Skip to content

Commit 97b21b1

Browse files
davidmrdaviddavidmrdavid
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into dajusto/pystein-df-patch-link
2 parents e1c1681 + 6a7eba3 commit 97b21b1

File tree

5 files changed

+65
-50
lines changed

5 files changed

+65
-50
lines changed

‎articles/batch/account-move.md

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Move an Azure Batch account to another region
33
description: Learn how to move an Azure Batch account to a different region using an Azure Resource Manager template in the Azure portal.
44
ms.topic: how-to
5-
ms.date: 12/20/2021
5+
ms.date: 02/27/2023
66
ms.custom: subject-moving-resources
77
---
88

@@ -17,11 +17,11 @@ For more information on Resource Manager and templates, see [Quickstart: Create
1717
## Prerequisites
1818

1919
- Make sure that the services and features that your Batch account uses are supported in the new target region.
20-
- It's recommended to move the storage account associated with your Batch account to the new target region. Follow the steps in [Move an Azure Storage account to another region](../storage/common/storage-account-move.md). If you prefer, you can leave the storage account in the original region. Typically, performance is better when your storage account is in the same region as your Batch account. This article assumes you've already migrated your storage account.
20+
- It's recommended to move any Azure resources associated with your Batch account to the new target region. For example, follow the steps in [Move an Azure Storage account to another region](../storage/common/storage-account-move.md) to move an associated autostorage account. If you prefer, you can leave resources in the original region, however, performance is typically better when your Batch account is in the same region as your other Azure resources used by your workload. This article assumes you've already migrated your storage account or any other regional Azure resources to be aligned with your Batch account.
2121

2222
## Prepare the template
2323

24-
To get started, you'll need to export and then modify an ARM template.
24+
To get started, you need to export and then modify an ARM template.
2525

2626
### Export a template
2727

@@ -80,15 +80,15 @@ Load and modify the template so you can create a new Batch account in the target
8080
```
8181

8282
1. Finally, edit the **location** property to use your target region. This example sets the target region to `centralus`.
83-
83+
8484
```json
8585
{
8686
"resources": [
8787
{
8888
"type": "Microsoft.Batch/batchAccounts",
8989
"apiVersion": "2021-01-01",
9090
"name": "[parameters('batchAccounts_mysourceaccount_name')]",
91-
"location": "centralus",
91+
"location": "centralus",
9292
```
9393

9494
To obtain region location codes, see [Azure Locations](https://azure.microsoft.com/global-infrastructure/locations/). The code for a region is the region name with no spaces. For example, **Central US** = **centralus**.
@@ -110,15 +110,21 @@ Deploy the template to create a new Batch account in the target region.
110110

111111
### Configure the new Batch account
112112

113-
Some features won't export to a template, so you'll have to recreate them in the new Batch account. These features include:
113+
Some features don't export to a template, so you have to recreate them in the new Batch account. These features include:
114114

115-
- Jobs
115+
- Jobs (and tasks)
116116
- Job schedules
117117
- Certificates
118118
- Application packages
119119

120120
Be sure to configure features in the new account as needed. You can look at how you've configured these features in your source Batch account for reference.
121121

122+
> [!IMPORTANT]
123+
> New Batch accounts are entirely separate from any prior existing Batch accounts, even within the same region. These newly
124+
> created Batch accounts will have [default service and core quotas](batch-quota-limit.md) associated with them. For User
125+
> Subscription pool allocation mode Batch accounts, core quotas from the subscription will apply. You will need to ensure
126+
> that these new Batch accounts have sufficient quota before migrating your workload.
127+
122128
## Discard or clean up
123129

124130
Confirm that your new Batch account is successfully working in the new region. Also make sure to restore the necessary features. Then, you can delete the source Batch account.
@@ -132,4 +138,3 @@ Confirm that your new Batch account is successfully working in the new region. A
132138
## Next steps
133139

134140
- Learn more about [moving resources to a new resource group or subscription](../azure-resource-manager/management/move-resource-group-and-subscription.md).
135-
- Learn how to [move Azure VMs to another region](../site-recovery/azure-to-azure-tutorial-migrate.md).

‎articles/batch/batch-customer-managed-key.md

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,27 @@
11
---
22
title: Configure customer-managed keys for your Azure Batch account with Azure Key Vault and Managed Identity
3-
description: Learn how to encrypt Batch data using customer-managed keys.
3+
description: Learn how to encrypt Batch data using customer-managed keys.
44
ms.topic: how-to
5-
ms.date: 02/11/2021
5+
ms.date: 02/27/2023
66
ms.devlang: csharp
77
ms.custom: devx-track-azurecli
88
---
99

1010
# Configure customer-managed keys for your Azure Batch account with Azure Key Vault and Managed Identity
1111

12-
By default Azure Batch uses platform-managed keys to encrypt all the customer data stored in the Azure Batch Service, like certificates, job/task metadata. Optionally, you can use your own keys, i.e., customer-managed keys, to encrypt data stored in Azure Batch.
12+
By default Azure Batch uses platform-managed keys to encrypt all the customer data stored in the Azure Batch Service, like certificates, job/task metadata. Optionally, you can use your own keys, that is, customer-managed keys, to encrypt data stored in Azure Batch.
1313

1414
The keys you provide must be generated in [Azure Key Vault](../key-vault/general/basic-concepts.md), and they must be accessed with [managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).
1515

1616
There are two types of managed identities: [*system-assigned* and *user-assigned*](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types).
1717

18-
You can either create your Batch account with system-assigned managed identity, or create a separate user-assigned managed identity that will have access to the customer-managed keys. Review the [comparison table](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) to understand the differences and consider which option works best for your solution. For example, if you want to use the same managed identity to access multiple Azure resources, a user-assigned managed identity will be needed. If not, a system-assigned managed identity associated with your Batch account may be sufficient. Using a user-assigned managed identity also gives you the option to enforce customer-managed keys at Batch account creation, as shown [in the example below](#create-a-batch-account-with-user-assigned-managed-identity-and-customer-managed-keys).
18+
You can either create your Batch account with system-assigned managed identity, or create a separate user-assigned managed identity
19+
that has access to the customer-managed keys. Review the
20+
[comparison table](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) to understand the
21+
differences and consider which option works best for your solution. For example, if you want to use the same managed identity to
22+
access multiple Azure resources, a user-assigned managed identity is needed. If not, a system-assigned managed identity associated
23+
with your Batch account may be sufficient. Using a user-assigned managed identity also gives you the option to enforce
24+
customer-managed keys at Batch account creation, as shown next.
1925

2026
## Create a Batch account with system-assigned managed identity
2127

@@ -31,13 +37,13 @@ After the account is created, you can find a unique GUID in the **Identity princ
3137

3238
![Screenshot showing a unique GUID in the Identity principal Id field.](./media/batch-customer-managed-key/linked-batch-principal.png)
3339

34-
You will need this value in order to grant this Batch account access to the Key Vault.
40+
You need this value in order to grant this Batch account access to the Key Vault.
3541

3642
### Azure CLI
3743

3844
When you create a new Batch account, specify `SystemAssigned` for the `--identity` parameter.
3945

40-
```azurecli
46+
```azurecli-interactive
4147
resourceGroupName='myResourceGroup'
4248
accountName='mybatchaccount'
4349
@@ -48,9 +54,9 @@ az batch account create \
4854
--identity 'SystemAssigned'
4955
```
5056

51-
After the account is created, you can verify that system-assigned managed identity has been enabled on this account. Be sure to note the `PrincipalId`, as this value will be needed to grant this Batch account access to the Key Vault.
57+
After the account is created, you can verify that system-assigned managed identity has been enabled on this account. Be sure to note the `PrincipalId`, as this value is needed to grant this Batch account access to the Key Vault.
5258

53-
```azurecli
59+
```azurecli-interactive
5460
az batch account show \
5561
--name $accountName \
5662
--resource-group $resourceGroupName \
@@ -62,13 +68,13 @@ az batch account show \
6268
6369
## Create a user-assigned managed identity
6470

65-
If you prefer, you can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity) which can be used to access your customer-managed keys.
71+
If you prefer, you can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity) that can be used to access your customer-managed keys.
6672

67-
You will need the **Client ID** value of this identity in order for it to access the Key Vault.
73+
You need the **Client ID** value of this identity in order for it to access the Key Vault.
6874

6975
## Configure your Azure Key Vault instance
7076

71-
The Azure Key Vault in which your keys will be generated must be created in the same tenant as your Batch account. It does not need to be in the same resource group or even in the same subscription.
77+
The Azure Key Vault in which your keys are generated must be created in the same tenant as your Batch account. It doesn't need to be in the same resource group or even in the same subscription.
7278

7379
### Create an Azure Key Vault
7480

@@ -95,11 +101,11 @@ In the Azure portal, go to the Key Vault instance in the **key** section, select
95101

