Merge branch 'release-aio-ga' of https://github.com/MicrosoftDocs/azure-docs-pr into fabric-tutorial

jlian · jlian · commit b6a7b93cb367 · 2024-11-15T15:39:56.000-08:00
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-adlsv2-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-adlsv2-endpoint.md
@@ -21,7 +21,6 @@ To send data to Azure Data Lake Storage Gen2 in Azure IoT Operations, you can co
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 - An [Azure Data Lake Storage Gen2 account](../../storage/blobs/create-data-lake-storage-account.md)
 - A pre-created storage container in the storage account
 
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-adx-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-adx-endpoint.md
@@ -21,7 +21,6 @@ To send data to Azure Data Explorer in Azure IoT Operations, you can configure a
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 - An **Azure Data Explorer cluster**. Follow the **Full cluster** steps in the [Quickstart: Create an Azure Data Explorer cluster and database](/azure/data-explorer/create-cluster-and-database). The *free cluster* option doesn't work for this scenario.
 
 
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-fabric-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-fabric-endpoint.md
@@ -21,7 +21,6 @@ To send data to Microsoft Fabric OneLake in Azure IoT Operations, you can config
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 - **Microsoft Fabric OneLake**. See the following steps to create a workspace and lakehouse.
   - [Create a workspace](/fabric/get-started/create-workspaces). The default *my workspace* isn't supported.
   - [Create a lakehouse](/fabric/onelake/create-lakehouse-onelake).
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-fabric-real-time-intelligence.md b/articles/iot-operations/connect-to-cloud/howto-configure-fabric-real-time-intelligence.md
@@ -19,7 +19,6 @@ To send data to Microsoft Fabric Real-Time Intelligence from Azure IoT Operation
 ## Prerequisites
 
 - An [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md) instance
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 - [Create a Fabric workspace](/fabric/get-started/create-workspaces). The default *my workspace* isn't supported.
 - [Create an Event Stream](/fabric/real-time-intelligence/event-streams/create-manage-an-eventstream#create-an-eventstream)
 - [Add a Custom Endpoint as a source](/fabric/real-time-intelligence/event-streams/add-source-custom-app#add-custom-endpoint-data-as-a-source)
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-kafka-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-kafka-endpoint.md
@@ -21,7 +21,6 @@ To set up bi-directional communication between Azure IoT Operations and Apache K
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 
 ## Azure Event Hubs
 
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-local-storage-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-local-storage-endpoint.md
@@ -21,7 +21,6 @@ To send data to local storage in Azure IoT Operations, you can configure a dataf
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 - A [PersistentVolumeClaim (PVC)](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
 
 ## Create a local storage dataflow endpoint
diff --git a/articles/iot-operations/connect-to-cloud/howto-configure-mqtt-endpoint.md b/articles/iot-operations/connect-to-cloud/howto-configure-mqtt-endpoint.md
@@ -21,7 +21,6 @@ MQTT dataflow endpoints are used for MQTT sources and destinations. You can conf
 ## Prerequisites
 
 - An instance of [Azure IoT Operations](../deploy-iot-ops/howto-deploy-iot-operations.md)
-- A [configured dataflow profile](howto-configure-dataflow-profile.md)
 
 ## Azure IoT Operations local MQTT broker
 
diff --git a/articles/iot-operations/connect-to-cloud/howto-create-dataflow.md b/articles/iot-operations/connect-to-cloud/howto-create-dataflow.md
diff --git a/articles/iot-operations/create-edge-apps/concept-about-state-store-protocol.md b/articles/iot-operations/create-edge-apps/concept-about-state-store-protocol.md
@@ -3,13 +3,13 @@ title: Learn about the MQTT broker state store protocol
 description: Learn how to implement an MQTT broker state store protocol client
 author: PatAltimore
 ms.author: patricka
+ms.service: azure-iot-operations
 ms.subservice: azure-mqtt-broker
 ms.topic: concept-article
-ms.date: 10/30/2024
+ms.date: 11/15/2024
 
 # CustomerIntent: As a developer, I want understand what the MQTT broker state store protocol is, so
 # that I can implement a client app to interact with the state store.
-ms.service: azure-iot-operations
 ---
 
