Merge branch 'MicrosoftDocs:main' into krkutser-ie-PRASID

Author: krkutser

articles/automation/manage-runtime-environment.md

@@ -3,7 +3,7 @@ title: Manage Runtime Environment and Associated Runbooks in Azure Automation
 description: This article tells how to manage runbooks in Runtime environment and associated runbooks Azure Automation
 services: automation
 ms.subservice: process-automation
-ms.date: 06/27/2025
+ms.date: 07/09/2025
 ms.topic: how-to
 ms.custom: references_regions
 ms.service: azure-automation
@@ -95,7 +95,7 @@ In the **Runtime Environments** page, you can view the newly created  Runtime en
 
 You can create a new Runtime environment for PowerShell 7.4 with Az PowerShell module in the Automation.
 
-```rest
+```REST
 PUT 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2024-10-23 
 
@@ -114,7 +114,7 @@ https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<reso
 ```
 Upload a package Az.Accounts to the Runtime environment.  
 
-```rest
+```REST
 PUT 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>/packages/Az.Accounts?api-version=2024-10-23
 
@@ -131,17 +131,9 @@ https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<reso
 ### View Runtime environment
 
 Get the Runtime environment properties from the Automation account.
-```rest
+```REST
 GET 
-https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2023-05-15-preview 
-```
-
-### View Runtime environment
-
-Get the Runtime environment properties from the Automation account.
-```rest
-GET
-https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2023-05-15-preview
+https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2024-10-23 
 ```
 
 ### List Runtime environments
@@ -156,7 +148,7 @@ To list all the Runtime environments from the Automation account, follow this st
 
 #### [REST API](#tab/list-runtime-rest) 
 
-```rest
+```REST
 GET 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments?api-version=2024-10-23
 ```
@@ -185,7 +177,7 @@ To delete the Runtime environment from the Automation account, follow these step
 
 #### [REST API](#tab/delete-runtime-rest)
 
-```rest
+```REST
 DELETE  
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2024-10-23
 ```
@@ -215,7 +207,7 @@ To update a Runtime environment, follow these steps:
 
 Update the Az module version of an existing Runtime environment.
 
-```rest
+```REST
 PATCH 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runtimeEnvironments/<runtimeEnvironmentName>?api-version=2024-10-23
 { 
@@ -269,7 +261,7 @@ This runbook is linked to the selected Runtime environment. All the packages in
 **Prerequisite**
 - Configure a PowerShell Runtime environment and provide it as an input for runbook creation. 
 
-```rest
+```REST
 PUT 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runbooks/<runbookName>?api-version=2024-10-23
 
@@ -316,7 +308,7 @@ Check if the runbook executes as expected after update. If the runbook fails to
 
 Update Runtime environment linked to a runbook.  
 
-```rest
+```REST
 PATCH 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runbooks/<runbookName>?api-version=2024-10-23
 { 
@@ -357,7 +349,7 @@ To test runbook execution before publishing Runtime environment changes, follow
 
 Run a test job for a runbook with a different Runtime environment. This scenario is useful when a runbook needs to be tested with a Runtime environment before update.
 
-```rest
+```REST
 PUT 
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/runbooks/<runbookName>/draft/testJob?api-version=2024-10-23
 { 
@@ -378,7 +370,7 @@ You can execute runbooks linked to Runtime Environment both on Azure and Hybrid
 #### [REST API](#tab/create-cloud-job-rest)
 Jobs inherit the Runtime environment from the runbook. Run a cloud job for a published runbook.
 
-```rest
+```REST
 PUT
 https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Automation/automationAccounts/<accountName>/jobs/<jobName>?api-version=2024-10-23
 {

articles/automation/runtime-environment-overview.md

@@ -84,6 +84,7 @@ You can't edit these Runtime environments. However, any changes that are made in
 - Runtime environment can't be configured through Azure Automation extension for Visual Studio Code.
 - Deleted Runtime environments cannot be recovered.  
 - This feature is currently supported through Azure portal and [REST API](/rest/api/automation/runtime-environments?view=rest-automation-2024-10-23&preserve-view=true).
+- Use [Packages: REST API](/rest/api/automation/package?view=rest-automation-2024-10-23) to upload custom packages.
 - Management of modules for Azure Automation State Configuration is not supported through Runtime environment experience. You can continue using the old experience for managing modules and packages for Azure Automation State Configuration.
 
 ## Switch between new and old experience

articles/sentinel/bookmarks.md

@@ -10,7 +10,6 @@ appliesto:
     - Microsoft Sentinel in the Microsoft Defender portal
     - Microsoft Sentinel in the Azure portal
 
-
 #Customer intent: As a security analyst, I want to create and manage hunting bookmarks so that I can preserve and collaborate on relevant threat investigation data.
 
