Merge pull request #278435 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)

Author: Taojunshen

articles/azure-arc/servers/prerequisites.md

@@ -51,12 +51,22 @@ Azure Arc supports the following Windows and Linux operating systems. Only x86-6
 * Ubuntu 16.04, 18.04, 20.04, and 22.04 LTS
 * Windows 10, 11 (see [client operating system guidance](#client-operating-system-guidance))
 * Windows IoT Enterprise
-* Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, and 2022
+* Windows Server 2012, 2012 R2, 2016, 2019, and 2022
   * Both Desktop and Server Core experiences are supported
   * Azure Editions are supported on Azure Stack HCI
 
 The Azure Connected Machine agent hasn't been tested on operating systems hardened by the Center for Information Security (CIS) Benchmark.
 
+## Limited support operating systems
+
+The following operating system versions have **limited support**. In each case, newer agent versions won't support these operating systems.  The last agent version that supports the operating system is listed, and newer agent releases won't be made available for that system. 
+The listed version is supported until the **End of Arc Support Date**. If critical security issues are identified that affect these agent versions, the fixes can be backported to the last supported version, but new functionality or other bug fixes won't be.
+
+| Operating system | Last supported agent version | End of Arc Support Date | Notes |
+| -- | -- | -- | -- | 
+| Windows Server 2008 R2 SP1 | 1.39 [Download](https://download.microsoft.com/download/1/9/f/19f44dde-2c34-4676-80d7-9fa5fc44d2a8/AzureConnectedMachineAgent.msi)  | 3/31/2025 | Windows Server 2008 and 2008 R2 reached End of Support in January 2020. See [End of support for Windows Server 2008 and Windows Server 2008 R2](/troubleshoot/windows-server/windows-server-eos-faq/end-of-support-windows-server-2008-2008r2). | 
+
+
 ### Client operating system guidance
 
 The Azure Arc service and Azure Connected Machine Agent are supported on Windows 10 and 11 client operating systems only when using those computers in a server-like environment. That is, the computer should always be:

articles/iot-operations/manage-devices-assets/howto-configure-opcua-authentication-options.md

@@ -52,7 +52,7 @@ First, configure the secrets for the username and password in Azure Key Vault an
       az keyvault secret set \
         --name "password" \
         --vault-name "<your-azure-key-vault-name>" \
-        --value "<your-opc-ua-server-username>" \
+        --value "<your-opc-ua-server-password>" \
         --content-type "text/plain"
     ```
 

articles/role-based-access-control/built-in-roles/networking.md

@@ -597,7 +597,7 @@ Lets you manage DNS zones and record sets in Azure DNS, but does not let you con
 
 ## Network Contributor
 
-Lets you manage networks, but not access to them.
+Lets you manage networks, but not access to them. This role does not grant you permission to deploy or manage Virtual Machines.
 
 > [!div class="mx-tableFixed"]
 > | Actions | Description |
@@ -758,4 +758,4 @@ Lets you manage Traffic Manager profiles, but does not let you control who has a
 
 ## Next steps
 
-- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)
+- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)

articles/role-based-access-control/custom-roles.md

@@ -184,6 +184,9 @@ Just like built-in roles, the `AssignableScopes` property specifies the scopes t
 | Update a custom role | `Microsoft.Authorization/ roleDefinitions/write` | Users that are granted this action on all the `AssignableScopes` of the custom role can update custom roles in those scopes. For example, [Owners](built-in-roles.md#owner) and [User Access Administrators](built-in-roles.md#user-access-administrator) of management groups, subscriptions, and resource groups. |
 | View a custom role | `Microsoft.Authorization/ roleDefinitions/read` | Users that are granted this action at a scope can view the custom roles that are available for assignment at that scope. All built-in roles allow custom roles to be available for assignment. |
 
+> [!NOTE]  
+> Even if a role is renamed, the role ID does not change. If you are using scripts or automation to create your role assignments, it's a best practice to use the unique role ID instead of the role name. Therefore, if a role is renamed, your scripts are more likely to work.
+
 ## Find role assignments to delete a custom role
 
 Before you can delete a custom role, you must remove any role assignments that use the custom role. If you try to delete a custom role with role assignments, you get the message: `There are existing role assignments referencing role (code: RoleDefinitionHasAssignments)`.

