Merge pull request #90499 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to master to sync with https://github.com/Microsoft/azure-docs (branch master)

Author: v-alje

articles/azure-monitor/insights/container-insights-log-search.md

@@ -64,6 +64,7 @@ It's often useful to build queries that start with an example or two and then mo
 | ContainerImageInventory<br> &#124; summarize AggregatedValue = count() by Image, ImageTag, Running | Image inventory | 
 | **Select the Line chart display option**:<br> Perf<br> &#124; where ObjectName == "K8SContainer" and CounterName == "cpuUsageNanoCores" &#124; summarize AvgCPUUsageNanoCores = avg(CounterValue) by bin(TimeGenerated, 30m), InstanceName | Container CPU | 
 | **Select the Line chart display option**:<br> Perf<br> &#124; where ObjectName == "K8SContainer" and CounterName == "memoryRssBytes" &#124; summarize AvgUsedRssMemoryBytes = avg(CounterValue) by bin(TimeGenerated, 30m), InstanceName | Container memory |
+| InsightsMetrics<br> &#124; where Name == "requests_count"<br> &#124; summarize Val=any(Val) by TimeGenerated=bin(TimeGenerated, 1m)<br> &#124; sort by TimeGenerated asc<br> &#124; project RequestsPerMinute = Val - prev(Val), TimeGenerated <br> &#124; render barchart  | Requests Per Minute with Custom Metrics |
 
 The following example is a Prometheus metrics query. The metrics collected are counts and in order to determine how many errors occurred within a specific time period, we have to subtract from the count. The dataset is partitioned by *partitionKey*, meaning for each unique set of *Name*, *HostName*, and *OperationType*, we run a subquery on that set that orders the logs by *TimeGenerated*, a process that makes it possible to find the previous *TimeGenerated* and the count recorded for that time, to determine a rate.
 
@@ -99,4 +100,4 @@ The output will show results similar to the following:
 
 ## Next steps
 
-Azure Monitor for containers does not include a predefined set of alerts. Review the [Create performance alerts with Azure Monitor for containers](container-insights-alerts.md) to learn how to create recommended alerts for high CPU and memory utilization to support your DevOps or operational processes and procedures. 
+Azure Monitor for containers does not include a predefined set of alerts. Review the [Create performance alerts with Azure Monitor for containers](container-insights-alerts.md) to learn how to create recommended alerts for high CPU and memory utilization to support your DevOps or operational processes and procedures. 

articles/governance/management-groups/create.md

@@ -32,9 +32,13 @@ can't use Resource Manager templates to create management groups.
 
 1. Log into the [Azure portal](https://portal.azure.com).
 
-1. Select **All services** > **Management groups**.
+1. Select **All services** > **Management + governance**.
 
-1. On the main page, select **New Management group**.
+1. Select **Cost Management + Billing**
+
+1. On the Cost Management + Billing - Management groups page, select **Management Groups**
+
+1. Select **+ Add management group**.
 
    ![Page for working with management groups](./media/main.png)
 
@@ -100,4 +104,4 @@ To learn more about management groups, see:
 - [How to change, delete, or manage your management groups](manage.md)
 - [Review management groups in Azure PowerShell Resources Module](/powershell/module/az.resources#resources)
 - [Review management groups in REST API](/rest/api/resources/managementgroups)
-- [Review management groups in Azure CLI](/cli/azure/account/management-group)
+- [Review management groups in Azure CLI](/cli/azure/account/management-group)

articles/key-vault/key-vault-subscription-move-fix.md

@@ -41,6 +41,8 @@ Because this vault was in tenant A before the move, the original value of **$vau
 
 Now that your vault is associated with the correct tenant ID and old access policy entries are removed, set new access policy entries with [Set-AzKeyVaultAccessPolicy](https://docs.microsoft.com/powershell/module/az.keyvault/Set-azKeyVaultAccessPolicy).
 
+If you are using MSI, you'll also have to update the MSI identity since the old identity will no longer be in the correct AAD tenant.
+
 ## Next steps
 
 If you have questions about Azure Key Vault, visit the [Azure Key Vault Forums](https://social.msdn.microsoft.com/forums/azure/home?forum=AzureKeyVault).

articles/role-based-access-control/role-assignments-template.md

@@ -154,6 +154,9 @@ New-AzDeployment -Location centralus -TemplateFile rbac-test.json -principalId $
 az deployment create --location centralus --template-file rbac-test.json --parameters principalId=$userid builtInRoleType=Reader
 ```
 
+> [!NOTE]
+> This template is not idempotent unless the same `roleNameGuid` value is provided as a parameter for each deployment of the template. If no `roleNameGuid` is provided, by default a new GUID is generated on each deployment and subsequent deployments will fail with a `Conflict: RoleAssignmentExists` error.
+
 ## Create a role assignment at a resource scope
 
 If you need to create a role assignment at the level of a resource, the format of the role assignment is different. You provide the resource provider namespace and resource type of the resource to assign the role to. You also include the name of the resource in the name of the role assignment.
@@ -175,8 +178,6 @@ To use the template, you must specify the following inputs:
 
 - The unique identifier of a user, group, or application to assign the role to
 - The role to assign
-- A unique identifier that will be used for the role assignment, or you can use the default identifier
-
 
 ```json
 {
@@ -200,13 +201,6 @@ To use the template, you must specify the following inputs:
                 "description": "Built-in role to assign"
             }
         },
-        "roleNameGuid": {
-            "type": "string",
-            "defaultValue": "[newGuid()]",
-            "metadata": {
-                "description": "A new GUID used to identify the role assignment"
-            }
-        },
         "location": {
             "type": "string",
             "defaultValue": "[resourceGroup().location]"
@@ -233,7 +227,7 @@ To use the template, you must specify the following inputs:
         {
             "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
             "apiVersion": "2018-09-01-preview",
-            "name": "[concat(variables('storageName'), '/Microsoft.Authorization/', parameters('roleNameGuid'))]",
+            "name": "[concat(variables('storageName'), '/Microsoft.Authorization/', guid(uniqueString(parameters('storageName'))))]",
             "dependsOn": [
                 "[variables('storageName')]"
             ],