Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into aas-autoscale

Author: Owen Duncan

.openpublishing.redirection.json

@@ -3258,6 +3258,11 @@
       "redirect_url": "/azure/iot-edge/how-to-register-device",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/iot-edge/how-to-install-production-certificates.md",
+      "redirect_url": "/azure/iot-edge/how-to-manage-device-certificates",
+      "redirect_document_id": true
+    },
     {
       "source_path": "articles/cognitive-services/cognitive-services-recommendations-quick-start.md",
       "redirect_url": "/azure/cognitive-services/recommendations/overview",

articles/active-directory/fundamentals/concept-fundamentals-security-defaults.md

@@ -66,7 +66,7 @@ One common method to improve protection for all users is to require a stronger f
 
 To give your users easy access to your cloud apps, Azure AD supports a variety of authentication protocols, including legacy authentication. *Legacy authentication* is a term that refers to an authentication request made by:
 
-- Older Office clients that don't use modern authentication (for example, an Office 2010 client).
+- Clients that don't use modern authentication (for example, an Office 2010 client).
 - Any client that uses older mail protocols such as IMAP, SMTP, or POP3.
 
 Today, the majority of compromising sign-in attempts come from legacy authentication. Legacy authentication does not support Multi-Factor Authentication. Even if you have a Multi-Factor Authentication policy enabled on your directory, an attacker can authenticate by using an older protocol and bypass Multi-Factor Authentication. 

articles/app-service/containers/deploy-container-github-action.md

@@ -36,12 +36,12 @@ az ad sp create-for-rbac --name "myApp" --role contributor \
                             --scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group} \
                             --sdk-auth
                             
-  # Replace {subscription-id}, {resource-group} with the subscription, resource group details of the WebApp
+# Replace {subscription-id}, {resource-group} with the subscription, resource group details of the WebApp
 ```
 
 The output is a JSON object with the role assignment credentials that provide access to your App Service app similar to below. Copy this JSON object to authenticate from GitHub.
 
- ```azurecli 
+ ```output 
   {
     "clientId": "<GUID>",
     "clientSecret": "<GUID>",

articles/automation/automation-linux-hrw-install.md

@@ -3,7 +3,7 @@ title: Azure Automation Linux Hybrid Runbook Worker
 description: This article provides information on installing an Azure Automation Hybrid Runbook Worker so you can run runbooks on Linux-based computers in your local datacenter or cloud environment.
 services: automation
 ms.subservice: process-automation
-ms.date: 06/28/2018
+ms.date: 03/02/2020
 ms.topic: conceptual
 ---
 # Deploy a Linux Hybrid Runbook Worker
@@ -21,7 +21,7 @@ The Hybrid Runbook Worker feature supports the following distributions:
 * Oracle Linux 5, 6, and 7 (x86/x64)
 * Red Hat Enterprise Linux Server 5, 6, and 7 (x86/x64)
 * Debian GNU/Linux 6, 7, and 8 (x86/x64)
-* Ubuntu 12.04 LTS, 14.04 LTS, and 16.04 LTS (x86/x64)
+* Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 18.04 (x86/x64)
 * SUSE Linux Enterprise Server 11 and 12 (x86/x64)
 
 ## Installing a Linux Hybrid Runbook Worker

articles/azure-resource-manager/templates/cross-resource-group-deployment.md

@@ -350,7 +350,7 @@ az group deployment create \
 
 The output from the preceding example is:
 
-```azurecli
+```output
 "outputs": {
   "defaultScopeRG": {
     "type": "String",

articles/azure-resource-manager/templates/deploy-cli.md

@@ -57,7 +57,7 @@ az group deployment create \
 
 The deployment can take a few minutes to complete. When it finishes, you see a message that includes the result:
 
-```azurecli
+```output
 "provisioningState": "Succeeded",
 ```
 
@@ -177,7 +177,7 @@ az group deployment validate \
 
 If no errors are detected, the command returns information about the test deployment. In particular, notice that the **error** value is null.
 
-```azurecli
+```output
 {
   "error": null,
   "properties": {
@@ -186,7 +186,7 @@ If no errors are detected, the command returns information about the test deploy
 
 If an error is detected, the command returns an error message. For example, passing an incorrect value for the storage account SKU, returns the following error:
 
-```azurecli
+```output
 {
   "error": {
     "code": "InvalidTemplate",
@@ -202,7 +202,7 @@ If an error is detected, the command returns an error message. For example, pass
 
 If your template has a syntax error, the command returns an error indicating it couldn't parse the template. The message indicates the line number and position of the parsing error.
 
-```azurecli
+```output
 {
   "error": {
     "code": "InvalidTemplate",

articles/azure-resource-manager/templates/deploy-to-management-group.md

@@ -2,15 +2,13 @@
 title: Deploy resources to management group
 description: Describes how to deploy resources at the management group scope in an Azure Resource Manager template.
 ms.topic: conceptual
-ms.date: 02/10/2020
+ms.date: 03/02/2020
 ---
 
 # Create resources at the management group level
 
 Typically, you deploy Azure resources to a resource group in your Azure subscription. However, you can also create resources at the management group level. You use management group level deployments to take actions that make sense at that level, such as assigning [role-based access control](../../role-based-access-control/overview.md) or applying [policies](../../governance/policy/overview.md).
 
