You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/overview-managed-identity.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -432,9 +432,9 @@ The **IDENTITY_ENDPOINT** is a local URL from which your app can request tokens.
432
432
> | resource | Query | The Microsoft Entra resource URI of the resource for which a token should be obtained. This could be one of the [Azure services that support Microsoft Entra authentication](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication) or any other resource URI. |
433
433
> | api-version | Query | The version of the token API to be used. Use `2019-08-01`. |
434
434
> | X-IDENTITY-HEADER | Header | The value of the IDENTITY_HEADER environment variable. This header is used to help mitigate server-side request forgery (SSRF) attacks. |
435
-
> | client_id | Query | (Optional) The client ID of the user-assigned identity to be used. Cannot be used on a request that includes `principal_id`, `mi_res_id`, or `object_id`. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `mi_res_id`) are omitted, the system-assigned identity is used. |
436
-
> | principal_id | Query | (Optional) The principal ID of the user-assigned identity to be used. `object_id` is an alias that may be used instead. Cannot be used on a request that includes client_id, mi_res_id, or object_id. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `mi_res_id`) are omitted, the system-assigned identity is used. |
437
-
> |mi_res_id| Query | (Optional) The Azure resource ID of the user-assigned identity to be used. Cannot be used on a request that includes `principal_id`, `client_id`, or `object_id`. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `mi_res_id`) are omitted, the system-assigned identity is used. |
435
+
> | client_id | Query | (Optional) The client ID of the user-assigned identity to be used. Cannot be used on a request that includes `principal_id`, `msi_res_id`, or `object_id`. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `msi_res_id`) are omitted, the system-assigned identity is used. |
436
+
> | principal_id | Query | (Optional) The principal ID of the user-assigned identity to be used. `object_id` is an alias that may be used instead. Cannot be used on a request that includes client_id, msi_res_id, or object_id. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `msi_res_id`) are omitted, the system-assigned identity is used. |
437
+
> |msi_res_id| Query | (Optional) The Azure resource ID of the user-assigned identity to be used. Cannot be used on a request that includes `principal_id`, `client_id`, or `object_id`. If all ID parameters (`client_id`, `principal_id`, `object_id`, and `msi_res_id`) are omitted, the system-assigned identity is used. |
438
438
439
439
> [!IMPORTANT]
440
440
> If you are attempting to obtain tokens for user-assigned identities, you must include one of the optional properties. Otherwise the token service will attempt to obtain a token for a system-assigned identity, which may or may not exist.
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/cross-workspace-query.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Query and correlated data from multiple Log Analytics workspaces, a
4
4
ms.topic: how-to
5
5
author: guywi-ms
6
6
ms.author: guywild
7
-
ms.date: 05/30/2023
7
+
ms.date: 12/28/2023
8
8
# Customer intent: As a data analyst, I want to write KQL queries that correlate data from multiple Log Analytics workspaces, applications, or resources, to enable my analysis.
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/log-analytics-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Overview of Log Analytics in Azure Monitor
3
3
description: This overview describes Log Analytics, which is a tool in the Azure portal used to edit and run log queries for analyzing data in Azure Monitor logs.
Copy file name to clipboardExpand all lines: articles/cosmos-db/burst-capacity-faq.yml
+3-11Lines changed: 3 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -51,19 +51,14 @@ sections:
51
51
- question: |
52
52
How can I enable burst capacity on an account programatically?
53
53
answer: |
54
-
You can use the [Azure Cosmos DB Resource Provider REST API version `2023-03-15-preview`](/rest/api/cosmos-db-resource-provider/2023-03-15-preview/database-accounts/create-or-update) or a [Resource Manager template with API version `2023-03-01-preview`](/azure/templates/microsoft.documentdb/2023-03-01-preview/databaseaccounts) to set the property `enableBurstCapacity` to true.
54
+
You can use the [Azure Cosmos DB Resource Provider REST API version `2023-09-15` or later](/rest/api/cosmos-db-resource-provider/database-accounts/create-or-update) or a [Resource Manager template with API version `2023-03-01-preview`](/azure/templates/microsoft.documentdb/2023-03-01-preview/databaseaccounts) to set the property `enableBurstCapacity` to true.
