Merge pull request #195423 from MicrosoftDocs/main

4/18 PM Publish

Author: huypub

articles/active-directory/conditional-access/concept-conditional-access-users-groups.md

@@ -74,7 +74,7 @@ By default the policy will provide an option to exclude the current user from th
 
 ![Warning, don't lock yourself out!](./media/concept-conditional-access-users-groups/conditional-access-users-and-groups-lockout-warning.png)
 
-If you do find yourself locked out[What to do if you are locked out of the Azure portal?](troubleshoot-conditional-access.md#what-to-do-if-youre-locked-out-of-the-azure-portal)
+If you do find yourself locked out, see [What to do if you are locked out of the Azure portal?](troubleshoot-conditional-access.md#what-to-do-if-youre-locked-out-of-the-azure-portal)
 
 ## Next steps
 

articles/active-directory/devices/howto-vm-sign-in-azure-ad-linux.md

@@ -56,6 +56,9 @@ It's not supported to use this extension on Azure Kubernetes Service (AKS) clust
 
 If you choose to install and use the CLI locally, you must be running the Azure CLI version 2.22.1 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI](/cli/azure/install-azure-cli).
 
+> [!NOTE]
+> This is functionality is also available for [Azure Arc-enabled servers](../../azure-arc/servers/ssh-arc-overview.md).
+
 ## Requirements for login with Azure AD using openSSH certificate-based authentication
 
 To enable Azure AD login using SSH certificate-based authentication for Linux VMs in Azure, ensure the following network, virtual machine, and client (ssh client) requirements are met.
@@ -365,8 +368,8 @@ For customers who are using previous version of Azure AD login for Linux that wa
    ```azurecli
    az vm extension delete -g MyResourceGroup --vm-name MyVm -n AADLoginForLinux
    ```
-> [!NOTE]
-> The extension uninstall can fail if there are any Azure AD users currently logged in on the VM. Make sure all users are logged off first.
+    > [!NOTE]
+    > The extension uninstall can fail if there are any Azure AD users currently logged in on the VM. Make sure all users are logged off first.
 
 1. Enable system-assigned managed identity on your VM.
 
@@ -448,7 +451,7 @@ Solution 1: Upgrade the Azure CLI client to version 2.21.0 or higher.
 
 After the user has successfully signed in using az login, connection to the VM using `az ssh vm -ip <addres>` or `az ssh vm --name <vm_name> -g <resource_group>` fails with *Connection closed by <ip_address> port 22*.
 
-Cause 1: The user isn’t assigned to the either the Virtual Machine Administrator/User Login Azure RBAC roles within the scope of this VM.
+Cause 1: The user isn’t assigned to either of the Virtual Machine Administrator/User Login Azure RBAC roles within the scope of this VM.
 
 Solution 1: Add the user to the either of the Virtual Machine Administrator/User Login Azure RBAC roles within the scope of this VM.
 

articles/active-directory/enterprise-users/domains-verify-custom-subdomain.md

@@ -25,11 +25,9 @@ After a root domain is added to Azure Active Directory (Azure AD), all subsequen
 
 In the Azure AD portal, when the parent domain is federated and the admin tries to verify a managed subdomain on the **Custom domain names** page, you'll get a 'Failed to add domain' error with the reason "One or more properties contains invalid values." If you try to add this subdomain from the Microsoft 365 admin center, you will receive a similar error. For more information about the error, see [A child domain doesn't inherit parent domain changes in Office 365, Azure, or Intune](/office365/troubleshoot/administration/child-domain-fails-inherit-parent-domain-changes).
 
-## How to verify a custom subdomain
-
 Because subdomains inherit the authentication type of the root domain by default, you must promote the subdomain to a root domain in Azure AD using the Microsoft Graph so you can set the authentication type to your desired type.
 
-### Add the subdomain and view its authentication type
+## Add the subdomain
 
 1. Use PowerShell to add the new subdomain, which has its root domain's default authentication type. The Azure AD and Microsoft 365 admin centers don't yet support this operation.
 
@@ -61,15 +59,15 @@ Because subdomains inherit the authentication type of the root domain by default
      },
    ```
 
-### Use Microsoft Graph API to make this a root domain
+## Change subdomain to a root domain
 
 Use the following command to promote the subdomain:
 
 ```http
 POST https://graph.microsoft.com/v1.0/domains/foo.contoso.com/promote
 ```
 
-#### Promote command error conditions
+### Promote command error conditions
 
 Scenario | Method | Code | Message
 -------- | ------ | ---- | -------

articles/api-management/api-management-api-import-restrictions.md

@@ -15,23 +15,27 @@ ms.author: danlep
 # API import restrictions and known issues
 
 When importing an API, you might encounter some restrictions or need to identify and rectify issues before you can successfully import. In this article, you'll learn:
+
 * API Management's behavior during OpenAPI import. 
 * OpenAPI import limitations and how OpenAPI export works.
 * Requirements and limitations for WSDL and WADL import.
 
