You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/devices/howto-manage-local-admin-passwords.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,12 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: devices
8
8
ms.topic: how-to
9
-
ms.date: 04/20/2023
9
+
ms.date: 04/21/2023
10
10
11
11
ms.author: sandeo
12
12
author: sandeo-MSFT
13
13
ms.reviewer: joflore
14
+
ms.custom: references_regions
14
15
15
16
ms.collection: M365-identity-device-management
16
17
---
@@ -72,7 +73,7 @@ LAPS is supported on Azure AD joined or hybrid Azure AD joined devices only. Azu
72
73
73
74
LAPS is available to all customers with Azure AD Free or higher licenses. Other related features like administrative units, custom roles, Conditional Access, and Intune have other licensing requirements.
74
75
75
-
## Required roles or permission
76
+
###Required roles or permission
76
77
77
78
Other than the built-in Azure AD roles of Cloud Device Administrator, Intune Administrator, and Global Administrator that are granted *device.LocalCredentials.Read.All*, you can use [Azure AD custom roles](/azure/active-directory/roles/custom-create) or administrative units to authorize local administrator password recovery. For example,
78
79
@@ -117,7 +118,7 @@ Conditional Access policies can be scoped to the built-in roles like Cloud Devic
117
118
> [!NOTE]
118
119
> Other role types including administrative unit-scoped roles and custom roles aren't supported
119
120
120
-
## Frequently Asked Questions
121
+
## Frequently asked questions
121
122
122
123
### Is Windows LAPS with Azure AD management configuration supported using Group Policy Objects (GPO)?
Copy file name to clipboardExpand all lines: articles/dms/known-issues-azure-sql-migration-azure-data-studio.md
+13-1Lines changed: 13 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.custom: seo-lt-2019
15
15
Known issues and troubleshooting steps associated with the Azure SQL Migration extension for Azure Data Studio.
16
16
17
17
> [!IMPORTANT]
18
-
> The latest version of Integration Runtime (5.28.8488) prevents access to a network file share on a local host. This security measure will lead to failures when performing the pre-migration validation using Azure Data Studio as a client. Please ensure you run Integration Runtime on a different machine than the network share hosting.
18
+
> The latest version of Integration Runtime (5.28.8488) prevents access to a network file share on a local host. This security measure will lead to failures when performing migrations to Azure SQL using DMS. Please ensure you run Integration Runtime on a different machine than the network share hosting.
19
19
20
20
## Error code: 2007 - CutoverFailedOrCancelled
21
21
@@ -215,6 +215,18 @@ WHERE STEP in (3,4,6);
215
215
216
216
-**Recommendation**: For more troubleshooting steps, see [Troubleshoot Azure Data Factory and Synapse pipelines](../data-factory/data-factory-troubleshoot-guide.md#error-code-2108).
-**Message**: `The value of the property '' is invalid: 'Access to <share path> is denied, resolved IP address is <IP address>, network type is OnPremise'.`
222
+
223
+
-**Cause**: The network share where the database backups are stored is in the same machine as the self-hosted Integration Runtime (SHIR).
224
+
225
+
-**Recommendation**: The latest version of Integration Runtime (**5.28.8488**) prevents access to a network file share on a local host. Please ensure you run Integration Runtime on a different machine than the network share hosting. If hosting the self-hosted Integration Runtime and the network share on different machines is not possible with your current migration setup, you can use the option to opt-out using ```DisableLocalFolderPathValidation```.
226
+
> [!NOTE]
227
+
> For more information, see [Set up an existing self-hosted IR via local PowerShell](../data-factory/create-self-hosted-integration-runtime.md#set-up-an-existing-self-hosted-ir-via-local-powershell). Use the disabling option with discretion as this is less secure.