55
55
You can also use the Azure CLI or PowerShell.
56
56
57
57
#### [PowerShell](#tab/azure-powershell)
58
58
59
59
```azurepowershell
60
-
// Add the preview extension 2.0.5-preview or higher
Copy file name to clipboardExpand all lines: articles/cosmos-db/burst-capacity.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ Burst capacity applies only to Azure Cosmos DB accounts using provisioned throug
22
22
## How burst capacity works
23
23
24
24
> [!NOTE]
25
-
> The current implementation of burst capacity is subject to change in the future. Usage of burst capacity is subject to system resource availability and is not guaranteed. Azure Cosmos DB may also use burst capacity for background maintenance tasks. If your workload requires consistent throughput beyond what you have provisioned, it's recommended to provision your RU/s accordingly without relying on burst capacity. Before enabling burst capacity, it is also recommended to evaluate if your partition layout can be [merged](merge.md) to permanently give more RU/s per physical partition without relying on burst capacity.
25
+
> The current implementation of burst capacity is subject to change in the future. Usage of burst capacity is subject to system resource availability and is **not guaranteed**. Azure Cosmos DB may also use burst capacity for background maintenance tasks. If your workload requires consistent throughput beyond what you have provisioned, it's recommended to provision your RU/s accordingly without relying on burst capacity. Before enabling burst capacity, it is also recommended to evaluate if your partition layout can be [merged](merge.md) to permanently give more RU/s per physical partition without relying on burst capacity.
26
26
27
27
Let's take an example of a physical partition that has 100 RU/s of provisioned throughput and is idle for 5 minutes. With burst capacity, it can accumulate a maximum of 100 RU/s * 300 seconds = 30,000 RU of burst capacity. The capacity can be consumed at a maximum rate of 3000 RU/s, so if there's a sudden spike in request volume, the partition can burst up to 3000 RU/s for up 30,000 RU / 3000 RU/s = 10 seconds. Without burst capacity, any requests that are consumed beyond the provisioned 100 RU/s would have been rate limited (429).
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/exempt-resource.md
+15-17Lines changed: 15 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,16 +8,15 @@ author: dcurwin
8
8
ms.date: 10/29/2023
9
9
---
10
10
11
-
# Exempt resources from recommendations
11
+
# Exempt resources from recommendations
12
12
13
-
14
-
When you investigate security recommendations in Microsoft Defender for Cloud, you usually review the list of affected resources. Occasionally, a resource will be listed that you feel shouldn't be included. Or a recommendation will show in a scope where you feel it doesn't belong. For example, a resource might have been remediated by a process not tracked by Defender for Cloud, or a recommendation might be inappropriate for a specific subscription. Or perhaps your organization has decided to accept the risks related to the specific resource or recommendation.
13
+
When you investigate security recommendations in Microsoft Defender for Cloud, you usually review the list of affected resources. Occasionally, a resource is listed that you feel shouldn't be included. Or a recommendation shows in a scope where you feel it doesn't belong. For example, a resource might be remediated by a process not tracked by Defender for Cloud, or a recommendation might be inappropriate for a specific subscription. Or perhaps your organization decided to accept the risks related to the specific resource or recommendation.
15
14
16
15
In such cases, you can create an exemption to:
17
16
18
-
-**Exempt a resource** to ensure it isn't listed with the unhealthy resources in the future, and doesn't impact your secure score. The resource will be listed as not applicable and the reason will be shown as "exempted" with the specific justification you select.
17
+
-**Exempt a resource** to ensure it isn't listed with the unhealthy resources in the future, and doesn't affect your secure score. The resource will be listed as not applicable and the reason will be shown as "exempted" with the specific justification you select.
19
18
20
-
-**Exempt a subscription or management group** to ensure that the recommendation doesn't impact your secure score and won't be shown for the subscription or management group in the future. This relates to existing resources and any you create in the future. The recommendation will be marked with the specific justification you select for the scope that you selected.
19
+
-**Exempt a subscription or management group** to ensure that the recommendation doesn't affect your secure score and won't be shown for the subscription or management group in the future. This relates to existing resources and any you create in the future. The recommendation will be marked with the specific justification you select for the scope that you selected.
