Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into waf-tshoot

Author: halkazwini

articles/azure-compute-fleet/TOC.yml

@@ -6,6 +6,8 @@
     href: quickstart-create-portal.md
   - name: Create with ARM template
     href: quickstart-create-rest-api.md
+  - name: Create using Azure CLI
+    href: quickstart-create-azure-cli.md
   expand: true 
 - name: Allocation strategies
   href: allocation-strategies.md

articles/azure-compute-fleet/quickstart-create-azure-cli.md

@@ -0,0 +1,111 @@
+---
+title: Create an Azure Compute Fleet using Azure CLI
+description: Learn how to create an Azure Compute Fleet using Azure CLI.
+author: ykh015
+ms.author: yakhande
+ms.topic: how-to
+ms.service: azure-compute-fleet
+ms.date: 05/09/2025
+ms.reviewer: jushiman
+ms.custom: devx-track-azurecli
+---
+
+# Create an Azure Compute Fleet using Azure CLI
+
+This article steps through using the Azure CLI to create and deploy a Compute Fleet resource
+
+Make sure that you've installed the latest [Azure CLI](/cli/azure/install-az-cli2) and are logged in to an Azure account with [az login](/cli/azure/reference-index).
+
+## Launch Azure Cloud Shell
+
+The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.
+
+To open the Cloud Shell, select **Open Cloud Shell** from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to [https://shell.azure.com/cli](https://shell.azure.com/cli). Select **Copy** to copy the blocks of code, paste it into the Cloud Shell, and press enter to run it.
+
+## Prerequisites
+
+- If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
+- Before using Compute Fleet, complete the feature registration and configure role-based access controls (RBAC). 
+
+## Feature registration
+
+Register the Azure Compute Fleet resource provider with your subscription using Azure CLI. Registration can take up to 30 minutes to successfully show as registered.
+
+```azurecli-interactive
+az provider register --namespace 'Microsoft.AzureFleet'
+```
+
+## Define environment variables
+
+Define environment variables as follows.
+
+```bash
+export RANDOM_ID="$(openssl rand -hex 3)"
+export MY_RESOURCE_GROUP_NAME="myFleetResourceGroup$RANDOM_ID"
+export REGION=EastUS
+export MY_FLEET_NAME="myFleet$RANDOM_ID"
+export MY_USERNAME=azureuser
+export MY_VNET_NAME="myVNet$RANDOM_ID"
+export NETWORK_PREFIX="$(($RANDOM % 254 + 1))"
+export MY_VNET_PREFIX="10.$NETWORK_PREFIX.0.0/16"
+export MY_VM_SN_NAME="myVMSN$RANDOM_ID"
+export MY_VM_SN_PREFIX="10.$NETWORK_PREFIX.0.0/24"
+```
+
+## Create a resource group
+
+A resource group is a logical container into which Azure resources are deployed and managed. All resources must be placed in a resource group. The following command creates a resource group with the previously defined `$MY_RESOURCE_GROUP_NAME` and `$REGION` parameters.
+
+```azurecli-interactive
+az group create --name $MY_RESOURCE_GROUP_NAME --location $REGION
+```
+
+## Create virtual network and subnet
+
+Now you'll create a virtual network using the previously defined `$MY_VNET_PREFIX`, `$MY_VM_SN_NAME`, and `$MY_VM_SN_PREFIX` parameters.
+
+```azurecli-interactive
+az network vnet create  --name $MY_VNET_NAME  --resource-group $MY_RESOURCE_GROUP_NAME --location $REGION  --address-prefix $MY_VNET_PREFIX  --subnet-name $MY_VM_SN_NAME --subnet-prefix $MY_VM_SN_PREFIX
+```
+
+The following command gets the subnet ARM ID.
+
+```azurecli-interactive
+export MY_SUBNET_ID="$(az network vnet subnet show \
+  --resource-group $MY_RESOURCE_GROUP_NAME \
+  --vnet-name $MY_VNET_NAME \
+  --name $MY_VM_SN_NAME \
+  --query id --output tsv)"
+```
+
+## Set up the admin password
+
+Set up a password that meets the [password requirements for Azure VMs](https://learn.microsoft.com/azure/virtual-machines/windows/faq#what-are-the-password-requirements-when-creating-a-vm-).
+
+```bash
+export ADMIN_PASSWORD="Azure compliant password"
+```
+
+## Create a Compute Fleet
+
+Set up the compute profile which is applied to the underlying VMs.
+
+```bash
+export COMPUTE_PROFILE="{ 'baseVirtualMachineProfile': { 'storageProfile': { 'imageReference': { 'publisher':'canonical', 'offer':'0001-com-ubuntu-server-focal', 'sku': '20_04-lts-gen2', 'version': 'latest' } }, 'osProfile': { 'computerNamePrefix': 'vm', 'adminUsername': '$MY_USERNAME', 'adminPassword': '$ADMIN_PASSWORD'}, 'networkProfile': { 'networkInterfaceConfigurations': [{ 'name': 'nic', 'primary': 'true', 'enableIPForwarding': 'true', 'ipConfigurations': [{ 'name': 'ipc', 'subnet': { 'id': '$MY_SUBNET_ID' } }] }], 'networkApiVersion': '2020-11-01'} } }"
+```
+ 
+```azurecli-interactive
+az compute-fleet create --name $MY_FLEET_NAME --resource-group $MY_RESOURCE_GROUP_NAME --location $REGION \
+    --spot-priority-profile "{ 'capacity': 5 }" \
+    --regular-priority-profile "{ 'capacity': 5 }" \
+    --compute-profile "$COMPUTE_PROFILE" \
+    --vm-sizes-profile "[{ 'name': 'Standard_F1s' }]"
+```
+
+## Clean up resources (optional)
+
+To avoid Azure charges, you should clean up unneeded resources. When you no longer need your Compute Fleet and other resources, delete the resource group and all its resources with [az group delete](/cli/azure/group). The `--no-wait` parameter returns control to the prompt without waiting for the operation to complete. The `--yes` parameter confirms that you wish to delete the resources without another prompt to do so.
+
+## Next steps
+> [!div class="nextstepaction"]
+> [Learn how to modify a Compute Fleet.](modify-fleet.md)

