Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into patch-168

Author: batamig

articles/active-directory-b2c/cookie-definitions.md

@@ -9,7 +9,7 @@ manager: CelesteDG
 ms.service: active-directory
 ms.workload: identity
 ms.topic: reference
-ms.date: 08/12/2021
+ms.date: 03/20/2022
 ms.author: kengaderdus
 ms.subservice: B2C
 ---
@@ -42,8 +42,18 @@ The following table lists the cookies used in Azure AD B2C.
 | `x-ms-cpim-trans` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Used for tracking the transactions  (number of authentication requests to Azure AD B2C) and the current transaction. |
 | `x-ms-cpim-sso:{Id}` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Used for maintaining the SSO session. This cookie is set as `persistent`, when [Keep Me Signed In](session-behavior.md#enable-keep-me-signed-in-kmsi) is enabled.|
 | `x-ms-cpim-cache:{id}_n` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md), successful authentication | Used for maintaining the request state. |
-| `x-ms-cpim-csrf` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Cross-Site Request Forgery token used for CRSF protection. |
+| `x-ms-cpim-csrf` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Cross-Site Request Forgery token used for CRSF protection. For more information, read the [Cross-Site request forgery token](#cross-site-request-forgery-token) section. |
 | `x-ms-cpim-dc` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Used for Azure AD B2C network routing. |
 | `x-ms-cpim-ctx` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Context |
 | `x-ms-cpim-rp` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Used for storing membership data for the resource provider tenant. |
 | `x-ms-cpim-rc` | b2clogin.com, login.microsoftonline.com, branded domain | End of [browser session](session-behavior.md) | Used for storing the relay cookie. |
+
+## Cross-Site request forgery token
+
+To prevent Cross Site Request Forgery (CSRF) attacks, Azure AD B2C applies the Synchronizer Token strategy mechanism. For more details on this pattern, check out the [Cross-Site Request Forgery Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern) article.
+
+Azure AD B2C generates a synchronizer token, and adds it in two places; in a cookie labeled `x-ms-cpim-csrf`, and a query string parameter named `csrf_token` in the URL of the page sent to the Azure AD B2C. As Azure AD B2C service processes the incoming requests from the browser, it confirms that both the query string and cookie versions of the token exist, and that they exactly match. Also it verifies the elements of the contents of the token to confirm against expected values for the in-progress authentication.
+
+For example, in the sign-up or sign-in page, when a user selects the "Forgot password", or "Sign-up now" links, the browser sends a GET request to Azure AD B2C in order to load the contents of the next page. The request to load content Azure AD B2C additionally chooses to send and validate the Synchronizer Token as an extra layer of protection to ensure that the request to load the page was the result of an in-progress authentication.
+
+The Synchronizer Token is a credential that doesn't identify a user, but rather is tied to an active unique authentication session. 

