Skip to content

Commit 6ce03df

Browse files
authored
Merge pull request #195464 from MicrosoftDocs/main
Merge main to live, 4 AM
2 parents 43d0b2d + 7a6782f commit 6ce03df

File tree

264 files changed

+3795
-3421
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

264 files changed

+3795
-3421
lines changed

.openpublishing.redirection.azure-monitor.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@
3030
"redirect_url": "/azure/azure-monitor/change/change-analysis-visualizations",
3131
"redirect_document_id": false
3232
},
33+
{
34+
"source_path_from_root": "/articles/azure-monitor/app/troubleshoot-portal-connectivity.md",
35+
"redirect_url": "https://docs.microsoft.com/troubleshoot/azure/azure-monitor/app-insights/troubleshoot-portal-connectivity",
36+
"redirect_document_id": false
37+
},
3338
{
3439
"source_path_from_root": "/articles/azure-monitor/app/change-analysis-troubleshoot.md",
3540
"redirect_url": "/azure/azure-monitor/change/change-analysis-troubleshoot",

articles/active-directory/managed-identities-azure-resources/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@
125125
href: how-to-assign-app-role-managed-identity-cli.md
126126
- name: View managed identity activity
127127
href: how-to-view-managed-identity-activity.md
128+
- name: Move a managed identity to a new region
129+
href: how-to-managed-identity-regional-move.md
128130

129131
- name: Reference
130132
items:
Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
title: Move managed identities to another region - Azure AD
3+
description: Steps involved in getting a managed identity recreated in another region
4+
services: active-directory
5+
documentationcenter:
6+
author: barclayn
7+
manager: karenhoran
8+
editor:
9+
10+
ms.service: active-directory
11+
ms.subservice: msi
12+
ms.topic: how-to
13+
ms.tgt_pltfrm: na
14+
ms.workload: identity
15+
ms.date: 04/13/2022
16+
ms.author: barclayn
17+
ms.custom: subject-moving-resources
18+
19+
---
20+
21+
# Move managed identity for Azure resources across regions
22+
23+
There are situations in which you'd want to move your existing user-assigned managed identities from one region to another. For example, you may need to move a solution that uses user-assigned managed identities to another region. You may also want to move an existing identity to another region as part of disaster recovery planning, and testing.
24+
25+
Moving User-assigned managed identities across Azure regions is not supported. You can however, recreate a user-assigned managed identity in the target region.
26+
27+
## Prerequisites
28+
29+
- Permissions to list permissions granted to existing user-assigned managed identity.
30+
- Permissions to grant a new user-assigned managed identity the required permissions.
31+
- Permissions to assign a new user-assigned identity to the Azure resources.
32+
- Permissions to edit Group membership, if your user-assigned managed identity is a member of one or more groups.
33+
34+
## Prepare and move
35+
36+
1. Copy user-assigned managed identity assigned permissions. You can list [Azure role assignments](../../role-based-access-control/role-assignments-list-powershell.md) but that may not be enough depending on how permissions were granted to the user-assigned managed identity. You should confirm that your solution doesn't depend on permissions granted using a service specific option.
37+
1. Create a [new user-assigned managed identity](how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-powershell#create-a-user-assigned-managed-identity-2) at the target region.
38+
1. Grant the managed identity the same permissions as the original identity that it's replacing, including Group membership. You can review [Assign Azure roles to a managed identity](../../role-based-access-control/role-assignments-portal-managed-identity.md), and [Group membership](../../active-directory/fundamentals/active-directory-groups-view-azure-portal.md).
39+
1. Specify the new identity in the properties of the resource instance that uses the newly created user assigned managed identity.
40+
41+
## Verify
42+
43+
After reconfiguring your service to use your new managed identities in the target region, you need to confirm that all operations have been restored.
44+
45+
## Clean up
46+
47+
Once that you confirm your service is back online, you can proceed to delete any resources in the source region that you no longer use.
48+
49+
## Next steps
50+
51+
In this tutorial, you took the steps needed to recreate a user-assigned managed identity in a new region.
52+
53+
- [Manage user-assigned managed identities](how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-powershell#delete-a-user-assigned-managed-identity-2)