articles/azure-functions/flex-consumption-plan.md

@@ -3,7 +3,7 @@ title: Azure Functions Flex Consumption plan hosting
 description: Running your function code in the Azure Functions Flex Consumption plan provides virtual network integration, dynamic scale (to zero), and reduced cold starts.
 ms.service: azure-functions
 ms.topic: concept-article
-ms.date: 11/01/2024
+ms.date: 05/08/2025
 ms.custom: references_regions, build-2024, ignite-2024
 # Customer intent: As a developer, I want to understand the benefits of using the Flex Consumption plan so I can get the scalability benefits of Azure Functions without having to pay for resources I don't need.
 ---
@@ -107,7 +107,7 @@ This table shows the language stack versions that are currently supported for Fl
 | Java | Java 11, Java 17 |
 | Node.js | Node 20   |
 | PowerShell | PowerShell 7.4   |
-| Python | Python 3.10, Python 3.11  | 
+| Python | Python 3.10, Python 3.11, Python 3.12  | 
 
 <sup>1</sup>[C# in-process mode](./functions-dotnet-class-library.md) isn't supported. You instead need to [migrate your .NET code project to run in the isolated worker model](migrate-dotnet-to-isolated-model.md).  
 <sup>2</sup>Requires version `1.20.0` or later of [Microsoft.Azure.Functions.Worker](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker) and version `1.16.2` or later of [Microsoft.Azure.Functions.Worker.Sdk](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Sdk).
@@ -134,7 +134,7 @@ Keep these other considerations in mind when using Flex Consumption plan:
 + **Host**: There's a 30-second time out for app initialization. When your function app takes longer than 30 seconds to start, you might see gRPC-related `System.TimeoutException` entries logged. You can't currently configure this time out. For more information, see [this host work item](https://github.com/Azure/azure-functions-host/issues/10482).
 + **Durable Functions**: Azure Storage is currently the only supported [storage provider](./durable/durable-functions-storage-providers.md) for Durable Functions when hosted in the Flex Consumption plan. See [recommendations](./durable/durable-functions-azure-storage-provider.md#flex-consumption-plan) when hosting Durable Functions in the Flex Consumption plan.
 + **Virtual network integration** Ensure that the `Microsoft.App` Azure resource provider is enabled for your subscription by [following these instructions](/azure/azure-resource-manager/management/resource-providers-and-types#register-resource-provider). The subnet delegation required by Flex Consumption apps is `Microsoft.App/environments`.
-+ **Triggers**: All triggers are fully supported except for Kafka and Azure SQL triggers. The Blob storage trigger only supports the [Event Grid source](./functions-event-grid-blob-trigger.md). Non-C# function apps must use version `[4.0.0, 5.0.0)` of the [extension bundle](./functions-bindings-register.md#extension-bundles), or a later version. 
++ **Triggers**: While all triggers are fully supported in a Flex Consumption plan, the Blob storage trigger only supports the [Event Grid source](./functions-event-grid-blob-trigger.md). Non-C# function apps must use version `[4.0.0, 5.0.0)` of the [extension bundle](./functions-bindings-register.md#extension-bundles), or a later version. 
 + **Regions**: Not all regions are currently supported. To learn more, see [View currently supported regions](flex-consumption-how-to.md#view-currently-supported-regions).
 + **Deployments**: Deployment slots aren't currently supported.
 + **Scale**: The lowest maximum scale is currently `40`. The highest currently supported value is `1000`. 