articles/api-management/api-management-advanced-policies.md

@@ -604,7 +604,7 @@ The `send-one-way-request` policy sends the provided request to the specified UR
 
 ```xml
 <send-one-way-request mode="new | copy">
-  <url>...</url>
+  <set-url>...</set-url>
   <method>...</method>
   <header name="" exists-action="override | skip | append | delete">...</header>
   <body>...</body>
@@ -648,7 +648,7 @@ This sample policy shows an example of using the `send-one-way-request` policy t
 | Element                    | Description                                                                                                 | Required                        |
 | -------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------- |
 | send-one-way-request       | Root element.                                                                                               | Yes                             |
-| url                        | The URL of the request.                                                                                     | No if mode=copy; otherwise yes. |
+| set-url                        | The URL of the request.                                                                                     | No if mode=copy; otherwise yes. |
 | method                     | The HTTP method for the request.                                                                            | No if mode=copy; otherwise yes. |
 | header                     | Request header. Use multiple header elements for multiple request headers.                                  | No                              |
 | body                       | The request body.                                                                                           | No                              |

articles/azure-functions/functions-bindings-event-grid-output.md

@@ -119,7 +119,7 @@ public static async Task Run(
 
 The following example shows how the custom type is used in both the trigger and an Event Grid output binding:
 
-:::code language="csharp" source="~/azure-functions-dotnet-worker/samples/Extensions/EventGrid/EventGridFunction.cs" range="12-23":::
+:::code language="csharp" source="~/azure-functions-dotnet-worker/samples/Extensions/EventGrid/EventGridFunction.cs" range="4-49":::
 
 # [C# Script](#tab/csharp-script)
 

articles/azure-monitor/alerts/alerts-unified-log.md

@@ -164,7 +164,7 @@ See this alert stateless evaluation example:
 | 00:15 | TRUE  | Alert fires and action groups called. New alert state ACTIVE.
 | 00:20 | FALSE | Alert doesn't fire. No actions called. Pervious alerts state remains ACTIVE.
 
-Stateful alerts fire once per incident and resolve. The alert rule resolves when the alert condition isn't met for 30 minutes for a specific evaluation period (to account for log ingestion delay), and for three consecutive evaluations to reduce noise if there is flapping conditions. For example, with a frequency of 5 minutes, the alert resolve after 40 minutes or with a frequency of 1 minute, the alert resolve after 32 minutes. The resolved notification is sent out via web-hooks or email, the status of the alert instance (called monitor state) in Azure portal is also set to resolved.
+Stateful alerts fire once per incident and resolve. The alert rule resolves when the alert condition isn't met for 30 minutes for a specific evaluation period (to account for [log ingestion delay](../alerts/alerts-troubleshoot-log.md#data-ingestion-time-for-logs)), and for three consecutive evaluations to reduce noise if there is flapping conditions. For example, with a frequency of 5 minutes, the alert resolve after 40 minutes or with a frequency of 1 minute, the alert resolve after 32 minutes. The resolved notification is sent out via web-hooks or email, the status of the alert instance (called monitor state) in Azure portal is also set to resolved.
 
 Stateful alerts feature is currently in preview. You can set this using **Automatically resolve alerts** in the alert details section.
 

articles/azure-monitor/logs/basic-logs-query.md

@@ -24,7 +24,7 @@ Log queries against Basic Logs are optimized for simple data retrieval using a s
 - [extend](/azure/data-explorer/kusto/query/extendoperator)
 - [project](/azure/data-explorer/kusto/query/projectoperator)
 - [project-away](/azure/data-explorer/kusto/query/projectawayoperator)
-- [project-keep](/azure/data-explorer/kusto/query/projectkeepoperator)
+- [project-keep](/azure/data-explorer/kusto/query/project-keep-operator)
 - [project-rename](/azure/data-explorer/kusto/query/projectrenameoperator)
 - [project-reorder](/azure/data-explorer/kusto/query/projectreorderoperator)
 - [parse](/azure/data-explorer/kusto/query/parseoperator)
@@ -98,4 +98,4 @@ For more information, see [Azure Monitor pricing](https://azure.microsoft.com/pr
 
 - [Learn more about Basic Logs and the different log plans.](log-analytics-workspace-overview.md#log-data-plans-preview)
 - [Configure a table for Basic Logs.](basic-logs-configure.md)
-- [Use a search job to retrieve data from Basic Logs into Analytics Logs where it can be queries multiple times.](search-jobs.md)
+- [Use a search job to retrieve data from Basic Logs into Analytics Logs where it can be queries multiple times.](search-jobs.md)

articles/azure-monitor/logs/custom-logs-overview.md

@@ -27,8 +27,8 @@ Authentication for the custom logs API is performed at the data collection endpo
 ## Tables
 Custom logs can send data to any custom table that you create and to certain built-in tables in your Log Analytics workspace. The target table must exist before you can send data to it. The following built-in tables are currently supported:
 
-- [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecurityevent)
-- [SecurityEvents](/azure/azure-monitor/reference/tables/securityevents)
+- [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog)
+- [SecurityEvents](/azure/azure-monitor/reference/tables/securityevent)
 - [Syslog](/azure/azure-monitor/reference/tables/syslog)
 - [WindowsEvents](/azure/azure-monitor/reference/tables/windowsevent)
 

articles/azure-monitor/logs/data-ingestion-time.md

@@ -4,7 +4,8 @@ description: Explains the different factors that affect latency in collecting lo
 ms.topic: conceptual
 author: bwren
 ms.author: bwren
-ms.date: 07/18/2019
+ms.reviewer: eternovsky
+ms.date: 03/21/2022
 
 ---
 
@@ -167,4 +168,4 @@ Heartbeat
 ```
 