 ## API Management during OpenAPI import
 
 During OpenAPI import, API Management:
+
 * Checks specifically for query string parameters marked as required.
 * Converts the query string parameters to template parameters. 
 
 If you prefer a different behavior, you can either: 
+
 * Manually change via form-based editor, or 
 * Remove the "required" attribute from the OpenAPI definition, thus not converting them to template parameters.
 
 ## <a name="open-api"> </a>OpenAPI/Swagger import limitations
 
 If you receive errors while importing your OpenAPI document, make sure you've validated it beforehand by either:
+
 * Using the designer in the Azure portal (Design > Front End > OpenAPI Specification Editor), or 
 * With a third-party tool, such as <a href="https://editor.swagger.io">Swagger Editor</a>.
 
@@ -52,10 +56,10 @@ If you receive errors while importing your OpenAPI document, make sure you've va
 **Supported versions**
 
 API Management only supports:
+
 * OpenAPI version 2.
 * OpenAPI version 3.0.x (up to version 3.0.3).
-
-OpenAPI version 3.1 is currently not supported in API Management.
+* OpenAPI version 3.1 (import only)
 
 **Size limitations**
 
@@ -65,6 +69,7 @@ OpenAPI version 3.1 is currently not supported in API Management.
 | **Size limit doesn't apply** | When an OpenAPI document is provided via a URL to a location accessible from your API Management service. |
 
 #### Supported extensions
+
 The only supported extensions are:
 
 | Extension | Description |
@@ -73,40 +78,62 @@ The only supported extensions are:
 | **`x-servers`** | A backport of the [OpenAPI 3 `servers` object](https://swagger.io/docs/specification/api-host-and-base-path/) for OpenAPI 2. |
 
 #### Unsupported extensions
+
 | Extension | Description |
 | ----------- | ----------- |
 | **`Recursion`** | API Management doesn't support definitions defined recursively.<br />For example, schemas referring to themselves. |
 | **`Server` object** | Not supported on the API operation level. |
 | **`Produces` keyword** | Describes MIME types returned by an API. <br />Not supported. |
 
 #### Custom extensions
-- Are ignored on import.
-- Aren't saved or preserved for export.
+
+* Are ignored on import.
+* Aren't saved or preserved for export.
 
 #### Unsupported definitions 
+
 Inline schema definitions for API operations aren't supported. Schema definitions:
-- Are defined in the API scope.
-- Can be referenced in API operations request or response scopes.
+
+* Are defined in the API scope.
+* Can be referenced in API operations request or response scopes.
 
 #### Ignored definitions
+
 Security definitions are ignored.
 
+#### Definition restrictions
+
+<!-- Ref: 1851786 Query parameter handling -->
+When importing query parameters, only the default array serialization method (`style: form`, `explode: true`) is supported.  For more details on query parameters in OpenAPI specifications, refer to [the serialization specification](https://swagger.io/docs/specification/serialization/).
+
+<!-- Ref: 1795433 Parameter limitations -->
+Parameters [defined in cookies](https://swagger.io/docs/specification/describing-parameters/#cookie-parameters) are not supported.  You can still use policy to decode and validate the contents of cookies.  
+
 ### <a name="open-api-v2"> </a>OpenAPI version 2
 
 OpenAPI version 2 support is limited to JSON format only.
 
-### <a name="open-api-v3"> </a>OpenAPI version 3.0.x
+<!-- Ref: 1795433 Parameter limitations -->
+["Form" type parameters](https://swagger.io/specification/v2/#parameter-object) are not supported.  You can still use policy to decode and validate `application/x-www-form-urlencoded` and `application/form-data` payloads.
+
+### <a name="open-api-v3"> </a>OpenAPI version 3.x
 
-The latest supported OpenAPI version 3.0 is 3.0.3.
+API Management supports the following specification versions:
+
+* [OpenAPI 3.0.3](https://swagger.io/specification/)
+* [OpenAPI 3.1.0](https://spec.openapis.org/oas/v3.1.0) (import only)
 
 #### HTTPS URLs
-- If multiple `servers` are specified, API Management will use the first HTTPS URL it finds. 
-- If there aren't any HTTPS URLs, the server URL will be empty.
+
+* If multiple `servers` are specified, API Management will use the first HTTPS URL it finds. 
+* If there aren't any HTTPS URLs, the server URL will be empty.
 
