Merge pull request #295239 from MicrosoftDocs/main

2/24/2025 PM Publish

Author: Taojunshen

.openpublishing.redirection.json

@@ -5970,5 +5970,10 @@
       "redirect_url": "/azure/nat-gateway/nat-overview",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/sentinel/kusto-resources.md",
+      "redirect_url": "/kusto/query/kql-learning-resources?view=microsoft-sentinel?view=microsoft-sentinel&preserve-view=true&toc=/azure/sentinel/TOC.json&bc=/azure/sentinel/breadcrumb/toc.json",
+      "redirect_document_id": false
+    }
   ]
 }

articles/api-management/api-management-howto-properties.md

@@ -17,7 +17,7 @@ ms.custom: engagement-fy23, devx-track-azurecli
 
 [API Management policies](api-management-howto-policies.md) are a powerful capability of the system that allow the publisher to change the behavior of the API through configuration. Policies are a collection of statements that are executed sequentially on the request or response of an API. Policy statements can be constructed using literal text values, policy expressions, and named values.
 
-*Named values* are a global collection of name/value pairs in each API Management instance. There is no imposed limit on the number of items in the collection. Named values can be used to manage constant string values and secrets across all API configurations and policies. 
+*Named values* are a global collection of name/value pairs in each API Management instance. There's no imposed limit on the number of items in the collection. Named values can be used to manage constant string values and secrets across all API configurations and policies. 
 
 :::image type="content" source="media/api-management-howto-properties/named-values.png" alt-text="Named values in the Azure portal":::
 
@@ -44,10 +44,10 @@ Using key vault secrets is recommended because it helps improve API Management s
 * Secrets updated in the key vault are automatically rotated in API Management. After update in the key vault, a named value in API Management is updated within 4 hours. You can also manually refresh the secret using the Azure portal or via the management REST API.
 
 > [!NOTE]
-> The secrets stored in Azure Key Vault must be between 1 and 4096 characters, as API Management cannot retrieve values that exceed this limit.
+> The secrets stored in Azure Key Vault must be between 1 and 4096 characters, as API Management can't retrieve values that exceed this limit.
 ## Prerequisites
 
-* If you have not created an API Management service instance yet, see [Create an API Management service instance](get-started-create-service-instance.md).
+* If you haven't created an API Management service instance yet, see [Create an API Management service instance](get-started-create-service-instance.md).
 
 ### Prerequisites for key vault integration
 
@@ -59,8 +59,7 @@ Using key vault secrets is recommended because it helps improve API Management s
 
 - Enable a system-assigned or user-assigned [managed identity](api-management-howto-use-managed-service-identity.md) in the API Management instance.
 
-[!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
-
+[!INCLUDE [api-management-key-vault-secret-access](../../includes/api-management-key-vault-secret-access.md)]
 
 [!INCLUDE [api-management-key-vault-network](../../includes/api-management-key-vault-network.md)]
 
@@ -134,7 +133,7 @@ az apim nv show --resource-group apim-hello-word-resource-group \
     --service-name apim-hello-world --named-value-id named_value_01
 ```
 
-This example is a secret value. The previous command does not return the value. To see the value, run the [az apim nv show-secret](/cli/azure/apim/nv#az-apim-nv-show-secret) command:
+This example is a secret value. The previous command doesn't return the value. To see the value, run the [az apim nv show-secret](/cli/azure/apim/nv#az-apim-nv-show-secret) command:
 
 ```azurecli
 az apim nv show-secret --resource-group apim-hello-word-resource-group \

articles/api-management/api-management-howto-use-managed-service-identity.md

@@ -123,9 +123,9 @@ The `tenantId` property identifies which Microsoft Entra tenant the identity bel
 
 ## Configure Key Vault access using a managed identity
 
-The following configurations are needed for API Management to access secrets and certificates from an Azure key vault.
+The following configurations are needed for API Management to access certificates from an Azure key vault.
 
-[!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
+[!INCLUDE [api-management-key-vault-certificate-access](../../includes/api-management-key-vault-certificate-access.md)]
 
 [!INCLUDE [api-management-key-vault-network](../../includes/api-management-key-vault-network.md)]
 

articles/api-management/configure-custom-domain.md

@@ -89,8 +89,7 @@ To fetch a TLS/SSL certificate, API Management must have the list and get secret
     1. On the **Managed identities** page of your API Management instance, enable a system-assigned or user-assigned [managed identity](api-management-howto-use-managed-service-identity.md). Note the principal ID on that page.
     1.  Assign permissions to the managed identity to access the key vault. Use steps in the following section.
 
