Merge pull request #102455 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to master to sync with https://github.com/Microsoft/azure-docs (branch master)

Author: huypub

articles/api-management/api-management-using-with-internal-vnet.md

@@ -123,7 +123,7 @@ If you use a custom DNS server in a virtual network, you can also create A DNS r
 
 * A load balanced *private* virtual IP address from the subnet range will be reserved and used to access the API Management service endpoints from within the virtual network. This *private* IP address can be found on the Overview blade for the service in the Azure portal. This address must be registered with the DNS servers used by the virtual network.
 * A load balanced *public* IP address (VIP) will also be reserved to provide access to the management service endpoint over port 3443. This *public* IP address can be found on the Overview blade for the service in the Azure portal. The *public* IP address is used only for control plane traffic to the `management` endpoint over port 3443 and can be locked down to the [ApiManagement][ServiceTags] servicetag.
-* IP addresses from the subnet IP range (DIP) will be assigned to each VM in the service and will used to access resources within the virtual network. A public IP address (VIP) will be used to access resources outside the virtual network. If IP restriction lists are used to secure resources within the virtual network, the entire range for the subnet where the API Management service is deployed must specified to grant or restrict access from the service.
+* IP addresses from the subnet IP range (DIP) will be assigned to each VM in the service and will be used to access resources within the virtual network. A public IP address (VIP) will be used to access resources outside the virtual network. If IP restriction lists are used to secure resources within the virtual network, the entire range for the subnet where the API Management service is deployed must be specified to grant or restrict access from the service.
 * The load balanced public and private IP addresses can be found on the Overview blade in the Azure portal.
 * The IP addresses assigned for public and private access may change if the service is removed from and then added back into the virtual network. If this happens, it may be necessary to update DNS registrations, routing rules, and IP restriction lists within the virtual network.
 

articles/app-service/configure-ssl-certificate.md

@@ -56,6 +56,7 @@ The free App Service Managed Certificate is a turn-key solution for securing you
 - Does not support wildcard certificates.
 - Does not support naked domains.
 - Is not exportable.
+- Does not support DNS A-records.
 
 > [!NOTE]
 > The free certificate is issued by DigiCert. For some top-level domains, you must explicitly allow DigiCert as a certificate issuer by creating a [CAA domain record](https://wikipedia.org/wiki/DNS_Certification_Authority_Authorization) with the value: `0 issue digicert.com`.

articles/app-service/deploy-configure-credentials.md

@@ -15,7 +15,7 @@ and [FTP/S deployment](deploy-ftp.md). These credentials are not the same as you
 * **User-level credentials**: one set of credentials for the entire Azure account. It can be used to deploy to App Service for any app, in any subscription, that the Azure account has permission to access. It's the default set that's surfaced in the portal GUI (such as the **Overview** and **Properties**
 of the app's [resource page](../azure-resource-manager/management/manage-resources-portal.md#manage-resources)). When a user is granted app access via Role-Based Access Control (RBAC) or coadmin permissions, that user can use their own user-level credentials until the access is revoked. Do not share these credentials with other Azure users.
 
-* **App-level credentials**: one set of credentials for each app. It can be used to deploy to that app only. The credentials for each app are generated automatically at app creation. They can't be configured manually, but can be reset anytime. For a user to be granted access to app-level credentials via (RBAC), that user must be contributor or higher on the app. Readers are not allowed to publish, and can't access those credentials.
+* **App-level credentials**: one set of credentials for each app. It can be used to deploy to that app only. The credentials for each app are generated automatically at app creation. They can't be configured manually, but can be reset anytime. For a user to be granted access to app-level credentials via (RBAC), that user must be contributor or higher on the app (including Website Contributor built-in role). Readers are not allowed to publish, and can't access those credentials.
 
