Merge pull request #193911 from MicrosoftDocs/main

huypub · web-flow · commit 330d2568e768 · 2022-04-04T10:01:57.000-07:00
4/04 AM Publish
diff --git a/articles/application-gateway/custom-error.md b/articles/application-gateway/custom-error.md
@@ -5,7 +5,7 @@ services: application-gateway
 author: vhorne
 ms.service: application-gateway
 ms.topic: how-to
-ms.date: 11/16/2019
+ms.date: 04/04/2022
 ms.author: victorh 
 ms.custom: devx-track-azurepowershell
 ---
@@ -44,18 +44,16 @@ After you specify an error page, the application gateway downloads it from the s
 
 1. Navigate to Application Gateway in the portal and choose an application gateway.
 
-    ![Screenshot shows the Overview page for an application gateway.](media/custom-error/ag-overview.png)
-2. Click **Listeners** and navigate to a particular listener where you want to specify an error page.
+2. Select **Listeners** and navigate to a particular listener where you want to specify an error page.
 
-    ![Application Gateway listeners](media/custom-error/ag-listener.png)
 3. Configure a custom error page for a 403 WAF error or a 502 maintenance page at the listener level.
 
     > [!NOTE]
     > Creating global level custom error pages from the Azure portal is currently not supported.
 
-4. Specify a publicly accessible blob URL for a given error status code and click **Save**. The Application Gateway is now configured with the custom error page.
+4. Under **Error page url**, select **Yes**, and then configure a publicly accessible blob URL for a given error status code. Select **Save**. The Application Gateway is now configured with the custom error page.
 
-   ![Application Gateway error codes](media/custom-error/ag-error-codes.png)
+   ![Screenshot of Application Gateway custom error page.](media/custom-error/ag-error-codes.png)
 
 ## Azure PowerShell configuration
 
diff --git a/articles/application-gateway/media/custom-error/ag-error-codes.png b/articles/application-gateway/media/custom-error/ag-error-codes.png
diff --git a/articles/azure-sql/database/maintenance-window.md b/articles/azure-sql/database/maintenance-window.md
@@ -51,7 +51,7 @@ Once the maintenance window selection is made and service configuration complete
 
 ## Advance notifications
 
-Maintenance notifications can be configured to alert you of upcoming planned maintenance events for your Azure SQL Database. The alerts arrive 24 hours in advance, at the time of maintenance, and when the maintenance is complete. For more information, see [Advance Notifications](advance-notifications.md).
+Maintenance notifications can be configured to alert you of upcoming planned maintenance events for your Azure SQL Database and Azure SQL Managed Instance. The alerts arrive 24 hours in advance, at the time of maintenance, and when the maintenance is complete. For more information, see [Advance Notifications](advance-notifications.md).
 
 ## Feature availability
 
@@ -206,5 +206,5 @@ For the full reference of the sample queries and how to use them across tools li
 
 * [Maintenance window FAQ](maintenance-window-faq.yml)
 * [Azure SQL Database](sql-database-paas-overview.md) 
-* [SQL managed instance](../managed-instance/sql-managed-instance-paas-overview.md)
+* [Azure SQL Managed Instance](../managed-instance/sql-managed-instance-paas-overview.md)
 * [Plan for Azure maintenance events in Azure SQL Database and Azure SQL Managed Instance](planned-maintenance.md)
diff --git a/articles/batch/virtual-file-mount.md b/articles/batch/virtual-file-mount.md
@@ -428,7 +428,7 @@ new PoolAddParameter
                 RelativeMountPath = "cifsmountpoint",
                 Source = "source",
                 Password = "StorageAccountKey",
-                MountOptions = "-o vers=3.0,dir_mode=0777,file_mode=0777,serverino"
+                MountOptions = "-o vers=3.0,dir_mode=0777,file_mode=0777,serverino,domain=MyDomain"
             },
         }
     }
diff --git a/articles/search/query-lucene-syntax.md b/articles/search/query-lucene-syntax.md
@@ -8,7 +8,7 @@ author: bevloh
 ms.author: beloh
 ms.service: cognitive-search
 ms.topic: conceptual
-ms.date: 06/08/2021
+ms.date: 04/04/2022
 ---
 