articles/role-based-access-control/role-definitions.md

@@ -61,7 +61,7 @@ The following table describes what the role properties mean.
 | --- | --- |
 | `Name`</br>`roleName` | Display name of the role. |
 | `Id`</br>`name` | Unique ID of the role. Built-in roles have the same role ID across clouds. |
-| `id` | Fully qualified unique ID of the role. |
+| `id` | Fully qualified unique ID of the role. Even if the role is renamed, the role ID does not change. It's a best practice to use the role ID in your scripts. |
 | `IsCustom`</br>`roleType` | Indicates whether this role is a custom role. Set to `true` or `CustomRole` for custom roles. Set to `false` or `BuiltInRole` for built-in roles. |
 | `type` | Type of object. Set to `Microsoft.Authorization/roleDefinitions`.  |
 | `Description`</br>`description` | Description of the role. |

articles/synapse-analytics/sql/develop-openrowset.md

@@ -131,7 +131,7 @@ Below you'll find the relevant \<storage account path> values that will link to
 | Azure Blob Storage         | http[s]  | \<storage_account>.blob.core.windows.net/path/file   |
 | Azure Blob Storage         | wasb[s]  | \<container>@\<storage_account>.blob.core.windows.net/path/file |
 | Azure Data Lake Store Gen1 | http[s]  | \<storage_account>.azuredatalakestore.net/webhdfs/v1 |
-| Azure Data Lake Store Gen2 | http[s]  | \<storage_account>.dfs.core.windows.net /path/file   |
+| Azure Data Lake Store Gen2 | http[s]  | \<storage_account>.dfs.core.windows.net/path/file   |
 | Azure Data Lake Store Gen2 | abfs[s]  | [\<file_system>@\<account_name>.dfs.core.windows.net/path/file](../../storage/blobs/data-lake-storage-introduction-abfs-uri.md#uri-syntax)              |
 ||||
 

includes/azure-monitor-limits-alerts.md

@@ -14,8 +14,7 @@ ms.custom: "include file"
 | Metric alerts (classic) |100 active alert rules per subscription. <br/>Classic alerts are [retired](/previous-versions/azure/azure-monitor/alerts/monitoring-classic-retirement) for public cloud users. <br/>Classic alerts for Azure Government cloud and Microsoft Azure operated by 21Vianet will retire on 29 February 2024.| Call support. |
 | Metric alerts |5,000 active alert rules per subscription in Azure public, Microsoft Azure operated by 21Vianet, and Azure Government clouds. If you're hitting this limit, explore if you can use the [same type multi-resource alerts](../articles/azure-monitor/alerts/alerts-metric-overview.md#monitoring-at-scale-using-metric-alerts-in-azure-monitor).<br/>5,000 metric time-series per alert rule. | Call support. |
 | Activity log alerts | 100 active alert rules per subscription (can't be increased). <br/>As this limit can't be increased, consider [sending your Activity Logs to a Log Analytics workspace](../articles/azure-monitor/essentials/activity-log.md#send-to-log-analytics-workspace) and creating log search alerts instead, if you need a larger number of rules per subscription. | Same as default. |
-| Log alerts | 5,000 active alert rules per subscription. Out of which, 100 active alert rules with a </br>1-minute frequency. <br/>1,000 active alert rules per resource. <br/>Each stateless alert rule can trigger up to 6,000 alerts per evaluation.<br/>Each stateful alert rule can trigger up to 300 alerts per evaluation.<br/>Up to 6000 fired stateful alerts at a time.<br/>The combined size of all data in the log alert rule properties can't exceed 64 KB.
-<br/>The Kusto query results can't exceed more than 20 MB.<br/>| Call support. |
+| Log alerts | 5,000 active alert rules per subscription. Out of which, 100 active alert rules with a </br>1-minute frequency. <br/>1,000 active alert rules per resource. <br/>Each stateless alert rule can trigger up to 6,000 alerts per evaluation.<br/>Each stateful alert rule can trigger up to 300 alerts per evaluation.<br/>Up to 5,000 fired stateful alerts at a time.<br/>The combined size of all data in the log alert rule properties can't exceed 64 KB.<br/>The Kusto query results can't exceed more than 20 MB.<br/>| Call support. |
 | Alert processing rules | 1,000 active rules per subscription. | Call support. |
 | Alert rules and alert processing rules description length| Log search alerts 4,096 characters.<br/>All others are 2,048 characters. | Same as default. |