB \| 2,000 MBps \| 80,000 \| 512 GB \| 300 MBps \| 4,000 \| 1,024 GB \| \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 40,000 \| 512 GB \| 300 MBps \| 4,000 \| 1,024 GB \| \| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 40,000 \| 512 GB \| 350 MBps \| 4,500 \| 1,024 GB \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 4,000 MBps \| 130,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 80,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| -\| M416s_8_v2 \| 5,700 GiB \| 2,000 MBps \| 80,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| +\| M416s_8_v2 \| 7,600 GiB \| 2,000 MBps \| 80,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| +\| M416(d)s_8_v3 \| 7,600 GiB \| 4,000 MBps \| 130,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 80,000 \| 512 GB \| 400 MBps \| 5,000 \| 1,024 GB \| +\| M624s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 130,000 \| 512 GB \| 600 MBps \| 6,000 \| 1,024 GB \| \| M832ixs<sup>1</sup> \| 14,902 GiB \| larger than 2,000 Mbps \| 80,000 \| 512 GB \| 600 MBps \| 9,000 \| 1,024 GB \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 130,000 \| 512 GB \| 600 MBps \| 10,000 \| 1,024 GB \| \| M832ixs_v2<sup>1</sup> \| 23,088 GiB \| larger than 2,000 Mbps \| 80,000 \| 512 GB \| 600 MBps \| 9,000 \| 1,024 GB \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 130,000/260,000<sup>3</sup> \| 600 MBps \| 10,000 \| 1,024 GB \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 130,000/260,000<sup>3</sup> \| 600 MBps \| 10,000 \| 1,024 GB \| <sup>1</sup> VM type not available by default. Contact your Microsoft account team + <sup>2</sup> Review carefully the [considerations for sizing /han#considerations-for-the-hana-shared-file-system) +<sup>3</sup> Larger number with using NVMe interface usage + Check whether the storage throughput for the different suggested volumes meets the workload that you want to run. If the workload requires higher volumes for /hana/data and /hana/log**, you need to increase either IOPS, and/or throughput on the individual disks you're using.
sap	Hana Vm Ultra Disk	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sap/workloads/hana-vm-ultra-disk.md	keywords: 'SAP, Azure HANA, Storage Ultra disk, Premium storage' Previously updated : 1/17/2023 Last updated : 09/03/2024 The recommendations are often exceeding the SAP minimum requirements as stated e \| M208s_v2 \| 2,850 GiB \| 1,000 MBps \| 3,500 GB \| 750 MBps \| 7,000 \| 512 GB \| 250 MBps \| 2,500 \| \| M208ms_v2 \| 5,700 GiB \| 1,000 MBps \| 7,200 GB \| 750 MBps \| 14,400 \| 512 GB \| 250 MBps \| 2,500 \| \| M416s_v2 \| 5,700 GiB \| 2,000 MBps \| 7,200 GB \| 1,000 MBps \| 14,400 \| 512 GB \| 400 MBps \| 4,000 \| +\| M416(d)s_6_v3 \| 5,696 GiB \| 4,000 MBps \| 7,200 GB \| 1,000 MBps \| 14,400 \| 512 GB \| 400 MBps \| 4,000 \| \| M416s_8_v2 \| 7,600 \| 2,000 MBps \| 9,500 GB \| 1,250 MBps \| 20,000 \| 512 GB \| 400 MBps \| 4,000 \| +\| M416(d)s_8_v3 \| 7,600 GiB \| 4,000 MBps \| 1,250 MBps \| 20,000 \| 512 GB \| 400 MBps \| 4,000 \| \| M416ms_v2 \| 11,400 GiB \| 2,000 MBps \| 14,400 GB \| 1,500 MBps \| 28,800 \| 512 GB \| 400 MBps \| 4,000 \| +\| M624s_12_v3, M832s_12_v3 \| 11,400 GiB \| 4,000 MBps \| 1,500 MBps \| 28,800 \| 512 GB \| 400 MBps \| 4,000 \| \| M832isx<sup>1</sup> \| 14902 GiB \| larger than 2,000 Mbps \| 19,200 GB \| 2,000 MBps<sup>2</sup> \| 40,000 \| 512 GB \| 600 MBps \| 9,000 \| +\| M832s_16_v3 \| 15,200 GiB \| 8,000 Mbps \| 4,000 MBps<sup>2</sup> \| 60,000 \| 512 GB \| 600 MBps \| 10,000 \| \| M832isx_v2<sup>1</sup> \| 23088 GiB \| larger than 2,000 Mbps \| 28,400 GB \| 2,000 MBps<sup>2</sup> \| 60,000 \| 512 GB \| 600 MBps \| 9,000 \| +\| M896ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 2,000 MBps<sup>2</sup> \| 60,000 \| 512 GB \| 600 MBps \| 10,000 \| +\| M1792ixds_32_v3<sup>1</sup> \| 30,400 GiB \| 8,000 Mbps \| 2,000 MBps<sup>2</sup> \| 60,000 \| 512 GB \| 600 MBps \| 10,000 \| <sup>1</sup> VM type not available by default. Please contact your Microsoft account team
sentinel	Sentinel Solutions Deploy	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/sentinel-solutions-deploy.md	Title: Discover and deploy Microsoft Sentinel out-of-the-box content from Content hub description: Learn how to find and deploy Sentinel packaged solutions containing data connectors, analytics rules, hunting queries, workbooks, and other content.-+ Last updated 03/01/2024-+ appliesto: - Microsoft Sentinel in the Azure portal - Microsoft Sentinel in the Microsoft Defender portal. Here's an example showing the install of an individual solution. The tabs correspond with the content offered by the solution. Different solutions might have different types of content, so you might not see the same tabs in every solution. - You might also be prompted to enter credentials to a third party service so that Microsoft Sentinel can authenticate to your systems. For example, with playbooks, you might want to take response actions as prescribed in your system. + You might also be prompted to enter credentials to a non-Microsoft service so that Microsoft Sentinel can authenticate to your systems. For example, with playbooks, you might want to take response actions as prescribed in your system. 1. In the Review + create tab, wait for the `Validation Passed` message. 1. Select Create or Update to deploy the solution. You can also select the Download a template for automation link to deploy the solution as code. -Each content type within the solution might require more steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution). +### Install with dependencies + +Some solutions have dependencies to install, including many [domain solutions](sentinel-solutions-catalog.md#domain-solutions) and solutions that use the unified AMA connectors for [CEF, Syslog](cef-syslog-ama-overview.md), or [custom logs](connect-custom-logs-ama.md). + +In such cases, select Install with dependencies to ensure that the required data connectors are also installed. From there, select one or more of the dependencies to install them along with the original solution. The original solution you chose to install is always selected by default. + +If one or more of the dependency solutions is already installed, but has updates, use the Install/Update button to both install and update all selected solutions in bulk. For example: ++ +After you install a solution, each content type within the solution might require more steps to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution). ## Bulk install and update content Content hub supports a list view in addition to the default card view. Select th 1. Select Manage for each solution you installed. Content types within the solution might require more information for you to configure. For more information, see [Enable content items in a solution](#enable-content-items-in-a-solution). ++ ## Enable content items in a solution Centrally manage content items for installed solutions from the content hub.
sentinel	Whats New	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/whats-new.md	description: Learn about the latest new features and announcement in Microsoft S Previously updated : 08/18/2024 Last updated : 09/04/2024 # What's new in Microsoft Sentinel To learn more about the Syslog and CEF connectors, see [Ingest Syslog and CEF lo ## February 2024 +- [Install domain solutions with dependencies](#install-domain-solutions-with-dependencies) - [Microsoft Sentinel solution for Microsoft Power Platform preview available](#microsoft-sentinel-solution-for-microsoft-power-platform-preview-available) - [New Google Pub/Sub-based connector for ingesting Security Command Center findings (Preview)](#new-google-pubsub-based-connector-for-ingesting-security-command-center-findings-preview) - [Incident tasks now generally available (GA)](#incident-tasks-now-generally-available-ga) - [AWS and GCP data connectors now support Azure Government clouds](#aws-and-gcp-data-connectors-now-support-azure-government-clouds) - [Windows DNS Events via AMA connector now generally available (GA)](#windows-dns-events-via-ama-connector-now-generally-available-ga) +### Install domain solutions with dependencies + +Some Microsoft Sentinel content hub solutions, including many [domain solutions](sentinel-solutions-catalog.md#domain-solutions) and solutions that use the unified AMA connectors for [CEF, Syslog](cef-syslog-ama-overview.md), or [custom logs](connect-custom-logs-ama.md), don't necessarily include a data connector of their own. Instead, they rely on data connectors from other solutions to provide visibility in a specific area across data connectors. The data connectors they use are prerequisites for the domain solution to work properly. + +When installing a domain solution, you can now select Install with dependencies to ensure that the data connectors required by the domain solution are also installed: ++ +For more information, see [Install with dependencies](sentinel-solutions-deploy.md#install-with-dependencies) and [Domain solutions](sentinel-solutions-catalog.md#domain-solutions). + ### Microsoft Sentinel solution for Microsoft Power Platform preview available The Microsoft Sentinel solution for Power Platform (preview) allows you to monitor and detect suspicious or malicious activities in your Power Platform environment. The solution collects activity logs from different Power Platform components and inventory data. It analyzes those activity logs to detect threats and suspicious activities like the following activities:
site-recovery	Azure To Azure Common Questions	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/azure-to-azure-common-questions.md	Multi-VM consistency is CPU intensive, and enabling it can affect workload perfo When you enable replication for a virtual machine, you can add it to a new replication group, or to an existing group. You can't add a virtual machine that's already replicating to a group. +### What conditions must be met to create a recovery plan for multi-VM consistency? + +Creating a recovery plan for multi-VM consistency virtual machine works only if the following conditions are met: + +- Virtual machine must be in the same subscription and region. +- Virtual machine must communicate over the network using host names. + ## Failover ### How do we ensure capacity in the target region?