 # State store protocol
@@ -465,6 +465,8 @@ $3<CR><LF>
 abc<CR><LF>
 ```
 
+The `KEYNOTIFY` notification message contains the timestamp of the value when notifying a client about a SET request (value updated) or when notifying a client about a DEL or VDEL request (value deleted). The timestamp is included as part of the message's MQTT v5 User Property __ts. For more information, see the section [Versions as Hybrid Logical Clocks](#versions-as-hybrid-logical-clocks).
+
 ## Related content
 
 - [MQTT broker overview](../manage-mqtt-broker/overview-broker.md)
diff --git a/articles/iot-operations/manage-mqtt-broker/howto-configure-authentication.md b/articles/iot-operations/manage-mqtt-broker/howto-configure-authentication.md
@@ -240,6 +240,7 @@ resource myBrokerAuthentication 'Microsoft.IoTOperations/instances/brokers/authe
       {
         method: 'X509'
         x509Settings: {
+          trustedClientCaCert: 'client-ca'
           authorizationAttributes: {
             root: {
               attributes: {
@@ -303,8 +304,8 @@ spec:
         - my-audience
     - method: X509
       x509Settings:
+        trustedClientCaCert: client-ca
         authorizationAttributes:
-          trustedClientCaCert: client-ca
           root:
             attributes:
               organization: contoso
diff --git a/articles/iot-operations/manage-mqtt-broker/howto-configure-authorization.md b/articles/iot-operations/manage-mqtt-broker/howto-configure-authorization.md
@@ -78,7 +78,7 @@ resource brokerAuthorization 'Microsoft.IoTOperations/instances/brokers/authoriz
       rules: [
         {
           principals: {
-            usernames: [
+            clientIds: [
               'temperature-sensor'
               'humidity-sensor'
             ]
@@ -96,7 +96,7 @@ resource brokerAuthorization 'Microsoft.IoTOperations/instances/brokers/authoriz
             {
               method: 'Publish'
               topics: [
-                '/telemetry/{principal.username}'
+                '/telemetry/{principal.clientId}'
                 '/telemetry/{principal.attributes.organization}'
               ]
             }
@@ -134,7 +134,7 @@ spec:
     cache: Enabled
     rules:
       - principals:
-          usernames:
+          clientIds:
             - "temperature-sensor"
             - "humidity-sensor"
           attributes:
@@ -144,7 +144,7 @@ spec:
           - method: Connect
           - method: Publish
             topics:
-              - "/telemetry/{principal.username}"
+              - "/telemetry/{principal.clientId}"
               - "/telemetry/{principal.attributes.organization}"
           - method: Subscribe
             topics:
@@ -155,17 +155,27 @@ To create this *BrokerAuthorization* resource, apply the YAML manifest to your K
 
 ---
 
-This broker authorization allows clients with usernames `temperature-sensor` or `humidity-sensor`, or clients with attributes `organization` with value `contoso` and `city` with value `seattle`, to:
+This broker authorization allows clients with client IDs `temperature-sensor` or `humidity-sensor`, or clients with attributes `organization` with value `contoso` and `city` with value `seattle`, to:
 
 - Connect to the broker.
-- Publish messages to telemetry topics scoped with their usernames and organization. For example:
+- Publish messages to telemetry topics scoped with their client IDs and organization. For example:
   - `temperature-sensor` can publish to `/telemetry/temperature-sensor` and `/telemetry/contoso`.
   - `humidity-sensor` can publish to `/telemetry/humidity-sensor` and `/telemetry/contoso`.
   - `some-other-username` can publish to `/telemetry/contoso`.
 - Subscribe to commands topics scoped with their organization. For example:
   - `temperature-sensor` can subscribe to `/commands/contoso`.
   - `some-other-username` can subscribe to `/commands/contoso`.
 
+### Using username for authorization
+
+To use the MQTT username for authorization, specify them as an array under `principals.usernames`. However, depending on the authentication method, the username might not be verified:
+
+- **Kubernetes SAT** - Username shouldn't be used for authorization because it's not verified for MQTTv5 with enhanced authentication.
+- **X.509** - Username matches the CN from certificate and can be used for authorization rules.
+- **Custom** - Username should only be used for authorization rules if custom authentication validates the username.
+
+To prevent security issues, only use the MQTT username for broker authorization when it can be verified.
+
 ### Further limit access based on client ID
 
 Because the `principals` field is a logical OR, you can further restrict access based on client ID by adding the `clientIds` field to the `brokerResources` field. For example, to allow clients with client IDs that start with its building number to connect and publish telemetry to topics scoped with their building, use the following configuration:
