Merge branch 'main' of github.com:MicrosoftDocs/azure-docs-pr into v2-mlops-updates

Larry Franks · Larry Franks · commit b19c3e4febe4 · 2022-09-23T13:24:17.000-04:00
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -23,11 +23,11 @@ jobs:
         # start-date: '2021-03-19'
         stale-pr-message: >
           This pull request has been inactive for at least 14 days.
-          If you are finished with your changes, don't forget to sign off. See the [contributor guide](https://review.docs.microsoft.com/help/contribute/contribute-how-to-write-pull-request-automation?branch=main) for instructions.
+          If you are finished with your changes, don't forget to sign off. See the [contributor guide](https://review.learn.microsoft.com/help/contribute/contribute-how-to-write-pull-request-automation?branch=main) for instructions.
                     
-          [Get Help](https://review.docs.microsoft.com/help/contribute/help-options?branch=main)  
+          [Get Help](https://review.learn.microsoft.com/help/contribute/help-options?branch=main)  
           
           [Docs Support Teams Channel](https://teams.microsoft.com/l/channel/19%3a7ecffca1166a4a3986fed528cf0870ee%40thread.skype/General?groupId=de9ddba4-2574-4830-87ed-41668c07a1ca&tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47)  
           
-          [Resolve Merge Conflict](https://review.docs.microsoft.com/help/contribute/resolve-merge-conflicts?branch=main)  
+          [Resolve Merge Conflict](https://review.learn.microsoft.com/help/contribute/resolve-merge-conflicts?branch=main)  
         
diff --git a/articles/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-playbook.md b/articles/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-playbook.md
@@ -230,10 +230,11 @@ Use the **Activity triggers** dashboard to view information and set alerts and t
 -   **Group entitlements and Usage reports:** Provides guidance on cleaning up directly assigned permissions
 -   **Access Key Entitlements and Usage reports**: Identifies high risk service principals with old secrets that haven’t been rotated every 90 days (best practice) or decommissioned due to lack of use (as recommended by the Cloud Security Alliance).
 
-## Next Steps
-For more information about Permissions Management, see:                     
-                     
-**Microsoft Docs**: [Visit Docs](../cloud-infrastructure-entitlement-management/index.yml).
+## Next steps
+
+For more information about Permissions Management, see:
+
+**Microsoft Learn**: [Permissions management](../cloud-infrastructure-entitlement-management/index.yml).
 
 **Datasheet:** <https://aka.ms/PermissionsManagementDataSheet>
 
diff --git a/articles/azure-arc/kubernetes/quickstart-connect-cluster.md b/articles/azure-arc/kubernetes/quickstart-connect-cluster.md
@@ -412,7 +412,7 @@ You can delete the Azure Arc-enabled Kubernetes resource, any associated configu
 az connectedk8s delete --name AzureArcTest1 --resource-group AzureArcTest
 ```
 
-If the deletion process hangs, use the following command to force deletion (adding `-y` if you want to bypass the confirmation prompt):
+If the deletion process fails, use the following command to force deletion (adding `-y` if you want to bypass the confirmation prompt):
 
 ```azurecli
 az connectedk8s delete -g AzureArcTest1 -n AzureArcTest --force
diff --git a/articles/azure-monitor/app/app-insights-overview.md b/articles/azure-monitor/app/app-insights-overview.md
@@ -66,7 +66,7 @@ Integrated Auto-instrumentation is available for [Azure App Service .NET](azure-
 
 A detailed view of all Auto-instrumentation supported environments, languages, and resource providers are available [here](codeless-overview.md#supported-environments-languages-and-resource-providers).
 
-For other scenarios, the [Application Insights SDK](https://docs.microsoft.com/dotnet/api/overview/azure/insights) is required.
+For other scenarios, the [Application Insights SDK](/dotnet/api/overview/azure/insights) is required.
 