articles/active-directory/managed-identities-azure-resources/managed-identities-status.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ The following Azure services support managed identities for Azure resources:
5757
| Azure Media services | [Managed identities](/azure/media-services/latest/concept-managed-identities) |
5858
| Azure Monitor | [Azure Monitor customer-managed key](../../azure-monitor/logs/customer-managed-keys.md?tabs=portal) |
5959
| Azure Policy | [Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md) |
60-
| Azure Purview | [Credentials for source authentication in Azure Purview](../../purview/manage-credentials.md) |
60+
| Microsoft Purview | [Credentials for source authentication in Microsoft Purview](../../purview/manage-credentials.md) |
6161
| Azure Resource Mover | [Move resources across regions (from resource group)](../../resource-mover/move-region-within-resource-group.md)
6262
| Azure Site Recovery | [Replicate machines with private endpoints](../../site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints.md#enable-the-managed-identity-for-the-vault) |
6363
| Azure Search | [Set up an indexer connection to a data source using a managed identity](../../search/search-howto-managed-identities-data-sources.md) |

articles/active-directory/roles/security-planning.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ keywords:
77
author: rolyon
88
manager: karenhoran
99
ms.author: rolyon
10-
ms.date: 11/04/2021
10+
ms.date: 04/19/2022
1111
ms.topic: conceptual
1212
ms.service: active-directory
1313
ms.workload: identity
@@ -110,7 +110,7 @@ Evaluate the accounts that are assigned or eligible for the Global Administrator
110110

111111
#### Turn on multi-factor authentication and register all other highly privileged single-user non-federated administrator accounts
112112

113-
Require Azure AD Multi-Factor Authentication (MFA) at sign-in for all individual users who are permanently assigned to one or more of the Azure AD administrator roles: Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator. Use the guide to enable [Multi-factor Authentication (MFA) for your administrator accounts](../authentication/howto-mfa-userstates.md) and ensure that all those users have registered at [https://aka.ms/mfasetup](https://aka.ms/mfasetup). More information can be found under step 2 and step 3 of the guide [Protect access to data and services in Microsoft 365](https://support.office.com/article/Protect-access-to-data-and-services-in-Office-365-a6ef28a4-2447-4b43-aae2-f5af6d53c68e).
113+
Require Azure AD Multi-Factor Authentication (MFA) at sign-in for all individual users who are permanently assigned to one or more of the Azure AD administrator roles: Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator. Use the guidance at [Enforce multifactor authentication on your administrators](../authentication/how-to-authentication-find-coverage-gaps.md#enforce-multifactor-authentication-on-your-administrators) and ensure that all those users have registered at [https://aka.ms/mfasetup](https://aka.ms/mfasetup). More information can be found under step 2 and step 3 of the guide [Protect user and device access in Microsoft 365](/microsoft-365/compliance/protect-access-to-data-and-services).
114114

115115
## Stage 2: Mitigate frequently used attacks
116116

articles/api-management/api-management-using-with-internal-vnet.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ After successful deployment, you should see your API Management service's **priv
6666
6767
### Enable connectivity using a Resource Manager template (`stv2` platform)
6868

69-
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-internal-vnet-publicip) (API version 2021-01-01-preview )
69+
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-internal-vnet-publicip) (API version 2021-08-01 )
7070

7171
[![Deploy to Azure](../media/template-deployments/deploy-to-azure.svg)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-create-with-internal-vnet-publicip%2Fazuredeploy.json)
7272

articles/api-management/api-management-using-with-vnet.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ It can take 15 to 45 minutes to update the API Management instance. The Develope
5353

5454
### Enable connectivity using a Resource Manager template (`stv2` compute platform)
5555

56-
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-external-vnet-publicip) (API version 2021-01-01-preview)
56+
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-external-vnet-publicip) (API version 2021-08-01)
5757

5858
[![Deploy to Azure](../media/template-deployments/deploy-to-azure.svg)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-create-with-external-vnet-publicip%2Fazuredeploy.json)
5959

articles/attestation/audit-logs.md

Lines changed: 60 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -11,123 +11,75 @@ ms.author: mbaldwin
1111

1212
---
1313

14-
# Audit logs for Azure Attestation
14+
# Azure Attestation logging
1515

16-
Audit logs are secure, immutable, timestamped records of discrete events that happened over time. These logs capture important events that may affect the functionality of your attestation instance.
16+
If you create one or more Azure Attestation resources, you’ll want to monitor how and when your attestation instance is accessed, and by whom. You can do this by enabling logging for Microsoft Azure Attestation, which saves information in an Azure storage account you provide.
1717