-    [!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
-
+    [!INCLUDE [api-management-key-vault-certificate-access](../../includes/api-management-key-vault-certificate-access.md)]
 
 If the certificate is set to `autorenew` and your API Management tier has an SLA (that is, in all tiers except the Developer tier), API Management will pick up the latest version automatically, without downtime to the service.
 

articles/app-service/environment/how-to-upgrade-preference.md

@@ -32,10 +32,10 @@ In smaller regions, Early and Late upgrade preferences might be very close to ea
 
 ## Manual upgrade preference
 
-Manual upgrade preference gives you the option to receive a notification when an upgrade is available. The availability is also visible in the Azure portal. After the upgrade is available, you'll have 15 days to start the upgrade process. If you don't start the upgrade within the 15 days, the upgrade is processed with the remaining automatic upgrades in the region.
+Manual upgrade preference gives you the option to receive a notification when an upgrade is available. The availability is also visible in the Azure portal. After the upgrade is available, you'll typically have 15 days to start the upgrade process. If you don't start the upgrade within the 15 days, the upgrade is processed with the remaining automatic upgrades in the region.
 
-> [!IMPORTANT]
-> In rare cases, you might see an upgrade is available in the **Configuration** page for your App Service Environment, but you don't receive a **Service Health** notification (if you [configure notifications](#configure-notifications)). If you don't receive a Service Health notification, this available upgrade isn't required and the 15-day time limit doesn't apply. This is a known bug that we are working to fix.
+> [!NOTE]
+> Our goal is to provide you with a 15-day notice before the upgrade is applied automatically. In rare cases, the notice period is less than 15 days. The "End Time" for the planned maintenance event that you receive always indicates the end of the notice period.
 > 
 
 Upgrades normally don't affect the availability of your apps. The upgrade adds extra instances to ensure that the same capacity is available during upgrade. Patched and restarted instances are added back in rotation, and when you have workloads sensitive to restarts you should plan to start the maintenance during non-business hours. The full upgrade process normally finishes within 18 hours, but could take longer. Once the upgrade is started the upgrade runs until it's complete and isn't paused during standard business hours.
@@ -44,6 +44,10 @@ Upgrades normally don't affect the availability of your apps. The upgrade adds e
 > In rare cases, the upgrade availability might be impacted by a security hotfix superseding the planned upgrade, or a regression found in the planned upgrade before it has been applied to your instance. In these rare cases, the available upgrade will be removed and will transition to automatic upgrade.
 > 
 
+> [!IMPORTANT]
+> In rare cases, you might see an upgrade is available in the **Configuration** page for your App Service Environment, but you don't receive a **Service Health** notification (if you [configure notifications](#configure-notifications)). If you don't receive a Service Health notification, this available upgrade isn't required and the 15-day time limit doesn't apply. This is a known bug that we are working to fix.
+> 
+
 ## Configure notifications
 
 When an upgrade is available, Azure adds a planned maintenance event in the Service Health dashboard of Azure Monitor. To see past notifications in the [Azure portal](https://portal.azure.com), navigate to **Home > Monitor > Service Health > Planned maintenance**. To make it easy to find the relevant events, select the **Service** box and check only the App Service type. You can also filter by subscription and region.

articles/app-service/environment/media/integrate-with-application-gateway/ilb-ase.png

@@ -218,6 +218,9 @@ To validate that the Azure Storage is mounted successfully for the app:
     1. Regenerate **key2**.
     1. In the storage mount configuration, update the access the key to use the regenerated **key2**.
     1. Regenerate **key1**.
+ 
+#### Configuration
+- If needing to use a real time file system, where changes to alter, add, or remove files are expected to be shown quickly, then use _Azure Files_ as the storage type when mounting storage. Azure Blob should be used when files are static and aren't expected to be changed. 
 