 A preview [Open Telemetry](opentelemetry-enable.md?tabs=net) offering is also available.
 
diff --git a/articles/azure-vmware/configure-external-identity-source-nsx-t.md b/articles/azure-vmware/configure-external-identity-source-nsx-t.md
@@ -16,7 +16,7 @@ In this article, you'll learn how to configure an external identity source for N
 - If you require Active Directory authentication with LDAPS:
     - You'll need access to the Active Directory Domain Controller(s) with Administrator permissions. 
 
-    - Your Active Directory Domain Controller(s) must have LDAPS enabled with a valid certificate. The certificate could be issued by an [Active Directory Certificate Services Certificate Authority (CA)](https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx) or a [third-party CA](https://docs.microsoft.com/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority).
+    - Your Active Directory Domain Controller(s) must have LDAPS enabled with a valid certificate. The certificate could be issued by an [Active Directory Certificate Services Certificate Authority (CA)](https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx) or a [third-party CA](/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority).
     >[!Note] 
     > Self-sign certificates are not recommended for production environments.   
     
diff --git a/articles/azure-vmware/deploy-vsan-stretched-clusters.md b/articles/azure-vmware/deploy-vsan-stretched-clusters.md
@@ -61,15 +61,15 @@ To request support, send an email request to **avsStretchedCluster@microsoft.com
 - Number of nodes in first stretched cluster (minimum 6, maximum 16 - in multiples of two)
 - Estimated provisioning date (used for billing purposes)
 
-When the request support details are received, quota will be reserved for a stretched cluster environment in the region requested. The subscription gets enabled to deploy a stretched cluster SDDC through the Azure portal. A confirmation email will be sent to the designated point of contact within two business days upon which you should be able to [self-deploy a stretched cluster private cloud via the Azure portal](https://docs.microsoft.com/azure/azure-vmware/tutorial-create-private-cloud?tabs=azure-portal#create-a-private-cloud). Be sure to select **Hosts in two availability zones** to ensure that a stretched cluster gets deployed in the region of your choice.
+When the request support details are received, quota will be reserved for a stretched cluster environment in the region requested. The subscription gets enabled to deploy a stretched cluster SDDC through the Azure portal. A confirmation email will be sent to the designated point of contact within two business days upon which you should be able to [self-deploy a stretched cluster private cloud via the Azure portal](/azure/azure-vmware/tutorial-create-private-cloud?tabs=azure-portal#create-a-private-cloud). Be sure to select **Hosts in two availability zones** to ensure that a stretched cluster gets deployed in the region of your choice.
 
 :::image type="content" source="media/stretch-clusters/stretched-clusters-hosts-two-availability-zones.png" alt-text="Screenshot shows where to select hosts in two availability zones.":::
 
-Once the private cloud is created, you can peer both availability zones (AZs) to your on-premises ExpressRoute circuit with Global Reach that helps connect your on-premises data center to the private cloud. Peering both the AZs will ensure that an AZ failure doesn't result in a loss of connectivity to your private cloud. Since an ExpressRoute Auth Key is valid for only one connection, repeat the [Create an ExpressRoute auth key in the on-premises ExpressRoute circuit](https://docs.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud#create-an-expressroute-auth-key-in-the-on-premises-expressroute-circuit) process to generate another authorization.
+Once the private cloud is created, you can peer both availability zones (AZs) to your on-premises ExpressRoute circuit with Global Reach that helps connect your on-premises data center to the private cloud. Peering both the AZs will ensure that an AZ failure doesn't result in a loss of connectivity to your private cloud. Since an ExpressRoute Auth Key is valid for only one connection, repeat the [Create an ExpressRoute auth key in the on-premises ExpressRoute circuit](/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud#create-an-expressroute-auth-key-in-the-on-premises-expressroute-circuit) process to generate another authorization.
 
 :::image type="content" source="media/stretch-clusters/express-route-availability-zones.png" alt-text="Screenshot shows how to generate Express Route authorizations for both availability zones."lightbox="media/stretch-clusters/express-route-availability-zones.png":::
 
-Next, repeat the process to [peer ExpressRoute Global Reach](https://docs.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud#peer-private-cloud-to-on-premises) two availability zones to the on-premises ExpressRoute circuit.
+Next, repeat the process to [peer ExpressRoute Global Reach](/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud#peer-private-cloud-to-on-premises) two availability zones to the on-premises ExpressRoute circuit.
 