96102
![Create a key](./media/batch-customer-managed-key/create-key.png)
97103

98-
After the key is created, click on the newly created key and the current version, copy the **Key Identifier** under **properties** section. Be sure sure that under **Permitted Operations**, **Wrap Key** and **Unwrap Key** are both checked.
104+
After the key is created, click on the newly created key and the current version, copy the **Key Identifier** under **properties** section. Be sure that under **Permitted Operations**, **Wrap Key** and **Unwrap Key** are both checked.
99105

100106
## Enable customer-managed keys on a Batch account
101107

102-
Once you have followed the steps above, you can enable customer-managed keys on your Batch account.
108+
Now that the prerequisites are in place, you can enable customer-managed keys on your Batch account.
103109

104110
### Azure portal
105111

@@ -111,7 +117,7 @@ In the [Azure portal](https://portal.azure.com/), go to the Batch account page.
111117

112118
After the Batch account is created with system-assigned managed identity and the access to Key Vault is granted, update the Batch account with the `{Key Identifier}` URL under `keyVaultProperties` parameter. Also set `--encryption-key-source` as `Microsoft.KeyVault`.
113119

114-
```azurecli
120+
```azurecli-interactive
115121
az batch account set \
116122
--name $accountName \
117123
--resource-group $resourceGroupName \
@@ -121,7 +127,8 @@ az batch account set \
121127

122128
## Create a Batch account with user-assigned managed identity and customer-managed keys
123129

124-
Using the Batch management .NET client, you can create a Batch account that will have a user-assigned managed identity and customer-managed keys.
130+
As an example using the Batch management .NET client, you can create a Batch account that has a user-assigned managed identity
131+
and customer-managed keys.
125132

126133
```c#
127134
EncryptionProperties encryptionProperties = new EncryptionProperties()
@@ -144,7 +151,7 @@ BatchAccountIdentity identity = new BatchAccountIdentity()
144151
var parameters = new BatchAccountCreateParameters(TestConfiguration.ManagementRegion, encryption:encryptionProperties, identity: identity);
145152

146153
var account = await batchManagementClient.Account.CreateAsync("MyResourceGroup",
147-
"mynewaccount", parameters);
154+
"mynewaccount", parameters);
148155
```
149156

150157
## Update the customer-managed key version
@@ -157,13 +164,18 @@ When you create a new version of a key, update the Batch account to use the new
157164

