Merge pull request #293383 from MicrosoftDocs/main

Publish to live, Wednesday 4AM PST, 1/22

Author: PMEds28

articles/active-directory-b2c/media/technical-overview/audit-log.png

@@ -269,8 +269,6 @@ In an audit log, which is available for your Azure AD B2C tenant or for a partic
 * CRUD operations on B2C resources (for example, policies and identity providers)
 * Validation of user credentials and token issuance
 
-:::image type="content" source="media/technical-overview/audit-log.png" alt-text="Individual user audit log shown in the Azure portal.":::
-
 For more information on audit logs, see [Accessing Azure AD B2C audit logs](view-audit-logs.md).
 
 ## Usage analytics

articles/active-directory-b2c/technical-overview.md

@@ -29,7 +29,7 @@ For more information on supported scenarios, limitations, and availability, see
 
 ## Create a Backup vault
 
-A Backup vault is a management entity that stores recovery points treated over time. A Backup vault also provides an interface to do the backup operations. Operations include taking on-demand backups, doing restores, and creating backup policies. AKS Backup requires the Backup vault and the AKS cluster to be in the same region. Learn [how to create a Backup vault](create-manage-backup-vault.md#create-a-backup-vault).
+A Backup vault is a management entity that stores recovery points treated over time. A Backup vault also provides an interface to do the backup operations. Operations include taking on-demand backups, doing restores, and creating backup policies. AKS Backup requires the Backup Vault and the AKS cluster to be located in the same region. However, they can reside in different subscriptions as long as they are within the same tenant.  Learn [how to create a Backup vault](create-manage-backup-vault.md#create-a-backup-vault).
 
 > [!NOTE]
 > A Backup vault is a new resource that's used to back up newly supported datasources. A Backup vault is different from a Recovery Services vault.

articles/backup/azure-kubernetes-service-cluster-backup.md

@@ -2,7 +2,7 @@
 title: Overview of Azure Blobs backup
 description: Learn about Azure Blobs backup.
 ms.topic: overview
-ms.date: 12/30/2024
+ms.date: 01/22/2025
 ms.service: azure-backup
 author: jyothisuri
 ms.author: jsuri
@@ -55,7 +55,7 @@ Operational backup is configured and managed at the **storage account** level, a
 
 When you configure backup for a storage account and assign a backup policy with a retention of ‘n’ days, the underlying properties are set as described below. You can view these properties in the **Data protection** tab of the blob service in your storage account.
 
-- **Point-in-time restore**: Set to ‘n’ days, as defined in the backup policy. If the storage account already had point-in-time enabled with a retention of, say ‘x’ days, before configuring backup, the point-in-time restore duration will be set to the greater of the two values that is max(n,x). If you had already enabled point-in-time restore and specified the retention to be greater than that in the backup policy, it will remain unchanged.
+- **Point-in-time restore**: Set to ‘n’ days, as defined in the backup policy. If the storage account already had point-in-time enabled with a retention of, say ‘x’ days, before configuring backup, the point-in-time restore duration will be set to the greater of the two values that are max(n,x). If you had already enabled point-in-time restore and specified the retention to be greater than that in the backup policy, it will remain unchanged.
 
 - **Soft delete**: Set to ‘n+5’ days, that is, five days in addition to the duration specified in the backup policy. If the storage account that is being configured for operational backup already had soft delete enabled with a retention of, say ‘y’ days, then the soft delete retention will be set to the maximum of the two values, that is, maximum (n+5, y). If you had already enabled soft delete and specified the retention to be greater than that according to the backup policy, it will remain unchanged.
 
@@ -66,7 +66,8 @@ When you configure backup for a storage account and assign a backup policy with
 To allow Backup to enable these properties on the storage accounts to be protected, the Backup vault must be granted the **Storage Account Backup Contributor** role on the respective storage accounts.
 
 >[!NOTE]
->Operational backup supports operations on block blobs only and operations on containers can’t be restored. If you delete a container from the storage account by calling the **Delete Container** operation, that container can’t be restored with a restore operation. It’s suggested you enable soft delete to enhance data protection and recovery.
+>- The Operational backup can only be enabled along with vaulted backup. 
+>- Operational backup supports operations on block blobs only and operations on containers can’t be restored. If you delete a container from the storage account by calling the **Delete Container** operation, that container can’t be restored with a restore operation. It’s suggested you enable soft delete to enhance data protection and recovery.
 