 :::image type="content" source="media/stretch-clusters/express-route-global-reach-peer-availability-zones.png" alt-text="Screenshot shows page to peer both availability zones to on-premises Express Route Global Reach."lightbox="media/stretch-clusters/express-route-global-reach-peer-availability-zones.png":::
 
diff --git a/articles/cognitive-services/Computer-vision/index.yml b/articles/cognitive-services/Computer-vision/index.yml
@@ -47,7 +47,7 @@ conceptualContent:
           text: Use the Read OCR container
           url: computer-vision-how-to-install-containers.md
         - itemType: learn
-          text: Microsoft Learn
+          text: Microsoft Learn training
           url: /training/modules/read-text-images-documents-with-computer-vision-service/
         - itemType: reference
           text: OCR API reference
@@ -76,7 +76,7 @@ conceptualContent:
           text: Generate metadata for images
           url: Tutorials/storage-lab-tutorial.md
         - itemType: learn
-          text: Microsoft Learn
+          text: Microsoft Learn training
           url: /training/modules/analyze-images-computer-vision/
         - itemType: reference
           text: Image Analysis API reference
@@ -105,7 +105,7 @@ conceptualContent:
           text: Add users to a Face service
           url: Tutorials/build-enrollment-app.md
         - itemType: learn
-          text: Microsoft Learn
+          text: Microsoft Learn training
           url: /training/modules/detect-analyze-faces/
         - itemType: reference
           text: Face API reference
diff --git a/articles/cognitive-services/Content-Moderator/index.yml b/articles/cognitive-services/Content-Moderator/index.yml
@@ -28,7 +28,7 @@ landingContent:
             url: overview.md
       - linkListType: learn
         links:
-          - text: Microsoft Learn
+          - text: Microsoft Learn training
             url: /training/modules/intro-to-content-moderator/
       - linkListType: video
         links:
diff --git a/articles/cognitive-services/Custom-Vision-Service/index.yml b/articles/cognitive-services/Custom-Vision-Service/index.yml
@@ -32,7 +32,7 @@ landingContent:
             url: whats-new.md
       - linkListType: learn
         links:
-          - text: Microsoft Learn
+          - text: Microsoft Learn training
             url: /training/modules/classify-images-custom-vision/
       - linkListType: video
         links:
diff --git a/articles/cognitive-services/personalizer/concept-rewards.md b/articles/cognitive-services/personalizer/concept-rewards.md
@@ -93,9 +93,9 @@ By adding up reward scores, your final reward may be outside the expected score
 
 ## Reward wait time
 
-Personalizer will correlate the information of a Rank call with the rewards sent in Reward calls to train the model. These may come at different times. Personalizer waits for a limited time, starting when the Rank call happened, even if the Rank call was made as an inactive event, and activated later.
+Personalizer will correlate the information of a Rank call with the rewards sent in Reward calls to train the model, which may come at different times. Personalizer waits for the reward score for a defined limited time, starting when the corresponding Rank call occured. This is done even if the Rank call was made using deferred activation](concept-active-inactive-events.md).
 
-If the **Reward Wait Time** expires, and there has been no reward information, a default reward is applied to that event for training. The maximum wait duration is 2 days. If your scenario requires longer reward wait times (e.g. for marketing email campaigns) we are offering a private preview of longer wait times. Open a support ticket in the Azure portal to get in contact with team and see if you qualify and it can be offered to you.
+If the **Reward Wait Time** expires and there has been no reward information, a default reward is applied to that event for training. You can select a reward wait time of 10 minutes, 4 hours, 12 hours, or 24 hours. If your scenario requires longer reward wait times (e.g., for marketing email campaigns) we are offering a private preview of longer wait times. Open a support ticket in the Azure portal to get in contact with team and see if you qualify and it can be offered to you.
 