articles/azure-resource-manager/bicep/data-types.md

@@ -2,7 +2,7 @@
 title: Data types in Bicep
 description: This article describes the data types that are available in Bicep.
 ms.topic: reference
-ms.date: 01/10/2025
+ms.date: 05/09/2025
 ms.custom: devx-track-bicep
 ---
 
@@ -423,7 +423,7 @@ You can use the union type syntax in [user-defined data types](./user-defined-da
 
 Secure strings use the same format as string, and secure objects use the same format as object. With Bicep, you add the `@secure()` [decorator](./parameters.md#use-decorators) to a string or object.
 
-When you set a parameter to a secure string or secure object, the value of the parameter isn't saved to the deployment history or logged. If you set that secure value to a property that isn't expecting a secure value, the value isn't protected. For example, if you set a secure string to a tag, that value is stored as plain text. Use secure strings for passwords and secrets.
+When you set a parameter (or an output) to a secure string or secure object, the value of the parameter (or the output) isn't saved to the deployment history or logged. If you set that secure value to a property that isn't expecting a secure value, the value isn't protected. For example, if you set a secure string to a tag, that value is stored as plain text. Use secure strings for passwords and secrets.
 
 The following example shows two secure parameters:
 
@@ -435,6 +435,8 @@ param password string
 param configValues object
 ```
 
+For more information, see [Secure parameters](./parameters.md#secure-parameters) and [Secure outputs](./outputs.md#secure-outputs).
+
 ## Data type assignability
 
 In Bicep, you can assign a value of one type (source type) to another type (target type). The following table shows which source type (listed horizontally) you can or can't assign to which target type (listed vertically). In the table, _X_ means assignable, an empty space means not assignable, and _?_ means only if the types are compatible.

articles/azure-resource-manager/bicep/modules.md

@@ -3,7 +3,7 @@ title: Bicep modules
 description: This article describes how to define a module in a Bicep file and how to use module scopes.
 ms.topic: conceptual
 ms.custom: devx-track-bicep
-ms.date: 03/25/2025
+ms.date: 05/09/2025
 ---
 
 # Bicep modules
@@ -545,6 +545,8 @@ module stgModule '../create-storage-account/main.bicep' = {
 output storageEndpoint object = stgModule.outputs.storageEndpoint
 ```
 
+With Bicep version 0.35.1 and later, the `@secure()` decorator can be applied to module outputs to mark them as sensitive, ensuring that their values are not exposed in logs or deployment history. This is useful when a module needs to return sensitive data, such as a generated key or connection string, to the parent Bicep file without risking exposure. For more information, see [Secure outputs](./outputs.md#secure-outputs).
+
 ## Related content
 
 - For a tutorial, see [Build your first Bicep template](/training/modules/deploy-azure-resources-by-using-bicep-templates/).

articles/azure-resource-manager/bicep/outputs.md

@@ -3,7 +3,7 @@ title: Outputs in Bicep
 description: Learn how to define output values in Bicep.
 ms.topic: conceptual
 ms.custom: devx-track-bicep
-ms.date: 03/25/2025
+ms.date: 05/09/2025
 ---
 
 # Outputs in Bicep
@@ -68,6 +68,7 @@ Decorators are written in the format `@expression` and are placed above output d
 | [minLength](#length-constraints) | array, string | int | This provides the minimum length for string and array outputs, and the value is inclusive. |
 | [minValue](#integer-constraints) | int | int | This provides the minimum value for the integer output, and the value is inclusive. |
 | [sealed](#sealed) | object | none | Elevate [BCP089](./diagnostics/bcp089.md) from a warning to an error when a property name of a use-define data type is likely a typo. For more information, see [Elevate error level](./user-defined-data-types.md#elevate-error-level). |
+| [secure](#secure-outputs) | string, object | none | Marks the output as secure. The value for a secure output isn't saved to the deployment history and isn't logged. For more information, see [Secure strings and objects](data-types.md#secure-strings-and-objects). |
 
 Decorators are in the [`sys` namespace](bicep-functions.md#namespaces-for-functions). If you need to differentiate a decorator from another item with the same name, preface the decorator with `sys`. For example, if your Bicep file includes a parameter named `description`, you must add the `sys` namespace when using the **description** decorator.
 
@@ -150,6 +151,20 @@ When you provide a `@metadata()` decorator with a property that conflicts with a
 
 See [Elevate error level](./user-defined-data-types.md#elevate-error-level).
 