18-
Azure Attestation manages attestation instances and the policies associated with them. Actions associated with instance management and policy changes are audited and logged.
18+
Logging information will be available up to 10 minutes after the operation occurred (in most cases, it will be quicker than this). Since you provide the storage account, you can secure your logs via standard Azure access controls and delete logs you no longer want to keep in your storage account.
1919

20-
This article contains information on the events that are logged, the information collected, and the location of these logs.
20+
## Interpret your Azure Attestation logs
2121

22-
## About Audit logs
22+
When logging is enabled, up to three containers may be automatically created for you in your specified storage account: **insights-logs-auditevent, insights-logs-operational, insights-logs-notprocessed**. It is recommended to only use **insights-logs-operational** and **insights-logs-notprocessed**. **insights-logs-auditevent** was created to provide early access to logs for customers using VBS. Future enhancements to logging will occur in the **insights-logs-operational** and **insights-logs-notprocessed**.
2323

24-
Azure Attestation uses code to produce audit logs for events that affect the way attestation is performed. This typically boils down to how or when policy changes are made to your attestation instance as well as some admin actions.
24+
**Insights-logs-operational** contains generic information across all TEE types.
2525

26-
### Auditable Events
27-
Here are some of the audit logs we collect:
26+
**Insights-logs-notprocessed** contains requests which the service was unable to process, typically due to malformed HTTP headers, incomplete message bodies, or similar issues.
2827

29-
| Event/API | Event Description |
30-
|--------------------------------------------|-----------------------------------------------------------------------------------------------|
31-
| Create Instance | Creates a new instance of an attestation service. |
32-
| Destroy Instance | Destroys an instance of an attestation service. |
33-
| Add Policy Certificate | Addition of a certificate to the current set of policy management certificates. |
34-
| Remove Policy Certificate | Remove a certificate from the current set of policy management certificates. |
35-
| Set Current Policy | Sets the attestation policy for a given TEE type. |
36-
| Reset Attestation Policy | Resets the attestation policy for a given TEE type. |
37-
| Prepare to Update Policy | Prepare to update attestation policy for a given TEE type. |
38-
| Rehydrate Tenants After Disaster | Re-seals all of the attestation tenants on this instance of the attestation service. This can only be performed by Attestation Service admins. |
28+
Individual blobs are stored as text, formatted as a JSON blob. Let’s look at an example log entry:
3929

40-
### Collected information
41-
For each of these events, Azure Attestation collects the following information:
4230

43-
- Operation Name
44-
- Operation Success
45-
- Operation Caller, which could be any of the following:
46-
- Azure AD UPN
47-
- Object ID
48-
- Certificate
49-
- Azure AD Tenant ID
50-
- Operation Target, which could be any of the following:
51-
- Environment
52-
- Service Region
53-
- Service Role
54-
- Service Role Instance
55-
- Resource ID
56-
- Resource Region
31+
```json
32+
{
33+
"Time": "2021-11-03T19:33:54.3318081Z",
34+
"resourceId": "/subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.Attestation/attestationProviders/<instance name>",
35+
"region": "EastUS",
36+
"operationName": "AttestSgxEnclave",
37+
"category": "Operational",
38+
"resultType": "Succeeded",
39+
"resultSignature": "400",
40+
"durationMs": 636,
41+
"callerIpAddress": "::ffff:24.17.183.201",
42+
"traceContext": "{\"traceId\":\"e4c24ac88f33c53f875e5141a0f4ce13\",\"parentId\":\"0000000000000000\",}",
43+
"identity": "{\"callerAadUPN\":\"[email protected]\",\"callerAadObjectId\":\"6ab02abe-6ca2-44ac-834d-42947dbde2b2\",\"callerId\":\"[email protected]\"}",
44+
"uri": "https://deschumatestrp.eus.test.attest.azure.net:443/attest/SgxEnclave?api-version=2018-09-01-preview",
45+
"level": "Informational",
46+
"location": "EastUS",
47+
"properties":
48+
{
49+
"failureResourceId": "",
50+
"failureCategory": "None",
51+
"failureDetails": "",
52+
"infoDataReceived":
53+
{
54+
"Headers":
55+
{
56+
"User-Agent": "PostmanRuntime/7.28.4"
57+
},
58+
"HeaderCount": 10,
59+
"ContentType": "application/json",
60+
"ContentLength": 6912,
61+
"CookieCount": 0,
62+
"TraceParent": ""
63+
}
64+
}
65+
}
66+
```
5767