228
+
229
+
218
230
## Error code: 2056 - SqlInfoValidationFailed
219
231
220
232
-**Message**: CollationMismatch: `Source database collation <CollationOptionSource> is not the same as the target database <CollationOptionTarget>. Source database: <SourceDatabaseName> Target database: <TargetDatabaseName>.`
|**Denver**|[CoreSite DE1](https://www.coresite.com/data-centers/locations/denver/de1)| 1 | West Central US | Supported | CoreSite, Megaport, PacketFabric, Zayo |
|**[Verizon](https://enterprise.verizon.com/products/network/application-enablement/secure-cloud-interconnect/)**|Supported |Supported | Amsterdam, Chicago, Dallas, Hong Kong SAR, London, Mumbai, Silicon Valley, Singapore, Sydney, Tokyo, Toronto, Washington DC |
175
-
|**[Viasat](http://www.directcloud.viasatbusiness.com/)**| Supported | Supported | Washington DC2 |
175
+
|**[Viasat](https://news.viasat.com/newsroom/press-releases/viasat-introduces-direct-cloud-connect-a-new-service-providing-fast-secure-private-connections-to-business-critical-cloud-services)**| Supported | Supported | Washington DC2 |
176
176
|**[Vocus Group NZ](https://www.vocus.co.nz/business/cloud-data-centres)**| Supported | Supported | Auckland, Sydney |
Copy file name to clipboardExpand all lines: articles/expressroute/expressroute-monitoring-metrics-alerts.md
+27-2Lines changed: 27 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,7 +64,9 @@ Metrics explorer supports SUM, MAX, MIN, AVG and COUNT as [aggregation types](..
64
64
|[Count of routes advertised to peer](#advertisedroutes)| Availability | Count | Maximum | Count Of Routes Advertised To Peer by ExpressRouteGateway | roleInstance | Yes |
65
65
|[Count of routes learned from peer](#learnedroutes)| Availability | Count | Maximum | Count Of Routes Learned From Peer by ExpressRouteGateway | roleInstance | Yes |
66
66
|[Frequency of routes changed](#frequency)| Availability | Count | Total | Frequency of Routes change in ExpressRoute Gateway | roleInstance | Yes |
67
-
|[Number of VMs in virtual network](#vm)| Availability | Count | Maximum | Number of VMs in the Virtual Network | No Dimensions | Yes |
67
+
|[Number of VMs in virtual network](#vm)| Availability | Count | Maximum | Number of VMs in the Virtual Network | No Dimensions | Yes |
68
+
|[Active flows](#activeflows)| Scalability | Count | Average | Number of active flows on ExpressRoute Gateway | roleInstance | Yes |
69
+
|[Max flows created per second](#maxflows)| Scalability | FlowsPerSecond | Maximum | Maximum number of flows created per second on ExpressRoute Gateway | roleInstance, direction | Yes |
68
70
69
71
### ExpressRoute Gateway connections
70
72
@@ -223,7 +225,9 @@ When you deploy an ExpressRoute gateway, Azure manages the compute and functions
223
225
* Count of routes advertised to peers
224
226
* Count of routes learned from peers
225
227
* Frequency of routes changed
226
-
* Number of VMs in the virtual network
228
+
* Number of VMs in the virtual network
229
+
* Count of active flows
230
+
* Max flows created per second
227
231
228
232
It's highly recommended you set alerts for each of these metrics so that you're aware of when your gateway could be seeing performance issues.
229
233
@@ -287,6 +291,27 @@ This metric shows the number of virtual machines that are using the ExpressRoute
287
291
> To maintain reliability of the service, Microsoft often performs platform or OS maintenance on the gateway service. During this time, this metric may fluctuate and report inaccurately.
288
292
>
289
293
294
+
## <aname = "activeflows"></a>Active flows
295
+
296
+
Aggregation type: *Avg*
297
+
298
+
Split by: Gateway Instance
299
+
300
+
301
+
This metric displays a count of the total number of active flows on the ExpressRoute Gateway. Through split at instance level, you can see active flow count per gateway instance. For more information, see [understand network flow limits](../virtual-network/virtual-machine-network-throughput.md#network-flow-limits).
302
+
303
+
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/active-flows.png" alt-text="Screenshot of number of active flows per second metrics dashboard.":::
304
+
305
+
## <aname = "maxflows"></a>Max flows created per second
306
+
307
+
Aggregation type: *Max*
308
+
309
+
Split by: Gateway Instance and Direction (Inbound/Outbound)
310
+
311
+
This metric display maximum number of flows created per second on the ExpressRoute Gateway. Through split at instance level and direction, you can see max flow creation rate per gateway instance and inbound/outbound direction respectively. For more information, see [understand network flow limits](../virtual-network/virtual-machine-network-throughput.md#network-flow-limits).