158165
You can also use Azure CLI to update the version.
159166

160-
```azurecli
167+
```azurecli-interactive
161168
az batch account set \
162169
--name $accountName \
163170
--resource-group $resourceGroupName \
164171
--encryption-key-identifier {YourKeyIdentifierWithNewVersion}
165172
```
166173

174+
> [!TIP]
175+
> You can have your keys automatically rotate by creating a key rotation policy within Key Vault. When specifying a Key Identifier
176+
> for the Batch account, use the versionless key identifier to enable autorotation with a valid rotation policy. For more information,
177+
> see [how to configure key rotation](../key-vault/keys/how-to-configure-key-rotation.md) in Key Vault.
178+
167179
## Use a different key for Batch encryption
168180

169181
To change the key used for Batch encryption, follow these steps:
@@ -174,7 +186,7 @@ To change the key used for Batch encryption, follow these steps:
174186

175187
You can also use Azure CLI to use a different key.
176188

177-
```azurecli
189+
```azurecli-interactive
178190
az batch account set \
179191
--name $accountName \
180192
--resource-group $resourceGroupName \
@@ -187,11 +199,11 @@ az batch account set \
187199
- **Can I select RSA key sizes larger than 2048 bits?** Yes, RSA key sizes of `3072` and `4096` bits are also supported.
188200
- **What operations are available after a customer-managed key is revoked?** The only operation allowed is account deletion if Batch loses access to the customer-managed key.
189201
- **How should I restore access to my Batch account if I accidentally delete the Key Vault key?** Since purge protection and soft delete are enabled, you could restore the existing keys. For more information, see [Recover an Azure Key Vault](../key-vault/general/key-vault-recovery.md).
190-
- **Can I disable customer-managed keys?** You can set the encryption type of the Batch Account back to "Microsoft managed key" at any time. After this, you are free to delete or change the key.
191-
- **How can I rotate my keys?** Customer-managed keys are not automatically rotated. To rotate the key, update the Key Identifier that the account is associated with.
202+
- **Can I disable customer-managed keys?** You can set the encryption type of the Batch Account back to "Microsoft managed key" at any time. You're free to delete or change the key afterwards.
203+
- **How can I rotate my keys?** Customer-managed keys aren't automatically rotated unless the [key is versionless with an appropriate key rotation policy set within Key Vault](../key-vault/keys/how-to-configure-key-rotation.md). To manually rotate the key, update the Key Identifier that the account is associated with.
192204
- **After I restore access how long will it take for the Batch account to work again?** It can take up to 10 minutes for the account to be accessible again once access is restored.
193-
- **While the Batch Account is unavailable what happens to my resources?** Any pools that are running when Batch access to customer-managed keys is lost will continue to run. However, the nodes will transition into an unavailable state, and tasks will stop running (and be requeued). Once access is restored, nodes will become available again and tasks will be restarted.
194-
- **Does this encryption mechanism apply to VM disks in a Batch pool?** No. For Cloud Services Configuration pools (which are [deprecated](https://azure.microsoft.com/updates/azure-batch-cloudserviceconfiguration-pools-will-be-retired-on-29-february-2024/)), no encryption is applied for the OS and temporary disk. For Virtual Machine Configuration pools, the OS and any specified data disks will be encrypted with a Microsoft platform managed key by default. Currently, you cannot specify your own key for these disks. To encrypt the temporary disk of VMs for a Batch pool with a Microsoft platform managed key, you must enable the [diskEncryptionConfiguration](/rest/api/batchservice/pool/add#diskencryptionconfiguration) property in your [Virtual Machine Configuration](/rest/api/batchservice/pool/add#virtualmachineconfiguration) Pool. For highly sensitive environments, we recommend enabling temporary disk encryption and avoiding storing sensitive data on OS and data disks. For more information, see [Create a pool with disk encryption enabled](./disk-encryption.md)
205+
- **While the Batch Account is unavailable what happens to my resources?** Any pools that are running when Batch access to the customer-managed key is lost will continue to run. However, the nodes in these pools will transition into an unavailable state, and tasks will stop running (and be requeued). Once access is restored, nodes become available again, and tasks are restarted.
206+
- **Does this encryption mechanism apply to VM disks in a Batch pool?** No. For Cloud Services Configuration pools (which are [deprecated](https://azure.microsoft.com/updates/azure-batch-cloudserviceconfiguration-pools-will-be-retired-on-29-february-2024/)), no encryption is applied for the OS and temporary disk. For Virtual Machine Configuration pools, the OS and any specified data disks are encrypted with a Microsoft platform managed key by default. Currently, you can't specify your own key for these disks. To encrypt the temporary disk of VMs for a Batch pool with a Microsoft platform managed key, you must enable the [diskEncryptionConfiguration](/rest/api/batchservice/pool/add#diskencryptionconfiguration) property in your [Virtual Machine Configuration](/rest/api/batchservice/pool/add#virtualmachineconfiguration) Pool. For highly sensitive environments, we recommend enabling temporary disk encryption and avoiding storing sensitive data on OS and data disks. For more information, see [Create a pool with disk encryption enabled](./disk-encryption.md)
195207
- **Is the system-assigned managed identity on the Batch account available on the compute nodes?** No. The system-assigned managed identity is currently used only for accessing the Azure Key Vault for the customer-managed key. To use a user-assigned managed identity on compute nodes, see [Configure managed identities in Batch pools](managed-identity-pools.md).
196208

197209
## Next steps

‎articles/healthcare-apis/iot/get-started.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,17 @@ author: msjasteppe
55
ms.service: healthcare-apis
66
ms.subservice: fhir
77
ms.topic: quickstart
8-
ms.date: 1/20/2023
8+
ms.date: 02/27/2023
99
ms.author: jasteppe
1010
ms.custom: mode-api
1111
---
1212

1313
# Get started with the MedTech service in the Azure Health Data Services
1414

15-
This article will show you how to get started with the Azure MedTech service in the [Azure Health Data Services](../healthcare-apis-overview.md). There are six steps you need to follow to be able to deploy and process MedTech service to ingest data from a device using Azure Event Hubs service, persist the data to Azure Fast Healthcare Interoperability Resources (FHIR®) service as Observation resources, and link FHIR service Observations to user and device resources. This article provides an architecture overview to help you follow the six steps of the implementation process.
15+
> [!NOTE]
16+
> [Fast Healthcare Interoperability Resources (FHIR®)](https://www.hl7.org/fhir/) is an open healthcare specification.
17+
18+
This article will show you how to get started with the Azure MedTech service in the [Azure Health Data Services](../healthcare-apis-overview.md). There are six steps you need to follow to be able to deploy and process MedTech service to ingest data from a device using Azure Event Hubs service, persist the data to Azure FHIR service as Observation resources, and link FHIR service Observations to user and device resources. This article provides an architecture overview to help you follow the six steps of the implementation process.
1619

1720
## Architecture overview of the MedTech service
1821

0 commit comments

Comments
 (0)