 ## <a name="userscope"></a>Configure user-level credentials
 

articles/app-service/overview-patch-os-runtime.md

@@ -79,6 +79,7 @@ The following table shows how to the versions of Windows and of the language run
 | PHP version | At `https://<appname>.scm.azurewebsites.net/DebugConsole`, run the following command in the command prompt: <br> `php --version` |
 | Default Node.js version | In the [Cloud Shell](../cloud-shell/overview.md), run the following command: <br> `az webapp config appsettings list --resource-group <groupname> --name <appname> --query "[?name=='WEBSITE_NODE_DEFAULT_VERSION']"` |
 | Python version | At `https://<appname>.scm.azurewebsites.net/DebugConsole`, run the following command in the command prompt: <br> `python --version` |  
+| Java version | At `https://<appname>.scm.azurewebsites.net/DebugConsole`, run the following command in the command prompt: <br> `java -version` |  
 
 > [!NOTE]  
 > Access to registry location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages`, where information on ["KB" patches](https://docs.microsoft.com/security-updates/SecurityBulletins/securitybulletins) is stored, is locked down.

articles/azure-monitor/platform/autoscale-common-metrics.md

@@ -30,7 +30,7 @@ The following host-level metrics are emitted by default for Azure VM and VMSS in
 - [Host metrics for Resource Manager-based Windows and Linux VMs](../../azure-monitor/platform/metrics-supported.md#microsoftcomputevirtualmachines)
 - [Host metrics for Resource Manager-based Windows and Linux VM Scale Sets](../../azure-monitor/platform/metrics-supported.md#microsoftcomputevirtualmachinescalesets)
 
-### Guest OS metrics Resource Manager-based Windows VMs
+### Guest OS metrics for Resource Manager-based Windows VMs
 When you create a VM in Azure, diagnostics is enabled by using the Diagnostics extension. The diagnostics extension emits a set of metrics taken from inside of the VM. This means you can autoscale off of metrics that are not emitted by default.
 
 You can generate a list of the metrics by using the following command in PowerShell.
@@ -123,8 +123,8 @@ Get-AzMetricDefinition -ResourceId <resource_id> | Format-Table -Property Name,U
 | \NetworkInterface\TotalTxErrors |Count |
 | \NetworkInterface\TotalCollisions |Count |
 
-## Commonly used Web (Server Farm) metrics
-You can also perform autoscale based on common web server metrics such as the Http queue length. It's metric name is **HttpQueueLength**.  The following section lists available server farm (Web Apps) metrics.
+## Commonly used App Service (Server Farm) metrics
+You can also perform autoscale based on common web server metrics such as the Http queue length. Its metric name is **HttpQueueLength**.  The following section lists available server farm (App Service) metrics.
 
 ### Web Apps metrics
 You can generate a list of the Web Apps metrics by using the following command in PowerShell.
@@ -153,8 +153,8 @@ For example, with a Classic Storage Account the autoscale setting metricTrigger
 
 ```
 "metricName": "ApproximateMessageCount",
- "metricNamespace": "",
- "metricResourceUri": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RES_GROUP_NAME/providers/Microsoft.ClassicStorage/storageAccounts/STORAGE_ACCOUNT_NAME/services/queue/queues/QUEUE_NAME"
+"metricNamespace": "",
+"metricResourceUri": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RES_GROUP_NAME/providers/Microsoft.ClassicStorage/storageAccounts/STORAGE_ACCOUNT_NAME/services/queue/queues/QUEUE_NAME"
  ```
 
 For a (non-classic) storage account, the metricTrigger would include:
@@ -171,7 +171,7 @@ You can scale by Service Bus queue length, which is the number of messages in th
 For VM scale sets, you can update the Autoscale setting in the Resource Manager template to use *metricName* as *ApproximateMessageCount* and pass the ID of the storage queue as *metricResourceUri*.
 
 ```
-"metricName": "MessageCount",
+"metricName": "ApproximateMessageCount",
  "metricNamespace": "",
 "metricResourceUri": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RES_GROUP_NAME/providers/Microsoft.ServiceBus/namespaces/SB_NAMESPACE/queues/QUEUE_NAME"
 ```

articles/azure-resource-manager/templates/create-multiple-instances.md

@@ -199,6 +199,10 @@ The following example shows how to apply `copy` to the dataDisks property on a v
 
 Notice that when using `copyIndex` inside a property iteration, you must provide the name of the iteration. You don't have to provide the name when used with resource iteration.
 