 ## Best practices for reward wait time
 
diff --git a/articles/cosmos-db/sql/kafka-connector-source.md b/articles/cosmos-db/sql/kafka-connector-source.md
@@ -91,7 +91,7 @@ curl -H "Content-Type: application/json" -X POST -d @<path-to-JSON-config-file>
 
 ## Insert document into Azure Cosmos DB
 
-1. Sign into the [Azure portal](https://portal.azure.com/learn.learn.microsoft.com) and navigate to your Azure Cosmos DB account.
+1. Sign into the [Azure portal](https://portal.azure.com/learn.docs.microsoft.com) and navigate to your Azure Cosmos DB account.
 1. Open the **Data Explore** tab and select **Databases**
 1. Open the "kafkaconnect" database and "kafka" container you created earlier.
 1. To create a new JSON document, in the SQL API pane, expand "kafka" container, select **Items**, then select **New Item** in the toolbar.
diff --git a/articles/education-hub/azure-dev-tools-teaching/program-faq.yml b/articles/education-hub/azure-dev-tools-teaching/program-faq.yml
@@ -122,10 +122,10 @@ sections:
           You can download this software in the [Education Hub](https://portal.azure.com/#blade/Microsoft_Azure_Education/EducationMenuBlade/software).
           
       - question: |
-          What is Microsoft training?
+          What is Microsoft Learn training?
         answer: |
-          [Microsoft Learn](/training/) is a free online learning platform that lets you to learn Azure technologies at your own pace. Learning paths combine modules that allow you to start with the basics, and then move to advanced methods that address real-world challenges.
-          
+          [Microsoft Learn training](/training/) is a free online learning platform that helps you learn Azure technologies at your own pace. Learning paths combine modules to allow you to start with the basics, and then move to advanced methods that address real-world challenges.
+
   - name: Azure Academic Grant
     questions:
       - question: |
diff --git a/articles/industrial-iot/overview-what-is-industrial-iot.md b/articles/industrial-iot/overview-what-is-industrial-iot.md
@@ -40,7 +40,7 @@ Azure IIoT solutions are built from specific components:
 
 The [Azure IoT Hub](https://azure.microsoft.com/services/iot-hub/) acts as a central message hub for secure, bi-directional communications between any IoT application and the devices it manages. It's an open and flexible cloud platform as a service (PaaS) that supports open-source SDKs and multiple protocols.
 
-Gathering your industrial and business data onto an IoT Hub lets you store your data securely, perform business and efficiency analyses on it, and generate reports from it. You can process your combined data with Microsoft Azure services and tools, for example [Azure Stream Analytics](https://docs.microsoft.com/azure/stream-analytics), or visualize in your Business Intelligence platform of choice such as [Power BI](https://powerbi.microsoft.com).
+Gathering your industrial and business data onto an IoT Hub lets you store your data securely, perform business and efficiency analyses on it, and generate reports from it. You can process your combined data with Microsoft Azure services and tools, for example [Azure Stream Analytics](/azure/stream-analytics), or visualize in your Business Intelligence platform of choice such as [Power BI](https://powerbi.microsoft.com).
 
 ### IoT Edge devices
 
diff --git a/articles/key-vault/certificates/index.yml b/articles/key-vault/certificates/index.yml
@@ -89,7 +89,7 @@ landingContent:
           - text: Soft-delete overview
             url: ../general/soft-delete-overview.md
   # Card
-  - title: Microsoft Learn
+  - title: Microsoft Learn training
     linkLists:
       - linkListType: learn
         links:
diff --git a/articles/key-vault/general/index.yml b/articles/key-vault/general/index.yml
@@ -94,7 +94,7 @@ landingContent:
 