 # Lucene query syntax in Azure Cognitive Search
@@ -70,9 +70,11 @@ You can embed Boolean operators in a query string to improve the precision of a
 
 |Text operator | Character | Example | Usage |
 |--------------|----------- |--------|-------|
-| AND | `+` | `wifi AND luxury` | Specifies terms that a match must contain. In the example, the query engine will look for documents containing both `wifi` and `luxury`. The plus character (`+`) can also be used directly in front of a term to make it reuqired. For example, `+wifi +luxury` stipulates that both terms must appear somewhere in the field of a single document.|
-| OR | | `wifi OR luxury` | Finds a match when either term is found. In the example, the query engine will return match on documents containing either `wifi` or `luxury` or both. Because OR is the default conjunction operator, you could also leave it out, such that `wifi luxury` is the equivalent of  `wifi OR luxury`.|
-| NOT | `!`, `-` | `wifi –luxury` | Returns matches on documents that exclude the term. For example, `wifi –luxury` will search for documents that have the `wifi` term but not `luxury`. <br/><br/>The `searchMode` parameter on a query request controls whether a term with the NOT operator is ANDed or ORed with other terms in the query (assuming there's no boolean operators on the other terms). Valid values include `any` or `all`.  <br/><br/>`searchMode=any` increases the recall of queries by including more results, and by default `-` will be interpreted as "OR NOT". For example, `wifi -luxury` will match documents that either contain the term `wifi` or those that don't contain the term `luxury`.  <br/><br/>`searchMode=all` increases the precision of queries by including fewer results, and by default - will be interpreted as "AND NOT". For example, `wifi -luxury` will match documents that contain the term `wifi` and don't contain the term "luxury". This is arguably a more intuitive behavior for the `-` operator. Therefore, you should consider using `searchMode=all` instead of `searchMode=any` if you want to optimize searches for precision instead of recall, *and* Your users frequently use the `-` operator in searches.<br/><br/>When deciding on a `searchMode` setting, consider the user interaction patterns for queries in various applications. Users who are searching for information are more likely to include an operator in a query, as opposed to e-commerce sites that have more built-in navigation structures. |
+| AND | `+` | `wifi AND luxury` | Specifies terms that a match must contain. In the example, the query engine will look for documents containing both `wifi` and `luxury`. The plus character (`+`) can also be used directly in front of a term to make it required. For example, `+wifi +luxury` stipulates that both terms must appear somewhere in the field of a single document.|
+| OR | (none) <sup>1</sup> | `wifi OR luxury` | Finds a match when either term is found. In the example, the query engine will return match on documents containing either `wifi` or `luxury` or both. Because OR is the default conjunction operator, you could also leave it out, such that `wifi luxury` is the equivalent of  `wifi OR luxury`.|
+| NOT | `!`, `-` | `wifi –luxury` | Returns matches on documents that exclude the term. For example, `wifi –luxury` will search for documents that have the `wifi` term but not `luxury`. </p>The `searchMode` parameter on a query request controls whether a term with the NOT operator is ANDed or ORed with other terms in the query (assuming there's no boolean operators on the other terms). Valid values include `any` or `all`.  </p>`searchMode=any` increases the recall of queries by including more results, and by default `-` will be interpreted as "OR NOT". For example, `wifi -luxury` will match documents that either contain the term `wifi` or those that don't contain the term `luxury`.  </p>`searchMode=all` increases the precision of queries by including fewer results, and by default - will be interpreted as "AND NOT". For example, `wifi -luxury` will match documents that contain the term `wifi` and don't contain the term "luxury". This is arguably a more intuitive behavior for the `-` operator. Therefore, you should consider using `searchMode=all` instead of `searchMode=any` if you want to optimize searches for precision instead of recall, *and* Your users frequently use the `-` operator in searches.</p>When deciding on a `searchMode` setting, consider the user interaction patterns for queries in various applications. Users who are searching for information are more likely to include an operator in a query, as opposed to e-commerce sites that have more built-in navigation structures. |
+
+<sup>1</sup> The `|` character is not supported for OR operations.
 