+> [!NOTE]
+> Property iteration also supports an offset argument. The offset must come after the name of the iteration, such as copyIndex('dataDisks', 1).
+>
+
 Resource Manager expands the `copy` array during deployment. The name of the array becomes the name of the property. The input values become the object properties. The deployed template becomes:
 
 ```json
@@ -294,6 +298,10 @@ You can use resource and property iteration together. Reference the property ite
 
 To create multiple instances of a variable, use the `copy` property in the variables section. You create an array of elements constructed from the value in the `input` property. You can use the `copy` property within a variable, or at the top level of the variables section. When using `copyIndex` inside a variable iteration, you must provide the name of the iteration.
 
+> [!NOTE]
+> Variable iteration also supports an offset argument. The offset must come after the name of the iteration, such as copyIndex('diskNames', 1).
+>
+
 For a simple example of creating an array of string values, see [copy array template](https://github.com/bmoore-msft/AzureRM-Samples/blob/master/copy-array/azuredeploy.json).
 
 The following example shows several different ways to create array variables with dynamically constructed elements. It shows how to use copy inside a variable to create arrays of objects and strings. It also shows how to use copy at the top level to create arrays of objects, strings, and integers.

articles/cost-management-billing/manage/account-admin-tasks.md

@@ -23,13 +23,18 @@ You must be the Account Administrator to perform any of these tasks.
 
 ## Navigate to your subscription's payment methods
 
-1. Sign in to the [Azure portal](https://portal.azure.com) as the Account Administrator.
+1. Sign in to the [Azure portal](https://portal.azure.com) as the Account Administrator. 
+
 1. Search for **Cost Management + Billing**.
 
     ![Screenshot that shows search for cost management + billing ](./media/account-admin-tasks/search-bar.png)
 
-1. In the **My subscriptions** list, select the subscription you'd like to add the credit card to.
-    ![Screenshot that shows my subscriptions grid in overview](./media/account-admin-tasks/cost-management-billing-overview-x.png)
+1. In the **My subscriptions** list, select the subscription you'd like to add the credit card to. 
+   
+   ![Screenshot that shows my subscriptions grid in overview](./media/account-admin-tasks/cost-management-billing-overview-x.png)
+   
+   > [!NOTE]
+   > If you don't see some of your subscriptions here, it might be because you changed the subscription directory at some point. For these subscriptions, you need to switch the directory to the original directory (the directory in which you initially signed up). Then, repeat step 2. 
 
 1. Select **Payment methods**.
 
@@ -113,10 +118,13 @@ The spending limit isn’t available for subscriptions with commitment plans or
 
     ![Screenshot that shows search for cost management + billing ](./media/account-admin-tasks/search-bar.png)
 
-1. In the **My subscriptions** list, select your Visual Studio Enterprise subscription.
-    
-    ![Screenshot that shows my subscriptions grid in overview](./media/account-admin-tasks/cost-management-overview-msdn-x.png)
+1. In the **My subscriptions** list, select your Visual Studio Enterprise subscription. 
 
+   ![Screenshot that shows my subscriptions grid in overview](./media/account-admin-tasks/cost-management-overview-msdn-x.png)
+
+    > [!NOTE]
+    > If you don't see some of your Visual Studio subscriptions here, it might be because you changed a subscription directory at some point. For these subscriptions, you need to switch the directory to the original directory (the directory in which you initially signed up). Then, repeat step 2.
+    
 1. In the Subscription overview, click the orange banner to remove the spending limit.
 
     ![Screenshot that shows remove spending limit banner](./media/account-admin-tasks/msdn-remove-spending-limit-banner-x.png)
