Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into ip-screenshots

Author: halkazwini

articles/automation/TOC.yml

@@ -273,11 +273,6 @@
     items:
     - name: Migration from Log Analytics to Azure Monitoring Agent version
       href: change-tracking/guidance-migration-log-analytics-monitoring-agent.md
-  - name: Change Tracking and Inventory using Log Analytics (Retired)
-    items:
-    - name: Enable
-    - name: Disable
-    - name: Troubleshoot
   - name: Update Management (Retired)
     items:
     - name: Overview

articles/backup/backup-support-matrix-iaas.md

@@ -2,7 +2,7 @@
 title: Support matrix for Azure VM backups
 description: Get a summary of support settings and limitations for backing up Azure VMs by using the Azure Backup service.
 ms.topic: reference
-ms.date: 01/10/2025
+ms.date: 03/03/2025
 ms.custom: references_regions, linux-related-content
 ms.reviewer: nikhilsarode
 ms.service: azure-backup
@@ -60,7 +60,7 @@ The following table summarizes the supported operating systems when you're backi
 
 **Scenario** | **OS support**
 --- | ---
-Back up with the Azure VM agent extension for application-consistent backup | - Windows 11 client (64 bit only) <br/><br/> - Windows 10 client (64 bit only) <br/><br/>- Windows Server 2022 (Datacenter, Datacenter Core, and Standard)   <br/><br/>- Windows Server 2019 (Datacenter, Datacenter Core, and Standard) <br/><br/> - Windows Server 2016 (Datacenter, Datacenter Core, and Standard) <br/><br/> - Windows Server 2012 R2 (Datacenter and Standard) <br/><br/> - Windows Server 2012 (Datacenter and Standard) <br/><br/> - Windows Server 2008 R2 (RTM and SP1 Standard)  <br/><br/> - Windows Server 2008 (64 bit only) <br><br> Note that *32 bit Operating Systems* aren't supported.
+Back up with the Azure VM agent extension for application-consistent backup | - Windows 11 client (64 bit only) <br/><br/> - Windows 10 client (64 bit only) <br/><br/>- Windows Server 2025 (Datacenter, Datacenter Core, and Standard)  <br/><br/>- Windows Server 2022 (Datacenter, Datacenter Core, and Standard)   <br/><br/>- Windows Server 2019 (Datacenter, Datacenter Core, and Standard) <br/><br/> - Windows Server 2016 (Datacenter, Datacenter Core, and Standard) <br/><br/> - Windows Server 2012 R2 (Datacenter and Standard) <br/><br/> - Windows Server 2012 (Datacenter and Standard) <br/><br/> - Windows Server 2008 R2 (RTM and SP1 Standard)  <br/><br/> - Windows Server 2008 (64 bit only) <br><br> Note that *32 bit Operating Systems* aren't supported.
 [Back up Azure VM directly using agentless crash-consistent backup](backup-azure-vms-agentless-multi-disk-crash-consistent-overview.md) | Agentless crash-consistent backups are operating system agnostic. 
 Back up with the MARS agent | [Supported](backup-support-matrix-mars-agent.md#supported-operating-systems) operating systems
 Back up with DPM or MABS | Supported operating systems for backup with [MABS](backup-mabs-protection-matrix.md) and [DPM](/system-center/dpm/dpm-protection-matrix)