 ##  <a name="bkmk_fields"></a> Fielded search
 
diff --git a/articles/static-web-apps/TOC.yml b/articles/static-web-apps/TOC.yml
@@ -88,6 +88,7 @@
           href: password-protection.md
     - name: Set up local development
       href: local-development.md
+      displayName: swa cli
     - name: Configure app settings
       href: application-settings.md
     - name: Configure front-end frameworks and libraries
diff --git a/articles/storage/blobs/assign-azure-role-data-access.md b/articles/storage/blobs/assign-azure-role-data-access.md
@@ -48,8 +48,6 @@ You can also assign an Azure Resource Manager role that provides additional perm
 
 > [!NOTE]
 > Prior to assigning yourself a role for data access, you will be able to access data in your storage account via the Azure portal because the Azure portal can also use the account key for data access. For more information, see [Choose how to authorize access to blob data in the Azure portal](../blobs/authorize-data-operations-portal.md).
->
-> The preview version of Storage Explorer in the Azure portal does not support using Azure AD credentials to view and modify blob data. Storage Explorer in the Azure portal always uses the account keys to access data. To use Storage Explorer in the Azure portal, you must be assigned a role that includes **Microsoft.Storage/storageAccounts/listkeys/action**.
 
 # [PowerShell](#tab/powershell)
 
diff --git a/articles/storage/blobs/authorize-data-operations-portal.md b/articles/storage/blobs/authorize-data-operations-portal.md
@@ -54,9 +54,6 @@ For information about the built-in roles that support access to blob data, see [
 
 Custom roles can support different combinations of the same permissions provided by the built-in roles. For more information about creating Azure custom roles, see [Azure custom roles](../../role-based-access-control/custom-roles.md) and [Understand role definitions for Azure resources](../../role-based-access-control/role-definitions.md).
 
-> [!NOTE]
-> The preview version of Storage Explorer in the Azure portal does not support using Azure AD credentials to view and modify blob data. Storage Explorer in the Azure portal always uses the account keys to access data. To use Storage Explorer in the Azure portal, you must be assigned a role that includes **Microsoft.Storage/storageAccounts/listkeys/action**.
-
 ## Navigate to blobs in the Azure portal
 
 To view blob data in the portal, navigate to the **Overview** for your storage account, and click on the links for **Blobs**. Alternatively you can navigate to the **Containers** section in the menu.
diff --git a/articles/storage/blobs/storage-quickstart-blobs-portal.md b/articles/storage/blobs/storage-quickstart-blobs-portal.md
@@ -7,7 +7,7 @@ author: stevenmatthew
 ms.service: storage
 ms.subservice: blobs
 ms.topic: quickstart
-ms.date: 10/25/2021
+ms.date: 04/04/2022
 ms.author: shaas
 ms.custom: mode-ui
 ---
diff --git a/articles/storage/common/authorize-data-access.md b/articles/storage/common/authorize-data-access.md
@@ -24,7 +24,7 @@ The following table describes the options that Azure Storage offers for authoriz
 | Azure Files (SMB) | [Supported](/rest/api/storageservices/authorize-with-shared-key/) | Not supported | [Supported, only with AAD Domain Services](../files/storage-files-active-directory-overview.md) | [Supported, credentials must be synced to Azure AD](../files/storage-files-active-directory-overview.md) | Not supported |
 | Azure Files (REST) | [Supported](/rest/api/storageservices/authorize-with-shared-key/) | [Supported](storage-sas-overview.md) | Not supported | Not supported | Not supported |
 | Azure Queues | [Supported](/rest/api/storageservices/authorize-with-shared-key/) | [Supported](storage-sas-overview.md) | [Supported](../queues/authorize-access-azure-active-directory.md) | Not Supported | Not supported |
-| Azure Tables | [Supported](/rest/api/storageservices/authorize-with-shared-key/) | [Supported](storage-sas-overview.md) | [Supported](../tables/authorize-access-azure-active-directory.md) (preview) | Not supported | Not supported |
+| Azure Tables | [Supported](/rest/api/storageservices/authorize-with-shared-key/) | [Supported](storage-sas-overview.md) | [Supported](../tables/authorize-access-azure-active-directory.md) | Not supported | Not supported |
 