 #### Supported
+
 - `example`
 
 #### Unsupported
+
 The following fields are included in [OpenAPI version 3.0.x](https://swagger.io/specification/), but are not supported:
 
 | Object | Field |
@@ -122,6 +149,7 @@ The following fields are included in [OpenAPI version 3.0.x](https://swagger.io/
 ### <a name="open-import-export-general"> </a>General
 
 API definitions exported from an API Management service are:
+
 * Primarily intended for external applications that need to call the API hosted in API Management service. 
 * Not intended to be imported into the same or different API Management service. 
 

articles/app-service/environment/migrate.md

@@ -3,7 +3,7 @@ title: Migrate to App Service Environment v3 by using the migration feature
 description: Overview of the migration feature for migration to App Service Environment v3
 author: seligj95
 ms.topic: article
-ms.date: 4/11/2022
+ms.date: 4/15/2022
 ms.author: jordanselig
 ms.custom: references_regions
 ---
@@ -68,18 +68,18 @@ The App Service platform will review your App Service Environment to confirm mig
 
 If your App Service Environment doesn't pass the validation checks or you try to perform a migration step in the incorrect order, you may see one of the following error messages:
 
-|Error message      |Description  |
-|---------|---------|
-|Migrate can only be called on an ASE in ARM VNET and this ASE is in Classic VNET.     |App Service Environments in Classic VNets can't migrate using the migration feature.       |
-|ASEv3 Migration is not yet ready.     |The underlying infrastructure isn't ready to support App Service Environment v3.         |
-|Migration cannot be called on this ASE, please contact support for help migrating.     |Support will need to be engaged for migrating this App Service Environment. This is potentially due to custom settings used by this environment.         |
-|Migrate cannot be called on Zone Pinned ASEs.     |App Service Environment v2s that are zone pinned can't be migrated using the migration feature at this time.         |
-|Migrate cannot be called if IP SSL is enabled on any of the sites|App Service Environments that have sites with IP SSL enabled can't be migrated using the migration feature at this time. |
-|Migrate is not available for this kind|App Service Environment v1 can't be migrated using the migration feature at this time. |
-|Full migration cannot be called before IP addresses are generated|You'll see this error if you attempt to migrate before finishing the pre-migration steps. |
-|Migration to ASEv3 is not allowed for this ASE|You won't be able to migrate using the migration feature. |
-|Subscription has too many App Service Environments. Please remove some before trying to create more.|The App Service Environment [quota for your subscription](/azure/azure-resource-manager/management/azure-subscription-service-limits#app-service-limits) has been met. You'll need to remove unneeded environments or contact support to review your options.|
-|`<ZoneRedundant><DedicatedHosts><ASEv3/ASE>` is not available in this location|You'll see this error if you're trying to migrate an App Service Environment in a region that doesn't support one of your requested features. |
+|Error message      |Description  |Recommendation  |
+|---------|---------|----------|
+|Migrate can only be called on an ASE in ARM VNET and this ASE is in Classic VNET.     |App Service Environments in Classic VNets can't migrate using the migration feature.       |Migrate using one of the [manual migration options](migration-alternatives.md).  |
+|ASEv3 Migration is not yet ready.     |The underlying infrastructure isn't ready to support App Service Environment v3.         |Migrate using one of the [manual migration options](migration-alternatives.md) if you want to migrate immediately. Otherwise, wait for the migration feature to be available in your region.  |
+|Migration cannot be called on this ASE, please contact support for help migrating.     |Support will need to be engaged for migrating this App Service Environment. This is potentially due to custom settings used by this environment.         |Engage support to resolve your issue.  |
+|Migrate cannot be called on Zone Pinned ASEs.     |App Service Environment v2s that are zone pinned can't be migrated using the migration feature at this time.         |Migrate using one of the [manual migration options](migration-alternatives.md) if you want to migrate immediately. Otherwise, wait for the migration feature to support this App Service Environment configuration.  |
+|Migrate cannot be called if IP SSL is enabled on any of the sites|App Service Environments that have sites with IP SSL enabled can't be migrated using the migration feature at this time. |Migrate using one of the [manual migration options](migration-alternatives.md) if you want to migrate immediately. Otherwise, wait for the migration feature to support this App Service Environment configuration.  |
+|Migrate is not available for this kind|App Service Environment v1 can't be migrated using the migration feature at this time. |Migrate using one of the [manual migration options](migration-alternatives.md) if you want to migrate immediately. Otherwise, wait for the migration feature to support this App Service Environment configuration.  |
+|Full migration cannot be called before IP addresses are generated|You'll see this error if you attempt to migrate before finishing the pre-migration steps. |Ensure you've completed all pre-migration steps before you attempt to migrate. See the [step-by-step guide for migrating](how-to-migrate.md).  |
+|Migration to ASEv3 is not allowed for this ASE|You won't be able to migrate using the migration feature. |Migrate using one of the [manual migration options](migration-alternatives.md).  |
+|Subscription has too many App Service Environments. Please remove some before trying to create more.|The App Service Environment [quota for your subscription](/azure/azure-resource-manager/management/azure-subscription-service-limits#app-service-limits) has been met. |Remove unneeded environments or contact support to review your options.  |
+|`<ZoneRedundant><DedicatedHosts><ASEv3/ASE>` is not available in this location|You'll see this error if you're trying to migrate an App Service Environment in a region that doesn't support one of your requested features. |Migrate using one of the [manual migration options](migration-alternatives.md) if you want to migrate immediately. Otherwise, wait for the migration feature to support this App Service Environment configuration.  |
 