21
20
22
21
For the scope you need, you can create an exemption rule to:
23
22
@@ -26,17 +25,17 @@ For the scope you need, you can create an exemption rule to:
26
25
27
26
## Before you start
28
27
29
-
This feature is in preview. [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)] This is a premium Azure Policy capability that's offered at no additional cost for customers with Microsoft Defender for Cloud's enhanced security features enabled. For other users, charges might apply in the future.
28
+
This feature is in preview. [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)] This is a premium Azure Policy capability offered at no extra cost for customers with Microsoft Defender for Cloud's enhanced security features enabled. For other users, charges might apply in the future.
30
29
31
30
- You need the following permissions to make exemptions:
32
-
-**Owner** or **Security Admin** or **Resource Policy Contributor** to create an exemption
33
-
- To create a rule, you need permissions to edit policies in Azure Policy. [Learn more](../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
31
+
-**Owner** or **Security Admin** or **Resource Policy Contributor** to create an exemption
32
+
- To create a rule, you need permissions to edit policies in Azure Policy. [Learn more](../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
34
33
35
34
- You can create exemptions for recommendations included in Defender for Cloud's default [Microsoft cloud security benchmark](/security/benchmark/azure/introduction) standard, or any of the supplied regulatory standards.
36
35
- Custom recommendations can't be exempted.
36
+
- If a recommendation is disabled, all of its subrecommendations are exempted.
37
37
- In addition to working in the portal, you can create exemptions using the Azure Policy API. Learn more [Azure Policy exemption structure](../governance/policy/concepts/exemption-structure.md).
38
38
39
-
40
39
## Define an exemption
41
40
42
41
To create an exemption rule:
@@ -49,7 +48,7 @@ To create an exemption rule:
49
48
50
49
1. In the **Exempt** pane:
51
50
1. Select the scope for the exemption.
52
-
- If you select a management group, the recommendation will be exempted from all subscriptions within that group
51
+
- If you select a management group, the recommendation is exempted from all subscriptions within that group
53
52
- If you're creating this rule to exempt one or more resources from the recommendation, choose "Selected resources" and select the relevant ones from the list
54
53
55
54
1. Enter a name for the exemption rule.
@@ -60,20 +59,19 @@ To create an exemption rule:
60
59
> [!NOTE]
61
60
> When you exempt a recommendation as mitigated, you aren't given points towards your secure score. But because points aren't *removed* for the unhealthy resources, the result is that your score will increase.
62
61
63
-
-**Risk accepted (waiver)** – if you’ve decided to accept the risk of not mitigating this recommendation
62
+
-**Risk accepted (waiver)** – if you decided to accept the risk of not mitigating this recommendation
64
63
1. Enter a description.
65
64
1. Select **Create**.
66
65
:::image type="content" source="media/exempt-resource/defining-recommendation-exemption.png" alt-text="Steps to create an exemption rule to exempt a recommendation from your subscription or management group." lightbox="media/exempt-resource/defining-recommendation-exemption.png":::
67
66
68
-
69
67
## After creating the exemption
70
68
71
-
After creating the exemption it can take up to 30 minutes to take effect. After it takes effect:
72
-
69
+
After creating the exemption, it can take up to 30 minutes to take effect. After it takes effect:
70
+
73
71
- The recommendation or resources won't impact your secure score.
74
-
- If you've exempted specific resources, they'll be listed in the **Not applicable** tab of the recommendation details page.
75
-
- If you've exempted a recommendation, it will be hidden by default on Defender for Cloud's recommendations page. This is because the default options of the **Recommendation status** filter on that page are to exclude **Not applicable** recommendations. The same is true if you exempt all recommendations in a security control.
72
+
- If you exempted specific resources, they'll be listed in the **Not applicable** tab of the recommendation details page.
73
+
- If you exempted a recommendation, it will be hidden by default on Defender for Cloud's recommendations page. This is because the default options of the **Recommendation status** filter on that page are to exclude **Not applicable** recommendations. The same is true if you exempt all recommendations in a security control.
76
74
77
75
## Next steps
78
76
79
-
[Review exempted resources](review-exemptions.md) in Defender for Cloud.
77
+
[Review exempted resources](review-exemptions.md) in Defender for Cloud.
0 commit comments