articles/governance/policy/concepts/assignment-structure.md

@@ -372,6 +372,12 @@ Assignments using a system-assigned managed identity must also specify a top-lev
 },
 ```
 
+> [!NOTE]
+>
+> For a `deployIfNotExists` policy, the assignment identity is always used for the ARM Template deployment. However, when the target resource is created or updated, the requestor's identity is used for the evaluation. 
+>
+> For example, imagine a policy which deploys `Microsoft.Insights/diagnosticSettings` on `Microsoft.KeyVault/vaults`. When a key vault is created, the caller identity will be used to get the `Microsoft.Insights/diagnosticSettings` resources to evaluate the existence condition of the policy definition. If the conditions are met, then the policy assignment's identity will be used to deploy the diagnostic settings on the key vault. This means that the caller would need `Microsoft.Insights/diagnosticSettings/read permissions`, and the assignment would need `Microsoft.Insights/diagnosticSettings/write permissions`.
+
 ## Next steps
 
 - Learn about the [policy definition structure](./definition-structure-basics.md).

articles/governance/policy/how-to/remediate-resources.md

@@ -12,7 +12,9 @@ Resources that are non-compliant to policies with `deployIfNotExists` or `modify
 
 ## How remediation access control works
 
-When Azure Policy starts a template deployment when evaluating `deployIfNotExists` policies or modifies a resource when evaluating `modify` policies, it does so using a [managed identity](/entra/identity/managed-identities-azure-resources/overview) associated with the policy assignment. Policy assignments use managed identities for Azure resource authorization. You can use either a system-assigned managed identity created by the policy service or a user-assigned identity provided by the user. The managed identity needs to be assigned the minimum Azure role-based access control (Azure RBAC) role required to remediate resources. If the managed identity is missing roles, an error is displayed in the portal during the assignment of the policy or an initiative. When you use the portal, Azure Policy automatically grants the managed identity the listed roles once assignment starts. When you use an Azure software development kit (SDK), the roles must manually be granted to the managed identity. The _location_ of the managed identity doesn't affect its operation with Azure Policy.
+When Azure Policy starts a template deployment when evaluating `deployIfNotExists` policies or modifies a resource when evaluating `modify` policies, it does so using a [managed identity](/entra/identity/managed-identities-azure-resources/overview) associated with the policy assignment. Note that while the assignment's identity is used for resource deployment or modification, it is not used for evaluation of the policy definition and its existence condition. Policy evalutation uses the identity of the caller that initiated the API request.
+
+Policy assignments use managed identities for Azure resource authorization during remediation. You can use either a system-assigned managed identity created by the policy service or a user-assigned identity provided by the user. The managed identity needs to be assigned the minimum Azure role-based access control (Azure RBAC) role required to remediate resources. If the managed identity is missing roles, an error is displayed in the portal during the assignment of the policy or an initiative. When you use the portal, Azure Policy automatically grants the managed identity the listed roles once assignment starts. When you use an Azure software development kit (SDK), the roles must manually be granted to the managed identity. The _location_ of the managed identity doesn't affect its operation with Azure Policy.
 
 > [!NOTE]
 > Changing a policy definition does not automatically update the assignment or the associated managed identity.

articles/peering-service/TOC.yml

@@ -3,19 +3,16 @@
 - name: Overview
   items:
   - name: About Peering Service
-    href: about.md  
+    href: about.md
+  expanded: true
 - name: Concepts
   items:
-  - name: Peering Service FAQ
+  - name: FAQ
     href: faq.yml
   - name: Locations and partners
     href: location-partners.md
   - name: Peering Service connection
     href: connection.md
-  - name: Security
-    items:
-      - name: Security baseline
-        href: /security/benchmark/azure/baselines/microsoft-azure-peering-service-security-baseline?toc=/azure/peering-service/TOC.json
   - name: Peering service prefix requirements
     href: peering-service-prefix-requirements.md
 - name: How-to-guides
@@ -32,6 +29,10 @@
     href: connection-telemetry.md
   - name: Azure Peering Service customer walkthrough
     href: customer-walkthrough.md
+- name: Security
+  items:
+  - name: Security baseline
+    href: /security/benchmark/azure/baselines/microsoft-azure-peering-service-security-baseline?toc=/azure/peering-service/TOC.json
 - name: References
   items:
   - name: Azure PowerShell

articles/peering-service/azure-portal.md

@@ -5,7 +5,7 @@ author: halkazwini
 ms.author: halkazwini
 ms.service: azure-peering-service
 ms.topic: how-to
-ms.date: 03/07/2024
+ms.date: 03/03/2025
 
 #CustomerIntent: As an administrator, I want to learn how to create and manage a Peering Service connection using the Azure portal so I can enhance the connectivity to Microsoft services over the public internet.
 ---
@@ -30,7 +30,7 @@ Sign in to the [Azure portal](https://portal.azure.com).
 
 1. In the search box at the top of the portal, enter *Peering Service*. Select **Peering Services** in the search results.
 
-    :::image type="content" source="./media/azure-portal/peering-service-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal." lightbox="./media/azure-portal/peering-service-portal-search.png":::
+    :::image type="content" source="./media/peering-services-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal." lightbox="./media/peering-services-portal-search.png":::
 
 1. Select **+ Create**.
 