 Each authorization option is briefly described below:
 
diff --git a/articles/storage/common/identity-library-acquire-token.md b/articles/storage/common/identity-library-acquire-token.md
@@ -36,7 +36,7 @@ When an Azure AD security principal attempts to access data in an Azure Storage
 
 - [Assign an Azure role for access to blob data](../blobs/assign-azure-role-data-access.md)
 - [Assign an Azure role for access to queue data](../queues/assign-azure-role-data-access.md)
-- [Assign an Azure role for access to table data (preview)](../tables/assign-azure-role-data-access.md)
+- [Assign an Azure role for access to table data](../tables/assign-azure-role-data-access.md)
 
 > [!NOTE]
 > When you create an Azure Storage account, you are not automatically assigned permissions to access data via Azure AD. You must explicitly assign yourself an Azure role for Azure Storage. You can assign it at the level of your subscription, resource group, storage account, or container, queue, or table.
diff --git a/articles/storage/files/storage-files-identity-ad-ds-assign-permissions.md b/articles/storage/files/storage-files-identity-ad-ds-assign-permissions.md
@@ -5,7 +5,7 @@ author: khdownie
 ms.service: storage
 ms.subservice: files
 ms.topic: how-to
-ms.date: 12/16/2021
+ms.date: 03/16/2022
 ms.author: kendownie 
 ms.custom: devx-track-azurepowershell, subject-rbac-steps, devx-track-azurecli 
 ms.devlang: azurecli
@@ -34,6 +34,7 @@ Most users should assign share-level permissions to specific Azure AD users or g
 There are three scenarios where we instead recommend using default share-level permissions assigned to all authenticated identities:
 
 - If you are unable to sync your on-premises AD DS to Azure AD, you can alternatively use a default share-level permission. Assigning a default share-level permission allows you to work around the sync requirement as you don't need to specify the permission to identities in Azure AD. Then you can use Windows ACLs for granular permission enforcement on your files and directories.
+    - Identities that are tied to an AD but aren't synching to Azure AD DS can also leverage the default share-level permission. This could include standalone Managed Service Accounts (sMSA), group Managed Service Accounts (gMSA), and computer service accounts. 
 - The on-premises AD DS you're using is synched to a different Azure AD than the Azure AD the file share is deployed in.
     - This is typical when you are managing multi-tenant environments. Using the default share-level permission allows you to bypass the requirement for a Azure AD hybrid identity. You can still use Windows ACLs on your files and directories for granular permission enforcement.
 - You prefer to enforce authentication only using Windows ACLS at the file and directory level. 
diff --git a/articles/storage/files/storage-files-identity-ad-ds-configure-permissions.md b/articles/storage/files/storage-files-identity-ad-ds-configure-permissions.md
@@ -5,15 +5,16 @@ author: khdownie
 ms.service: storage
 ms.subservice: files
 ms.topic: how-to
-ms.date: 09/16/2020
+ms.date: 03/16/2022
 ms.author: kendownie
 ---
 
 # Part three: configure directory and file level permissions over SMB 
 
 Before you begin this article, make sure you completed the previous article, [Assign share-level permissions to an identity](storage-files-identity-ad-ds-assign-permissions.md) to ensure that your share-level permissions are in place.
 
-After you assign share-level permissions with Azure RBAC, you must configure proper Windows ACLs at the root, directory, or file level, to take advantage of granular access control. Think of the Azure RBAC share-level permissions as the high-level gatekeeper that determines whether a user can access the share. While the Windows ACLs operate at a more granular level to determine what operations the user can do at the directory or file level. Both share-level and file/directory level permissions are enforced when a user attempts to access a file/directory, so if there is a difference between either of them, only the most restrictive one will be applied. For example, if a user has read/write access at the file-level, but only read at a share-level, then they can only read that file. The same would be true if it was reversed, and a user had read/write access at the share-level, but only read at the file-level, they can still only read the file.
+After you assign share-level permissions with Azure RBAC, you must configure proper Windows ACLs at the root, directory, or file level, to take advantage of granular access control. The Azure RBAC share-level permissions act as a high-level gatekeeper that determines whether a user can access the share. While the Windows ACLs operate at a more granular level to control what operations the user can do at the directory or file level. Both share-level and file/directory level permissions are enforced when a user attempts to access a file/directory, so if there is a difference between either of them, only the most restrictive one will be applied. For example, if a user has read/write access at the file-level, but only read at a share-level, then they can only read that file. The same would be true if it was reversed, and a user had read/write access at the share-level, but only read at the file-level, they can still only read the file.
+
 