+### Secure outputs
+
+With Bicep version 0.35.1 and later, you can mark string or object outputs as secure. When an output is decorated with `@secure()`, Azure Resource Manager treats the output value as sensitive, preventing it from being logged or displayed in deployment history, Azure portal, or command-line outputs.
+
+```bicep
+@secure()
+output demoPassword string
+
+@secure()
+output demoSecretObject object
+```
+
+The `@secure()` decorator is valid only for outputs of type string or object, as these align with the [secureString](../templates/syntax.md#outputs) and [secureObject](../templates/syntax.md#outputs) types in ARM templates. To pass arrays or numbers securely, wrap them in a secureObject or serialize them as a secureString.
+
 ## Conditional output
 
 When the value to return depends on a condition in the deployment, use the `?` operator.

articles/azure-resource-manager/bicep/parameters.md

@@ -3,7 +3,7 @@ title: Parameters in Bicep files
 description: Learn how to define and use parameters in a Bicep file.
 ms.topic: conceptual
 ms.custom: devx-track-bicep
-ms.date: 03/25/2025
+ms.date: 05/09/2025
 ---
 
 # Parameters in Bicep
@@ -207,7 +207,7 @@ See [Elevate error level](./user-defined-data-types.md#elevate-error-level).
 
 ### Secure parameters
 
-You can mark string or object parameters as secure. The value of a secure parameter isn't saved to the deployment history and isn't logged.
+You can mark string or object parameters as secure. When a parameter is decorated with `@secure()`, Azure Resource Manager treats the parameter value as sensitive, preventing it from being logged or displayed in deployment history, Azure Portal, or command-line outputs.
 
 ```bicep
 @secure()
@@ -232,6 +232,8 @@ resource keyvault 'Microsoft.KeyVault/vaults@2019-09-01' = {
 }
 ```
 
+The `@secure()` decorator is valid only for parameters of type string or object, as these align with the [secureString](../templates/syntax.md#parameters) and [secureObject](../templates/syntax.md#parameters) types in ARM templates. To pass arrays or numbers securely, wrap them in a secureObject or serialize them as a secureString.
+
 ## Use objects as parameters
 
 It can be easier to organize related values by passing them in as an object. This approach also reduces the number of parameters in the template.

articles/batch/batch-management-dotnet.md

@@ -2,7 +2,7 @@
 title: Use the Batch Management .NET library to manage account resources
 description: Create, delete, and modify Azure Batch account resources with the Batch Management .NET library.
 ms.topic: how-to
-ms.date: 04/02/2025
+ms.date: 05/09/2025
 ms.devlang: csharp
 ms.custom: has-adal-ref, devx-track-csharp, devx-track-dotnet
 ---
@@ -157,8 +157,8 @@ To see Batch Management .NET in action, check out the [AccountManagement](https:
 1. Acquire a security token from Microsoft Entra ID by using [Acquire and cache tokens using the Microsoft Authentication Library (MSAL)](../active-directory/develop/msal-net-acquire-token-silently.md). If the user is not already signed in, they are prompted for their Azure credentials.
 2. With the security token obtained from Microsoft Entra ID, create a [SubscriptionClient](/dotnet/api/microsoft.azure.management.resourcemanager.subscriptionclient) to query Azure for a list of subscriptions associated with the account. The user can select a subscription from the list if it contains more than one subscription.
 3. Get credentials associated with the selected subscription.
-4. Create a [ResourceManagementClient](/dotnet/api/microsoft.azure.management.resourcemanagementclient) object by using the credentials.
-5. Use a [ResourceManagementClient](/dotnet/api/microsoft.azure.management.resourcemanagementclient) object to create a resource group.
+4. Create a [ResourceManagementClient](/dotnet/api/microsoft.azure.management.resourcemanager.resourcemanagementclient) object by using the credentials.
+5. Use a [ResourceManagementClient](/dotnet/api/microsoft.azure.management.resourcemanager.resourcemanagementclient) object to create a resource group.
 6. Use a [BatchManagementClient](/dotnet/api/microsoft.azure.management.batch.batchmanagementclient) object to perform several Batch account operations:
    - Create a Batch account in the new resource group.
    - Get the newly created account from the Batch service.

articles/storage/common/redundancy-migration.md

@@ -431,7 +431,7 @@ An LRS storage account containing blobs in the archive tier can be switched to G
 
 ### Protocol support
 
-You can't convert storage accounts to zone-redundancy (ZRS, GZRS, or RA-GZRS) if either of the following cases are true:
+Customer and support initiated conversions are not supported if either of the following cases are true:
 
 - NFSv3 protocol support is enabled for Azure Blob Storage
 - The storage account contains Azure Files NFSv4.1 shares with public endpoint access enabled