 # [Vaulted backup](#tab/vaulted-backup)
 

articles/backup/blob-backup-overview.md

@@ -53,16 +53,16 @@ The following table summarizes the different backup alerts currently available v
 
 | **Alert Category** | **Alert Name** | **Supported workload types / vault types** | **Description** | 
 | ------------------ | -------------  | ------------------------------------------ | -------- |
-| Security | Delete Backup Data | - Microsoft Azure Virtual Machine <br><br> - SQL in Azure VM (non-AG scenarios) <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - DPM <br><br> - Azure Backup Server <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Blobs <br><br> - Azure Managed Disks  | This alert is fired when you stop backup and deletes backup data. <br><br> **Note** <br> If you disable the soft delete feature for the vault, Delete Backup Data alert isn't received. |
+| Security | Delete Backup Data | - Microsoft Azure Virtual Machine <br><br> - SQL in Azure VM (non-AG scenarios) <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - DPM <br><br> - Azure Backup Server <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Blobs <br><br> - Azure Managed Disks<br><br> - Azure Kubernetes Service  | This alert is fired when you stop backup and deletes backup data. <br><br> **Note** <br> If you disable the soft delete feature for the vault, Delete Backup Data alert isn't received. |
 | Security | Upcoming Purge | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM | For all workloads that support soft-delete, this alert is fired when the backup data for an item is 2 days away from being permanently purged by the Azure Backup service. | 
 | Security | Purge Complete | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM | Delete Backup Data |
 | Security | Soft Delete Disabled for Vault | Recovery Services vaults | This alert is fired when the soft-deleted backup data for an item has been permanently deleted by the Azure Backup service. | 
 | Security | Modify Policy with Shorter Retention | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM <br><br> - Azure Files | This alert is fired when a backup policy is modified to use lesser retention. | 
 | Security | Modify Protection with Shorter Retention | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM <br><br> - Azure Files | This alert is fired when a backup instance is assigned to a different policy with lesser retention. | 
 | Security | MUA Disabled | Recovery Services vaults | This alert is fired when a user disables MUA functionality for vault. | 
 | Security | Disable hybrid security features | Recovery Services vaults | This alert is fired when hybrid security settings are disabled for a vault. | 
-| Jobs | Backup Failure | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - Azure Files <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Managed Disks | This alert is fired when a backup job failure has occurred. By default, alerts for backup  failures are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). | 
-| Jobs | Restore Failure | - Azure Virtual Machine <br><br> - SQL in Azure VM (non-AG scenarios) <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - Azure Files <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Blobs <br><br> - Azure Managed Disks | This alert is fired when a restore job failure has occurred. By default, alerts for restore failures are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). |
+| Jobs | Backup Failure | - Azure Virtual Machine <br><br> - SQL in Azure VM <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - Azure Files <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Managed Disks <br><br> - Azure Kubernetes Service | This alert is fired when a backup job failure has occurred. By default, alerts for backup  failures are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). | 
+| Jobs | Restore Failure | - Azure Virtual Machine <br><br> - SQL in Azure VM (non-AG scenarios) <br><br> - SAP HANA in Azure VM <br><br> - Azure Backup Agent <br><br> - Azure Files <br><br> - Azure Database for PostgreSQL Server <br><br> - Azure Blobs <br><br> - Azure Managed Disks <br><br> - Azure Kubernetes Service | This alert is fired when a restore job failure has occurred. By default, alerts for restore failures are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). |
 | Jobs | Unsupported backup type | - SQL in Azure VM <br><br> - SAP HANA in Azure VM | This alert is fired when the current settings for a database don't support certain backup types present in the policy. By default, alerts for unsupported backup type scenario are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). |
 | Jobs | Workload extension unhealthy | - SQL in Azure VM <br><br> - SAP HANA in Azure VM | This alert is fired when the Azure Backup workload extension for database backups is in an unhealthy state that might prevent future backups from succeeding. By default, alerts for workload extension unhealthy scenario are turned on. For more information, see the [section on turning on alerts for this scenario](backup-azure-monitoring-alerts.md#turn-on-azure-monitor-alerts-for-job-failure-scenarios). |
 

articles/backup/monitoring-and-alerts-overview.md

@@ -1,17 +1,19 @@
 ---
-title: Apache Kafka & Apache Flink on Confluent Cloud - An Azure Native ISV Service overview
-description: Learn about using Apache Kafka & Apache Flink on Confluent Cloud in the Azure Marketplace.
+title: Apache Kafka & Apache Flink on Confluent Cloud overview
+description: Learn about using Apache Kafka & Apache Flink on Confluent Cloud in Azure Marketplace.
 ms.topic: overview
-ms.date: 1/31/2024
+ms.date: 01/22/2025
 ---
 
-# What is Apache Kafka & Apache Flink on Confluent Cloud - An Azure Native ISV Service?
+# What is Apache Kafka & Apache Flink on Confluent Cloud?
 