 ## Applies to
 | File share type | SMB | NFS |
@@ -72,7 +73,10 @@ The following permissions are included on the root directory of a file share:
 
 ## Mount a file share from the command prompt
 
-Use the Windows `net use` command to mount the Azure file share. Remember to replace the placeholder values in the following example with your own values. For more information about mounting file shares, see [Use an Azure file share with Windows](storage-how-to-use-files-windows.md). 
+Use the Windows `net use` command to mount the Azure file share. Remember to replace the placeholder values in the following example with your own values. For more information about mounting file shares, see [Use an Azure file share with Windows](storage-how-to-use-files-windows.md).
+
+> [!NOTE]
+> You may see the *Full Control** ACL applied to a role already. This typically already offers the ability to assign permissions. However, because there are access checks at two levels (the share-level and the file-level), this is restricted. Only users who have the **SMB Elevated Contributor** role and create a new file or folder can assign permissions on those specific new files or folders without the use of the storage account key. All other permission assignment requires mounting the share with the storage account key, first.
 
 ```
 $connectTestResult = Test-NetConnection -ComputerName <storage-account-name>.file.core.windows.net -Port 445
diff --git a/articles/storage/files/storage-how-to-use-files-portal.md b/articles/storage/files/storage-how-to-use-files-portal.md
@@ -4,7 +4,7 @@ description: See how to create and use Azure file shares with the Azure portal,
 author: khdownie
 ms.service: storage
 ms.topic: quickstart
-ms.date: 09/17/2021
+ms.date: 04/04/2022
 ms.author: kendownie
 ms.subservice: files
 ms.custom: mode-ui, devx-track-azurecli 
@@ -34,7 +34,7 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
 
 [!INCLUDE [cloud-shell-try-it.md](../../../includes/cloud-shell-try-it.md)]
 
-If you would like to install and use PowerShell locally, this guide requires the Azure PowerShell module Az version 0.7 or later. To find out which version of the Azure PowerShell module you are running, execute `Get-Module -ListAvailable Az`. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you are running PowerShell locally, you also need to run `Login-AzAccount` to log in to your Azure account.
+If you'd like to install and use PowerShell locally, this guide requires the Azure PowerShell module Az version 7.0.0 or later. To find out which version of the Azure PowerShell module you're running, execute `Get-InstalledModule Az`. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Login-AzAccount` to log in to your Azure account. To use multi-factor authentication, you'll need to supply your Azure tenant ID, such as `Login-AzAccount -TenantId <TenantId>`.
 
 # [Azure CLI](#tab/azure-cli)
 
diff --git a/articles/storage/queues/assign-azure-role-data-access.md b/articles/storage/queues/assign-azure-role-data-access.md
diff --git a/articles/storage/queues/authorize-data-operations-portal.md b/articles/storage/queues/authorize-data-operations-portal.md
diff --git a/articles/storage/tables/assign-azure-role-data-access.md b/articles/storage/tables/assign-azure-role-data-access.md
diff --git a/articles/storage/tables/authorize-access-azure-active-directory.md b/articles/storage/tables/authorize-access-azure-active-directory.md
diff --git a/articles/storage/tables/authorize-managed-identity.md b/articles/storage/tables/authorize-managed-identity.md

Original file line number	Diff line number	Diff line change
`@@ -428,7 +428,7 @@ new PoolAddParameter`
`428`	`428`	`RelativeMountPath = "cifsmountpoint",`
`429`	`429`	`Source = "source",`
`430`	`430`	`Password = "StorageAccountKey",`
`431`		`- MountOptions = "-o vers=3.0,dir_mode=0777,file_mode=0777,serverino"`
	`431`	`+ MountOptions = "-o vers=3.0,dir_mode=0777,file_mode=0777,serverino,domain=MyDomain"`
`432`	`432`	`},`
`433`	`433`	`}`
`434`	`434`	`}`