312
+
313
+
:::image type="content" source="./media/expressroute-monitoring-metrics-alerts/max-flows-per-second.png" alt-text="Screenshot of the maximum number of flows created per second metrics dashboard.":::
314
+
290
315
## <aname = "connectionbandwidth"></a>ExpressRoute gateway connections in bits/seconds
title: Safe deployment of Azure Policy assignments
3
3
description: Learn how to apply the safe deployment practices (SDP) framework to your Azure Policy assignments.
4
-
author: timwarner-msft
5
-
ms.date: 11/14/2022
4
+
ms.date: 04/21/2023
6
5
ms.topic: conceptual
7
-
ms.author: timwarner
8
6
---
7
+
9
8
# Safe deployment of Azure Policy assignments
10
9
11
10
As your environment expands, so does the demand for a controlled continuous deployment (CD)
@@ -30,77 +29,78 @@ Policy assignments that use the `deny` or `append` policy effects.
30
29
> [!NOTE]
31
30
> To learn more about Azure policy effects, see [Understand how effects work](../concepts/effects.md).
32
31
33
-
:::image type="content" source="safe-deployment-practices-flowchart-1.png" alt-text="Flowchart with steps one through eight showing safe deployment practices deployment of a new Azure Policy definition." border="true":::
32
+
:::image type="content" source="../media/policy-safe-deployment-practices/safe-deployment-practices-flowchart-1.png" alt-text="Flowchart with steps one through eight showing safe deployment practices deployment of a new Azure Policy definition." border="true":::
33
+
34
+
Flowchart step numbers:
34
35
35
-
1. Begin the release by creating a policy definition at the highest designated Azure management scope.
36
-
We recommend storing Azure Policy definitions at the management group scope for maximum flexibility.
36
+
1. Begin the release by creating a policy definition at the highest designated Azure management scope. We recommend storing Azure Policy definitions at the management group scope for maximum flexibility.
37
37
38
38
2. Once you've created your policy definition, assign the policy at the highest-level scope inclusive
39
39
of all deployment rings. Apply _resource selectors_ to narrow the applicability to the least
40
40
critical ring by using the `"kind": "resource location"` property. Configure the `audit` effect type
41
-
by using _assignment overrides_. Sample selector with eastUS location and effect as audit
41
+
by using _assignment overrides_. Sample selector with `eastUS` location and effect as `audit`:
42
42
43
-
```json
43
+
```json
44
44
"resourceSelectors": [{
45
-
"name": "SDPRegions",
46
-
"selectors": [{
47
-
"kind": "resourceLocation",
48
-
"in": [ "eastUS" ]
49
-
}]
45
+
"name": "SDPRegions",
46
+
"selectors": [{
47
+
"kind": "resourceLocation",
48
+
"in": [ "eastUS" ]
49
+
}]
50
50
}],
51
51
"overrides":[{
52
-
"kind": "policyEffect",
53
-
"value": "Audit"
52
+
"kind": "policyEffect",
53
+
"value": "Audit"
54
54
}]
55
-
```
55
+
```
56
56
57
57
3. Once the assignment is deployed and the initial compliance scan has completed,
58
58
validate that the compliance result is as expected.
59
59
60
-
You should also configure automated tests that run compliance checks. A compliance check should
61
-
encompass the following logic:
62
-
63
-
- Gather compliance results
64
-
- If compliance results are as expected, the pipeline should continue
65
-
- If compliance results aren't as expected, the pipeline should fail and you should start debugging
66
-
67
-
For example, you can configure the compliance check by using other tools within
68
-
your particular continuous integration/continuous deployment (CI/CD) pipeline.
69
-
70
-
At each rollout stage, the application health checks should confirm the stability of the service
71
-
and impact of the policy. If the results aren't as expected due to application configuration,
72
-
refactor the application as appropriate.