 
   # Card
-  - title: Microsoft Learn
+  - title: Microsoft Learn training
     linkLists:
       - linkListType: learn
         links:
diff --git a/articles/key-vault/general/rbac-guide.md b/articles/key-vault/general/rbac-guide.md
@@ -56,7 +56,11 @@ More about Azure Key Vault management guidelines, see:
 | Key Vault Crypto User  | Perform cryptographic operations using keys. Only works for key vaults that use the 'Azure role-based access control' permission model. | 12338af0-0e69-4776-bea7-57ae8d297424 |
 | Key Vault Reader | Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the 'Azure role-based access control' permission model. | 21090545-7ca7-4776-b22c-e363652d74d2 |
 | Key Vault Secrets Officer| Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model. | b86a8fe4-44ce-4948-aee5-eccb2c155cd7 |
-| Key Vault Secrets User | Read secret contents. Only works for key vaults that use the 'Azure role-based access control' permission model. | 4633458b-17de-408a-b874-0445c86b69e6 |
+| Key Vault Secrets User | Read secret contents including secret portion of a certificate with private key. Only works for key vaults that use the 'Azure role-based access control' permission model. | 4633458b-17de-408a-b874-0445c86b69e6 |
+
+> [!NOTE]
+> There is no 'Key Vault Certificate User` because applications require secrets portion of certificate with private key. 'Key Vault Secrets User` role should be used for applications to retrieve certificate.
+
 
 For more information about Azure built-in roles definitions, see [Azure built-in roles](../../role-based-access-control/built-in-roles.md).
 
@@ -336,6 +340,11 @@ For more Information about how to create custom roles, see:
 -   2000 Azure role assignments per subscription
 -   Role assignments latency: at current expected performance, it will take up to 10 minutes (600 seconds) after role assignments is changed for role to be applied
 
+## Frequently Asked Questions:
+
+### Can I use Key Vault role-based access control (RBAC) permission model object-scope assignments to provide isolation for application teams within Key Vault?
+No. RBAC permission model allows to assign access to individual objects in Key Vault to user or application, but any administrative operations like network access control, monitoring, and objects management require vault level permissions which will then expose secure information to operators across application teams.
+
 ## Learn more
 
 - [Azure RBAC Overview](../../role-based-access-control/overview.md)
diff --git a/articles/key-vault/keys/index.yml b/articles/key-vault/keys/index.yml
@@ -94,7 +94,7 @@ landingContent:
 
 
   # Card
-  - title: Microsoft Learn
+  - title: Microsoft Learn training
     linkLists:
       - linkListType: learn
         links:
diff --git a/articles/key-vault/secrets/index.yml b/articles/key-vault/secrets/index.yml
@@ -108,7 +108,7 @@ landingContent:
             url: ../general/overview-throttling.md
 
   # Card
-  - title: Microsoft Learn
+  - title: Microsoft Learn training
     linkLists:
       - linkListType: learn
         links:
diff --git a/articles/machine-learning/toc.yml b/articles/machine-learning/toc.yml
@@ -774,7 +774,7 @@
       href: reference-machine-learning-cloud-parity.md
     - name: User forum
       href: /answers/topics/azure-machine-learning.html
-    - name: Microsoft Learn
+    - name: Microsoft Learn training
       href: /training/browse/?expanded=azure&products=azure-machine-learning
     - name: Stack Overflow
       href: https://stackoverflow.com/questions/tagged/azure-machine-learning-service
diff --git a/articles/security/index.yml b/articles/security/index.yml
@@ -128,7 +128,7 @@ additionalContent:
 
     - title: Additional security guidance
       items:
-        - title: Microsoft Learn
+        - title: Microsoft Learn training
           summary: If you're new to security, build your skills with Microsoft Learn training
           url: /training/browse/?products=azure&roles=security-engineer%2Csecurity-operations-analyst
         - title: Microsoft Cloud Adoption Framework for Azure
diff --git a/articles/static-web-apps/front-door-manual.md b/articles/static-web-apps/front-door-manual.md
diff --git a/articles/virtual-machines/field-programmable-gate-arrays-attestation.md b/articles/virtual-machines/field-programmable-gate-arrays-attestation.md
diff --git a/markdown templates/virtual-machines-ps-template-compare-sm-arm-task.md b/markdown templates/virtual-machines-ps-template-compare-sm-arm-task.md
