| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| active-directory | Use Scim To Provision Users And Groups | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/use-scim-to-provision-users-and-groups.md | Use the general guidelines when implementing a SCIM endpoint to ensure compatibi * Microsoft Azure AD makes requests to fetch a random user and group to ensure that the endpoint and the credentials are valid. It's also done as a part of the **Test Connection** flow in the [Azure portal](https://portal.azure.com). * Support HTTPS on your SCIM endpoint. * Custom complex and multivalued attributes are supported but Azure AD doesn't have many complex data structures to pull data from in these cases. Simple paired name/value type complex attributes can be mapped to easily, but flowing data to complex attributes with three or more subattributes aren't well supported at this time.-* The "type" subattribute values of multivalued complex attributes must be unique. For example, there can't be two different email addresses with the "work" subtype. +* The "type" subattribute values of multivalued complex attributes must be unique. For example, there can't be two different email addresses with the "work" subtype. +* The header for all the responses should be of content-Type: application/scim+json ### Retrieving Resources: |
| active-directory | Apple Sso Plugin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/apple-sso-plugin.md | -> This feature [!INCLUDE [PREVIEW BOILERPLATE](../../../includes/active-directory-develop-preview.md)] +> This feature is in public preview. This preview is provided without a service-level agreement. For more information, see [Supplemental terms of use for Microsoft Azure public previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). The *Microsoft Enterprise SSO plug-in for Apple devices* provides single sign-on (SSO) for Azure Active Directory (Azure AD) accounts on macOS, iOS, and iPadOS across all applications that support Apple's [enterprise single sign-on](https://developer.apple.com/documentation/authenticationservices) feature. The plug-in provides SSO for even old applications that your business might depend on but that don't yet support the latest identity libraries or protocols. Microsoft worked closely with Apple to develop this plug-in to increase your application's usability while providing the best protection available. |
| active-directory | Single Sign On Saml Protocol | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/single-sign-on-saml-protocol.md | To request a user authentication, cloud services send an `AuthnRequest` element | Parameter | Type | Description | | | | |-| ID | Required | Azure AD uses this attribute to populate the `InResponseTo` attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "id" to the string representation of a GUID. For example, `id6c1c178c166d486687be4aaf5e482730` is a valid ID. | +| ID | Required | Azure AD uses this attribute to populate the `InResponseTo` attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "ID" to the string representation of a GUID. For example, `id6c1c178c166d486687be4aaf5e482730` is a valid ID. | | Version | Required | This parameter should be set to **2.0**. | | IssueInstant | Required | This is a DateTime string with a UTC value and [round-trip format ("o")](/dotnet/standard/base-types/standard-date-and-time-format-strings). Azure AD expects a DateTime value of this type, but doesn't evaluate or use the value. | | AssertionConsumerServiceURL | Optional | If provided, this parameter must match the `RedirectUri` of the cloud service in Azure AD. | If provided, don't include the `ProxyCount` attribute, `IDPListOption` or `Reque ### Signature -A `Signature` element in `AuthnRequest` elements is optional. Azure AD does not validate signed authentication requests if a signature is present. Requestor verification is provided for by only responding to registered Assertion Consumer Service URLs. +A `Signature` element in `AuthnRequest` elements is optional. Azure AD can be configured (Preview) to enforce the requirement of signed authentication requests. If enabled, only signed authentication requests are accepted, otherwise the requestor verification is provided for by only responding to registered Assertion Consumer Service URLs. ### Subject To generate this digital signature, Azure AD uses the signing key in the `IDPSSO #### Subject -This specifies the principal that is the subject of the statements in the assertion. It contains a `NameID` element, which represents the authenticated user. The `NameID` value is a targeted identifier that is directed only to the service provider that is the audience for the token. It is persistent - it can be revoked, but is never reassigned. It is also opaque, in that it does not reveal anything about the user and cannot be used as an identifier for attribute queries. +This specifies the principle that is the subject of the statements in the assertion. It contains a `NameID` element, which represents the authenticated user. The `NameID` value is a targeted identifier that is directed only to the service provider that is the audience for the token. It is persistent - it can be revoked, but is never reassigned. It is also opaque, in that it does not reveal anything about the user and cannot be used as an identifier for attribute queries. The `Method` attribute of the `SubjectConfirmation` element is always set to `urn:oasis:names:tc:SAML:2.0:cm:bearer`. |
| active-directory | Howto Enforce Signed Saml Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/manage-apps/howto-enforce-signed-saml-authentication.md | + + Title: Enforce signed SAML authentication requests +description: Learn how to enforce signed SAML authentication requests. +++++++ Last updated : 06/29/2022 +++ +++# SAML Request Signature Verification (Preview) ++SAML Request Signature Verification is a functionality that validates the signature of signed authentication requests. An App Admin now can enable and disable the enforcement of signed requests and upload the public keys that should be used to do the validation. ++If enabled Azure Active Directory will validate the requests against the public keys configured. There are some scenarios where the authentication requests can fail: ++- Protocol not allowed for signed requests. Only SAML protocol is supported. +- Request not signed, but verification is enabled. +- No verification certificate configured for SAML request signature verification. +- Signature verification failed. +- Key identifier in request is missing and two most recently added certificates don't match with the request signature. +- Request signed but algorithm missing. +- No certificate matching with provided key identifier. +- Signature algorithm not allowed. Only RSA-SHA256 is supported. ++## To configure SAML Request Signature Verification in the Azure portal ++1. Inside the Azure portal, navigate to **Azure Active Directory** from the Search bar or Azure Services. + +  + +2. Navigate to **Enterprise applications** from the left menu. + +  + +3. Select the application you wish to apply the changes. ++4. Navigate to **Single sign-on.** ++5. In the **Single sign-on** screen, there's a new subsection called **Verification certificates** under **SAML Certificates.** + +  + +6. Click on **Edit.** ++7. In the new blade, you'll be able to enable the verification of signed requests and opt-in for weak algorithm verification in case your application still uses RSA-SHA1 to sign the authentication requests. ++8. To enable the verification of signed requests, click **Enable verification certificates** and upload a verification public key that matches with the private key used to sign the request. + +  + +  + +  ++9. Once you have your verification certificate uploaded, click **Save.** + +  + +  ++10. When the verification of signed requests is enabled, the test experience is disabled as the requests requires to be signed by the service provider. + +  + +11. If you want to see the current configuration of an enterprise application, you can navigate to the **Single Sign-on** screen and see the summary of your configuration under **SAML Certificates**. There you'll be able to see if the verification of signed requests is enabled and the count of Active and Expired verification certificates. + +  ++## Next steps ++* Find out [How Azure AD uses the SAML protocol](../develop/active-directory-saml-protocol-reference.md) +* Learn the format, security characteristics, and contents of [SAML tokens in Azure AD](../develop/reference-saml-tokens.md) |
| active-directory | Memo 22 09 Meet Identity Requirements | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/standards/memo-22-09-meet-identity-requirements.md | -US executive order [14028, Improving the Nation's Cyber Security](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity), directs federal agencies on advancing security measures that dramatically reduce the risk of successful cyberattacks against the federal government's digital infrastructure. On January 26, 2022, the [Office of Management and Budget (OMB)](https://www.whitehouse.gov/omb/) released the federal Zero Trust strategy in [memorandum 22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf), in support of EO 14028. +US executive order [14028, Improving the Nation's Cyber Security](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity), directs federal agencies on advancing security measures that drastically reduce the risk of successful cyberattacks against the federal government's digital infrastructure. On January 26, 2022, the [Office of Management and Budget (OMB)](https://www.whitehouse.gov/omb/) released the federal Zero Trust strategy in [memorandum 22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf), in support of EO 14028. This series of articles offers guidance for employing Azure Active Directory (Azure AD) as a centralized identity management system for implementing Zero Trust principles, as described in memorandum 22-09. -The release of memorandum 22-09 is designed to support Zero Trust initiatives within federal agencies. It also provides regulatory guidance in supporting federal cybersecurity and data privacy paws. The memo cites the [Department of Defense (DoD) Zero Trust Reference Architecture](https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf): +The release of memorandum 22-09 is designed to support Zero Trust initiatives within federal agencies. It also provides regulatory guidance in supporting federal cybersecurity and data privacy laws. The memo cites the [Department of Defense (DoD) Zero Trust Reference Architecture](https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf): >"The foundational tenet of the Zero Trust Model is that no actor, system, network, or service operating outside or within the security perimeter is trusted. Instead, we must verify anything and everything attempting to establish access. It is a dramatic paradigm shift in philosophy of how we secure our infrastructure, networks, and data, from verify once at the perimeter to continual verification of each user, device, application, and transaction." |
| app-service | Overview Vnet Integration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/app-service/overview-vnet-integration.md | Gateway-required virtual network integration is built on top of point-to-site VP ### Access on-premises resources -Apps can access on-premises resources by integrating with virtual networks that have site-to-site connections. If you use gateway-required virtual network integration, update your on-premises VPN gateway routes with your point-to-site address blocks. When the site-to-site VPN is first set up, the scripts used to configure it should set up routes properly. If you add the point-to-site addresses after you create your site-to-site VPN, you need to update the routes manually. Details on how to do that vary per gateway and aren't described here. You can't have BGP configured with a site-to-site VPN connection. +Apps can access on-premises resources by integrating with virtual networks that have site-to-site connections. If you use gateway-required virtual network integration, update your on-premises VPN gateway routes with your point-to-site address blocks. When the site-to-site VPN is first set up, the scripts used to configure it should set up routes properly. If you add the point-to-site addresses after you create your site-to-site VPN, you need to update the routes manually. Details on how to do that vary per gateway and aren't described here. BGP routes won't be propagated automatically. No extra configuration is required for the regional virtual network integration feature to reach through your virtual network to on-premises resources. You simply need to connect your virtual network to on-premises resources by using ExpressRoute or a site-to-site VPN. |