58-
### Sample Audit log
68+
Most of these fields are documented in the [Top-level common schema](/azure-monitor/essentials/resource-logs-schema#top-level-common-schema). The following table lists the field names and descriptions for the entries not included in the top-level common schema:
5969

60-
Audit logs are provided in JSON format. Here is an example of what an audit log may look like.
70+
| Field Name | Description |
71+
|------------------------------------------|-----------------------------------------------------------------------------------------------|
72+
| traceContext | JSON blob representing the W3C trace-context |
73+
| uri | Request URI |
6174

62-
```json
63-
{
64-
"operationName": "SetCurrentPolicy",
65-
"resultType": "Success",
66-
"resultDescription": null,
67-
"auditEventCategory": [
68-
"ApplicationManagement"
69-
],
70-
"nCloud": null,
71-
"requestId": null,
72-
"callerIpAddress": null,
73-
"callerDisplayName": null,
74-
"callerIdentities": [
75-
{
76-
"callerIdentityType": "ObjectID",
77-
"callerIdentity": "<some object ID>"
78-
},
79-
{
80-
"callerIdentityType": "TenantId",
81-
"callerIdentity": "<some tenant ID>"
82-
}
83-
],
84-
"targetResources": [
85-
{
86-
"targetResourceType": "Environment",
87-
"targetResourceName": "PublicCloud"
88-
},
89-
{
90-
"targetResourceType": "ServiceRegion",
91-
"targetResourceName": "EastUS2"
92-
},
93-
{
94-
"targetResourceType": "ServiceRole",
95-
"targetResourceName": "AttestationRpType"
96-
},
97-
{
98-
"targetResourceType": "ServiceRoleInstance",
99-
"targetResourceName": "<some service role instance>"
100-
},
101-
{
102-
"targetResourceType": "ResourceId",
103-
"targetResourceName": "/subscriptions/<some subscription ID>/resourceGroups/<some resource group name>/providers/Microsoft.Attestation/attestationProviders/<some instance name>"
104-
},
105-
{
106-
"targetResourceType": "ResourceRegion",
107-
"targetResourceName": "EastUS2"
108-
}
109-
],
110-
"ifxAuditFormat": "Json",
111-
"env_ver": "2.1",
112-
"env_name": "#Ifx.AuditSchema",
113-
"env_time": "2020-11-23T18:23:29.9427158Z",
114-
"env_epoch": "MKZ6G",
115-
"env_seqNum": 1277,
116-
"env_popSample": 0.0,
117-
"env_iKey": null,
118-
"env_flags": 257,
119-
"env_cv": "##00000000-0000-0000-0000-000000000000_00000000-0000-0000-0000-000000000000_00000000-0000-0000-0000-000000000000",
120-
"env_os": null,
121-
"env_osVer": null,
122-
"env_appId": null,
123-
"env_appVer": null,
124-
"env_cloud_ver": "1.0",
125-
"env_cloud_name": null,
126-
"env_cloud_role": null,
127-
"env_cloud_roleVer": null,
128-
"env_cloud_roleInstance": null,
129-
"env_cloud_environment": null,
130-
"env_cloud_location": null,
131-
"env_cloud_deploymentUnit": null
132-
}
133-
```
75+
The properties contain additional Azure attestation specific context:
76+
77+
| Field Name | Description |
78+
|------------------------------------------|-----------------------------------------------------------------------------------------------|
79+
| failureResourceId | Resource ID of component which resulted in request failure |
80+
| failureCategory | Broad category indicating category of a request failure. Includes categories such as AzureNetworkingPhysical, AzureAuthorization etc. |
81+
| failureDetails | Detailed information about a request failure, if available |
82+
| infoDataReceived | Information about the request received from the client. Includes some HTTP headers, the number of headers received, the content type and content length |
83+
84+
## Next steps
85+
- [How to enable Microsoft Azure Attestation logging ](azure-diagnostic-monitoring.md)

0 commit comments

Comments
 (0)