@@ -43,8 +43,6 @@ Sign in to the [Azure portal](https://portal.azure.com).
     | Resource Group | Select **Create new**. </br> Enter *myResourceGroup*. </br> Select **OK**. |
     | **Instance details** |  |
     | Name | Enter *myPeeringService*. |
-
-    :::image type="content" source="./media/azure-portal/peering-service-basics.png" alt-text="Screenshot of the Basics tab of Create a peering service connection in Azure portal.":::
 
 1. Select **Next: Configuration**.
 
@@ -64,8 +62,6 @@ Sign in to the [Azure portal](https://portal.azure.com).
 
 1. Review the settings, and then select **Create**.
 
-    :::image type="content" source="./media/azure-portal/peering-service-create.png" alt-text="Screenshot of the Review + create tab of Create a peering service connection in Azure portal.":::
-
 1. After you create a Peering Service connection, more validation is performed on the included prefixes. You can review the validation status under the **Prefixes** section of your Peering Service. 
 
     :::image type="content" source="./media/azure-portal/peering-service-prefix-validation.png" alt-text="Screenshot shows the validation status of the prefixes." lightbox="./media/azure-portal/peering-service-prefix-validation.png":::
@@ -100,9 +96,7 @@ Review the [Technical requirements for Peering Service prefixes](../internet-pee
 
 1. Select the checkbox next to the Peering Service that you want to delete, and then select **Delete** at the top of the page.
 
-1. Enter *yes* in **Confirm delete**, and then select **Delete**.
-
-    :::image type="content" source="./media/azure-portal/peering-service-delete.png" alt-text="Screenshot of deleting a Peering Service in Azure portal.":::
+1. Enter ***yes*** in **Confirm delete**, and then select **Delete**.
 
 ## Modify the primary or backup peering location
 

articles/peering-service/cli.md

@@ -5,7 +5,7 @@ author: halkazwini
 ms.author: halkazwini
 ms.service: azure-peering-service
 ms.topic: how-to
-ms.date: 02/08/2024
+ms.date: 03/03/2025
 ms.custom: devx-track-azurecli
 
 #CustomerIntent: As an administrator, I want to learn how to create and manage a Peering Service connection using the Azure CLI so I can enhance the connectivity to Microsoft services over the public internet.

articles/peering-service/connection-telemetry.md

@@ -6,7 +6,7 @@ services: peering-service
 author: halkazwini
 ms.service: azure-peering-service
 ms.topic: how-to
-ms.date: 10/07/2024
+ms.date: 03/03/2025
 ms.author: halkazwini
 
 # Customer intent: Customer wants to access their connection telemetry per prefix to Microsoft services with Azure Peering Service.
@@ -30,12 +30,10 @@ To view the latency report for a specific Peering Service connection, follow the
 
 1. In the search box at the top of the portal, enter *Peering Service*. Select **Peering Services** in the search results.
 
-    :::image type="content" source="./media/connection-telemetry/peering-service-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal." lightbox="./media/connection-telemetry/peering-service-portal-search.png":::
+    :::image type="content" source="./media/peering-services-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal." lightbox="./media/peering-services-portal-search.png":::
 
 1. Select the Peering Service connection that you want to view its latency report. 
 
-    :::image type="content" source="./media/connection-telemetry/peering-service-connection-page.png" alt-text="Screenshot shows the selected Peering Service in the Azure portal." lightbox="./media/connection-telemetry/peering-service-connection-page.png":::
-
 1. Under **Settings**, select **Prefixes** to see the prefixes associated with the Peering Service connection. 
 
     :::image type="content" source="./media/connection-telemetry/peering-service-prefixes.png" alt-text="Screenshot shows the prefixes associated with the Peering Service connection in the Azure portal." lightbox="./media/connection-telemetry/peering-service-prefixes.png":::

articles/peering-service/customer-walkthrough.md

@@ -5,7 +5,7 @@ author: halkazwini
 ms.author: halkazwini
 ms.service: azure-peering-service
 ms.topic: how-to
-ms.date: 10/07/2024
+ms.date: 03/03/2025
 ---
 
 # Azure Peering Service customer walkthrough
@@ -22,20 +22,16 @@ To activate the prefix, follow these steps:
 
 1. In the search box at the top of the portal, enter *peering service*. Select **Peering Services** in the search results. 
 
-    :::image type="content" source="./media/customer-walkthrough/peering-service-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal.":::
+    :::image type="content" source="./media/peering-services-portal-search.png" alt-text="Screenshot shows how to search for Peering Service in the Azure portal." lightbox="./media/peering-services-portal-search.png":::
 
 1. Select **+ Create** to create a new Peering Service connection.
 
-    :::image type="content" source="./media/customer-walkthrough/peering-service-list.png" alt-text="Screenshot shows the list of existing Peering Service connections in the Azure portal.":::
-
 1. In the **Basics** tab, enter or select your subscription, resource group, and Peering Service connection name.
 
-    :::image type="content" source="./media/customer-walkthrough/peering-service-basics.png" alt-text="Screenshot shows the Basics tab of creating a Peering Service connection in the Azure portal.":::
-
 1. In the **Configuration** tab, provide details on the location, provider, and primary and backup interconnect locations. If the backup location is set to **None**, the traffic fails over to the internet.
 
     > [!NOTE]
-    > - The prefix key should be the same as the one obtained from your Peering Service provider. 
+    > The prefix key should be the same as the one obtained from your Peering Service provider. 
 
     :::image type="content" source="./media/customer-walkthrough/peering-service-configuration.png" alt-text="Screenshot shows the Configuration tab of creating a Peering Service connection in the Azure portal.":::