| automation | Extension Based Hybrid Runbook Worker Install | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/extension-based-hybrid-runbook-worker-install.md | You can delete an empty Hybrid Runbook Worker group from the portal. The hybrid worker group will be deleted. -## Use Azure Resource Manager template +## Manage Hybrid Worker extension using ARM template, REST API, and Azure CLI ++#### [ARM template](#tab/arm-template) You can use an Azure Resource Manager (ARM) template to create a new Azure Windows VM and connect it to an existing Automation account and Hybrid Worker Group. To learn more about ARM templates, see [What are ARM templates?](../azure-resource-manager/templates/overview.md) -### Review the template +**Review the template** ```json { The following Azure resources are defined in the template: - [hybridRunbookWorkerGroups/hybridRunbookWorkers](/azure/templates/microsoft.automation/automationaccounts/hybridrunbookworkergroups/hybridrunbookworkers) - [Microsoft.Compute/virtualMachines/extensions](/azure/templates/microsoft.compute/virtualmachines/extensions) -### Review parameters +**Review parameters** Review the parameters used in this template. Review the parameters used in this template. | osVersion | The OS for the new Windows VM. The default value is `2019-Datacenter`. | | dnsNameForPublicIP | The DNS name for the public IP. | + +#### [REST API](#tab/rest-api) -## Install Hybrid worker extension using REST API --### Prerequisites +**Prerequisites** You would require an Azure VM or Arc-enabled server. You can follow the steps [here](../azure-arc/servers/onboard-portal.md) to create an Arc connected machine. -### Install and use Hybrid Worker extension using REST API +**Install and use Hybrid Worker extension** To install and use Hybrid Worker extension using REST API, follow these steps. The West Central US region is considered in this example. To install and use Hybrid Worker extension using REST API, follow these steps. T ``` Response of the *PUT* call will confirm if the extension is successfully installed or not on the targeted VM. You can also go to the VM in the Azure portal, and check status of extensions installed on the target VM under **Extensions** tab. +#### [Azure CLI](#tab/cli) ++**Manage Hybrid Worker Extension** ++- To create, delete, and manage extension-based Hybrid Runbook Worker groups, see [az automation hrwg | Microsoft Docs](/cli/azure/automation/hrwg?view=azure-cli-latest) +- To create, delete, and manage extension-based Hybrid Runbook Worker, see [az automation hrwg hrw | Microsoft Docs](/cli/azure/automation/hrwg/hrw?view=azure-cli-latest) ++ ## Manage Role permissions for Hybrid Worker Groups and Hybrid Workers |
| automation | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/automation/whats-new.md | Azure Automation receives improvements on an ongoing basis. To stay up to date w This page is updated monthly, so revisit it regularly. If you're looking for items older than six months, you can find them in [Archive for What's new in Azure Automation](whats-new-archive.md). +## August 2022 ++### Azure Automation Hybrid Worker Extension (preview) now supports Arc-enabled VMware VMs ++**Type:** Enhancement to an existing feature ++In addition to the support for Azure VMs and Arc-enabled Servers, Azure Automation Hybrid Worker Extension (preview) now supports Arc-enabled VMware VMs as a target. You can now orchestrate management tasks using PowerShell and Python runbooks on Azure VMs, Arc-enabled Servers, and Arc-enabled VMWare VMs with an identical experience. Read [here](extension-based-hybrid-runbook-worker-install.md) for more information. + ## March 2022 ### Forward diagnostic audit data to Azure Monitor logs |
| azure-monitor | Autoscale Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-monitor/autoscale/autoscale-overview.md | This article describes Microsoft Azure autoscale and its benefits. Azure autoscale supports many resource types. For more information about supported resources, see [autoscale supported resources](#supported-services-for-autoscale). > [!NOTE]-> [Availability sets](/archive/blogs/kaevans/autoscaling-azurevirtual-machines) are an older scaling feature for virtual machines with limited support. We recommend migrating to [virtual machine scale sets](../../virtual-machine-scale-sets/overview.md) for faster and more reliable autoscale support. +> [Availability sets](/archive/blogs/kaevans/autoscaling-azurevirtual-machines) are an older scaling feature for virtual machines with limited support. We recommend migrating to [virtual machine scale sets](/azure/virtual-machine-scale-sets/overview) for faster and more reliable autoscale support. ## What is autoscale Autoscale is a service that allows you to automatically add and remove resources according to the load on your application. -When your application experiences higher load, autoscale adds resources to handle the increased load. When load is low, autoscale reduces the number of resources, lowering your costs. You can scale your application based on metrics like CPU usage, queue length, and available memory, or based on a schedule. Metrics and schedules are set up in rules. The rules include a minimum level of resources that you need to run your application, and a maximum level of resources that won't be exceeded. +When your application experiences higher load, autoscale adds resources to handle the increased load. When load is low, autoscale reduces the number of resources, lowering your costs. You can scale your application based on metrics like CPU usage, queue length, and available memory, or based on a schedule. Metrics and schedules are set up in rules. The rules include a minimum level of resources that you need to run your application, and a maximum level of resources that won't be exceeded. For example, scale out your application by adding VMs when the average CPU usage per VM is above 70%. Scale it back in removing VMs when CPU usage drops to 40%. In contrast, scaling up and down, or vertical scaling, keeps the number of resou :::image type="content" source="./media/autoscale-overview/vertical-scaling.png" alt-text="A diagram that shows scaling up by adding CPU and memory to a virtual machine."::: +When the conditions in the rules are met, one or more autoscale actions are triggered, adding or removing VMs. In addition, you can perform other actions like sending email notifications, or webhooks to trigger processes in other systems. + ### Predictive autoscale (preview) [Predictive autoscale](./autoscale-predictive.md) uses machine learning to help manage and scale Azure virtual machine scale sets with cyclical workload patterns. It forecasts the overall CPU load on your virtual machine scale set, based on historical CPU usage patterns. The scale set can then be scaled out in time to meet the predicted demand. In contrast, scaling up and down, or vertical scaling, keeps the number of resou You can set up autoscale via: -+ [Azure portal](autoscale-get-started.md) -+ [PowerShell](../powershell-samples.md#create-and-manage-autoscale-settings) -+ [Cross-platform Command Line Interface (CLI)](../cli-samples.md#autoscale) -+ [Azure Monitor REST API](/rest/api/monitor/autoscalesettings) +* [Azure portal](autoscale-get-started.md) +* [PowerShell](../powershell-samples.md#create-and-manage-autoscale-settings) +* [Cross-platform Command Line Interface (CLI)](../cli-samples.md#autoscale) +* [Azure Monitor REST API](/rest/api/monitor/autoscalesettings) ## Architecture The following diagram shows the autoscale architecture. ### Resource metrics -Resources generate metrics that are used in autoscale rules to trigger scale events. Virtual machine scale sets use telemetry data from Azure diagnostics agents to generate metrics. Telemetry for Web apps and Cloud services comes directly from the Azure Infrastructure. --Some commonly used metrics include CPU usage, memory usage, thread counts, queue length, and disk usage. See [Autoscale Common Metrics](autoscale-common-metrics.md) for a list of available metrics. +Resources generate metrics that are used in autoscale rules to trigger scale events. Virtual machine scale sets use telemetry data from Azure diagnostics agents to generate metrics. Telemetry for Web apps and Cloud services comes directly from the Azure Infrastructure. Some commonly used metrics include CPU usage, memory usage, thread counts, queue length, and disk usage. See [Autoscale Common Metrics](autoscale-common-metrics.md) for a list of available metrics. ### Custom metrics -Use your own custom metrics that your application generates. Configure your application to send metrics to [Application Insights](../app/app-insights-overview.md) so you can use those metrics decide when to scale. +Use your own custom metrics that your application generates. Configure your application to send metrics to [Application Insights](/azure/azure-monitor/app/app-insights-overview) so you can use those metrics decide when to scale. ### Time Set up schedule-based rules to trigger scale events. Use schedule-based rules wh Rules define the conditions needed to trigger a scale event, the direction of the scaling, and the amount to scale by. Rules can be: -+ Metric-based - Trigger based on a metric value, for example when CPU usage is above 50%. -+ Time-based - Trigger based on a schedule, for example, every Saturday at 8am. +* Metric-based +Trigger based on a metric value, for example when CPU usage is above 50%. +* Time-based +Trigger based on a schedule, for example, every Saturday at 8am. You can combine multiple rules using different metrics, for example CPU usage and queue length. --+ The OR operator is used when scaling out with multiple rules. -+ The AND operator is used when scaling in with multiple rules. +Autoscale scales out if *any* of the rules are met, whereas autoscale scales in only if *all* the rules are met. +In terms of logic operators, the OR operator is used when scaling out with multiple rules. The AND operator is used when scaling in with multiple rules. ### Actions and automation Rules can trigger one or more actions. Actions include: -+ Scale - Scale resources in or out. -+ Email - Send an email to the subscription admins, co-admins, and/or any other email address. -+ Webhooks - Call webhooks to trigger multiple complex actions inside or outside Azure. In Azure, you can: - + Start an [Azure Automation runbook](../../automation/overview.md). - + Call an [Azure Function](../../azure-functions/functions-overview.md). - + Trigger an [Azure Logic App](../../logic-apps/logic-apps-overview.md). +* Scale - Scale resources in or out. +* Email - Send an email to the subscription admins, co-admins, and/or any other email address. +* Webhooks - Call webhooks to trigger multiple complex actions inside or outside Azure. In Azure, you can: + * Start an [Azure Automation runbook](/azure/automation/overview). + * Call an [Azure Function](/azure/azure-functions/functions-overview). + * Trigger an [Azure Logic App](/azure/logic-apps/logic-apps-overview). ## Autoscale settings The full list of configurable fields and descriptions is available in the [Autos For code examples, see -+ [Advanced Autoscale configuration using Resource Manager templates for virtual machine scale sets](autoscale-virtual-machine-scale-sets.md) -+ [Autoscale REST API](/rest/api/monitor/autoscalesettings) +* [Advanced Autoscale configuration using Resource Manager templates for virtual machine scale sets](autoscale-virtual-machine-scale-sets.md) +* [Autoscale REST API](/rest/api/monitor/autoscalesettings) ## Horizontal vs vertical scaling -Autoscale scales horizontally, which is an increase, or decrease of the number of resource instances. For example, in a virtual machine scale set, scaling out means adding more virtual machines. Scaling in means removing virtual machines. Horizontal scaling is flexible in a cloud situation as it allows you to run a large number of VMs to handle load. +Autoscale scales horizontally, which is an increase, or decrease of the number of resource instances. For example, in a virtual machine scale set, scaling out means adding more virtual machines Scaling in means removing virtual machines. Horizontal scaling is flexible in a cloud situation as it allows you to run a large number of VMs to handle load. In contrast, vertical scaling, keeps the same number of resources constant, but gives them more capacity in terms of memory, CPU speed, disk space and network. Adding or removing capacity in vertical scaling is known as scaling or down. Vertical scaling is limited by the availability of larger hardware, which eventually reaches an upper limit. Hardware size availability varies in Azure by region. Vertical scaling may also require a restart of the virtual machine during the scaling process. The following services are supported by autoscale: | Azure Data Explorer Clusters|[Manage Azure Data Explorer clusters scaling to accommodate changing demand](/azure/data-explorer/manage-cluster-horizontal-scaling)| | Azure Stream Analytics | [Autoscale streaming units (Preview)](../../stream-analytics/stream-analytics-autoscale.md) | | Azure Machine Learning Workspace | [Autoscale an online endpoint](../../machine-learning/how-to-autoscale-endpoints.md) |-| Azure SignalR Service | [Automatically scale units of an Azure SignalR service](../../azure-signalr/signalr-howto-scale-autoscale.md) | -| Logic apps |[Adding integration service environment (ISE) capacity](../../logic-apps/ise-manage-integration-service-environment.md#add-ise-capacity)| -| Media Services | [Autoscaling in Media Services](/azure/media-services/latest/release-notes#autoscaling) | -| Service Bus |[Automatically update messaging units of an Azure Service Bus namespace](../../service-bus-messaging/automate-update-messaging-units.md)| -| Spring Cloud |[Set up autoscale for microservice applications](../../spring-apps/how-to-setup-autoscale.md)| -| Service Fabric Managed Clusters | [Introduction to Autoscaling on Service Fabric managed clusters](../../service-fabric/how-to-managed-cluster-autoscale.md) | ## Next steps To learn more about autoscale, see the following resources: -+ [Azure Monitor autoscale common metrics](autoscale-common-metrics.md) -+ [Scale virtual machine scale sets](../../virtual-machine-scale-sets/tutorial-autoscale-powershell.md?toc=%2fazure%2fazure-monitor%2ftoc.json) -+ [Autoscale using Resource Manager templates for virtual machine scale sets](../../virtual-machine-scale-sets/tutorial-autoscale-powershell.md?toc=%2fazure%2fazure-monitor%2ftoc.json) -+ [Best practices for Azure Monitor autoscale](autoscale-best-practices.md) -+ [Use autoscale actions to send email and webhook alert notifications](autoscale-webhook-email.md) -+ [Autoscale REST API](/rest/api/monitor/autoscalesettings) -+ [Troubleshooting virtual machine scale sets and autoscale](../../virtual-machine-scale-sets/virtual-machine-scale-sets-troubleshoot.md) -+ [Troubleshooting Azure Monitor autoscale](./autoscale-troubleshoot.md) +* [Azure Monitor autoscale common metrics](autoscale-common-metrics.md) +* [Scale virtual machine scale sets](../../virtual-machine-scale-sets/tutorial-autoscale-powershell.md?toc=%2fazure%2fazure-monitor%2ftoc.json) +* [Autoscale using Resource Manager templates for virtual machine scale sets](../../virtual-machine-scale-sets/tutorial-autoscale-powershell.md?toc=%2fazure%2fazure-monitor%2ftoc.json) +* [Best practices for Azure Monitor autoscale](autoscale-best-practices.md) +* [Use autoscale actions to send email and webhook alert notifications](autoscale-webhook-email.md) +* [Autoscale REST API](/rest/api/monitor/autoscalesettings) +* [Troubleshooting virtual machine scale sets and autoscale](../../virtual-machine-scale-sets/virtual-machine-scale-sets-troubleshoot.md) +* [Troubleshooting Azure Monitor autoscale](./autoscale-troubleshoot.md) |
| azure-netapp-files | Azacsnap Cmd Ref Restore | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/azure-netapp-files/azacsnap-cmd-ref-restore.md | The `-c restore` command has the following options: ## Perform a test DR failover `azacsnap -c restore --restore snaptovol` -This command is like the "full" DR Failover command (`--restore restorevolume`), but rather than breaking the replication between the primary site and the disaster recovery site, a clone volume is created out of the disaster recovery volumes, allowing the restoration of the most recent snapshot in the DR site. Those cloned volumes are then usable by the customer to test Disaster Recovery without having to +This command is like the "full" DR Failover command (`--restore revertvolume`), but rather than breaking the replication between the primary site and the disaster recovery site, a clone volume is created out of the disaster recovery volumes, allowing the restoration of the most recent snapshot in the DR site. Those cloned volumes are then usable by the customer to test Disaster Recovery without having to execute a complete failover of their HANA environment that breaks the replication agreement between the primary site and the disaster recovery site. - Multiple different restore points can be tested in this way, |
| backup | Backup Rm Template Samples | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/backup/backup-rm-template-samples.md | Title: Azure Resource Manager and Bicep templates description: Azure Resource Manager and Bicep templates for use with Recovery Services vaults and Azure Backup features Previously updated : 06/10/2022 Last updated : 09/05/2022 -The following table includes a link to a repository of Azure Resource Manager and Bicep templates for use with Recovery Services vaults and Azure Backup features. To learn about the JSON or Bicep syntax and properties, see [Microsoft.RecoveryServices resource types](/azure/templates/microsoft.recoveryservices/allversions). +The following table includes a link to a repository of Azure Resource Manager and Bicep templates for use with Recovery Services vaults, Backup vaults, and Azure Backup features. To learn about the JSON or Bicep syntax and properties, see [Microsoft.RecoveryServices resource types](/azure/templates/microsoft.recoveryservices/allversions) and [Microsoft.DataProtection resource types](/azure/templates/microsoft.dataprotection/allversions). | Template | Description | ||| |**Recovery Services vault** | | | [Create a Recovery Services vault](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-vault-create)| Create a Recovery Services vault. The vault can be used for Azure Backup and Azure Site Recovery. |+| [Create Recovery Services vault with backup policies](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-create-vault-with-backup-policies) | Create a Recovery Services vault. You can optionally configure backup policies, system identity, backup storage type, Cross Region Restores, and enable diagnostics logs and a delete lock. | +| [Create Recovery Services vault and Enable Diagnostics](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-create-vault-enable-diagnostics) | Template creates a Recovery Services vault and enables diagnostics for Azure Backup. | |**Back up virtual machines**| | | [Back up Resource Manager VMs](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-backup-vms) | Use the existing Recovery Services vault and Backup policy to back up Resource Manager-virtual machines in the same resource group.| | [Back up IaaS VMs to Recovery Services vault](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-backup-classic-resource-manager-vms) | Template to back up classic and Resource Manager-virtual machines. | The following table includes a link to a repository of Azure Resource Manager an | [Deploy Windows Server VM with backup enabled](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-create-vm-and-configure-backup) | Template creates a Windows Server VM and Recovery Services vault with the default backup policy enabled.| |**Monitor Backup jobs** | | | [Use Azure Monitor logs with Azure Backup](https://github.com/Azure/azure-quickstart-templates/tree/master/demos/backup-oms-monitoring) | Template deploys Azure Monitor logs with Azure Backup, which allows you to monitor backup and restore jobs, backup alerts, and the Cloud storage used in your Recovery Services vaults.|+| [Set up notifications for backup alerts using Azure Monitor](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-create-alert-processing-rule) | Template to enable you to set up email notifications for your Recovery Services vaults using Azure Monitor. | |**Back up SQL Server in Azure VM** | | | [Back up SQL Server in Azure VM](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-vm-workload-backup) | Template creates a Recovery Services vault and Workload specific Backup Policy. It Registers the VM with Azure Backup service and Configures Protection on that VM. Currently, it only works for SQL Gallery images. |-|**Back up Azure file shares** | | -| [Back up Azure file shares](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-backup-file-share) | This template configures protection for an existing Azure file share by specifying appropriate details for the Recovery Services vault and backup policy. It optionally creates a new Recovery Services vault and backup policy, and registers the storage account containing the file share to the Recovery Services vault. | -| | | +|**Back up Azure File shares** | | +| [Back up Azure File shares](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-backup-file-share) (daily) | This template configures protection for an existing Azure file share by specifying appropriate details for the Recovery Services vault and backup policy. It optionally creates a new Recovery Services vault and backup policy, and registers the storage account containing the file share to the Recovery Services vault. | +| [Backup File share](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.recoveryservices/recovery-services-backup-file-share-hourly) (hourly) | This template configures hourly protection for an existing Azure File share by specifying appropriate details for the Recovery Services vault and backup policy. It optionally creates a new Recovery Services vault and backup policy, and registers the storage account containing the File share to the Recovery Services vault. | +| **Backup vault** | | +| [Creates Backup vault](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.dataprotection/backup-vault-basic) | Template creates a Backup Vault. The vault can be used for Azure Database for PostgreSQL backup, Azure Blobs backup, Azure Disk backup. | +| **Backup Azure Disk** | | +| [Create Disk and enable protection](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.dataprotection/backup-create-disk-enable-protection) | Template creates a disk and enables protection via Azure Backup. | +| **Backup Azure Blobs** | | +| [Create storage account and enables blobs protection](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.dataprotection/backup-create-storage-account-enable-protection) | Template creates storage account and enables blobs protection via Azure Backup. |
| data-factory | Parameterize Linked Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/data-factory/parameterize-linked-services.md | All the linked service types are supported for parameterization. - Azure SQL Managed Instance - Azure Synapse Analytics - Azure Table Storage+- DB2 - File System - FTP - Generic HTTP |
| expressroute | Expressroute Howto Routing Portal Resource Manager | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/expressroute/expressroute-howto-routing-portal-resource-manager.md | You can remove your Microsoft peering configuration by right-clicking the peerin You can remove your private peering configuration by right-clicking the peering and selecting **Delete** as shown in the following image: > [!WARNING]-> You must ensure that all virtual networks and ExpressRoute Global Reach connections are removed before running this operation. +> You must ensure that all virtual network connections and ExpressRoute Global Reach connections are removed before running this operation. > :::image type="content" source="./media/expressroute-howto-routing-portal-resource-manager/delete-private-peering.png" alt-text="Screenshot showing how to delete private peering."::: |