site-recovery	Azure To Azure How To Enable Zone To Zone Disaster Recovery	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery.md	When you use zone-to-zone disaster recovery, Site Recovery doesn't move or store Learn more about [currently supported availability zones](../reliability/availability-zones-service-support.md#azure-regions-with-availability-zone-support). -> [!Note] +> [!NOTE] > Zone-to-zone disaster recovery isn't supported for VMs that have managed disks via zone-redundant storage (ZRS). +> +>Regions that don't support Azure availability zones also don't support Azure Site Recovery zone-to-zone replication. For Azure Site Recovery zone-to-zone replication to work, the region must support availability zones. ## Using availability zones for disaster recovery
site-recovery	Azure To Azure Support Matrix	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/azure-to-azure-support-matrix.md	V2 storage account \| 750 disks \| 375 disks As average churn on the disks increases, the number of disks that a storage account can support decreases. The above table may be used as a guide for making decisions on number of storage accounts that need to be provisioned. -Note that the above limits are specific to Azure-to-Azure and Zone-to-Zone DR scenarios. +> [!NOTE] +> The cache limits are specific to Azure-to-Azure and Zone-to-Zone DR scenarios. +> +> When you enable replication via the virtual machine workflow for cross subscription, the portal only lists the cache storage account from the source subscription, but doesn't list any storage account created in the target subscription. To set up this scenario, use [PowerShell](azure-to-azure-powershell.md). ++ ## Replicated machine operating systems
site-recovery	Configure Mobility Service Proxy Settings	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/configure-mobility-service-proxy-settings.md	Previously updated : 09/21/2023 Last updated : 07/10/2024 The purpose of this document is to provide steps to configure Proxy Settings for Proxies are network gateways that allow/disallow network connections to endpoints. Typically a proxy is a machine outside the client machine that tries to access network endpoints. A bypass list allows the client to make connections directly to the endpoints without going through the proxy. A username and password may be optionally set for a proxy by network admins so that only authenticated clients can use proxy. +> [!NOTE] +> Azure Site Recovery doesn't support PAC files as a proxy. + ## Before you start Learn how Site Recovery provides disaster recovery for [this scenario](azure-to-azure-architecture.md).
site-recovery	Move Azure Vms Cross Region	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/move-azure-VMs-cross-region.md	- Title: Move Azure VMs to another region with Azure Site Recovery -description: Use Azure Site Recovery to move Azure IaaS VMs from one Azure region to another. ---- Previously updated : 05/24/2024---- -# Move Azure VMs to another Azure region - -You might want to move Azure infrastructure as a service (IaaS) virtual machines from one region to another to improve reliability, availability, management, or governance. This tutorial shows you how to move VMs to another region by using Azure Site Recovery. You'll learn how to: - -> [!div class="checklist"] -> * Verify prerequisites -> * Prepare the source VMs -> * Prepare the target region -> * Copy data to the target region -> * Test the configuration -> * Perform the move -> * Discard the resources from the source region -- -> [!IMPORTANT] -> This article describes how to move Azure VMs from one region to another as is. If your goal is to improve the availability of your infrastructure by moving VMs to availability zones, see [Move Azure VMs to Availability Zones](move-azure-vms-avset-azone.md). - -## Prerequisites --- Make sure that you have Azure VMs in the source Azure region that you want to move from.-- Verify that your choice of [source region-target region combination is supported](./azure-to-azure-support-matrix.md#region-support), and carefully choose the target region.-- Make sure that you understand the [scenario architecture and components](azure-to-azure-architecture.md).-- Review the [support limitations and requirements](azure-to-azure-support-matrix.md).-- Verify account permissions. If you just created your free Azure account, you are the administrator of your subscription. If you aren't the administrator, work with the administrator to get the permissions that you need: - - To enable replication for a VM and copy data to the target by using Site Recovery, you must have permissions to create a VM in your Azure resources. The Virtual Machine Contributor built-in role has these permissions. With the permissions, you can: - - Create a VM in the selected resource group. - - Create a VM in the selected virtual network. - - Write to the selected storage account. - - - You also need permissions to manage Site Recovery operations. The Site Recovery Contributor role has all the permissions that are required to manage Site Recovery operations in an Azure Recovery Services vault. - -## Prepare the source VMs - -1. Check that the Azure VMs that you plan to move have the latest root certificates. If they don't, you can't enable data copy to the target region because of security constraints. - - - For Windows VMs, install the latest Windows updates so that all the trusted root certificates are on the machine. In a disconnected environment, follow the standard Windows Update and certificate-update processes for your organization. - - For Linux VMs, follow guidance from your Linux distributor to get the latest trusted root certificates and certificate revocation list. -2. Make sure that you're not using an authentication proxy to control network connectivity for VMs that you plan to move. -3. If a VM that you want to move doesn't have access to the internet and is using a firewall proxy to control outbound access, check the [requirements](azure-to-azure-tutorial-enable-replication.md#set-up-vm-connectivity). -4. Document the source networking layout and all resources that you're currently using, including (but not limited to) load balancers, network security groups, and public IP addresses for verification. - -## Prepare the target region - -1. In your Azure subscription, verify that you can create VMs in the target region that's used for disaster recovery. Contact Support to enable the required quota if necessary. - -2. Make sure that your subscription has enough resources to support your source VMs. If you're using Site Recovery to copy data to the target, it picks the same size or closest available size for the target VMs. - -3. Make sure that you create a target resource for every component that you identified in the source networking layout. This ensures that your VMs will have all the functionality and features in the target region that they had in the source region. - - Azure Site Recovery automatically discovers and creates a virtual network and storage account when you enable replication for the source VM. You can also pre-create these resources and assign them to the VM as part of the enable-replication step. But you must manually create any other resources in the target region. Refer to the following documents to create the most commonly used network resources based on the your source VM configuration: - - - [Network security groups](../virtual-network/manage-network-security-group.md) - - [Load balancers](../load-balancer/index.yml) - - [Public IP](../virtual-network/ip-services/virtual-network-public-ip-address.md) - - For any other networking components, see the [Azure networking documentation](../index.yml?pivot=products&panel=network). - -4. To test the configuration before you perform the move, manually [create a non-production network](../virtual-network/quick-create-portal.md) in the target region. Testing the setup creates minimal interference with the production environment, and we recommend it. - -## Copy data to the target region -The following steps use Azure Site Recovery to copy data to the target region. - -### Create the vault in any region except the source - -1. Sign in to the [Azure portal](https://portal.azure.com) > Recovery Services. -2. Select Create a resource > Management Tools > Backup and Site Recovery. -3. For Name, specify the friendly name ContosoVMVault. If you have more than one subscription, select the appropriate one. -4. Create a resource group ContosoRG. -5. Specify an Azure region. To check supported regions, see [Azure Site Recovery Pricing Details](https://azure.microsoft.com/pricing/details/site-recovery/). -6. For Recovery Services vaults, select Overview > ConsotoVMVault > +Replicate. -7. For Source, select Azure. -8. For Source location, select the source Azure region where your VMs are currently running. -9. Select the Azure Resource Manager deployment model. Then, select the Source subscription and Source resource group. -10. Select OK to save the settings. - -### Enable replication for Azure VMs and start copying the data - -Site Recovery retrieves a list of the VMs that are associated with the subscription and resource group. - -1. Select the VM that you want to move, and then select OK. -2. For Settings, select Disaster recovery. -3. For Configure disaster recovery > Target region, select the target region that you're replicating to. -4. Choose to use the default target resources or those that you pre-created. -5. Select Enable replication to start the job. -- - - -## Test the configuration -- -1. Go to the vault. In Settings > Replicated items, select the virtual machine that you want to move to the target region. Then, select Test Failover. -2. In Test Failover, select a recovery point to use for the failover: - - - Latest processed: Fails the VM over to the latest recovery point that was processed by the - Site Recovery service. The time stamp is shown. No time is spent processing data, so this option provides a low recovery time objective (RTO). - - Latest app-consistent: Fails over all VMs to the latest app-consistent - recovery point. The time stamp is shown. - - Custom: Select any recovery point. - -3. Select the target Azure virtual network to which you want to move the Azure VMs to test the configuration. - - > [!IMPORTANT] - > We recommend that you use a separate Azure VM network for the test failover, not the production network in the target region. - -4. To start testing the move, select OK. To track progress, select the VM to open its Properties. Or, - select the Test Failover job in the vault. Then, select Settings > Jobs > Site Recovery jobs. -5. After the failover finishes, the replica Azure VM appears in the Azure portal > Virtual Machines. Make sure that the VM is running, sized appropriately, and connected to the appropriate network. -6. To delete the VM that you created for testing, select Cleanup test failover on the replicated item. From Notes, record and save any observations related to the test. - -## Perform the move and confirm - -1. Go to the vault in Settings > Replicated items, select the virtual machine, and then select Failover. -1. For Failover, select Latest. -2. Select Shut down machine before beginning failover. Site Recovery tries to shut down the source VM before triggering the failover. But failover continues even if shutdown fails. You can follow the failover progress on the Jobs page. -3. When the job is finished, check that the VM appears in the target Azure region as expected. -4. In Replicated items, right-click the VM and select Commit. This finishes the move. Wait until the commit job finishes. - -## Discard the resources from the source region --- Go to the VM and select Disable Replication. This stops the process of copying the data for the VM.- - > [!IMPORTANT] - > Complete this step to avoid being charged for Site Recovery replication after the move. - -If you don't plan to reuse any of the source resources, follow these steps: - -1. Delete all relevant network resources in the source region that you listed in step 4 of [Prepare the source VMs](#prepare-the-source-vms). -2. Delete the corresponding storage account in the source region. - -## Next steps - -In this tutorial, you learned how to move Azure VMs to a different Azure region. Now you can configure disaster recovery for those VMs. --- [Set up disaster recovery after migration](azure-to-azure-quickstart.md)
site-recovery	Physical Azure Set Up Target	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/physical-azure-set-up-target.md	- Title: Set up the target environment for physical servers in Azure Site Recovery -description: This article describes how to set up the target Azure environment for disaster recovery of physical servers using Azure Site Recovery. ---- Previously updated : 11/27/2018--- -# Prepare target (VMware to Azure) - -This article describes how to prepare your Azure environment to start replicating physical servers (x64) running Windows or Linux into Azure. - -## Prerequisites - -The article assumes: -- You have created a Recovery Services Vault to protect your physical servers. You can create a Recovery Services Vault from the [Azure portal](https://portal.azure.com "Azure portal").-- You have [setup your on-premises environment](physical-azure-disaster-recovery.md) to replicate physical servers to Azure.- -## Prepare target - -After completing the Step 1:Select Protection goal and Step 2:Prepare Source, you are taken to Step 3: Target - -![Prepare target](./media/physical-azure-set-up-target/prepare-target-physical-to-azure.png) - -1. Subscription: From the drop-down menu, select the Subscription that you want to replicate your physical servers to. -2. Deployment Model: Select the deployment model (Classic or Resource Manager) - -Based on the chosen deployment model, a validation is run to ensure that you have at least one compatible storage account and virtual network in the target subscription to replicate and failover your physical servers to. - -Once the validations complete successfully, click OK to go to the next step. - -If you don't have a compatible Resource Manager storage account or virtual network, you can create one by clicking the + Storage Account or + Network buttons at the top of the page. - -## Next steps -[Configure replication settings](vmware-azure-set-up-replication.md).
site-recovery	Site Recovery Capacity Planner	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/site-recovery-capacity-planner.md	- Title: Plan capacity for Hyper-V disaster recovery with Azure Site Recovery -description: Use this article to estimate capacity when setting up disaster recovery with the Azure Site Recovery service. --- Previously updated : 12/14/2023----- -# Plan capacity for Hyper-V VM disaster recovery - -The[Azure Site Recovery Deployment Planner] (site-recovery-hyper-v-deployment-planner.md) for Hyper-V to Azure deployment provides the following: - -* VM eligibility assessment, based on the number of disks, disk size, IOPS, churn, and a few VM characteristics -* Network bandwidth need versus RPO assessment -* Azure infrastructure requirements -* On-premises infrastructure requirements -* Initial replication batching guidance -* Estimated total disaster recovery cost to Azure -- -Azure Site Recovery Capacity Planner helps you determine your capacity requirements when you replicate Hyper-V VMs with Azure Site Recovery. - -Use Site Recovery Capacity Planner to analyze your source environment and workloads. It helps you estimate bandwidth needs, the server resources you need for the source location, and the resources (such as VMs and storage) you need in the target location. - -You can run the tool in two modes: - -* Quick planning: Provides network and server projections based on an average number of VMs, disks, storage, and change rate. -* Detailed planning: Provides details of each workload at the VM level. Analyze VM compatibility and get network and server projections. - -## Before you start - -* Gather information about your environment, including VMs, disks per VM, storage per disk. -* Identify your daily change (churn) rate for replicated data. Download the [Hyper-V capacity planning tool](https://www.microsoft.com/download/details.aspx?id=39057) to get the change rate. [Learn more](./hyper-v-deployment-planner-overview.md) about this tool. We recommend that you run this tool over a week to capture averages. -- -## Run the Quick Planner -1. Download and open [Site Recovery Capacity Planner](/samples/browse/?redirectedfrom=TechNet-Gallery). You need to run macros. When you're prompted, make selections to enable editing and content. - -2. In the Select a planner type list box, select Quick Planner. - - ![Screenshot of the Select a planner type option, with Quick Planner selected.](./media/site-recovery-capacity-planner/getting-started.png) - -3. On the Capacity Planner worksheet, enter the required information. Fill in all the fields circled in red in the following screenshot: - - a. In Select your scenario, choose Hyper-V to Azure or VMware/Physical to Azure. - - b. In Average daily data change rate (%), enter the information you gather by using the [Hyper-V capacity planning tool](./hyper-v-deployment-planner-overview.md) or [Site Recovery Deployment Planner](./site-recovery-deployment-planner.md). - - c. The Compression setting isn't used when you replicate Hyper-V VMs to Azure. For compression, use a third-party appliance, such as Riverbed. - - d. In Retention in days, specify in days how long to retain replicas. - - e. In Number of hours in which initial replication for the batch of virtual machines should complete and Number of virtual machines per initial replication batch, enter settings that are used to compute initial replication requirements. When Site Recovery is deployed, the entire initial data set is uploaded. - - ![Screenshot of the Capacity Planner worksheet, showing the required input information.](./media/site-recovery-capacity-planner/inputs.png) - -4. After you enter the values for the source environment, the displayed output includes: - - * Bandwidth required for delta replication (in Megabits/sec): Network bandwidth for delta replication is calculated on the average daily data change rate. - * Bandwidth required for initial replication (in Megabits/sec): Network bandwidth for initial replication is calculated on the initial replication values you enter. - * Storage required (in GBs): The total Azure storage required. - * Total IOPS on Standard Storage: The number is calculated based on the 8K IOPS unit size on the total standard storage accounts. For the Quick Planner, the number is calculated based on all the source VM disks and the daily data change rate. For the Detailed Planner, the number is calculated based on the total number of VMs that are mapped to standard Azure VMs and the data change rate on those VMs. - * Number of Standard storage accounts required: The total number of standard storage accounts needed to protect the VMs. A standard storage account can hold up to 20,000 IOPS across all the VMs in standard storage. A maximum of 500 IOPS is supported per disk. - * Number of Blob disks required: The number of disks that are created on Azure storage. - * Number of premium accounts required: The total number of premium storage accounts needed to protect the VMs. A source VM with high IOPS (greater than 20,000) needs a premium storage account. A premium storage account can hold up to 80,000 IOPS. - * Total IOPS on Premium Storage: The number is calculated based on the 256K IOPS unit size on the total premium storage accounts. For the Quick Planner, the number is calculated based on all the source VM disks and the daily data change rate. For the Detailed Planner, the number is calculated based on the total number of VMs that are mapped to premium Azure VMs (DS and GS series) and the data change rate on those VMs. - * Number of Configuration Servers required: Shows how many configuration servers are required for the deployment. - * Number of additional Process Servers required: Shows whether additional process servers are required, in addition to the process server that's running on the configuration server by default. - * 100% additional storage on the Source: Shows whether additional storage is required in the source location. - - ![Screenshot of the displayed output based on the input provided.](./media/site-recovery-capacity-planner/output.png) - -## Run the Detailed Planner - -1. Download and open [Site Recovery Capacity Planner](/samples/browse/?redirectedfrom=TechNet-Gallery). You need to run macros. When you're prompted, make selections to enable editing and content. - -2. In Select a planner type, select Detailed Planner from the list box. - - ![Screenshot of the Select a planner type option, with Detailed Planner selected.](./media/site-recovery-capacity-planner/getting-started-2.png) - -3. On the Workload Qualification worksheet, enter the required information. You must fill in all the marked fields. - - a. In Processor Cores, specify the total number of cores on a source server. - - b. In Memory allocation (in MBs), specify the RAM size of a source server. - - c. In Number of NICs, specify the number of network adapters on a source server. - - d. In Total Storage (in GB), specify the total size of the VM storage. For example, if the source server has three disks with 500 GB each, total storage size is 1,500 GB. - - e. In Number of disks attached, specify the total number of disks of a source server. - - f. In Disk capacity utilization (%), specify the average utilization. - - g. In Daily data change rate (%), specify the daily data change rate of a source server. - - h. In Mapping Azure VM size, enter the Azure VM size that you want to map. If you don't want to do this manually, select Compute IaaS VMs. If you input a manual setting and then select Compute IaaS VMs, the manual setting might be overwritten. The compute process automatically identifies the best match on Azure VM size. - - ![Screenshot of the Workload Qualification worksheet, showing the required input information.](./media/site-recovery-capacity-planner/workload-qualification.png) - -4. If you select Compute IaaS VMs, here's what it does: - - * Validates the mandatory inputs. - * Calculates IOPS and suggests the best Azure VM size match for each VM that's eligible for replication to Azure. If an appropriate size Azure VM can't be detected, an error displays. For example, if the number of disks attached is 65, an error displays because the highest size for an Azure VM is 64. - * Suggests a storage account that can be used for an Azure VM. - * Calculates the total number of standard storage accounts and premium storage accounts required for the workload. Scroll down to view the Azure storage type and the storage account that can be used for a source server. - * Completes and sorts the rest of the table based on the required storage type (standard or premium) assigned for a VM and the number of disks attached. For all VMs that meet the requirements for Azure, the column Is VM qualified? shows Yes. If a VM can't be backed up to Azure, an error displays. - -Columns AA to AE are output and provide information for each VM. - -![Screenshot showing output columns AA to AE.](./media/site-recovery-capacity-planner/workload-qualification-2.png) - -### Example -As an example, for six VMs with the values shown in the table, the tool calculates and assigns the best Azure VM match and the Azure storage requirements. - -![Screenshot showing Workload Qualification assignments.](./media/site-recovery-capacity-planner/workload-qualification-3.png) - -* In the example output, note the following: - - * The first column is a validation column for the VMs, disks, and churn. - * Two standard storage accounts and one premium storage account are needed for five VMs. - * VM3 doesn't qualify for protection because one or more disks are more than 1 TB. - * VM1 and VM2 can use the first standard storage account - * VM4 can use the second standard storage account. - * VM5 and VM6 need a premium storage account, and both can use a single account. - - > [!NOTE] - > IOPS on standard and premium storage are calculated at the VM level and not at disk level. A standard VM can handle up to 500 IOPS per disk. If IOPS for a disk are greater than 500, you need premium storage. If IOPS for a disk are more than 500 but IOPS for the total VM disks are within the support standard Azure VM limits, the planner picks a standard VM and not the DS or GS series. (The Azure VM limits are VM size, number of disks, number of adapters, CPU, and memory.) You need to manually update the mapping Azure size cell with the appropriate DS or GS series VM. -- -After all the information is entered, select Submit data to the planner tool to open Capacity Planner. Workloads are highlighted to show whether they're eligible for protection. - -### Submit data in Capacity Planner -1. When you open the Capacity Planner worksheet, it's populated based on the settings you specified. The word "Workload" appears in the Infra inputs source cell to show that the input is the Workload Qualification worksheet. - -2. If you want to make changes, you need to modify the Workload Qualification worksheet. Then select Submit data to the planner tool again. - - ![Screenshot showing the modified inputs and resulting outputs in the Capacity Planner worksheet.](./media/site-recovery-capacity-planner/capacity-planner.png) - -## Next steps -[Learn how to run](./hyper-v-deployment-planner-overview.md) the capacity planning tool.
site-recovery	Site Recovery Monitor And Troubleshoot	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/site-recovery-monitor-and-troubleshoot.md	Title: Azure Site Recovery dashboard and built-in alerts description: Monitor and troubleshoot Azure Site Recovery replication issues and operations, and enable built-in alerts, by using the portal. Previously updated : 04/29/2024 Last updated : 07/10/2024 Get an at-scale view of all vaults across all subscriptions using Classic Alerts ### Manage Azure Site Recovery alerts in Backup Center +> [!IMPORTANT] +> This section describes an older alerting solution (referred to as classic alerts). We recommend you to switch to using Azure Monitor based alerts as it offers multiple benefits. For more information on how to switch, see [Switch Azure Monitor Based alerts](../backup/move-to-azure-monitor-alerts.md). + To manage your alerts settings, do the following: 1. Select Click here to take action to manage built-in alerts for site recovery.
site-recovery	Tutorial Shared Disk	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/site-recovery/tutorial-shared-disk.md	No, enable replication can only be enabled successfully when all the VMs attache #### Is it possible to exclude shared disks and enable replication for only some of the VMs in a cluster? Yes, the first time you donΓÇÖt select all the VMs in Enable Replication, a warning appears mentioning the unselected VMs attached to the shared disk. If you still proceed, unselect the shared disk replication by selecting ΓÇÿNoΓÇÖ for the storage option in Replication Settings tab. +#### If the enable replication job fails for a cluster, can we restart it after fixing the issue without reselecting clusters again? +Yes, you can restart the job without reselecting clusters, just like other A2A scenarios. However, since the enable replication process runs for each node, you need to restart the failed job for all nodes through the Site Recovery Jobs interface. #### Can new shared disks be added to a protected cluster? No, if new shared disks need to be added, disable the replication for the already protected cluster. Enable a new cluster protection with a new cluster name for the modified infrastructure.
spring-apps	How To Deploy In Azure Virtual Network	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/spring-apps/enterprise/how-to-deploy-in-azure-virtual-network.md	Use the following steps to grant permission: :::image type="content" source="media/how-to-deploy-in-azure-virtual-network/access-control.png" alt-text="Screenshot of the Azure portal Access Control (IAM) page showing the Check access tab with the Add role assignment button highlighted." lightbox="media/how-to-deploy-in-azure-virtual-network/access-control.png"::: -1. Assign the `Owner` role to the Azure Spring Apps Resource Provider. For more information, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml). +1. Assign the `Owner` role to the Azure Spring Cloud Resource Provider. For more information, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml). - > [!NOTE] - > If you don't find Azure Spring Apps Resource Provider, search for Azure Spring Cloud Resource Provider. - :::image type="content" source="./media/how-to-deploy-in-azure-virtual-network/assign-owner-resource-provider.png" alt-text="Screenshot of the Azure portal Access Control page with Add role assignment pane and Select box with Azure Spring Apps Resource Provider highlighted." lightbox="./media/how-to-deploy-in-azure-virtual-network/assign-owner-resource-provider.png"::: + :::image type="content" source="./media/how-to-deploy-in-azure-virtual-network/assign-owner-resource-provider.png" alt-text="Screenshot of the Azure portal Access Control page with Add role assignment pane and Select box with Azure Spring Cloud Resource Provider highlighted." lightbox="./media/how-to-deploy-in-azure-virtual-network/assign-owner-resource-provider.png"::: ### [Azure CLI](#tab/azure-CLI) The route tables to which your custom vnet is associated must meet the following * You can associate your Azure route tables with your vnet only when you create a new Azure Spring Apps service instance. You can't change to use another route table after Azure Spring Apps has been created. * Both the Spring application subnet and the service runtime subnet must associate with different route tables or neither of them. -* Permissions must be assigned before instance creation. Be sure to grant Azure Spring Apps Resource Provider the `Owner` permission (or `User Access Administrator` and `Network Contributor` permissions) on your route tables. +* Permissions must be assigned before instance creation. Be sure to grant Azure Spring Cloud Resource Provider the `Owner` permission (or `User Access Administrator` and `Network Contributor` permissions) on your route tables. * You can't update the associated route table resource after cluster creation. While you can't update the route table resource, you can modify custom rules on the route table. * You can't reuse a route table with multiple instances due to potential conflicting routing rules.
storage-mover	Release Notes	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage-mover/release-notes.md	Azure Storage Mover is a hybrid service, which continuously introduces new featu > [!IMPORTANT] > Preview versions of the Storage Mover agent cannot update themselves. You must replace them manually by deploying the [latest available agent](https://aka.ms/StorageMover/agent). +## 2024 August 30 + +Major refresh release notes for: + +- Service version: August 30, 2024 +- Agent version: 3.1.636 + +### What's new + +- Stricter password restrictions. +- Security improvements and bug fixes. + ## 2024 July 10 Major refresh release notes for:
storage	Concurrency Manage	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/concurrency-manage.md	Title: Managing concurrency in Blob storage + Title: Manage concurrency in Blob Storage description: Learn how to manage multiple writers to a blob by implementing either optimistic or pessimistic concurrency in your application. Optimistic concurrency checks the ETag value for a blob and compares it to the ETag provided. Pessimistic concurrency uses an exclusive lease to lock the blob to other writers. Previously updated : 04/05/2023 Last updated : 09/04/2024 ms.devlang: csharp -# Managing Concurrency in Blob storage +# Manage concurrency in Blob Storage Modern applications often have multiple users viewing and updating data simultaneously. Application developers need to think carefully about how to provide a predictable experience to their end users, particularly for scenarios where multiple users can update the same data. There are three main data concurrency strategies that developers typically consider:
storage	Storage Blob Event Overview	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/blobs/storage-blob-event-overview.md	Applications that handle Blob storage events should follow a few recommended pra - Similarly, check that the eventType is one you are prepared to process, and do not assume that all events you receive will be the types you expect. -- While most messages arrive in near real-time, there is no service level agreement around the time it takes for a message to arrive. In some instances, it might take few minutes for the message to arrive. As messages can arrive after some delay, use the etag fields to understand if your information about objects is still up-to-date. To learn how to use the etag field, see [Managing concurrency in Blob storage](./concurrency-manage.md?toc=/azure/storage/blobs/toc.json#managing-concurrency-in-blob-storage). +- While most messages arrive in near real-time, there is no service level agreement around the time it takes for a message to arrive. In some instances, it might take few minutes for the message to arrive. As messages can arrive after some delay, use the etag fields to understand if your information about objects is still up-to-date. To learn how to use the etag field, see [Manage concurrency in Blob Storage](./concurrency-manage.md?toc=/azure/storage/blobs/toc.json#manage-concurrency-in-blob-storage). - As messages can arrive out of order, use the sequencer fields to understand the order of events on any particular object. The sequencer field is a string value that represents the logical sequence of events for any particular blob name. You can use standard string comparison to understand the relative sequence of two events on the same blob name.
storage	Storage Files Identity Auth Hybrid Identities Enable	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/files/storage-files-identity-auth-hybrid-identities-enable.md	Enable the Microsoft Entra Kerberos functionality on the client machine(s) you w Use one of the following three methods: -- Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/CloudKerberosTicketRetrievalEnabled](/windows/client-management/mdm/policy-csp-kerberos#cloudkerberosticketretrievalenabled), set to 1-- Configure this group policy on the client(s) to "Enabled": `Administrative Templates\System\Kerberos\Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon`-- Set the following registry value on the client(s) by running this command from an elevated command prompt: `reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1` +# [Intune](#tab/intune) + +Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/CloudKerberosTicketRetrievalEnabled](/windows/client-management/mdm/policy-csp-kerberos#cloudkerberosticketretrievalenabled), set to 1 + +# [Group Policy](#tab/gpo) + +Configure this group policy on the client(s) to "Enabled": `Administrative Templates\System\Kerberos\Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon` + +# [Registry Key](#tab/regkey) + +Set the following registry value on the client(s) by running this command from an elevated command prompt: + +```console +reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1 +``` ++ Changes are not instant, and require a policy refresh or a reboot to take effect. If you want to enable client machines to connect to storage accounts that are co Add an entry for each storage account that uses on-premises AD DS integration. Use one of the following three methods to configure Kerberos realm mappings. Changes aren't instant, and require a policy refresh or a reboot to take effect. -- Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/HostToRealm](/windows/client-management/mdm/policy-csp-admx-kerberos#hosttorealm)-- Configure this group policy on the client(s): `Administrative Template\System\Kerberos\Define host name-to-Kerberos realm mappings`-- Run the `ksetup` Windows command on the client(s): `ksetup /addhosttorealmmap <hostname> <REALMNAME>` - - For example, `ksetup /addhosttorealmmap <your storage account name>.file.core.windows.net CONTOSO.LOCAL` +# [Intune](#tab/intune) + +Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/HostToRealm](/windows/client-management/mdm/policy-csp-admx-kerberos#hosttorealm) + +# [Group Policy](#tab/gpo) + +Configure this group policy on the client(s): `Administrative Template\System\Kerberos\Define host name-to-Kerberos realm mappings` + +- Set the policy to `Enabled` +- Then, click on the `Show...` button to define the list of host name-to-realm mappings. For each storage account configured for AD DS, add an entry where: + - `Value` is the AD DS-enabled storage account's host name, i.e. `<your storage account name>.file.core.windows.net` + - `Value name` is the AD DS realm name + +# [Registry Key](#tab/regkey) + +Run the following `ksetup` Windows command on the client(s): + +```console +ksetup /addhosttorealmmap <hostname> <REALMNAME> +``` + +For example, if your realm is `CONTOSO.LOCAL`, run `ksetup /addhosttorealmmap <your storage account name>.file.core.windows.net CONTOSO.LOCAL` ++ > [!IMPORTANT] > In Kerberos, realm names are case sensitive and upper case. Your Kerberos realm name is usually the same as your domain name, in upper-case letters. Add an entry for each storage account that uses on-premises AD DS integration. U If you no longer want to use a client machine for Microsoft Entra Kerberos authentication, you can disable the Microsoft Entra Kerberos functionality on that machine. Use one of the following three methods, depending on how you enabled the functionality: -- Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/CloudKerberosTicketRetrievalEnabled](/windows/client-management/mdm/policy-csp-kerberos#kerberos-cloudkerberosticketretrievalenabled), set to 0-- Configure this group policy on the client(s) to "Disabled": `Administrative Templates\System\Kerberos\Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon`-- Set the following registry value on the client(s) by running this command from an elevated command prompt: `reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 0` +# [Intune](#tab/intune) + +Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/CloudKerberosTicketRetrievalEnabled](/windows/client-management/mdm/policy-csp-kerberos#kerberos-cloudkerberosticketretrievalenabled), set to 0 + +# [Group Policy](#tab/gpo) + +Configure this group policy on the client(s) to "Disabled": `Administrative Templates\System\Kerberos\Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon` + +# [Registry Key](#tab/regkey) + +Set the following registry value on the client(s) by running this command from an elevated command prompt: + +```console +reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 0 +``` ++ Changes are not instant, and require a policy refresh or a reboot to take effect. If you followed the steps in [Configure coexistence with storage accounts using on-premises AD DS](#configure-coexistence-with-storage-accounts-using-on-premises-ad-ds), you can optionally remove all host name to Kerberos realm mappings from the client machine. Use one of the following three methods: -- Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/HostToRealm](/windows/client-management/mdm/policy-csp-admx-kerberos#hosttorealm)-- Configure this group policy on the client(s): `Administrative Template\System\Kerberos\Define host name-to-Kerberos realm mappings`-- Run the `ksetup` Windows command on the client(s): `ksetup /delhosttorealmmap <hostname> <realmname>` - - For example, `ksetup /delhosttorealmmap <your storage account name>.file.core.windows.net contoso.local` - - You can view the list of current host name to Kerberos realm mappings by inspecting the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\HostToRealm`. +# [Intune](#tab/intune) + +Configure this Intune [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) and apply it to the client(s): [Kerberos/HostToRealm](/windows/client-management/mdm/policy-csp-admx-kerberos#hosttorealm) + +# [Group Policy](#tab/gpo) + +Configure this group policy on the client(s): `Administrative Template\System\Kerberos\Define host name-to-Kerberos realm mappings` + +# [Registry Key](#tab/regkey) + +Run the following `ksetup` Windows command on the client(s): + +```console +ksetup /delhosttorealmmap <hostname> <realmname> +``` + +For example, if your realm is `CONTOSO.LOCAL`, run `ksetup /delhosttorealmmap <your storage account name>.file.core.windows.net CONTOSO.LOCAL` + +You can view the list of current host name to Kerberos realm mappings by inspecting the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\HostToRealm`. ++ Changes aren't instant, and require a policy refresh or a reboot to take effect.
update-manager	Tutorial Webhooks Using Runbooks	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/update-manager/tutorial-webhooks-using-runbooks.md	Title: Create pre and post events using a webhook with Automation runbooks. description: In this tutorial, you learn how to create the pre and post events using webhook with Automation runbooks. Previously updated : 07/24/2024 Last updated : 09/04/2024 In this tutorial, you learn how to: $notificationPayload = ConvertFrom-Json -InputObject $WebhookData.RequestBody $eventType = $notificationPayload[0].eventType - if ($eventType -ne ΓÇ£Microsoft.Maintenance.PreMaintenanceEventΓÇ¥ -or $eventType ΓÇône ΓÇ£Microsoft.Maintenance.PostMaintenanceEventΓÇ¥ ) { + if ($eventType -ne ΓÇ£Microsoft.Maintenance.PreMaintenanceEventΓÇ¥ -and $eventType ΓÇône ΓÇ£Microsoft.Maintenance.PostMaintenanceEventΓÇ¥ ) { Write-Output "Webhook not triggered as part of pre or post patching for maintenance run" return }
virtual-desktop	Compare Remote Desktop Clients	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/compare-remote-desktop-clients.md	The following table shows which local devices you can redirect to a remote sessi \| Local drive/storage \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>² \| \| Microphones \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| \| Printers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>³ \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>⁴ \| -\| Scanners \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| +\| Scanners⁵ \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Smart cards \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Speakers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| The following table shows which local devices you can redirect to a remote sessi \| Local drive/storage \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>² \| \| Microphones \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| \| Printers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>³ \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>⁴ \| -\| Scanners \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| +\| Scanners⁵ \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Smart cards \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Speakers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| The following table shows which local devices you can redirect to a remote sessi \| Local drive/storage \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>² \| \| Microphones \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| \| Printers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>³ \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sup>   </sup><sub>:::image type="icon" source="media/yes.svg" border="false":::</sub>⁴ \| -\| Scanners \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| +\| Scanners⁵ \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Smart cards \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/no.svg" border="false":::</sub> \| \| Speakers \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| <sub>:::image type="icon" source="media/yes.svg" border="false":::</sub> \| The following table shows which local devices you can redirect to a remote sessi 1. Limited to uploading and downloading files through a web browser. 1. The Remote Desktop app on macOS supports the Publisher Imagesetter printer driver by default (Common UNIX Printing System (CUPS) only). Native printer drivers aren't supported. 1. PDF printing only. +1. High-level redirection of TWAIN scanners isn't supported. You can only redirect USB scanners using opaque low-level redirection. For more information, see [Peripheral and resource redirection over the Remote Desktop Protocol](redirection-remote-desktop-protocol.md). The following table provides a description for each type of device you can redirect:
virtual-desktop	Whats New Agent	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-desktop/whats-new-agent.md	Make sure to check back here often to keep up with new updates. New versions of the Azure Virtual Desktop Agent are installed automatically. When new versions are released, they're rolled out progressively to session hosts. This process is called flighting and it enables Microsoft to monitor the rollout in [validation environments](create-validation-host-pool.md) first. -A rollout may take several weeks before the agent is available in all environments. Some agent versions may not reach non-validation environments, so you may see multiple versions of the agent deployed across your environments. +A rollout might take several weeks before the agent is available in all environments. Some agent versions might not reach nonvalidation environments, so you may see multiple versions of the agent deployed across your environments. \| Release \| Latest version \| \|--\|--\| \| Production \| 1.0.9103.3700 \| -\| Validation \| 1.0.9103.5000 \| +\| Validation \| 1.0.9103.2900 \| > [!TIP] > The Azure Virtual Desktop Agent is automatically installed when adding session hosts in most scenarios. If you need to install the agent manually, you can download it at [Register session hosts to a host pool](add-session-hosts-host-pool.md#register-session-hosts-to-a-host-pool), together with the steps to install it. -## Version 1.0.9103.5000 (validation) +## Version 1.0.9103.3800 -Published: July 2024 +Published: June 2024 In this update, we've made the following changes: - General improvements and bug fixes. -## Version 1.0.9103.3800 +## Version 1.0.9103.3700 Published: June 2024 In this update, we've made the following changes: - General improvements and bug fixes. -## Version 1.0.9103.3700 +## Version 1.0.9103.2900 (validation) -Published: June 2024 +Published: June 2024 In this update, we've made the following changes: -- General improvements and bug fixes. +- General improvements and bug fixes. ## Version 1.0.9103.2300 In this release, we've made the following changes: - Fixed broker URL cache to address Agent Telemetry calls. - Fixed some network-related issues. - Created two new mechanisms to trigger health checks.-- Additional general bug fixes and agent upgrades. +- Other general bug fixes and agent upgrades. ## Version 1.0.4230.1600