 ## Next steps
-* Read the [Service Level Agreement (SLA)](https://azure.microsoft.com/support/legal/sla/monitor/v1_3/) for Azure Monitor.
+* Read the [Service Level Agreement (SLA)](https://azure.microsoft.com/support/legal/sla/monitor/v1_3/) for Azure Monitor.

articles/azure-monitor/logs/search-jobs.md

@@ -221,7 +221,7 @@ Log queries in a search job are intended to scan very large sets of data. To sup
 - [extend](/azure/data-explorer/kusto/query/extendoperator)
 - [project](/azure/data-explorer/kusto/query/projectoperator)
 - [project-away](/azure/data-explorer/kusto/query/projectawayoperator)
-- [project-keep](/azure/data-explorer/kusto/query/projectkeepoperator)
+- [project-keep](/azure/data-explorer/kusto/query/project-keep-operator)
 - [project-rename](/azure/data-explorer/kusto/query/projectrenameoperator)
 - [project-reorder](/azure/data-explorer/kusto/query/projectreorderoperator)
 - [parse](/azure/data-explorer/kusto/query/whereoperator)
@@ -246,4 +246,4 @@ For more information, see [Azure Monitor pricing](https://azure.microsoft.com/pr
 
 - [Learn more about data retention and archiving data.](data-retention-archive.md)
 - [Learn about restoring data, which is another method for retrieving archived data.](restore.md)
-- [Learn about directly querying Basic Logs.](basic-logs-query.md)
+- [Learn about directly querying Basic Logs.](basic-logs-query.md)

articles/azure-monitor/logs/tables-feature-support.md

@@ -122,7 +122,6 @@ The following list identifies the tables in a [Log Analytics workspace](log-anal
 | [DeviceNetworkInfo](/azure/azure-monitor/reference/tables/devicenetworkinfo) | |
 | [DnsEvents](/azure/azure-monitor/reference/tables/dnsevents) | |
 | [DnsInventory](/azure/azure-monitor/reference/tables/dnsinventory) | |
-| [DummyHydrationFact](/azure/azure-monitor/reference/tables/dummyhydrationfact) | |
 | [Dynamics365Activity](/azure/azure-monitor/reference/tables/dynamics365activity) | |
 | [EmailAttachmentInfo](/azure/azure-monitor/reference/tables/emailattachmentinfo) | |
 | [EmailEvents](/azure/azure-monitor/reference/tables/emailevents) | |

articles/azure-monitor/logs/tutorial-custom-logs-api.md

@@ -27,7 +27,7 @@ In this tutorial, you learn to:
 To complete this tutorial, you need the following: 
 
 - Log Analytics workspace where you have at least [contributor rights](manage-access.md#manage-access-using-azure-permissions) .
-- [Permissions to create Data Collection Rule objects](/essentials/data-collection-rule-overview.md#permissions) in the workspace.
+- [Permissions to create Data Collection Rule objects](/azure/azure-monitor/essentials/data-collection-rule-overview#permissions) in the workspace.
 
 ## Collect workspace details
 Start by gathering information that you'll need from your workspace.
@@ -440,4 +440,4 @@ The cache that drives IntelliSense may take up to 24 hours to update.
 
 - [Complete a similar tutorial using the Azure portal.](tutorial-custom-logs.md)
 - [Read more about custom logs.](custom-logs-overview.md)
-- [Learn more about writing transformation queries](../essentials/data-collection-rule-transformations.md)
+- [Learn more about writing transformation queries](../essentials/data-collection-rule-transformations.md)