-Currently, to deploy templates at the management group level, you must use the REST API.
-
 ## Supported resources
 
 You can deploy the following resource types at the management group level:
@@ -40,7 +38,16 @@ https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeployment
 
 ## Deployment commands
 
-The command for management group deployments is different than the command for resource group deployments.
+The commands for management group deployments are different than the commands for resource group deployments.
+
+For Azure PowerShell, use [New-AzManagementGroupDeployment](/powershell/module/az.resources/new-azmanagementgroupdeployment). 
+
+```azurepowershell-interactive
+New-AzManagementGroupDeployment `
+  -ManagementGroupId "myMG" `
+  -Location "West US" `
+  -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/management-level-deployment/azuredeploy.json
+```
 
 For REST API, use [Deployments - Create At Management Group Scope](/rest/api/resources/deployments/createorupdateatmanagementgroupscope).
 
@@ -145,7 +152,7 @@ The following example assigns an existing policy definition to the management gr
 
 ## Template sample
 
-* Create a resource group, a policy and a policy assignment.  See [here](https://github.com/Azure/azure-docs-json-samples/blob/master/management-level-deployment/azuredeploy.json).
+* [Create a resource group, a policy and a policy assignment](https://github.com/Azure/azure-docs-json-samples/blob/master/management-level-deployment/azuredeploy.json).
 
 ## Next steps
 

articles/azure-resource-manager/templates/deploy-to-subscription.md

@@ -2,7 +2,7 @@
 title: Deploy resources to subscription
 description: Describes how to create a resource group in an Azure Resource Manager template. It also shows how to deploy resources at the Azure subscription scope.
 ms.topic: conceptual
-ms.date: 02/10/2020
+ms.date: 03/02/2020
 ---
 
 # Create resource groups and resources at the subscription level
@@ -15,6 +15,7 @@ To deploy templates at the subscription level, use Azure CLI, PowerShell, or RES
 
 You can deploy the following resource types at the subscription level:
 
+* [budgets](/azure/templates/microsoft.consumption/budgets)
 * [deployments](/azure/templates/microsoft.resources/deployments)
 * [peerAsns](/azure/templates/microsoft.peering/peerasns)
 * [policyAssignments](/azure/templates/microsoft.authorization/policyassignments)
@@ -55,10 +56,10 @@ az deployment create \
 ```
 
 
-For the PowerShell deployment command, use [New-AzDeployment](/powershell/module/az.resources/new-azdeployment). The following example deploys a template to create a resource group:
+For the PowerShell deployment command, use [New-AzDeployment](/powershell/module/az.resources/new-azdeployment) or **New-AzSubscriptionDeployment**. The following example deploys a template to create a resource group:
 
 ```azurepowershell-interactive
-New-AzDeployment `
+New-AzSubscriptionDeployment `
   -Name demoDeployment `
   -Location centralus `
   -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/emptyRG.json `
@@ -295,7 +296,7 @@ $definition = Get-AzPolicyDefinition | Where-Object { $_.Properties.DisplayName
 $locations = @("westus", "westus2")
 $policyParams =@{listOfAllowedLocations = @{ value = $locations}}
 
-New-AzDeployment `
+New-AzSubscriptionDeployment `
   -Name policyassign `
   -Location centralus `
   -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policyassign.json `
@@ -361,16 +362,16 @@ az deployment create \
 To deploy this template with PowerShell, use:
 
 ```azurepowershell
-New-AzDeployment `
+New-AzSubscriptionDeployment `
   -Name definePolicy `
   -Location centralus `
   -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policydefineandassign.json
 ```
 
 ## Template samples
 
-* Create a resource group, lock it and give permissions to it. See [here](https://github.com/Azure/azure-quickstart-templates/tree/master/subscription-level-deployments/create-rg-lock-role-assignment).
-* Create a resource group, a policy and a policy assignment.  See [here](https://github.com/Azure/azure-docs-json-samples/blob/master/subscription-level-deployment/azuredeploy.json).
+* [Create a resource group, lock it and give permissions to it](https://github.com/Azure/azure-quickstart-templates/tree/master/subscription-level-deployments/create-rg-lock-role-assignment).
+* [Create a resource group, a policy, and a policy assignment](https://github.com/Azure/azure-docs-json-samples/blob/master/subscription-level-deployment/azuredeploy.json).
 
 ## Next steps
 

articles/cosmos-db/cosmosdb-monitor-resource-logs.md

@@ -94,7 +94,7 @@ For detailed information about how to create a diagnostic setting by using the A
    | summarize count = count()  by OperationName, requestResourceType_s, bin(TimeGenerated, 1h) 
    ```
 
-1. What is the maximum throughput that a partition provides?
+1. What is the maximum throughput that a partition has consumed?
 
    ```Kusto
    AzureDiagnostics

articles/cosmos-db/sql-query-keywords.md

@@ -37,13 +37,13 @@ In SQL API, unlike ANSI SQL, you can express range queries against properties of
 
 The DISTINCT keyword eliminates duplicates in the query's projection.
 
+In this example, the query projects values for each last name:
+
 ```sql
 SELECT DISTINCT VALUE f.lastName
 FROM Families f
 ```
 
-In this example, the query projects values for each last name.
-
 The results are:
 
 ```json
@@ -96,6 +96,13 @@ The results are:
     }
 ]
 ```
+
+Queries with an aggregate system function and a subquery with DISTINCT are not supported. For example, the following query is not supported:
+
+```sql
+SELECT COUNT(1) FROM (SELECT DISTINCT f.lastName FROM f)
+```
+
 ## <a name="in"></a> IN
 
 Use the IN keyword to check whether a specified value matches any value in a list. For example, the following query returns all family items where the `id` is `WakefieldFamily` or `AndersenFamily`.