 #### Troubleshooting
 

articles/app-service/environment/media/upgrade-preference/service-health-dashboard.png

@@ -6,6 +6,7 @@ ms.author: msangapu
 ms.topic: article
 ms.custom: devx-track-bicep
 ms.date: 11/18/2022
+zone_pivot_groups: app-service-bicep
 ---
 
 # Create App Service app using Bicep
@@ -22,6 +23,8 @@ To effectively create resources with Bicep, you'll need to set up a Bicep [devel
 
 ## Review the template
 
+::: zone pivot="app-service-bicep-linux"
+
 The template used in this quickstart is shown below. It deploys an App Service plan and an App Service app on Linux and a sample Node.js "Hello World" app from the [Azure Samples](https://github.com/Azure-Samples) repo.
 
 ```bicep
@@ -113,6 +116,82 @@ To deploy a different language stack, update `linuxFxVersion` with appropriate v
 
 ---
 
+::: zone-end  
+
+::: zone pivot="app-service-bicep-windows-container"
+
+The template used in this quickstart is shown below. It deploys an App Service plan and an App Service app on Windows and a sample .NET "Hello World" app from the [Azure Samples](https://github.com/Azure-Samples) repo.
+
+```bicep
+param webAppName string = uniqueString(resourceGroup().id) // generate unique name for web app
+param location string = resourceGroup().location // location for all resources
+param sku string = 'P1V3' // The SKU of App Service Plan
+param dockerContainerImage string = 'mcr.microsoft.com/dotnet/framework/samples:aspnetapp' // sample .NET app
+var appServicePlanName = toLower('ASP-${webAppName}') // generate unique name for App Service Plan
+
+resource appServicePlan 'Microsoft.Web/serverfarms@2021-02-01' = {
+  name: appServicePlanName
+  location: location
+  sku: {
+    name: sku
+  }
+  properties: {
+    hyperV: true
+  }
+}
+
+resource webApp 'Microsoft.Web/sites@2024-04-01' = {
+  name: webAppName
+  location: location
+  kind:'app,container,windows'
+  properties: {
+    serverFarmId: appServicePlan.id
+    siteConfig: {
+      windowsFxVersion: 'DOCKER|${dockerContainerImage}'
+      appCommandLine: ''
+      alwaysOn: true
+      minTlsVersion: '1.3'
+    }
+    httpsOnly: true
+  }
+}
+
+```
+
+Two Azure resources are defined in the template:
+
+* [**Microsoft.Web/serverfarms**](/azure/templates/microsoft.web/serverfarms): create an App Service plan.
+* [**Microsoft.Web/sites**](/azure/templates/microsoft.web/sites): create an App Service app.
+
+This template contains several parameters that are predefined for your convenience. See the table below for parameter defaults and their descriptions:
+
+| Parameters | Type    | Default value                | Description |
+|------------|---------|------------------------------|-------------|
+| webAppName | string  | "webApp-**[`<uniqueString>`](../azure-resource-manager/templates/template-functions-string.md#uniquestring)**" | App name |
+| location   | string  | "[[resourceGroup().location](../azure-resource-manager/templates/template-functions-resource.md#resourcegroup)]" | App region |
+| sku        | string  | "P1V3"                         | Instance size  |
+| appServicePlanName        | string  | "toLower('ASP-${webAppName}')"              | App Service Plan name  |
+| dockerContainerImage    | string  | "mcr.microsoft.com/dotnet/framework/samples:aspnetapp"    | container image sample |
+
+---
+
+## Deploy the template
+
+Copy and paste the template to your preferred editor/IDE and save the file to your local working directory.
+
+Azure CLI is used here to deploy the template. You can also use the Azure portal, Azure PowerShell, and REST API. To learn other deployment methods, see [Bicep Deployment Commands](../azure-resource-manager/bicep/deploy-cli.md).
+
+The following code creates a resource group, an App Service plan, and a web app. A default resource group, App Service plan, and location have been set for you. Replace `<app-name>` with a globally unique app name (valid characters are `a-z`, `0-9`, and `-`).
+
+Open up a terminal where the Azure CLI is installed and run the code below to create a .NET app.
+
+```azurecli-interactive
+az group create --name myResourceGroup --location "southcentralus" &&
+az deployment group create --resource-group myResourceGroup --template-file <path-to-template>
+```
+
+::: zone-end 
+
 ## Validate the deployment
 
 Browse to `http://<app_name>.azurewebsites.net/` and verify it's been created.