 ---
@@ -19,16 +18,18 @@ appliesto:
 
 Hunting bookmarks in Microsoft Sentinel helps you preserve the queries and query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration. For more information, see [Bookmarks](hunting.md#bookmarks-to-keep-track-of-data).
 
+>[!NOTE]
+> Bookmarks can only be created in the Azure portal. While you can't add bookmarks in the Microsoft Defender portal, you can see bookmarks that were already created.
+
 [!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
-## Add a bookmark
+## Add a bookmark (Azure portal only)
 
 Create a bookmark to preserve the queries, results, your observations, and findings.
 
-1. For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **Threat management**  select **Hunting**.<br> For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **Microsoft Sentinel** > **Threat management** > **Hunting**.
-1. From the **Hunting** tab, select a hunt.
-1. Select one of the hunting queries.
-1. In the hunting query details, select **Run Query**.
+1. Under **Threat management**, select **Hunting**.
+1. From the **Queries** tab, select one or more of the hunting queries.
+1. From the top command bar, select **Run selected queries**.
 
 1. Select **View query results**. For example:
 
@@ -38,7 +39,7 @@ Create a bookmark to preserve the queries, results, your observations, and findi
 
 1. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.
 
-1. Select **Add bookmark**:
+1. In Azure portal, select **Add bookmark**:
 
     :::image type="content" source="media/bookmarks/add-hunting-bookmark.png" alt-text="Screenshot of adding hunting bookmark to query." lightbox="media/bookmarks/add-hunting-bookmark.png":::
 
@@ -54,9 +55,9 @@ Create a bookmark to preserve the queries, results, your observations, and findi
 
     To view the bookmark in the investigation graph, you must map at least one entity. Entity mappings to account, host, IP, and URL entity types you created are supported, preserving backwards compatibility.
 
-1. Select **Save** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
+1. Select **Create** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
 
-The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from other locations, such as directly from Azure Monitor.
+The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, if you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from another location, such as directly from Azure Monitor.
 
 ## View and update bookmarks
 
@@ -84,9 +85,9 @@ Visualize your bookmarked data by launching the investigation experience in whic
 
 For instructions to use the investigation graph, see [Use the investigation graph to deep dive](investigate-cases.md#use-the-investigation-graph-to-deep-dive).
 
-## Add bookmarks to a new or existing incident
+## Add bookmarks to a new or existing incident (Azure portal only)
 
-Add bookmarks to an incident from the bookmarks tab on the **Hunting** page. 
+Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
 
 1. From the **Bookmarks** tab, select the bookmark or bookmarks you want to add to an incident.
 
@@ -104,7 +105,6 @@ Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
    1. Select the incident with your bookmark and **View full details**.
    1. On the incident page, in the left pane, select the **Bookmarks**.
 
-
 ## View bookmarked data in logs
 
 View bookmarked queries, results, or their history.

articles/sentinel/ci-cd.md

@@ -30,11 +30,20 @@ When creating custom content, you can manage it from your own Microsoft Sentinel
 Microsoft Sentinel currently supports connections to GitHub and Azure DevOps repositories. Before connecting your Microsoft Sentinel workspace to your source control repository, make sure that you have:
 
 - An **Owner** role in the resource group that contains your Microsoft Sentinel workspace *or* a combination of **User Access Administrator** and **Sentinel Contributor** roles to create the connection
-- Collaborator access to your GitHub repository or Project Administrator access to your Azure DevOps repository
+- Ensure custom content files you want to deploy to your workspaces are in a supported format. For supported formats, see [Plan your repository content](ci-cd-custom-content.md#plan-your-repository-content).
+
+### [GitHub prerequisites](#tab/github)
+
+- Collaborator access to your GitHub repository 
 - Actions enabled for GitHub and Pipelines enabled for Azure DevOps
+
+### [Azure DevOps prerequisites](#tab/azure-devops)
+
+- Project Administrator access to your Azure DevOps repository
 - Third-party application access via OAuth enabled for Azure DevOps [application connection policies](/azure/devops/organizations/accounts/change-application-access-policies#manage-a-policy).
-- An Azure DevOps connection must be in the same tenant as your Microsoft Sentinel workspace
-- Ensure custom content files you want to deploy to your workspaces are in a supported format. For supported formats, see [Plan your repository content](ci-cd-custom-content.md#plan-your-repository-content).
+- An Azure DevOps connection in the same tenant as your Microsoft Sentinel workspace
+
+---
 
 For more information on deployable content types, see [Validate your content](ci-cd-custom-content.md#validate-your-content).