virtual-network	Public Ip Basic Upgrade Guidance	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/ip-services/public-ip-basic-upgrade-guidance.md	We recommend the following approach to upgrade to Standard SKU public IP address a. If you need a zone redundant public IP address, create a new Standard SKU public IP address using [Portal](create-public-ip-portal.md), [PowerShell](create-public-ip-powershell.md), [CLI](create-public-ip-cli.md), or [ARM template](create-public-ip-template.md). - b. If you don't need a zone redundant public IP address, use the [following upgrade options](#upgrade-using-portal-powershell-and-azure-cli). + b. If you don't need a zone redundant public IP address, use the [following upgrade options](#upgrade-disassociated-public-ips-using-portal-powershell-or-azure-cli). 4. Create a migration plan for planned downtime. 5. Depending on the resource associated with your Basic SKU public IP addresses, perform the upgrade based on the following table: - \| Resource using Basic SKU public IP addresses \| Decision path \| + \| Resource using Basic SKU public IP addresses \| Decision path \| \| \| \| - \| Virtual Machine or Virtual Machine Scale Sets (flex model) \| Disassociate IP(s) and utilize the upgrade options detailed after the table. For virtual machines, you can use the [upgrade script](public-ip-upgrade-vm.md). \| + \| Virtual Machine \| Use scripts or manually detach and upgrade public IPs. For standalone virtual machines, you can use the [upgrade script](public-ip-upgrade-vm.md) or for virtual machines in an availability set use [this script](public-ip-upgrade-availability-set.md). \| + \| Virtual Machine Scale Sets \| [Replace basic SKU instance public IP addresses](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-networking#public-ipv4-per-virtual-machine) with new standard SKU \| \| Load Balancer (Basic SKU) \| New Load Balancer SKU required. Use the upgrade script [Upgrade Basic Load Balancer to Standard SKU](../../load-balancer/upgrade-basic-standard-with-powershell.md) to upgrade to Standard Load Balancer \| -\| VPN Gateway (using Basic IPs) \|At this time, it's not necessary to upgrade. When an upgrade is necessary, we'll update this decision path with migration information and send out a service health alert. \| -\| ExpressRoute Gateway (using Basic IPs) \| New ExpressRoute Gateway is required. Follow the [ExpressRoute Gateway migration guidance](../../expressroute/gateway-migration.md) for upgrading from Basic to Standard SKU. \| + \| VPN Gateway (using Basic IPs) \|At this time, it's not necessary to upgrade. When an upgrade is necessary, we'll update this decision path with migration information and send out a service health alert. \| + \| ExpressRoute Gateway (using Basic IPs) \| New ExpressRoute Gateway is required. Follow the [ExpressRoute Gateway migration guidance](../../expressroute/gateway-migration.md) for upgrading from Basic to Standard SKU. \| \| Application Gateway (v1 SKU) \| New AppGW SKU required. Use this [migration script to migrate from v1 to v2](../../application-gateway/migrate-v1-v2.md). \| > [!NOTE] -> If you have a virtual machine scale set (uniform model) with public IP configurations per instance, note these are not Public IP resources and as such cannot be upgraded; a new virtual machine scale set is required. You can use the SKU property to specify that Standard IP configurations are required for each VMSS instance as shown [here](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-networking#public-ipv4-per-virtual-machine). +> If you have a virtual machine scale set (uniform model) with public IP configurations per instance, note these are not Public IP resources and as such cannot be upgraded; a new public IP address is required. You can use the SKU property to specify that Standard IP configurations are required for each VMSS instance as shown [here](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-networking#public-ipv4-per-virtual-machine). ## Basic SKU vs. Standard SKU This section lists out some key differences between these two SKUs. -\|""\| Standard SKU public IP \| Basic SKU public IP \| +\| Aspect \| Standard SKU public IP \| Basic SKU public IP \| \|\|\|\| \| Allocation method \| Static. \| For IPv4: Dynamic or Static; For IPv6: Dynamic. \| \| Security \| Secure by default model and be closed to inbound traffic when used as a frontend. Allow traffic with [network security group](../network-security-groups-overview.md#network-security-groups) is required (for example, on the NIC of a virtual machine with a Standard SKU public IP attached). \| Open by default. Network security groups are recommended but optional for restricting inbound or outbound traffic. \| This section lists out some key differences between these two SKUs. \| [NAT Gateway Support](../nat-gateway/nat-overview.md) \| IPv4 is supported \| Not supported \| \| [Azure Firewall Support](../nat-gateway/nat-overview.md) \| IPv4 is supported \| Not supported \| -## Upgrade using Portal, PowerShell, and Azure CLI +## Upgrade disassociated public IPs using Portal, PowerShell, or Azure CLI Use the Azure portal, Azure PowerShell, or Azure CLI to help upgrade from Basic to Standard SKU. -- [Upgrade a public IP address - Azure portal](public-ip-upgrade-portal.md) +- [Upgrade a disassociated public IP address - Azure portal](public-ip-upgrade-portal.md) -- [Upgrade a public IP address - Azure PowerShell](public-ip-upgrade-powershell.md) +- [Upgrade a disassociated public IP address - Azure PowerShell](public-ip-upgrade-powershell.md) -- [Upgrade a public IP address - Azure CLI](public-ip-upgrade-cli.md) +- [Upgrade a disassociated public IP address - Azure CLI](public-ip-upgrade-cli.md) ## FAQ
virtual-network	Public Ip Upgrade Availability Set	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-network/ip-services/public-ip-upgrade-availability-set.md	+ + Title: 'Upgrade public IP addresses attached to virtual machines in an Availability Set from Basic to Standard' + +description: This article shows you how to upgrade all public IP address attached to a VM in an Availability Set to a standard public IP address ++ Last updated : 08/27/2024+++++ +# Upgrade all public IP addresses attached to VMs in an Availability Set from Basic to Standard + +>[!Important] +>On September 30, 2025, Basic SKU public IPs will be retired. For more information, see the [official announcement](https://azure.microsoft.com/updates/upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired/). If you are currently using Basic SKU public IPs, make sure to upgrade to Standard SKU public IPs prior to the retirement date. This article will help guide you through the upgrade process. + +For more information about the retirement of Basic SKU Public IPs and the benefits of Standard SKU Public IPs, see [here](public-ip-basic-upgrade-guidance.md) + +## Upgrade overview + +This script upgrades any Public IP Addresses attached to the Virtual Machines (VMs) in an Availability Set from Basic to Standard SKU. In order to perform the upgrade, the Public IP Address allocation method is set to static before being disassociated from each VM. Once disassociated, the Public IP SKU is upgraded to Standard, then the IP is reassociated with original VM until all IPs are upgraded. + +Because the Public IP allocation is set to 'Static' before detaching from the VMs, the IP addresses don't change during the upgrade process, even in the event of a script failure. The module double-checks that the Public IP allocation method is 'Static' before detaching the Public IP from the VM. + +The module logs all upgrade activity to a file named `AvSetPublicIPUpgrade.log`, created in the same location where the module was executed (by default). + +## Constraints/ Unsupported Scenarios + +* VMs with network interfaces associated to a Load Balancer: Because the Load Balancer and Public IP SKUs associated with a VM must match, it isn't possible to upgrade the instance-level Public IP addresses associated with a VM when the VM's network interfaces are also associated with a Load Balancer, either through Backend Pool or NAT Pool membership. Use the scripts [Upgrade a Basic Load Balancer to Standard SKU](../../load-balancer/upgrade-basic-standard-with-powershell.md) to upgrade both the Load Balancer and Public IPs as the same time. + +* VMs without a Network Security Group: VMs with IPs to be upgraded must have a Network Security Group (NSG) associated with either the subnet of each IP configuration with a Public IP, or with the NIC directly. This is because Standard SKU Public IPs are "secure by default," meaning that any traffic to the Public IP must be explicitly allowed at an NSG to reach the VM. Basic SKU Public IPs allow any traffic by default. Upgrading Public IP SKUs without an NSG would result in inbound internet traffic to the Public IP previously allowed with the Basic SKU. See: [Public IP SKUs](public-ip-addresses.md#sku) + +## Download the script + +Download the migration script from the [PowerShell Gallery](https://www.powershellgallery.com/packages/AzureAvSetBasicPublicIPUpgrade). + +```powershell +Install-Module -Name AzureAvSetBasicPublicIPUpgrade -Scope CurrentUser -Repository PSGallery -Force +``` + +## Use the module + +1. Use `Select-AzSubscription` to select the Azure subscription where your Availability Set exists + + ```powershell + Select-AzSubscription -Subscription <SubscriptionId> + ``` +2. Locate the Availability Set with the attached Basic Public IPs that you wish to upgrade. Record its name and resource group name. + +3. Examine the module parameters: + - AvailabilitySetName [string] Required - This parameter is the name of your Availability Set. + - ResourceGroupName [string] Required - This parameter is the resource group for your Availability Set with the Basic Public IPs attached that you want to upgrade. + +4. Run the upgrade, using the following examples or `Get-Help Start-AzAvSetPublicIPUpgrade` for guidance. + +### Example uses of the script + +Upgrade VMs in a single Availability Set, passing the Availability Set name and resource group name as parameters. +```powershell +Start-AzAvSetPublicIPUpgrade -availabilitySetName 'myAvSet' -resourceGroupName 'myRG' +``` + +Evaluate VMs in a single Availability Set, without making any changes +```powershell +Start-AzAvSetPublicIPUpgrade -availabilitySetName 'myAvSet' -resourceGroupName 'myRG' -WhatIf +``` + +Attempt upgrade of VMs in every Availability Set the user has access to. VMs without Public IPs, which are already upgraded, or which do not have NSGs are skipped. +```powershell +Get-AzAvailabilitySet -resourceGroupName 'myRG' \| Start-AzAvSetPublicIPUpgrade -skipVMMissingNSG +``` + +Recover from a failed migration, passing the name and resource group of the Availability Set to recover, along with the recovery log file. +```powershell +Start-AzAvSetPublicIPUpgrade -RecoverFromFile ./AvSetPublicIPUpgrade_Recovery_2020-01-01-00-00.csv -AvailabilitySetName myAvSet -ResourceGroup rg-myrg +``` + +### Recovering from a failed migration + +If a migration fails due to a transient issue, such as a network outage or client system issue, the migration can be retried to configure the VM and Public IPs in the goal state. At execution, the script outputs a recovery log file, which is used to ensure the VM is properly reconfigured. Review the log file `AvSetPublicIPUpgrade.log` created in the location where the script was executed. + +To recover from a failed upgrade, pass the recovery log file path to the script with the `-recoverFromFile` parameter and identify the Availability Set to recover with the `-AvailabilitySetName` parameter, as shown in this example. + +```powershell +Start-VMPublicIPUpgrade -RecoverFromFile ./AvSetPublicIPUpgrade_Recovery_2020-01-01-00-00.csv -AvailabilitySetName myAvSet -ResourceGroupName rg-myrg +``` + +## Common questions + +### How long will the migration take and how long will my VM be inaccessible at its Public IP? + +The time it takes to upgrade a VM's Public IPs depends on the number of Public IPs and Network Interfaces associated with the VM. In testing, a VM with a single NIC and Public IP takes between 1 and 2 minutes to upgrade. Each NIC on the VM adds about another minute, and each Public IP adds a few seconds each. + +### Can I roll back to a Basic SKU Public IP? + +It isn't possible to downgrade a Public IP address from Standard to Basic. + +### Can I test a migration before executing? + +There is no way to evaluate upgrading a Public IP without completing the action. However, this script includes a `-WhatIf` parameter, which checks that your Availability Set VMs will support the upgrade and walks through the steps without taking action. + +### Does the script support Zonal Basic SKU Public IPs? + +Yes, the process of upgrading a Zonal Basic SKU Public IP to a Zonal Standard SKU Public IP is identical and works in the script. + +## Next steps + +* [Upgrading a Basic public IP address to Standard SKU - Guidance](public-ip-basic-upgrade-guidance.md) +* [Upgrading a Basic public IP address to Standard SKU - Portal](public-ip-upgrade-portal.md)
virtual-wan	Create Bgp Peering Hub Powershell	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/create-bgp-peering-hub-powershell.md	Update an existing hub BGP peer connection. ```azurepowershell-interactive Update-AzVirtualHubBgpConnection -ResourceGroupName "[resource group name]" -VirtualHubName "westushub" -PeerIp 192.168.1.6 -PeerAsn 20000 -Name "testBgpConnection" -VirtualHubVnetConnection $hubVnetConnection ``` +## BGP learned route in HUB +Check BGP learned route in HUB. + +```azurepowershell-interactive +Get-AzRouteServerPeerLearnedRoute -ResourceGroupName "[resource group name]" -RouteServerName "[hub name]" -PeerName "[peer name]" +``` ## Delete a BGP peer Remove an existing hub BGP connection.
virtual-wan	How To Routing Policies	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/how-to-routing-policies.md	The following section describes common ways to troubleshoot when you configure r ### Effective Routes +> [!NOTE] +> Getting the effective routes applied on Virtual WAN routing intent next hop resources is only supported for the next hop resource specified in private routing policy. If you are using both private and internet routing policies, check the effective routes on the next hop resource specified in the private routing policy for the effective routes Virtual WAN programs on the internet routing policy next hop resource. If you are only using internet routing policies, check the effective routes on the defaultRouteTable to view the routes programmed on the internet routing policy next hop resource. + When private routing policies are configured on the Virtual Hub, all traffic between on-premises and Virtual Networks are inspected by Azure Firewall, Network Virtual Appliance, or SaaS solution in the Virtual hub. Therefore, the effective routes of the defaultRouteTable show the RFC1918 aggregate prefixes (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) with next hop Azure Firewall or Network Virtual Appliance. This reflects that all traffic between Virtual Networks and branches is routed to Azure Firewall, NVA or SaaS solution in the hub for inspection.
virtual-wan	Howto Private Link	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/howto-private-link.md	## Before you begin -The steps in this article assume that you've already deployed a virtual WAN with one or more hubs and at least two virtual networks connected to Virtual WAN. +The steps in this article assume that you've deployed a virtual WAN with one or more hubs and at least two virtual networks connected to Virtual WAN. To create a new virtual WAN and a new hub, use the steps in the following articles: To create a new virtual WAN and a new hub, use the steps in the following articl * [Create a hub](virtual-wan-site-to-site-portal.md#hub) * [Connect a VNet to a hub](virtual-wan-site-to-site-portal.md#hub) +## Routing Considerations with Private Link in Virtual WAN + +Private Endpoint connectivity in Azure is stateful. When a connection to a private endpoint gets established through Virtual WAN, traffic is routed through one or more traffic hops through different Virtual WAN components (for example Virtual Hub router, ExpressRoute Gateway, VPN Gateway, Azure Firewall, or NVA). The exact hops traffic takes is based on your Virtual WAN routing configurations. Behind the scenes, Azure's software-defined networking layer sends all packets related to a single 5-tuple flow to one of the backend instances servicing different Virtual WAN components. Asymmetrically routed traffic (for example, traffic corresponding to a single 5-tuple flow routed to different backend instances) is not supported and is dropped by the Azure platform. + +During maintenance events on Virtual WAN infrastructure, backend instances are rebooted one at a time, which can lead to intermittent connectivity issues to Private Endpoint as the instance servicing the flow is temporarily unavailable. The similar problem can occur when Azure Firewall or Virtual hub router scales out. The same traffic flow can be load-balanced to a new backend instance that is different than the instance currently servicing the flow. + +To mitigate the impact of maintenance and scale-out events on Private Link or Private Endpoint traffic consider the following best practices: + +* Configure the TCP time-out value of your on-premises application to fall between 15-30 seconds. A smaller TCP time-out value will allow application traffic to recover more quickly from maintenance and scale-out events. Alternatively, test different application time-out values to determine a suitable time-out based on your requirements. +* Pre-scale Virtual WAN components to handle traffic bursts to prevent autoscale events from occurring. For the Virtual Hub router, you can set the minimum routing infrastructure units on your hub router to prevent scaling during traffic bursts. + +Lastly, if you are using on-premises connectivity between Azure and on-premises using VPN or ExpressRoute, ensure your on-premises device is configured to use the same VPN tunnel or same Microsoft Enterprise Edge router as the next-hop for each 5-tuple corresponding to private endpoint traffic. + ## <a name="endpoint"></a>Create a private link endpoint You can create a private link endpoint for many different services. In this example, we're using Azure SQL Database. You can find more information about how to create a private endpoint for an Azure SQL Database in [Quickstart: Create a Private Endpoint using the Azure portal](../private-link/create-private-endpoint-portal.md). The following image shows the network configuration of the Azure SQL Database: After creating the Azure SQL Database, you can verify the private endpoint IP ad :::image type="content" source="./media/howto-private-link/endpoints.png" alt-text="private endpoints" lightbox="./media/howto-private-link/endpoints.png"::: -Clicking on the private endpoint we've created, you should see its private IP address and its Fully Qualified Domain Name (FQDN). The private endpoint should have an IP address in the range of the VNet where it has been deployed (10.1.3.0/24): +Clicking on the private endpoint we've created, you should see its private IP address and its Fully Qualified Domain Name (FQDN). The private endpoint should have an IP address in the range of the VNet (10.1.3.0/24): :::image type="content" source="./media/howto-private-link/sql-endpoint.png" alt-text="SQL endpoint" lightbox="./media/howto-private-link/sql-endpoint.png"::: sqlcmd -S wantest.database.windows.net -U $username -P $password -Q "$query" With this example, we've seen how creating a private endpoint in one of the VNets attached to a Virtual WAN provides connectivity to the rest of VNets and branches in the Virtual WAN. + ## Next steps For more information about Virtual WAN, see the [FAQ](virtual-wan-faq.md).
virtual-wan	Virtual Wan Faq	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-wan/virtual-wan-faq.md	Yes, this can be done automatically with no update or reset required on the peer You can find more information on how to change the VNet address space [here](../virtual-network/manage-virtual-network.yml). +### What is the maximum number of spoke Virtual Network addresses supported for hubs configured with Routing Intent? +The maximum number of address spaces across all Virtual Networks directly connected to a single Virtual WAN hub is 400. This limit is applied individually to each Virtual WAN hub in a Virtual WAN deployment. Virtual Network address spaces connected to remote (other Virtual WAN hubs in the same Virtual WAN) hubs are not counted towards this limit. + +This limit is adjustable. For more information on the limit, the procedure to request a limit increase and sample scripts to determine the number of address spaces across Virtual Networks connected to a Virtual WAN hub, see [routing intent virtual network address space limits](how-to-routing-policies.md#virtual-network-address-space-limits). ## <a name="vwan-customer-controlled-maintenance"></a>Virtual WAN customer-controlled gateway maintenance When working with VPN and ExpressRoute in a coexistence scenario or whenever you No, maintenance activities won't be paused on your resource during the period before the scheduled maintenance window. For the days not covered in your maintenance schedule, maintenance continues as usual on the resource. +### Are there limits on the number of routes I can advertise? + +Yes, there are limits. ExpressRoute supports up to 4,000 prefixes for private peering and 200 prefixes for Microsoft peering. With ExpressRoute Premium, you can increase the limit to 10,000 routes for private peering. The maximum number of routes advertised from Azure private peering via an ExpressRoute Gateway over an ExpressRoute circuit is 1,000, which is the same for both standard and premium ExpressRoute circuits. For more details, you can review [the ExpressRoute circuits Route Limits on the Azure subscription limits and quotas page](../azure-resource-manager/management/azure-subscription-service-limits.md#route-advertisement-limits) Please note that IPv6 route advertisements are currently not supported with Virtual WAN. + +### Are there restrictions on IP ranges I can advertise over the BGP session? + +Yes, there are restrictions. Private prefixes (RFC1918) are not accepted for the Microsoft peering BGP session. However, any prefix size up to a /32 prefix is accepted on both the Microsoft and private peering. + +### What happens if the BGP route limit gets exceeded? +If the BGP route limit is exceeded, BGP sessions will disconnect. The sessions will be restored once the prefix count is reduced below the limit. For more information, see [the ExpressRoute circuits Route limits on the Azure subscription limits and quotas page](../azure-resource-manager/management/azure-subscription-service-limits.md#route-advertisement-limits). + +### Can I monitor the number of routes advertised or received over an ExpressRoute circuit? + +Yes, you can. For the best practices and configuration for metric-based alert monitoring, [refer to the Azure monitoring best practices](../virtual-wan/monitoring-best-practices.md#expressroute-gateway). + +### What is the recommendation to reduce the number of IP prefixes? + +We recommend aggregating the prefixes before advertising them over ExpressRoute or VPN gateway. Additionally, you can use +[Route-Maps](../virtual-wan/route-maps-about.md) to summarize routes advertised from/to Virtual WAN. ++ ## Next steps For more information about Virtual WAN, see [About Virtual WAN](virtual-wan-about.md).
vpn-gateway	Vpn Gateway Troubleshoot Point To Site Osx Ikev2	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/vpn-gateway/vpn-gateway-troubleshoot-point-to-site-osx-ikev2.md	Title: 'Troubleshoot Point-to-Site connections: Mac OS X clients' + Title: 'Troubleshoot point-to-site connections: macOS X clients' -description: Learn how to troubleshoot point-to-site connectivity issues from Mac OS X using the native VPN client and IKEv2. +description: Learn how to troubleshoot point-to-site connectivity issues from macOS X using the native VPN client. Previously updated : 02/10/2021 Last updated : 09/04/2024 -# Troubleshoot Point-to-Site VPN connections from Mac OS X VPN clients +# Troubleshoot Point-to-Site VPN connections from macOS X VPN clients -This article helps you troubleshoot Point-to-Site connectivity issues from Mac OS X using the native VPN client and IKEv2. The VPN client in Mac for IKEv2 is very basic and does not allow for much customization. There are only four settings that need to be checked: +This article helps you troubleshoot point-to-site connectivity issues from macOS X clients that use the native macOS X VPN client and IKEv2. VPN client configuration in macOS X is very basic for IKEv2 connections and doesn't allow for much customization. There are only four settings that need to be checked: * Server Address * Remote ID This article helps you troubleshoot Point-to-Site connectivity issues from Mac O * Authentication Settings * OS Version (10.11 or higher) +## <a name="certificate"></a> Certificate-based authentication -## <a name="VPNClient"></a> Troubleshoot certificate-based authentication -1. Check the VPN client settings. Go to the Network Setting by pressing Command + Shift, and then type "VPN" to check the VPN client settings. From the list, click the VPN entry that needs to be investigated. +1. Check the VPN client settings. Go to Settings and locate VPN. +1. From the list, click the i next to the VPN entry that you want to investigate. This opens the settings configuration for the VPN connection. +1. Verify that the Server Address is the complete FQDN and includes the cloudapp.net. +1. The Remote ID should be the same as the Server Address (Gateway FQDN). +1. The Local ID should be the same as the Subject of the client certificate. +1. For Authentication, verify that "Certificate" is selected. +1. Click the Select button and verify that the correct certificate is selected. +1. Click OK to save any changes. - ![IKEv2 certificate-based authentication](./media/vpn-gateway-troubleshoot-point-to-site-osx-ikev2/ikev2cert1.jpg) -2. Verify that the Server Address is the complete FQDN and includes the cloudapp.net. -3. The Remote ID should be the same as the Server Address (Gateway FQDN). -4. The Local ID should be the same as the Subject of the client certificate. -5. Click on Authentication Settings to open the Authentication Settings page. +If you're still having issues, see the [IKEv2 packet capture](#packet) section. - ![Screenshot shows an Authentication Settings dialog box with Certificate selected.](./media/vpn-gateway-troubleshoot-point-to-site-osx-ikev2/ikev2auth2.jpg) -6. Verify that Certificate is selected from the dropdown. -7. Click the Select button and verify that the correct certificate is selected. Click OK to save any changes. +## <a name="ikev2"></a>Username and password authentication -## <a name="ikev2"></a>Troubleshoot username and password authentication +1. Check the VPN client settings. Go to Settings and locate VPN. +1. From the list, click the i next to the VPN entry that you want to investigate. This opens the settings configuration for the VPN connection. +1. Verify that the Server Address is the complete FQDN and includes the cloudapp.net. +1. The Remote ID should be the same as the Server Address (Gateway FQDN). +1. The Local ID can be blank. +1. For Authentication, verify that "Username" is selected. +1. Verify that the correct credentials are entered. +1. Click OK to save any changes. -1. Check the VPN client settings. Go to the Network Setting by pressing Command + Shift, and then type "VPN" to check the VPN client settings. From the list, click the VPN entry that needs to be investigated. +If you're still having issues, see the [IKEv2 packet capture](#packet) section. - ![IKEv2 username password](./media/vpn-gateway-troubleshoot-point-to-site-osx-ikev2/ikev2user3.jpg) -2. Verify that the Server Address is the complete FQDN and includes the cloudapp.net. -3. The Remote ID should be the same as the Server Address (Gateway FQDN). -4. The Local ID can be blank. -5. Click the Authentication Setting button and verify that "Username" is selected from the dropdown. +## <a name="packet"></a>Packet capture - IKEv2 - ![Screenshot shows an Authentication Settings dialog box with Username selected.](./media/vpn-gateway-troubleshoot-point-to-site-osx-ikev2/ikev2auth4.png) -6. Verify that the correct credentials are entered. +Download [Wireshark](https://www.wireshark.org/#download) and perform a packet capture. -## <a name="additional"></a>Additional steps - -If you try the previous steps and everything is configured properly, download [Wireshark](https://www.wireshark.org/#download) and perform a packet capture. - -1. Filter on isakmp and look at the IKE_SA packets. You should be able to look at the SA proposal details under the Payload: Security Association. -2. Verify that the client and the server have a common set. - - ![packet](./media/vpn-gateway-troubleshoot-point-to-site-osx-ikev2/packet5.jpg) - -3. If there is no server response on the network traces, verify you enabled IKEv2 protocol on the Azure Gateway Configuration page on the Azure portal website. +1. Filter on isakmp and look at the IKE_SA packets. You should be able to look at the SA proposal details under the Payload: Security Association. +1. Verify that the client and the server have a common set. +1. If there's no server response on the network traces, verify you enabled IKEv2 protocol on the Azure VPN gateway. You can check by going to the Azure portal, selecting the VPN gateway, and then selecting Point-to-site configuration. ## Next steps -For additional help, see [Microsoft Support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade). + +For more help, see [Microsoft Support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade).
vpn-gateway	Vpn Gateway Troubleshoot Vpn Point To Site Connection Problems	https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/vpn-gateway/vpn-gateway-troubleshoot-vpn-point-to-site-connection-problems.md	description: Learn to troubleshoot and solve common point-to-site connection pro Previously updated : 09/03/2024 Last updated : 09/04/2024 # Troubleshooting: Azure point-to-site connection problems This error message occurs if the client can't access http://crl3.digicert.com/ss Check the proxy server settings, make sure that the client can access http://crl3.digicert.com/ssca-sha2-g1.crl and http://crl4.digicert.com/ssca-sha2-g1.crl. -## VPN Client Error: The connection was prevented because of a policy configured on your RAS/VPN server. (Error 812) +## VPN client error: The connection was prevented because of a policy configured on your RAS/VPN server. (Error 812) ### Cause Make sure that RADIUS server is configured correctly. For More information, see Root certificate hasn't been installed. The root certificate is installed in the client's Trusted certificates store. -## VPN Client Error: The remote connection was not made because the attempted VPN tunnels failed. (Error 800) +## VPN client error: The remote connection was not made because the attempted VPN tunnels failed. (Error 800) ### Cause Update the NIC driver: 1. If Windows doesn't find a new driver, you can try looking for one on the device manufacturer's website and follow their instructions. 1. Restart the computer and try the connection again. -## VPN Client Error: Dialing VPN connection \<VPN Connection Name\>, Status = VPN Platform did not trigger connection +## <a name="entra-expired"></a>VPN client error: Your authentication with Microsoft Entra has expired + +If you're using Microsoft Entra ID authentication, you might encounter the following error: + +Your authentication with Microsoft Entra has expired so you need to re-authenticate to acquire a new token. Please try connecting again. Authentication policies and timeout are configured by your administrator in Entra tenant. + +### Cause + +The point-to-site connection is disconnected because the current refresh token has expired or becomes invalid. New access tokens canΓÇÖt be fetched for authenticating the user. + +When an Azure VPN Client tries to establish connection with an Azure VPN gateway using Microsoft Entra ID authentication, an access token is required to authenticate the user. This token gets renewed approximately every hour. A valid access token can only be issued when the user has a valid refresh token. If the user doesnΓÇÖt have a valid refresh token, the connection gets disconnected. + +The refresh token can show as expired/invalid due to several reasons. You can check User Entra sign-in logs for debugging. See [Microsoft Entra sign-in logs](/entra/identity/monitoring-health/concept-sign-ins). + +* Refresh token has expired + + * The default lifetime for the refresh tokens is 90 days. After 90 days, users need to reconnect to get a new refresh token. + * Entra tenant admins can add conditional access policies for sign-in frequency that trigger periodic reauthentication every 'X' hrs. (Refresh token will expire in 'X' hrs). By using custom conditional access policies, users are forced use an interactive sign-in every 'X' hrs. For more information, see [Refresh tokens in the Microsoft identity platform](/entra/identity-platform/refresh-tokens) and [Configure adaptive session lifetime policies](/entra/identity/conditional-access/howto-conditional-access-session-lifetime). + +* Refresh token is invalid + + * The user has been removed from tenant. + * The user's credentials have changed. + * Sessions have been revoked by the Entra tenant Admin. + * The device has become noncompliant (if itΓÇÖs a managed device). + * Other Entra policies configured by Entra Admins that require users to periodically use interactive sign-in. + +### Solution + +In these scenarios, users need to reconnect. This triggers an interactive sign-in process in Microsoft Entra that issues a new refresh token and access token. + +## VPN client error: Dialing VPN connection \<VPN Connection Name\>, Status = VPN Platform did not trigger connection You might also see the following error in Event Viewer from RasClient: "The user \<User\> dialed a connection named \<VPN Connection Name\> which has failed. The error code returned on failure is 1460."