@@ -138,10 +146,13 @@ If you have an Azure in Open Licensing subscription, you can add credits to your
 
     ![Screenshot that shows search for cost management + billing ](./media/account-admin-tasks/search-bar.png)
 
-1. In the **My subscriptions** list, select your Azure in Open subscription.
-   
+1. In the **My subscriptions** list, select your Azure in Open subscription. 
+
     ![Screenshot that shows my subscriptions grid in overview](./media/account-admin-tasks/cost-management-overview-aio-x.png)
 
+   > [!NOTE]
+   > If you don't see your subscription here, it might be because you changed its directory at some point. You need to switch the subscription's directory to the original directory (the directory in which you initially signed up). Then, repeat step 2.
+    
 1. Select **Credit history**.
 
     ![Screenshot that shows credit history](./media/account-admin-tasks/aio-credit-history-blade.png)

articles/databox/data-box-disk-deploy-picked-up.md

@@ -174,6 +174,8 @@ If you are using Data Box Disk in Japan, Singapore, Korea, and West Europe and h
 
 ::: zone target="docs"
 
+---
+
 ## Next steps
 
 In this tutorial, you learned about Azure Data Box Disk topics such as:

articles/service-fabric/service-fabric-cluster-creation-setup-aad.md

@@ -100,9 +100,19 @@ When you try to sign in to Azure AD in Service Fabric Explorer, the page returns
 The cluster (web) application that represents Service Fabric Explorer attempts to authenticate against Azure AD, and as part of the request it provides the redirect return URL. But the URL is not listed in the Azure AD application **REPLY URL** list.
 
 #### Solution
-Select "App registrations" in AAD page, select your cluster application, and then select the **Reply URLs** button. On "Reply URLs" page, add the URL of Service Fabric Explorer to the list or replace one of the items in the list. When you have finished, save your change.
+On the Azure AD page, select **App registrations**, select your cluster application, and then select **Reply URLs**. In the **Reply URLs** pane, add the Service Fabric Explorer URL to the list, or replace one of the items in the list. Save your change.
 
-![Web application reply url][web-application-reply-url]
+![Web application reply URL][web-application-reply-url]
+
+### Connecting to the cluster using Azure AD authentication via PowerShell gives an error when you sign in: "AADSTS50011"
+#### Problem
+When you try to connect to a Service Fabric cluster using Azure AD via PowerShell, the sign-in page returns a failure: "AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: <guid>."
+
+#### Reason
+Similar to the preceding issue, PowerShell attempts to authenticate against Azure AD, which provides a redirect URL that isn't listed in the Azure AD application **Reply URLs** list.  
+
+#### Solution
+Use the same process as in the preceding issue, but the URL must be set to `urn:ietf:wg:oauth:2.0:oob`, a special redirect for command-line authentication.
 
 ### Connect the cluster by using Azure AD authentication via PowerShell
 To connect the Service Fabric cluster, use the following PowerShell command example:

articles/time-series-insights/time-series-insights-update-how-to-shape-events.md

@@ -152,5 +152,4 @@ In the example above, the flattened `data_flow` property would present a naming
 
 ## Next steps
 
-- To put these guidelines into practice, read [Azure Time Series Insights Preview query syntax](./time-series-insights-query-data-csharp.md). You'll learn more about the query syntax for the Time Series Insights Preview REST API for data access.
-- To learn about supported JSON shapes, read [Supported JSON shapes](./time-series-insights-send-events.md#supported-json-shapes).
+To put these guidelines into practice, read [Azure Time Series Insights Preview query syntax](./time-series-insights-query-data-csharp.md). You'll learn more about the query syntax for the Time Series Insights Preview REST API for data access.