-Azure Native ISV Services enable you to easily provision, manage, and tightly integrate independent software vendor (ISV) software and services on Azure. This Azure Native ISV Service is developed and managed by Microsoft and Confluent.
+[!INCLUDE [what-is](../includes/what-is.md)]
 
-You can find Apache Kafka® & Apache Flink® on Confluent Cloud™ - An Azure Native ISV Service in the [Azure portal](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Confluent%2Forganizations) or get it on [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/confluentinc.confluent-cloud-azure-prod?tab=Overview).
+Microsoft and Confluent Cloud developed this service and manage it together.
 
-Apache Kafka & Apache Flink on Confluent Cloud - An Azure Native ISV Service is an Azure Marketplace offering that provides Apache Kafka and Apache Flink as a managed service. It's fully managed so you can focus on building your applications rather than managing the clusters.
+You can find Apache Kafka® & Apache Flink® on Confluent Cloud™ in the [Azure portal](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Confluent%2Forganizations) or get it on [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/confluentinc.confluent-cloud-azure-prod?tab=Overview).
+
+Apache Kafka & Apache Flink on Confluent Cloud is an Azure Marketplace offering that provides Apache Kafka and Apache Flink as a fully managed service so you can focus on building your applications rather than managing the clusters.
 
 To reduce the burden of cross-platform management, Microsoft partnered with Confluent Cloud to build an integrated provisioning layer from Azure to Confluent Cloud. It provides a consolidated experience for using Confluent Cloud on Azure. You can easily integrate and manage Confluent Cloud with your Azure applications.
 
@@ -36,7 +38,7 @@ Each Azure subscription can contain multiple Confluent plans. Each Confluent pla
 
 When you provision a Confluent Cloud resource in Azure, you get a Confluent organization ID, default environment, and user account. For more information, see [QuickStart: Get started with Confluent Cloud on Azure](create.md).
 
-For billing, each Confluent Cloud offer purchased in the Marketplace maps to a unique Confluent organization.
+Each Confluent Cloud offer purchased in the Marketplace maps to a unique Confluent organization for billing.
 
 ## Single sign-on
 
@@ -53,13 +55,12 @@ There are two billing options available: pay-as-you-go monthly plan and commitme
 
 You decide which billing option to use when you create the service.
 
-## Next steps
+## Subscribe to Confluent Cloud
 
-- To create an instance of Apache Kafka & Apache Flink on Confluent Cloud, see [QuickStart: Get started with Confluent Cloud on Azure](create.md).
-- Get started with Apache Kafka on Confluent Cloud - An Azure Native ISV Service on
+[!INCLUDE [subscribe](../includes/subscribe.md)] *Apache Kafka and Apache Flink on Confluent Cloud*.
 
-    > [!div class="nextstepaction"]
-    > [Azure portal](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Confluent%2Forganizations)
+[!INCLUDE [subscribe](../includes/subscribe-from-azure-portal.md)]
+
+## Next steps
 
-    > [!div class="nextstepaction"]
-    > [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/confluentinc.confluent-cloud-azure-prod?tab=Overview)
+- [QuickStart: Get started with Apache Kafka & Apache Flink on Confluent Cloud](create.md)

articles/partner-solutions/apache-kafka-confluent-cloud/overview.md

@@ -1145,6 +1145,8 @@
       href: sentinel-integration-guide.md
     - name: Partner integrations best practices
       href: partner-integrations.md
+    - name: Creating Workbooks
+      href: sentinel-workbook-creation.md
     - name: Publish solutions
       href: publish-sentinel-solutions.md
     - name: Solution lifecycle post publish

articles/sentinel/TOC.yml

@@ -66,7 +66,7 @@ To ingest and synchronize Microsoft Defender XDR incidents with all their alerts
 
    ```kusto
       SecurityIncident
-      | where ProviderName == "Microsoft 365 Defender"
+      | where ProviderName == "Microsoft Defender XDR"
    ```
 
 When you enable the Microsoft Defender XDR connector, any Microsoft Defender components’ connectors that were previously connected are automatically disconnected in the background. Although they continue to *appear* connected, no data flows through them.
@@ -153,7 +153,7 @@ let Now = now();
 | extend Count = 0 
 | union isfuzzy=true ( 
     SecurityIncident
-    | where ProviderName == "Microsoft 365 Defender"
+    | where ProviderName == "Microsoft Defender XDR"
     | summarize Count = count() by bin_at(TimeGenerated, 1d, Now) 
 ) 
 | summarize Count=max(Count) by bin_at(TimeGenerated, 1d, Now)