| frontdoor | Create Front Door Cli | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/frontdoor/create-front-door-cli.md | Run [az appservice plan create](/cli/azure/appservice/plan#az-appservice-plan-cr ```azurecli-interactive az appservice plan create \ --name myAppServicePlanCentralUS \- --resource-group myRGFD + --resource-group myRGFD \ + --location centralus ``` ```azurecli-interactive az appservice plan create \ --name myAppServicePlanEastUS \- --resource-group myRGFD + --resource-group myRGFD \ + --location eastus ``` ### Create web apps -Run [az webapp create](/cli/azure/webapp#az-webapp-create&preserve-view=true) to create a web app in each of the app service plans in the previous step. Web app names have to be globally unique. +Run [az webapp create](/cli/azure/webapp#az-webapp-create) to create a web app in each of the app service plans in the previous step. Web app names have to be globally unique. ```azurecli-interactive az webapp create \ |
| hdinsight | Manage Clusters Runbooks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/hdinsight/manage-clusters-runbooks.md | If you donΓÇÖt have an Azure subscription, create a [free account](https://azure ## Prerequisites -* An existing [Azure Automation account](../automation/quickstarts/create-account-portal.md). +* An existing [Azure Automation account](/azure/automation/quickstarts/create-azure-automation-account-portal). * An existing [Azure Storage account](../storage/common/storage-account-create.md), which will be used as cluster storage. ## Install HDInsight modules When no longer needed, delete the Azure Automation Account that was created to a ## Next steps > [!div class="nextstepaction"]-> [Manage Apache Hadoop clusters in HDInsight by using Azure PowerShell](hdinsight-administer-use-powershell.md) +> [Manage Apache Hadoop clusters in HDInsight by using Azure PowerShell](hdinsight-administer-use-powershell.md) |
| lab-services | Reliability In Azure Lab Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/lab-services/reliability-in-azure-lab-services.md | Last updated 08/18/2022 # What is reliability in Azure Lab Services? -This article describes reliability support in Azure Lab Services, and covers regional resiliency with availability zones. For a more detailed overview of reliability in Azure, see [Azure resiliency](/azure/availability-zones/overview.md). +This article describes reliability support in Azure Lab Services, and covers regional resiliency with availability zones. For a more detailed overview of reliability in Azure, see [Azure resiliency](/azure/availability-zones/overview). ## Availability zone support -Azure availability zones are at least three physically separate groups of datacenters within each Azure region. Datacenters within each zone are equipped with independent power, cooling, and networking infrastructure. In the case of a local zone failure, availability zones allow the services to fail over to the other availability zones to provide continuity in service with minimal interruption. Failures can range from software and hardware failures to events such as earthquakes, floods, and fires. Tolerance to failures is achieved with redundancy and logical isolation of Azure services. For more detailed information on availability zones in Azure, see [Regions and availability zones](/azure/availability-zones/az-overview.md). +Azure availability zones are at least three physically separate groups of datacenters within each Azure region. Datacenters within each zone are equipped with independent power, cooling, and networking infrastructure. In the case of a local zone failure, availability zones allow the services to fail over to the other availability zones to provide continuity in service with minimal interruption. Failures can range from software and hardware failures to events such as earthquakes, floods, and fires. Tolerance to failures is achieved with redundancy and logical isolation of Azure services. For more detailed information on availability zones in Azure, see [Regions and availability zones](/azure/availability-zones/az-overview). Azure availability zones-enabled services are designed to provide the right level of resiliency and flexibility. They can be configured in two ways. They can be either zone redundant, with automatic replication across zones, or zonal, with instances pinned to a specific zone. You can also combine these approaches. For more information on zonal vs. zone-redundant architecture, see [Build solutions with availability zones](/azure/architecture/high-availability/building-solutions-for-high-availability). Azure Lab Services does not provide any service-specific signals about an outage ## Next steps > [!div class="nextstepaction"]-> [Resiliency in Azure](/azure/availability-zones/overview.md) +> [Resiliency in Azure](/azure/availability-zones/overview) |
| private-5g-core | Create A Site | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-5g-core/create-a-site.md | In this step, you'll create the mobile network site resource representing the ph 1. In the **Attached data networks** section, select **Add data network**. Use the information you collected in [Collect data network values](collect-required-information-for-a-site.md#collect-data-network-values) to fill out the fields. Note the following: - **N6 interface name** (if this site will support 5G UEs) or **SGi interface name** (if this site will support 4G UEs) must match the corresponding virtual network name on port 6 on your Azure Stack Edge Pro device.- - If you decided not to configure a DNS server, untick the **Specify DNS addresses for UEs?** checkbox. + - If you decided not to configure a DNS server, clear the **Specify DNS addresses for UEs?** checkbox. :::image type="content" source="media/create-a-site/create-site-add-data-network.png" alt-text="Screenshot of the Azure portal showing the Add data network screen."::: |
| private-5g-core | Manage Existing Sims | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-5g-core/manage-existing-sims.md | To assign a SIM policy to one or more SIMs: 1. In the resource menu, select **SIMs**. 1. You'll see a list of provisioned SIMs in the private mobile network. For each SIM policy you want to assign to one or more SIMs, do the following: - 1. Tick the checkbox next to the name of each SIM to which you want to assign the SIM policy. + 1. Select the checkbox next to the name of each SIM to which you want to assign the SIM policy. 1. Select **Assign SIM policy**. 1. In **Assign SIM policy** on the right, select your chosen SIM policy from the **SIM policy** drop-down menu. 1. Select **Assign SIM policy**. Deleting a SIM will remove it from your private mobile network. 1. Search for and select the **Mobile Network** resource representing the private mobile network containing your SIMs. 1. In the resource menu, select **SIMs**.-1. Tick the checkbox next to each SIM you want to delete. +1. Select the checkbox next to each SIM you want to delete. 1. Select **Delete**. 1. Select **Delete** to confirm you want to delete the SIM(s). |
| private-5g-core | Manage Sim Groups | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-5g-core/manage-sim-groups.md | To create a new SIM group: You can delete SIM groups through the Azure portal. 1. Navigate to the list of SIM groups in your private mobile network, as described in [View existing SIM groups](#view-existing-sim-groups).-1. Check the **Number of SIMs** column for the SIM group you want to delete. If there are any SIMs in the SIM group, you'll need to delete the SIMs first. To delete the SIMs: - - 1. Select the relevant SIM group. - 1. Tick the checkboxes next to all of the SIMs in the SIM group. - 1. Select **Delete** from the **Command** bar. - 1. In the pop-up that appears, select **Delete** to confirm you want to delete the SIMs. - -1. Once you've confirmed the SIM group is empty, tick the checkbox next to it in the list of SIM groups. +1. Make sure any SIMs in the SIM group are no longer needed. When you delete the SIM group, all SIMs that it contains will be deleted. +1. Select the checkbox next to the SIM group you want to delete. 1. Select **Delete** from the **Command** bar. 1. In the pop-up that appears, select **Delete** to confirm you want to delete the SIM group. ## Next steps-Learn more about how to manage the SIMs in your SIM groups. -- [Manage existing SIMs - Azure portal](manage-existing-sims.md) +Learn more about how to manage the SIMs in your SIM groups. ++- [Manage existing SIMs - Azure portal](manage-existing-sims.md) |
| private-5g-core | Tutorial Create Example Set Of Policy Control Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/private-5g-core/tutorial-create-example-set-of-policy-control-configuration.md | To create the service: |Field |Value | ||| |**Template name** |`icmp_and_udp_traffic` |- |**Protocols** | Tick both the **UDP** and **ICMP** checkboxes. | + |**Protocols** | Select both the **UDP** and **ICMP** checkboxes. | |**Direction** | Select **Bidirectional**. | |**Remote IPs** | `any` | |**Ports** | Leave blank. | In this step, we will provision two SIMs and assign a SIM policy to each one. Th :::image type="content" source="media/tutorial-create-example-set-of-policy-control-configuration/sims-list.png" alt-text="Screenshot of the Azure portal. It shows a SIM group containing two SIMs." lightbox="media/tutorial-create-example-set-of-policy-control-configuration/sims-list.png"::: -1. Tick the checkbox next to **SIM1**. +1. Select the checkbox next to **SIM1**. 1. In the **Command** bar, select **Assign SIM policy**. :::image type="content" source="media/tutorial-create-example-set-of-policy-control-configuration/assign-sim-policy-from-sims-list.png" alt-text="Screenshot of the Azure portal showing a list of SIMs. The SIM1 resource and the Assign SIM policy option are highlighted."::: In this step, we will provision two SIMs and assign a SIM policy to each one. Th :::image type="content" source="media/tutorial-create-example-set-of-policy-control-configuration/sim-with-sim-policy.png" alt-text="Screenshot of the Azure portal showing a SIM resource. The SIM policy field is highlighted in the Management section." lightbox="media/tutorial-create-example-set-of-policy-control-configuration/sim-with-sim-policy-enlarged.png"::: 1. In the **SIM group** field under **Essentials**, select **SIMGroup1** to return to the SIM group. -1. Tick the checkbox next to **SIM2**. +1. Select the checkbox next to **SIM2**. 1. In the **Command** bar, select **Assign SIM policy**. 1. Under **Assign SIM policy** on the right, set the **SIM policy** field to **sim-policy-2**. 1. Select the **Assign SIM policy** button. You can now delete each of the resources we've created during this tutorial. 1. Search for and select the Mobile Network resource representing your private mobile network. 1. In the **Resource** menu, select **SIM groups**.-1. Select **SIMGroup1**. -1. Tick the checkboxes next to **SIM1** and **SIM2**, and then select **Delete** from the **Command** bar. -1. Select **Delete** to confirm your choice. -1. Once the SIMs have been deleted, select the name of your private mobile network from the breadcrumbs in the top left corner to return to the list of SIM groups. -1. Tick the checkbox next to **SIMGroup1**, and then select **Delete** from the **Command** bar. +1. Select the checkbox next to **SIMGroup1**, and then select **Delete** from the **Command** bar. 1. Select **Delete** to confirm your choice. 1. Once the SIM group has been deleted, select **SIM policies** from the **Resource** menu.-1. Tick the checkboxes next to **sim-policy-1** and **sim-policy-2**, and then select **Delete** from the **Command** bar. +1. Select the checkboxes next to **sim-policy-1** and **sim-policy-2**, and then select **Delete** from the **Command** bar. 1. Select **Delete** to confirm your choice. 1. Once the SIM policies have been deleted, select **Services** from the **Resource** menu.-1. Tick the checkboxes next to **service_unrestricted_udp_and_icmp**, **service_blocking_udp_from_specific_sources**, and **service_traffic_limits**, and then select **Delete** from the command bar. +1. Select the checkboxes next to **service_unrestricted_udp_and_icmp**, **service_blocking_udp_from_specific_sources**, and **service_traffic_limits**, and then select **Delete** from the command bar. 1. Select **Delete** to confirm your choice. ## Next steps |
| sentinel | Add Entity To Threat Intelligence | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/add-entity-to-threat-intelligence.md | + + Title: Add entities to threat intelligence in Microsoft Sentinel +description: This article shows you, if you discover a malicious entity in an incident investigation, how to add the entity to your threat intelligence indicator lists in Microsoft Sentinel. ++ Last updated : 08/25/2022++++# Add entities to threat intelligence in Microsoft Sentinel ++When investigating an incident, you examine entities and their context as an important part of understanding the scope and nature of the incident. In the course of the investigation, you may discover a domain name, URL, file, or IP address in the incident that should be labeled and tracked as an indicator of compromise (IOC), a threat indicator. ++For example, you may discover an IP address performing port scans across your network, or functioning as a command and control node, sending and/or receiving transmissions from large numbers of nodes in your network. ++Microsoft Sentinel allows you to flag these types of entities as malicious, right from within the investigation graph, and add it to your threat indicator lists. You'll then be able to view the added indicators both in Logs and in the Threat Intelligence blade, and use them across your Microsoft Sentinel workspace. ++> [!IMPORTANT] +> Adding entities as TI indicators is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. ++## Add an entity to your indicators list ++The [investigation graph](investigate-cases.md) is a visual, intuitive tool that presents connections and patterns and enables your analysts to ask the right questions and follow leads. You can use it to add entities to your threat intelligence indicator lists, making them available across your workspace. ++1. From the Microsoft Sentinel navigation menu, select **Incidents**. ++1. Select an incident to investigate. In the incident details panel, select the **Actions** button and choose **Investigate** from the pop-up menu. This will open the investigation graph. ++ :::image type="content" source="media/add-entity-to-threat-intelligence/select-incident-to-investigate.png" alt-text="Screenshot of selecting incident from queue to investigate."::: ++1. Select the entity from the graph that you want to add as a threat indicator. A side panel will open on the right. Select **Add to TI**. ++ Only the following types of entities can be added as threat indicators: + - Domain name + - IP address (IPv4 and IPv6) + - URL + - File (hash) ++ :::image type="content" source="media/add-entity-to-threat-intelligence/add-entity-to-ti.png" alt-text="Screenshot of adding entity to threat intelligence."::: ++1. The **New indicator** side panel will open. The following fields will be populated automatically: ++ - **Type** + - The type of indicator represented by the entity you're adding. + Drop-down with possible values: *ipv4-addr*, *ipv6-addr*, *URL*, *file*, *domain-name* + - Required; automatically populated based on the **entity type**. ++ - **Value** + - The name of this field changes dynamically to the selected indicator type. + - The value of the indicator itself. + - Required; automatically populated by the **entity value**. ++ - **Tags** + - Free-text tags you can add to the indicator. + - Optional; automatically populated by the **incident ID**. You can add others. + + - **Name** + - Name of the indicator - this is what will be displayed in your list of indicators. + - Optional; automatically populated by the **incident name.** + + - **Created by** + - Creator of the indicator. + - Optional; automatically-populated by the user logged into Microsoft Sentinel. ++ Fill in the remaining fields accordingly. ++ - **Threat type** + - The threat type represented by the indicator. + - Optional; free text. ++ - **Description** + - Description of the indicator. + - Optional; free text. ++ - **Revoked** + - Revoked status of the indicator. Mark checkbox to revoke the indicator, clear checkbox to make it active. + - Optional; boolean. ++ - **Confidence** + - Score reflecting confidence in the correctness of the data, by percent. + - Optional; integer, 1-100 ++ - **Kill chain** + - Phases in the [*Lockheed Martin Cyber Kill Chain*](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html#OVERVIEW) to which the indicator corresponds. + - Optional; free text ++ - **Valid from** + - The time from which this indicator is considered valid. + - Required; date/time ++ - **Valid until** + - The time at which this indicator should no longer be considered valid. + - Optional; date/time ++ :::image type="content" source="media/add-entity-to-threat-intelligence/new-indicator-panel.png" alt-text="Screenshot of entering information in new threat indicator panel."::: ++1. When all the fields are filled in to your satisfaction, select **Apply**. You'll see a confirmation message in the upper-right-hand corner that your indicator was created. ++1. The entity will be added as a threat indicator in your workspace. You can find it [in the list of indicators in the **Threat intelligence** page](work-with-threat-indicators.md#find-and-view-your-indicators-in-the-threat-intelligence-page), and also [in the *ThreatIntelligenceIndicators* table in **Logs**](work-with-threat-indicators.md#find-and-view-your-indicators-in-logs). ++## Next steps ++In this article, you learned how to add entities to your threat indicator lists. For more information, see: ++- [Investigate incidents with Microsoft Sentinel](investigate-cases.md) +- [Understand threat intelligence in Microsoft Sentinel](understand-threat-intelligence.md) +- [Work with threat indicators in Microsoft Sentinel](work-with-threat-indicators.md) |
| sentinel | Normalization Parsers List | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/normalization-parsers-list.md | Microsoft Sentinel provides the following out-of-the-box, product-specific Netwo | **Azure Firewall logs** | |`_Im_NetworkSession_AzureFirewallVxx`| | **Azure Monitor VMConnection** | Collected as part of the Azure Monitor [VM Insights solution](../azure-monitor/vm/vminsights-overview.md). | `_Im_NetworkSession_VMConnectionVxx` | | **Azure Network Security Groups (NSG) logs** | Collected as part of the Azure Monitor [VM Insights solution](../azure-monitor/vm/vminsights-overview.md). | `_Im_NetworkSession_AzureNSGVxx` |+| **Checkpoint Firewall-1** | Collected using CEF. | `__Im_NetworkSession_CheckPointFirewallVxx` | +| **Cisco Meraki** | Collected using the Cisco Meraki API connector. | `_Im_NetworkSession_CiscoMerakiVxx` | +| **Corelight Zeek** | Collected using the Corelight Zeek connector. | `_im_NetworkSession_CorelightZeekVxx` | | **Fortigate FortiOS** | IP connection logs collected using Syslog. | `_Im_NetworkSession_FortinetFortiGateVxx` | | **Microsoft 365 Defender for Endpoint** | | `_Im_NetworkSession_Microsoft365DefenderVxx`| | **Microsoft Defender for IoT - Endpoint** | | `_Im_NetworkSession_MD4IoTVxx` | Microsoft Sentinel provides the following out-of-the-box, product-specific Netwo | **Sysmon for Linux** (event 3) | Collected using the Log Analytics Agent<br> or the Azure Monitor Agent. |`_Im_NetworkSession_LinuxSysmonVxx` | | **Vectra AI** | | `_Im_NetworkSession_VectraIAVxx` | | **Windows Firewall logs** | Collected as Windows events using the Log Analytics Agent (Event table) or Azure Monitor Agent (WindowsEvent table). Supports Windows events 5150 to 5159. | `_Im_NetworkSession_MicrosoftWindowsEventFirewallVxx`|+| **Watchguard FirewareOW** | Collected using Syslog. | `_Im_NetworkSession_WatchGuardFirewareOSVxx` | | **Zscaler ZIA firewall logs** | Collected using CEF. | `_Im_NetworkSessionZscalerZIAVxx` | Deploy the workspace deployed parsers from the [Microsoft Sentinel GitHub repository](https://aka.ms/AsimNetworkSession). |
| sentinel | Whats New Archive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/whats-new-archive.md | description: A description of what's new and changed in Azure Sentinel from six Previously updated : 11/22/2021 Last updated : 08/31/2022 |
| sentinel | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/sentinel/whats-new.md | description: This article describes new features in Microsoft Sentinel from the Previously updated : 08/08/2022 Last updated : 08/31/2022 If you're looking for items older than six months, you'll find them in the [Arch > > You can also contribute! Join us in the [Microsoft Sentinel Threat Hunters GitHub community](https://github.com/Azure/Azure-Sentinel/wiki). +## September 2022 ++- [Add entities to threat intelligence (Preview)](#add-entities-to-threat-intelligence-preview) ++### Add entities to threat intelligence (Preview) ++When investigating an incident, you examine entities and their context as an important part of understanding the scope and nature of the incident. In the course of the investigation, you may discover an entity in the incident that should be labeled and tracked as an indicator of compromise (IOC), a threat indicator. ++Microsoft Sentinel allows you to flag the entity as malicious, right from within the investigation graph. You'll then be able to view this indicator both in Logs and in the Threat Intelligence blade in Sentinel. ++Learn how to [add an entity to your threat intelligence](add-entity-to-threat-intelligence.md). + ## August 2022 - [Heads up: Microsoft 365 Defender now integrates Azure Active Directory Identity Protection (AADIP)](#heads-up-microsoft-365-defender-now-integrates-azure-active-directory-identity-protection-aadip) |
| storage | Partner Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/storage/solution-integration/validated-partners/container-solutions/partner-overview.md | This article highlights Microsoft partner solutions that enable automation, data |  |**Kasten**<br>Kasten by Veeam provides a solution for Kubernetes backup and disaster recovery. Kasten helps enterprises overcome Day 2 data management challenges to confidently run applications on Kubernetes.<br><br>The Kasten K10 data management software platform provides enterprise operations teams a scalable and secure system for BCDR and mobility of Kubernetes applications.|[Partner page](https://docs.kasten.io/latest/install/azure/azure.html)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/veeam.kasten_k10_by_veeam_byol?tab=Overview)| |  |**Portworx**<br>Portworx by Pure Storage is the Kubernetes Data Services Platform enterprises trust to run mission-critical applications in containers in production.<br><br>Portworx provides a fully integrated solution for persistent storage, data protection, disaster recovery, data security, cross-cloud and data migrations, and automated capacity management for applications running on Kubernetes.|[Partner page](https://portworx.com/azure/)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/portworx.portworx_enterprise?tab=overview)| |  |**Robin.io**<br>Robin.io provides an application and data management platform that enables enterprises and 5G service providers to deliver complex application pipelines as a service.<br><br>Robin Cloud Native Storage (CNS) brings advanced data management capabilities to Azure Kubernetes Service. Robin CNS seamlessly integrates with Azure Disk Storage to simplify management of stateful applications. Developers and DevOps teams can deploy Robin CNS as a standard Kubernetes operator on AKS. Robin Cloud Native Storage helps simplify data management operations such as BCDR and cloning of entire applications. |[Partner page](https://robin.io/robin-cloud-native-storage-for-microsoft-aks/)|-|  |**NetApp**<br>NetApp is a global cloud-led, data-centric software company that empowers organizations to lead with data in the age of accelerated digital transformation.<br><br>NetApp Astra Control Service is a fully managed service that makes it easier for customers to manage, protect, and move their data-rich containerized workloads running on Kubernetes within and across public clouds and on-premises. Astra Control provides persistent container storage with Azure NetApp Files offering advanced application-aware data management functionality (like snapshot-revert, backup-restore, activity log, and active cloning) for data protection, disaster recovery, data audit, and migration use-cases for your modern apps. |[Partner page](https://cloud.netapp.com/astra)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/netapp.astra-info?tab=Overview)| +|  |**NetApp**<br>NetApp is a global cloud-led, data-centric software company that empowers organizations to lead with data in the age of accelerated digital transformation.<br><br>NetApp Astra Control Service is a fully managed service that makes it easier for customers to manage, protect, and move their data-rich containerized workloads running on Kubernetes within and across public clouds and on-premises. Astra Control provides persistent container storage with Azure NetApp Files offering advanced application-aware data management functionality (like snapshot-revert, backup-restore, activity log, and active cloning) for data protection, disaster recovery, data audit, and migration use-cases for your modern apps. |[Partner page](https://cloud.netapp.com/astra)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/netapp.netapp-astra-acs)| |  |**Rackware**<br>RackWare provides an intelligent highly automated Hybrid Cloud Management Platform that extends across physical and virtual environments.<br><br>RackWare SWIFT is a converged disaster recovery, backup and migration solution for Kubernetes and OpenShift. It is a cross-platform, cross-cloud and cross-version solution that enables you to move and protect your stateful Kubernetes applications from any on-premises or cloud environment to Azure Kubernetes Service (AKS) and Azure Storage.|[Partner page](https://www.rackwareinc.com/rackware-swift-microsoft-azure)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps?search=rackware%20swift&page=1&filters=virtual-machine-images)| |  |**Ondat**<br>Ondat, formerly StorageOS, provides an agnostic platform to run any data service anywhere, while ensuring industry-leading levels of application performance, availability and security.<br><br>Ondat cloud native storage solution delivers persistent container storage for your stateful applications in production. Fast, scalable, software-based block storage, Ondat delivers high availability, rapid application failover, replication, encryption of data in-transit & at-rest, data reduction with access controls and native Kubernetes integration.|[Partner page](https://www.ondat.io/platform/how-it-works)<br>[Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/storageosinc.storageos_sds?tab=Overview)| |
| stream-analytics | Postgresql Database Output | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/postgresql-database-output.md | Title: Azure Database for PostgreSQL output from Azure Stream Analytics (Preview) + Title: Azure Database for PostgreSQL output from Azure Stream Analytics description: This article describes Azure Database for PostgreSQL as output for Azure Stream Analytics. -# Azure Database for PostgreSQL output from Azure Stream Analytics (Preview) +# Azure Database for PostgreSQL output from Azure Stream Analytics You can use [Azure Database for PostgreSQL](https://azure.microsoft.com/services/postgresql/) as an output for data that is relational in nature or for applications that depend on the content being hosted in a relational database. Azure Stream Analytics jobs write to an existing table in PostgreSQL Database. The table schema must exactly match the fields and their types in your job's output. The following table lists the property names and their description for creating Partitioning needs to enabled and is based on the PARTITION BY clause in the query. When the Inherit Partitioning option is enabled, it follows the input partitioning for [fully parallelizable queries](stream-analytics-scale-jobs.md). -## Limitation -Test connection functionality to Azure Database for PostgreSQL is not supported at the time of preview. ## Next steps |
| stream-analytics | Private Endpoints | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/private-endpoints.md | Last updated 05/20/2021 You can connect your Azure Stream Analytics jobs running on a cluster to input and output resources that are behind a firewall or an Azure Virtual Network (VNet). First, you create a managed private endpoint for a resource, such as Azure Event Hub or Azure SQL Database, in your Stream Analytics cluster. Then, approve the private endpoint connection from your input or output. -Once you approve the connection, any job running in your Stream Analytics cluster can access the resource through the private endpoint. This article shows you how to create and delete private endpoints in a Stream Analytics cluster. You can create private endpoints for Azure SQL Database, Azure Cosmos DB, Azure Storage, Azure Data Lake Storage Gen2, Azure Event Hub, Azure IoT Hubs and Azure Service Bus. +Once you approve the connection, any job running in your Stream Analytics cluster can access the resource through the private endpoint. This article shows you how to create and delete private endpoints in a Stream Analytics cluster. You can create private endpoints for: +* Azure SQL Database +* Azure Cosmos DB +* Azure Blob Storage +* Azure Data Lake Storage Gen2 +* Azure Event Hub +* Azure IoT Hubs +* Azure Service Bus +* Azure Synapse Analytics - Dedicated SQL pool ## Create managed private endpoint in Stream Analytics cluster In this section, you learn how to create a private endpoint in a Stream Analytic  +## Limitation +When configuring managed private endpoints to Azure Synapse Analytics (Dedicated SQL pool), you must add your Synapse SQL output to your job using **Provide SQL Database settings manually** mode. Provide the full Dedicated Synapse SQL pool URL such as **{WorkspaceName}.sql.azuresynapse.net** for the **Server name** field. + ## Next steps You now have an overview of how to manage private endpoints in an Azure Stream Analytics cluster. Next, you can learn how to scale your clusters and run jobs in your cluster: |
| stream-analytics | Service Bus Managed Identity | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/stream-analytics/service-bus-managed-identity.md | Last updated 08/10/2022 -# Use managed identities to access Service Bus from an Azure Stream Analytics job (preview) +# Use managed identities to access Service Bus from an Azure Stream Analytics job Azure Stream Analytics supports managed identity authentication for both Azure Service Bus output. Managed identities for Azure resources is a cross-Azure feature that enables you to create a secure identity associated with the deployment under which your application code runs. You can then associate that identity with access-control roles that grant custom permissions for accessing specific Azure resources that your application needs. Now that your managed identity is configured, you're ready to add the Service 1. Fill out the rest of the properties and select **Save**. -### Limitation -Test connection on the azure portal is not expected to work when authentication mode for Service Bus is set to user-assigned or system-assigned managed identity. - ## Next steps * [Understand outputs from Azure Stream Analytics](stream-analytics-define-outputs.md) |
| update-center | Manage Vms Programmatically | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/update-center/manage-vms-programmatically.md | The following table describes the elements of the request body: | `maximumDuration` | Maximum amount of time that the operation runs. It must be an ISO 8601-compliant duration string such as `PT4H` (4 hours). | | `rebootSetting` | Flag to state if machine should be rebooted if Guest OS update installation requires it for completion. Acceptable values are: `IfRequired, NeverReboot, AlwaysReboot`. | | `windowsParameters` | Parameter options for Guest OS update on Azure VMs running a supported Microsoft Windows Server operating system. |-| `windowsParameters - classificationsToInclude` | List of categories/classifications to be used for selecting the updates to be installed on the machine. Acceptable values are: `Critical, Security, UpdateRollUp, FeaturePack, ServicePack, Definition, Tools, Update` | +| `windowsParameters - classificationsToInclude` | List of categories/classifications to be used for selecting the updates to be installed on the machine. Acceptable values are: `Critical, Security, UpdateRollUp, FeaturePack, ServicePack, Definition, Tools, Updates` | | `windowsParameters - kbNumbersToInclude` | List of Windows Update KB Ids that should be installed. All updates belonging to the classifications provided in `classificationsToInclude` list will be installed. `kbNumbersToInclude` is an optional list of specific KBs to be installed in addition to the classifications. For example: `1234` | | `windowsParameters - kbNumbersToExclude` | List of Windows Update KB Ids that should **not** be installed. This parameter overrides `windowsParameters - classificationsToInclude`, meaning a Windows Update KB Id specified here will not be installed even if it belongs to the classification provided under `classificationsToInclude` parameter. | | `linuxParameters` | Parameter options for Guest OS update on Azure VMs running a supported Linux server operating system. |-| `linuxParameters - classificationsToInclude` | List of categories/classifications to be used for selecting the updates to be installed on the machine. Acceptable values are: `Critical, Security, Others` | +| `linuxParameters - classificationsToInclude` | List of categories/classifications to be used for selecting the updates to be installed on the machine. Acceptable values are: `Critical, Security, Other` | | `linuxParameters - packageNameMasksToInclude` | List of Linux packages that should be installed. All updates belonging to the classifications provided in `classificationsToInclude` list will be installed. `packageNameMasksToInclude` is an optional list of package names to be installed in addition to the classifications. For example: `mysql, libc=1.0.1.1, kernel*` | | `linuxParameters - packageNameMasksToExclude` | List of updates that should **not** be installed. This parameter overrides `linuxParameters - packageNameMasksToExclude`, meaning a package specified here will not be installed even if it belongs to the classification provided under `classificationsToInclude` parameter. | |
| virtual-machines | Ephemeral Os Disks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/ephemeral-os-disks.md | The image OS diskΓÇÖs size should be less than or equal to the temp/cache size o For example, if you want to opt for **OS cache placement**: Standard Windows Server images from the marketplace are about 127 GiB, which means that you need a VM size that has a cache equal to or larger than 127 GiB. The Standard_DS3_v2 has a cache size of 127 GiB, which is large enough. In this case, the Standard_DS3_v2 is the smallest size in the DSv2 series that you can use with this image. If you want to opt for **Temp disk placement**: Standard Ubuntu server image from marketplace is about 30 GiB. To enable Ephemeral OS disk on temp, the temp disk size must be equal to or larger than 30 GiB. Standard_B4ms has a temp size of 32 GiB, which can fit the 30 GiB OS disk. Upon creation of the VM, the temp disk space would be 2 GiB. -> [!Important] +> [!IMPORTANT] > If opting for temp disk placement the Final Temp disk size = (Initial temp disk size - OS image size). -In the case of **Temp disk placement** as Ephemeral OS disk is placed on temp disk it will share the IOPS with temp disk as per the VM size chosen by you. +In the case of **Temp disk placement**, as Ephemeral OS disk is placed on temp disk it will share the IOPS with temp disk as per the VM size chosen by you. Basic Linux and Windows Server images in the Marketplace that are denoted by `[smallsize]` tend to be around 30 GiB and can use most of the available VM sizes. Ephemeral disks also require that the VM size supports **Premium storage**. The sizes usually (but not always) have an `s` in the name, like DSv2 and EsV3. For more information, see [Azure VM sizes](sizes.md) for details around which sizes support Premium storage. For example, If you try to create a Trusted launch Ephemeral OS disk VM using OS This is because the temp storage for [Standard_DS4_v2](dv2-dsv2-series.md) is 56 GiB, and 1 GiB is reserved for VMGS when using trusted launch. For the same example above, if you create a standard Ephemeral OS disk VM you would not get any errors and it would be a successful operation. -> [!Important] +> [!IMPORTANT] > > While using ephemeral disks for Trusted Launch VMs, keys and secrets generated or sealed by the vTPM after VM creation may not be persisted for operations like reimaging and platform events like service healing. > For more information on [how to deploy a trusted launch VM](trusted-launch-porta AMD-based Confidential VMs cater to high security and confidentiality requirements of customers. These VMs provide a strong, hardware-enforced boundary to help meet your security needs. There are limitations to use Confidential VMs. Check the [region](../confidential-computing/confidential-vm-overview.md#regions), [size](../confidential-computing/confidential-vm-overview.md#size-support) and [OS supported](../confidential-computing/confidential-vm-overview.md#os-support) limitations for confidential VMs. Virtual machine guest state (VMGS) blob contains the security information of the confidential VM. Confidential VMs using Ephemeral OS disks by default **1 GiB** from the **OS cache** or **temp storage** based on the chosen placement option is reserved for VMGS.The lifecycle of the VMGS blob is tied to that of the OS Disk.-> [!Important] +> [!IMPORTANT] > > When choosing a confidential VM with full OS disk encryption before VM deployment that uses a customer-managed key (CMK). [Updating a CMK key version](../storage/common/customer-managed-keys-overview.md#update-the-key-version) or [key rotation](../key-vault/keys/how-to-configure-key-rotation.md) is not supported with Ephemeral OS disk. Confidential VMs using Ephemeral OS disks need to be deleted before updating or rotating the keys and can be re-created subsequently. > For more information on [confidential VM](../confidential-computing/confidential-vm-overview.md)++## Customer Managed key (preview) +You can choose to use customer managed keys or platform managed keys when you enable end-to-end encryption for VMs using Ephemeral OS disk. Currently this option is available only via [PowerShell](./windows/disks-enable-customer-managed-keys-powershell.md), [CLI](./linux/disks-enable-customer-managed-keys-cli.md) and SDK in all regions. ++> [!IMPORTANT] +> +> [Updating a CMK key version](../storage/common/customer-managed-keys-overview.md#update-the-key-version) or [key rotation](../key-vault/keys/how-to-configure-key-rotation.md) of customer managed key is not supported with Ephemeral OS disk. VMs using Ephemeral OS disks need to be deleted before updating or rotating the keys and can be re-created subsequently. +> +For more information on [Encryption at host](./disk-encryption.md) ## Next steps-Create a VM with ephemeral OS disk using [Azure Portal/CLI/Powershell/ARM template](ephemeral-os-disks-deploy.md). +Create a VM with ephemeral OS disk using [Azure Portal/CLI/PowerShell/ARM template](ephemeral-os-disks-deploy.md). Check out the [frequently asked questions on ephemeral os disk](ephemeral-os-disks-faq.md). |
| virtual-machines | Automation Configure Devops | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/automation-configure-devops.md | description: Configure your Azure DevOps Services for the SAP Deployment Automat Previously updated : 12/16/2021 Last updated : 08/30/2022 Push the changes back to the repository by selecting the source control icon and ## Set up the web app -The automation framework optionally provisions a web app as a part of the control plane to assist with the deployment of SAP workload zones and systems. If you would like to use the web app, you must first create an app registration for authentication purposes. Open the Azure Cloud Shell and execute the following commands: +The automation framework optionally provisions a web app as a part of the control plane to assist with the SAP workload zone and system configuration files. If you would like to use the web app, you must first create an app registration for authentication purposes. Open the Azure Cloud Shell and execute the following commands: # [Linux](#tab/linux) Replace MGMT with your environment as necessary. az ad app credential reset --id $TF_VAR_app_registration_app_id --append --query rm ./manifest.json ``` -Save the app registration ID and password values for later. ++Save the app registration ID and password values for later use. ## Create Azure Pipelines Create a new variable group 'SDAF-MGMT' for the control plane environment using | FENCING_SPN_TENANT | Enter the service principal tenant ID for the fencing agent. | Required for highly available deployments. | | `PAT` | `<Personal Access Token>` | Use the Personal Token defined in the previous | | `POOL` | `<Agent Pool name>` | Use the Agent pool defined in the previous |-| TF_VAR_app_registration_app_id | App registration application ID | Required if deploying the web app | -| TF_VAR_webapp_client_secret | App registration password | Required if deploying the web app | +| APP_REGISTRATION_APP_ID | App registration application ID | Required if deploying the web app | +| WEB_APP_CLIENT_SECRET | App registration password | Required if deploying the web app | Save the variables. > [!NOTE] > Remember to assign permissions for all pipelines using _Pipeline permissions_. >-> For use with the web app, assign the administrator role to the build service using _Security_. +> When using the web app, ensure that the Build Service has at least Contribute permissions. > > You can use the clone functionality to create the next environment variable group. |
| virtual-machines | Automation Configure Workload Zone | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/automation-configure-workload-zone.md | -An [SAP application](automation-deployment-framework.md#sap-concepts) typically has multiple development tiers. For example, you might have development, quality assurance, and production tiers. The [SAP deployment automation framework on Azure](automation-deployment-framework.md) refers to these tiers as [workload zones](automation-deployment-framework.md#deployment-components). +An [SAP application](automation-deployment-framework.md#sap-concepts) typically has multiple development tiers. For example, you might have development, quality assurance, and production tiers. The [SAP deployment automation framework on Azure](automation-deployment-framework.md) refers to these tiers as [workload zones](automation-deployment-framework.md#deployment-components). See the following diagram for an example of a workload zone with two SAP systems. ++ ## Workload zone deployment configuration |
| virtual-machines | Cal S4h | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/cal-s4h.md | The online library is continuously updated with Appliances for demo, proof of co |This solution offers you an insight of SAP BW/4HANA. SAP BW/4HANA is the next generation Data Warehouse optimized for HANA. Beside the basic BW/4HANA options the solution offers a bunch of HANA optimized BW/4HANA Content and the next step of Hybrid Scenarios with SAP Data Warehouse Cloud. As the system is pre-configured you can start directly implementing your scenarios. | [Details]( https://cal.sap.com/catalog?provider=208b780d-282b-40ca-9590-5dd5ad1e52e8#/applianceTemplates/06725b24-b024-4757-860d-ac2db7b49577) | | **SAP S/4HANA 2021, Fully-Activated Appliance** December 20 2021 | [Create Appliance](https://cal.sap.com/registration?sguid=b8a9077c-f0f7-47bd-977c-70aa6a6a2aa7&provider=208b780d-282b-40ca-9590-5dd5ad1e52e8) | |This appliance contains SAP S/4HANA 2021 (SP00) with pre-activated SAP Best Practices for SAP S/4HANA core functions, and further scenarios for Service, Master Data Governance (MDG), Transportation Mgmt. (TM), Portfolio Mgmt. (PPM), Human Capital Management (HCM), Analytics, Migration Cockpit, and more. User access happens via SAP Fiori, SAP GUI, SAP HANA Studio, Windows remote desktop, or the backend operating system for full administrative access. | [Details]( https://cal.sap.com/catalog?provider=208b780d-282b-40ca-9590-5dd5ad1e52e8#/applianceTemplates/b8a9077c-f0f7-47bd-977c-70aa6a6a2aa7) |-| **System Conversion for SAP S/4HANA ΓÇô Source system SAP ERP6.0 before running SUM** July 05 2022 | [Create Appliance](https://cal.sap.com/registration?sguid=b28b67f3-ebab-4b03-bee9-1cd57ddb41b6&provider=208b780d-282b-40ca-9590-5dd5ad1e52e8) | -|Second solution for performing a system conversion from SAP ERP to SAP S/4HANA after preparation steps before running Software Update Manager. It has been tested and prepared to be converted from SAP EHP7 for SAP ERP 6.0 to SAP S/4HANA 2021 FPS01 | [Details](https://cal.sap.com/catalog?provider=208b780d-282b-40ca-9590-5dd5ad1e52e8#/applianceTemplates/b28b67f3-ebab-4b03-bee9-1cd57ddb41b6) | +| **SAP Product Lifecycle Costing 4.0 SP4 Hotfix 3** August 10 2022 | [Create Appliance](https://cal.sap.com/registration?sguid=61af97ea-be7e-4531-ae07-f1db561d0847&provider=208b780d-282b-40ca-9590-5dd5ad1e52e8) | +|SAP Product Lifecycle Costing is a solution to calculate costs and other dimensions for new products or product related quotations in an early stage of the product lifecycle, to quickly identify cost drivers and to easily simulate and compare alternatives. | [Details]( https://cal.sap.com/catalog?provider=208b780d-282b-40ca-9590-5dd5ad1e52e8#/applianceTemplates/61af97ea-be7e-4531-ae07-f1db561d0847) | | **SAP NetWeaver 7.5 SP15 on SAP ASE** January 20 2020 | [Create Appliance](https://cal.sap.com/registration?sguid=69efd5d1-04de-42d8-a279-813b7a54c1f6&provider=208b780d-282b-40ca-9590-5dd5ad1e52e8) | |SAP NetWeaver 7.5 SP15 on SAP ASE | [Details](https://cal.sap.com/catalog?provider=208b780d-282b-40ca-9590-5dd5ad1e52e8#/solutions/69efd5d1-04de-42d8-a279-813b7a54c1f6) | |
| virtual-machines | High Availability Guide Rhel Pacemaker | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/high-availability-guide-rhel-pacemaker.md | The following items are prefixed with either **[A]** - applicable to all nodes, > RHEL 7.4: fence-agents-4.0.11-66.el7_4.12 > For more information, see [Azure VM running as a RHEL High Availability cluster member take a very long time to be fenced, or fencing fails / times-out before the VM shuts down](https://access.redhat.com/solutions/3408711). + > [!IMPORTANT] + > We recommend the following versions of Azure Fence agent (or later) for customers wishing to use Managed Identities for Azure resources instead of service principal names for the fence agent. + > RHEL 8.4: fence-agents-4.2.1-54.el8 + > RHEL 8.2: fence-agents-4.2.1-41.el8_2.4 + > RHEL 8.1: fence-agents-4.2.1-30.el8_1.4 + > RHEL 7.9: fence-agents-4.2.1-41.el7_9.4. + Check the version of the Azure fence agent. If necessary, update it to a version equal to or later than the stated above. <pre><code># Check the version of the Azure Fence Agent The following items are prefixed with either **[A]** - applicable to all nodes, ## Create STONITH device -The STONITH device uses a Service Principal to authorize against Microsoft Azure. Follow these steps to create a Service Principal. +The STONITH device uses either a managed identity for Azure resource or service principal to authorize against Microsoft Azure. ++### Using Managed Identity +To create a managed identity (MSI), [create a system-assigned](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. ++### Using Service Principal +Follow these steps to create a service principal, if not using managed identity. 1. Go to the [Azure portal](https://portal.azure.com). 