73
-
74
-
4. Repeat by expanding the resource selector property values to include the next rings’
60
+
You should also configure automated tests that run compliance checks. A compliance check should
61
+
encompass the following logic:
62
+
63
+
- Gather compliance results
64
+
- If compliance results are as expected, the pipeline should continue
65
+
- If compliance results aren't as expected, the pipeline should fail and you should start debugging
66
+
67
+
For example, you can configure the compliance check by using other tools within
68
+
your particular continuous integration/continuous deployment (CI/CD) pipeline.
69
+
70
+
At each rollout stage, the application health checks should confirm the stability of the service
71
+
and impact of the policy. If the results aren't as expected due to application configuration,
72
+
refactor the application as appropriate.
73
+
74
+
4. Repeat by expanding the resource selector property values to include the next rings'
75
75
locations and validating the expected compliance results and application health. Example selector with an added location value:
76
76
77
-
```json
77
+
```json
78
78
"resourceSelectors": [{
79
-
"name": "SDPRegions",
80
-
"selectors": [{
81
-
"kind": "resourceLocation",
82
-
"in": [ "eastUS", "westUS"]
83
-
}]
79
+
"name": "SDPRegions",
80
+
"selectors": [{
81
+
"kind": "resourceLocation",
82
+
"in": [ "eastUS", "westUS"]
83
+
}]
84
84
}]
85
-
```
85
+
```
86
86
87
87
5. Once you have successfully assigned the policy to all rings using `audit` mode,
88
88
the pipeline should trigger a task that changes the policy effect to `deny` and reset
89
89
the resource selectors to the location associated with _Ring 0_. Example selector with one region and effect set to deny:
90
90
91
-
```json
91
+
```json
92
92
"resourceSelectors": [{
93
-
"name": "SDPRegions",
94
-
"selectors": [{
95
-
"kind": "resourceLocation",
96
-
"in": [ "eastUS" ]
97
-
}]
93
+
"name": "SDPRegions",
94
+
"selectors": [{
95
+
"kind": "resourceLocation",
96
+
"in": [ "eastUS" ]
97
+
}]
98
98
}],
99
99
"overrides":[{
100
-
"kind": "policyEffect",
101
-
"value": "Deny"
100
+
"kind": "policyEffect",
101
+
"value": "Deny"
102
102
}]
103
-
```
103
+
```
104
104
105
105
6. Once the effect is changed, automated tests should check whether enforcement is taking place as
106
106
expected.
@@ -114,7 +114,9 @@ expected.
114
114
Steps 1-4 for policies using the `modify` or `deployIfNotExists` effects are the same as steps previously explained.
115
115
Review the following flowchart with modified steps 5-9:
116
116
117
-
:::image type="content" source="safe-deployment-practices-flowchart-2.png" alt-text="Flowchart showing steps 5 through 9 in the Azure Policy safe deployment practices workflow." border="true":::
117
+
:::image type="content" source="../media/policy-safe-deployment-practices/safe-deployment-practices-flowchart-2.png" alt-text="Flowchart showing steps 5 through 9 in the Azure Policy safe deployment practices workflow." border="true":::
118
+
119
+
Flowchart step numbers:
118
120
119
121
5. Once you've assigned the policy to all rings using `audit` mode, the pipeline should trigger
120
122
a task that changes the policy effect to `modify` or `deployIfNotExists` and resets
@@ -131,8 +133,9 @@ as expected using compliance and application health checks.
131
133
132
134
> [!NOTE]
133
135
> For more information on Azure policy remediation tasks, read [Remediate non-compliant resources with Azure Policy](./remediate-resources.md).
136
+
134
137
## Next steps
135
138
136
-
- Learn how to [programmatically create policies](./programmatically-create.md)
137
-
- Review [Azure Policy as code workflows](../concepts/policy-as-code.md)
138
-
- Study Microsoft's guidance concerning [safe deployment practices](/devops/operate/safe-deployment-practices)
139
+
- Learn how to [programmatically create policies](./programmatically-create.md).
140
+
- Review [Azure Policy as code workflows](../concepts/policy-as-code.md).
141
+
- Study Microsoft's guidance concerning [safe deployment practices](/devops/operate/safe-deployment-practices).
0 commit comments