 ## Overview of the migration process using the migration feature
 

articles/app-service/tutorial-java-spring-cosmosdb.md

@@ -12,7 +12,7 @@ ms.custom: mvc, seodec18, seo-java-july2019, seo-java-august2019, seo-java-septe
 # Tutorial: Build a Java Spring Boot web app with Azure App Service on Linux and Azure Cosmos DB
 
 This tutorial walks you through the process of building, configuring, deploying, and scaling Java web apps on Azure. 
-When you are finished, you will have a [Spring Boot](https://projects.spring.io/spring-boot/) application storing data in [Azure Cosmos DB](../cosmos-db/index.yml) running on [Azure App Service on Linux](overview.md).
+When you are finished, you will have a [Spring Boot](https://spring.io/projects/spring-boot) application storing data in [Azure Cosmos DB](../cosmos-db/index.yml) running on [Azure App Service on Linux](overview.md).
 
 ![Spring Boot application storing data in Azure Cosmos DB](./media/tutorial-java-spring-cosmosdb/spring-todo-app-running-locally.jpg)
 

articles/application-gateway/proxy-buffers.md

@@ -12,7 +12,7 @@ ms.author: jaysoni
 
 # Configure Request and Response Proxy Buffers
 
-Azure Application Gateway Standard v2 and WAF v2 SKUs support buffering Requests (from clients) or Responses (from the backend servers). Based on the processing capabilities of the clients that interact with your Application Gateway, you can use these buffers to configure the speed of packet delivery.
+Azure Application Gateway Standard v2 SKU supports buffering Requests (from clients) or Responses (from the backend servers). Based on the processing capabilities of the clients that interact with your Application Gateway, you can use these buffers to configure the speed of packet delivery.
 
 ## Response Buffer 
 
@@ -69,3 +69,8 @@ You can change this setting by using GlobalConfiguration in the ARM template as
 } 
 ```
 For reference, visit [Azure SDK for .NET](/dotnet/api/microsoft.azure.management.network.models.applicationgatewayglobalconfiguration)
+
+## Limitations
+- API version 2020-01-01 or later should be used to configure buffers.
+- Currently, these changes are supported only through ARM templates.
+- Request and Response Buffers cannot be disabled for WAF v2 SKU.

articles/azure-arc/servers/agent-release-notes-archive.md

@@ -2,7 +2,7 @@
 title: Archive for What's new with Azure Arc-enabled servers agent
 description: The What's new release notes in the Overview section for Azure Arc-enabled servers agent contains six months of activity. Thereafter, the items are removed from the main article and put into this article.
 ms.topic: overview
-ms.date: 03/17/2022
+ms.date: 04/15/2022
 ms.custom: references_regions
 ---
 
@@ -16,6 +16,13 @@ The Azure Connected Machine agent receives improvements on an ongoing basis. Thi
 - Known issues
 - Bug fixes
 
+## Version 1.12 - October 2021
+
+### Fixed
+
+- Improved reliability when validating signatures of extension packages.
+- `azcmagent_proxy remove` command on Linux now correctly removes environment variables on Red Hat Enterprise Linux and related distributions.
+- `azcmagent logs` now includes the computer name and timestamp to help disambiguate log files.
 ## Version 1.11 - September 2021
 
 ### Fixed