1. Open the Azure Active Directory blade The STONITH device uses a Service Principal to authorize against Microsoft Azure The sign-on URL is not used and can be any valid URL 1. Select Certificates and Secrets, then click New client secret 1. Enter a description for a new key, select "Never expires" and click Add-1. Make a node the Value. It is used as the **password** for the Service Principal -1. Select Overview. Make a note the Application ID. It is used as the username (**login ID** in the steps below) of the Service Principal +1. Make a node the Value. It is used as the **password** for the service principal +1. Select Overview. Make a note the Application ID. It is used as the username (**login ID** in the steps below) of the service principal ### **[1]** Create a custom role for the fence agent -The Service Principal does not have permissions to access your Azure resources by default. You need to give the Service Principal permissions to start and stop (power-off) all virtual machines of the cluster. If you did not already create the custom role, you can create it using [PowerShell](../../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../../role-based-access-control/custom-roles-cli.md) +Neither managed identity nor service principal have permissions to access your Azure resources by default. You need to give the managed identity or service principal permissions to start and stop (power-off) all virtual machines of the cluster. If you did not already create the custom role, you can create it using [PowerShell](../../../role-based-access-control/custom-roles-powershell.md) or [Azure CLI](../../../role-based-access-control/custom-roles-cli.md) Use the following content for the input file. You need to adapt the content to your subscriptions that is, replace *xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx* and *yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy* with the Ids of your subscription. If you only have one subscription, remove the second entry in AssignableScopes. Use the following content for the input file. You need to adapt the content to y } ``` -### **[A]** Assign the custom role to the Service Principal +### **[A]** Assign the custom role ++#### Using Managed Identity ++Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to each managed identity of the cluster VMs. Each VM system-assigned managed identity needs the role assigned for every cluster VM's resource. For detailed steps, see [Assign a managed identity access to a resource by using the Azure portal](/azure/active-directory/managed-identities-azure-resources/howto-assign-access-portal). Verify each VM's managed identity role assignment contains all cluster VMs. ++> [!IMPORTANT] +> Be aware assignment and removal of authorization with managed identities [can be delayed](/azure/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations#limitation-of-using-managed-identities-for-authorization) until effective. ++#### Using Service Principal ++Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the service principal. Do not use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../../role-based-access-control/role-assignments-portal.md). +Make sure to assign the role for both cluster nodes. -Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to the Service Principal. Do not use the Owner role anymore! For detailed steps, see [Assign Azure roles using the Azure portal](../../../role-based-access-control/role-assignments-portal.md). -Make sure to assign the custom role to the service principal at all VM (cluster node) scopes. - ### **[1]** Create the STONITH devices After you edited the permissions for the virtual machines, you can configure the STONITH devices in the cluster. sudo pcs property set stonith-timeout=900 > Option 'pcmk_host_map' is ONLY required in the command, if the RHEL host names and the Azure VM names are NOT identical. Specify the mapping in the format **hostname:vm-name**. > Refer to the bold section in the command. For more information, see [What format should I use to specify node mappings to stonith devices in pcmk_host_map](https://access.redhat.com/solutions/2619961) ++#### [Managed Identity](#tab/msi) + For RHEL **7.X**, use the following command to configure the fence device: -<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm login="<b>login ID</b>" passwd="<b>password</b>" resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" <b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ +<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm <b>msi=true</b> resourceGroup="<b>resource group</b>" \ +subscriptionId="<b>subscription id</b>" <b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ power_timeout=240 pcmk_reboot_timeout=900 pcmk_monitor_timeout=120 pcmk_monitor_retries=4 pcmk_action_limit=3 pcmk_delay_max=15 \ op monitor interval=3600 </code></pre> For RHEL **8.X**, use the following command to configure the fence device: -<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm username="<b>login ID</b>" password="<b>password</b>" resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" <b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ +<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm <b>msi=true</b> resourceGroup="<b>resource group</b>" \ +subscriptionId="<b>subscription id</b>" <b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ power_timeout=240 pcmk_reboot_timeout=900 pcmk_monitor_timeout=120 pcmk_monitor_retries=4 pcmk_action_limit=3 pcmk_delay_max=15 \ op monitor interval=3600 </code></pre> +#### [Service Principal](#tab/spn) ++For RHEL **7.X**, use the following command to configure the fence device: +<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm login="<b>login ID</b>" passwd="<b>password</b>" \ +resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" \ +<b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ +power_timeout=240 pcmk_reboot_timeout=900 pcmk_monitor_timeout=120 pcmk_monitor_retries=4 pcmk_action_limit=3 pcmk_delay_max=15 \ +op monitor interval=3600 +</code></pre> ++For RHEL **8.X**, use the following command to configure the fence device: +<pre><code>sudo pcs stonith create rsc_st_azure fence_azure_arm username="<b>login ID</b>" password="<b>password</b>" \ +resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" subscriptionId="<b>subscription id</b>" \ +<b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ +power_timeout=240 pcmk_reboot_timeout=900 pcmk_monitor_timeout=120 pcmk_monitor_retries=4 pcmk_action_limit=3 pcmk_delay_max=15 \ +op monitor interval=3600 +</code></pre> +++ > [!TIP] > Only configure the `pcmk_delay_max` attribute in two node Pacemaker clusters. For more information on preventing fence races in a two node Pacemaker cluster, see [Delaying fencing in a two node cluster to prevent fence races of "fence death" scenarios](https://access.redhat.com/solutions/54829). |
| virtual-machines | High Availability Guide Suse Pacemaker | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/virtual-machines/workloads/sap/high-availability-guide-suse-pacemaker.md | You can configure the SBD device by using either of two options: - For more information about limitations for Azure shared disks, carefully review the "Limitations" section of [Azure shared disk documentation](../../disks-shared.md#limitations). ### Use an Azure fence agent-You can set up STONITH by using an Azure fence agent. Azure fence agents require a service principal that manages restarting failed nodes via Azure APIs. Azure fence agents don't require the deployment of additional virtual machines. +You can set up STONITH by using an Azure fence agent. Azure fence agent require managed identities for the cluster VMs or a service principal, that manages restarting failed nodes via Azure APIs. Azure fence agent doesn't require the deployment of additional virtual machines. ## SBD with an iSCSI target server This section applies only if you want to use a STONITH device with an Azure fenc ### Create an Azure fence agent STONITH device -This section applies only if you're using a STONITH device that's based on an Azure fence agent. The STONITH device uses a service principal to authorize against Microsoft Azure. To create a service principal, do the following: +This section applies only if you're using a STONITH device that's based on an Azure fence agent. The STONITH device uses either a managed identity or a service principal to authorize against Microsoft Azure. ++#### Using managed identity +To create a managed identity (MSI), [create a system-assigned](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#system-assigned-managed-identity) managed identity for each VM in the cluster. Should a system-assigned managed identity already exist, it will be used. User assigned managed identities should not be used with Pacemaker at this time. ++#### Using service principal ++To create a service principal, do the following: 1. In the [Azure portal](https://portal.azure.com), select **Azure Active Directory** > **Properties**, and then write down the Directory ID. This is the **tenant ID**. 1. Select **App registrations**. This section applies only if you're using a STONITH device that's based on an Az ### **[1]** Create a custom role for the fence agent -By default, the service principal doesn't have permissions to access your Azure resources. You need to give the service principal permissions to start and stop (deallocate) all virtual machines in the cluster. If you didn't already create the custom role, you can do so by using [PowerShell](../../../role-based-access-control/custom-roles-powershell.md#create-a-custom-role) or the [Azure CLI](../../../role-based-access-control/custom-roles-cli.md). +By default, neither managed identity norservice principal have permissions to access your Azure resources. You need to give the managed identity or service principal permissions to start and stop (deallocate) all virtual machines in the cluster. If you didn't already create the custom role, you can do so by using [PowerShell](../../../role-based-access-control/custom-roles-powershell.md#create-a-custom-role) or the [Azure CLI](../../../role-based-access-control/custom-roles-cli.md). Use the following content for the input file. You need to adapt the content to your subscriptions. That is, replace *xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx* and *yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy* with your own subscription IDs. If you have only one subscription, remove the second entry under AssignableScopes. Use the following content for the input file. You need to adapt the content to y } ``` -### **[A]** Assign the custom role to the service principal +### **[A]** Assign the custom role ++#### Using Managed Identity ++Assign the custom role "Linux Fence Agent Role" that was created in the last chapter to each managed identity of the cluster VMs. Each VM system-assigned managed identity needs the role assigned for every cluster VM's resource. For detailed steps, see [Assign a managed identity access to a resource by using the Azure portal](/azure/active-directory/managed-identities-azure-resources/howto-assign-access-portal). Verify each VM's managed identity role assignment contains all cluster VMs. ++> [!IMPORTANT] +> Be aware assignment and removal of authorization with managed identities [can be delayed](/azure/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations#limitation-of-using-managed-identities-for-authorization) until effective. ++#### Using Service Principal Assign the custom role *Linux fence agent Role* that you already created to the service principal. Do *not* use the *Owner* role anymore. For more information, see [Assign Azure roles by using the Azure portal](../../../role-based-access-control/role-assignments-portal.md). Make sure to assign the custom role to the service principal at all VM (cluster </code></pre> 1. **[1]** If you're using an Azure fence agent as STONITH, run the following commands. After you've assigned roles to both cluster nodes, you can configure the STONITH devices in the cluster.+ + <pre><code>sudo crm configure property stonith-enabled=true + crm configure property concurrent-fencing=true + </code></pre> > [!NOTE] > The 'pcmk_host_map' option is required in the command only if the hostnames and the Azure VM names are *not* identical. Specify the mapping in the format *hostname:vm-name*. > Refer to the bold section in the following command.-- <pre><code>sudo crm configure property stonith-enabled=true - crm configure property concurrent-fencing=true + + If using **managed identity** for your fence agent, run the following command (SLES 15 SP1 and newer, only) + <pre><code> + # replace the bold strings with your subscription ID and resource group of the VM + + sudo crm configure primitive rsc_st_azure stonith:fence_azure_arm \ + params <b>msi=true</b> subscriptionId="<b>subscription ID</b>" resourceGroup="<b>resource group</b>" \ + pcmk_monitor_retries=4 pcmk_action_limit=3 power_timeout=240 pcmk_reboot_timeout=900 <b>pcmk_host_map="prod-cl1-0:prod-cl1-0-vm-name;prod-cl1-1:prod-cl1-1-vm-name"</b> \ + op monitor interval=3600 timeout=120 - # replace the bold string with your subscription ID, resource group of the VM, tenant ID, service principal application ID and password + sudo crm configure property stonith-timeout=900 + </code></pre> ++ If using **service principal** for your fence agent, run the following command + <pre><code> + # replace the bold strings with your subscription ID, resource group of the VM, tenant ID, service principal application ID and password sudo crm configure primitive rsc_st_azure stonith:fence_azure_arm \ params subscriptionId="<b>subscription ID</b>" resourceGroup="<b>resource group</b>" tenantId="<b>tenant ID</b>" login="<b>application ID</b>" passwd="<b>password</b>" \ |