Merge pull request #301089 from MicrosoftDocs/main

6/9/2025 PM Publish

Author: Taojunshen

articles/azure-government/documentation-government-csp-list.md

@@ -18,7 +18,7 @@ The following tables contain lists of all the authorized Cloud Solution Provider
 
 |Partner name|
 |----------------------------|
-|[2w Technologies LLC](https://2wtech.com)|
+|[2w Technologies Inc](https://2wtech.com/)|
 |[10th Magnitude](https://www.10thmagnitude.com)|
 |[12:34 MicroTechnolgies Inc.](https://www.1234micro.com/)|
 |[1901 Group, LLC](https://1901group.com)|

articles/azure-maps/media/power-bi-visual/layer-position.png

@@ -84,9 +84,33 @@ The general layer section of the **Format** pane are common settings that apply
 
 | Setting        | Description                            |
 |----------------|----------------------------------------|
-| Unselected transparency | The transparency of shapes that aren't selected, when one or more shapes are selected.  |
-| Min data value | The minimum value of the input data to scale against. Good for clipping outliers.  |
-| Max data value | The maximum value of the input data to scale against. Good for clipping outliers.  |
+| Unselected transparency | The transparency of shapes that aren't selected, when one or more shapes are selected. |
+| Min data value | The minimum value of the input data to scale against. Good for clipping outliers. |
+| Max data value | The maximum value of the input data to scale against. Good for clipping outliers. |
+
+## Layer positions
+
+In the Azure Maps visual, certain layers are fixed, meaning they're set at a predefined level and can't be repositioned. Other layers are adjustable, giving users the flexibility to choose from three positioning options: "Above Labels," "Below Labels," or "Below Roads."
+
+:::image type="content" source="media/power-bi-visual/layer-position.png" alt-text="a screenshot showing the layer position drop-down list.":::
+
+Within each Layer position, the order of layers remains consistent. For instance, the 3D bar chart layer always appears above the bubble layer due to its higher layer order, regardless of whether they're placed in "Below Labels" or "Above Labels."
+
+## Layer order
+
+The following table outlines the layer order from top to bottom along with their respective layer position types. Layers marked as "Adjustable" can have their position changed using the Layer position dropdown, as shown in the previous screenshot. Layers marked as "Fixed" don't offer this option.
+
+| Layer Name           | Layer Order | Position type | Description                                           |
+|----------------------|-------------|---------------|-------------------------------------------------------|
+| Category Labels      | 1           | Fixed         |  The Category Labels is fixed as the top-most layer. You can consider this layer as "fixed" at the highest position. |
+| Selection Tools      | 2           | Fixed         |The Selection tool layer is fixed as the second-highest layer, overlaying all other map layers. "Fixed" means it remains in the second level.|
+| 3D Bar chart Layer   | 3           | Adjustable    |                                                       |
+| Pie chart Layer<br>Bubble Layer<br>Cluster Bubble Layer<br>Path Layer | 4 | Adjustable | These layers share the same "Layer position" as the bubble layer, and their relative order within this group remains fixed. |
+| Heat Map Layer       | 5           | Adjustable    |                                                       |
+| Reference Layer      | 6           | Fixed         |The Reference Layer is fixed at "Below labels".   |
+| Filled Map Layer     | 7           | Adjustable    |                                                       |
+| Tile Layer           | 8           | Adjustable    |                                                       |
+| Map Tiles            | 9           | Fixed         |The Map Tiles layer is fixed as the bottom-most map layer. It's the base map layer of the Azure Maps visual.|
 
 ## Next steps
 

articles/azure-maps/power-bi-visual-understanding-layers.md

@@ -4,7 +4,7 @@ description: This article provides details about the known issues of Azure VMwar
 ms.topic: reference
 ms.custom: "engagement-fy23"
 ms.service: azure-vmware
-ms.date: 5/29/2025
+ms.date: 6/9/2025
 ---
 
 # Known issues: Azure VMware Solution
@@ -15,8 +15,9 @@ Refer to the table to find details about resolution dates or possible workaround
 
 |Issue | Date discovered | Workaround | Date resolved |
 | :------------------------------------- | :------------ | :------------- | :------------- |
-|ESXi hosts may experience operational issues if NSX Layer-2 DFW default rule logging is enabled. More information can be obtained in this Knowledge Base article from Broadcom. [ESXi hosts may experience operational issues if L2 DFW default rule logging is enabled](https://knowledge.broadcom.com/external/article/326455/esxi-hosts-may-experience-operational-is.html)| May 2025 | It is not recommended to enable logging on the default Layer-2 DFW rule in a Production environment for any sustained period of time. If logging must be enabled on an L2 rule, it is advised to create a new L2 rule specific to the traffic flow in question and enable logging on that rule only. Please see [Broadcom Knowledge Base Article 326455](https://knowledge.broadcom.com/external/article/326455/esxi-hosts-may-experience-operational-is.html).| N/A |
-|With VMware HCX versions 4.10.3 and earlier, attempts to download upgrade bundles or the Connector OVA directly from the HCX Manager UI (port 443) fail due to the decommissioning of the external image depot server. More information can be obtained in this Knowledge Base article from Broadcom. [Upgrade Bundle Download from 443 UI will Fail in All HCX versions prior to 4.11](https://knowledge.broadcom.com/external/article/395372)| April 2025 | We will begin upgrading all Azure VMware Solution customers to HCX 4.11.0 in the coming weeks, this will provide customers with access to the HCX Connector upgrade bundles, which will be stored on their vSAN datastore. Until then, all customers will need to submit a support request (SR) to obtain the required upgrade bundles. | May 2025 |
+| [VMSA-2025-0010](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717) Multiple vulnerabilities (CVE-2025-41225, CVE-2025-41226, CVE-2025-41227, CVE-2025-41228) have been identified in VMware ESXi and vCenter Server. | May 2025 | Microsoft, in collaboration with Broadcom/VMware, has confirmed the applicability of these vulnerabilities to Azure VMware Solution (AVS). Existing security controls, including cloudadmin role restrictions and network isolation, are deemed to significantly mitigate the impact of these vulnerabilities prior to official patching. The vulnerabilities have been adjudicated with a combined adjusted Environmental Score of [6.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/MAC:L/MPR:N/MUI:N/MS:C/MC:H/MI:H/MA:H) within the Azure VMware Solution. Until the update is fully addressed, customers are advised to exercise additional caution when granting administrative access to guest virtual machines and to actively monitor any administrative activities performed on them. | N/A |
+| ESXi hosts may experience operational issues if NSX Layer-2 DFW default rule logging is enabled. More information can be obtained in this Knowledge Base article from Broadcom: [ESXi hosts may experience operational issues if L2 DFW default rule logging is enabled.](https://knowledge.broadcom.com/external/article/326455/esxi-hosts-may-experience-operational-is.html) | May 2025 | It is not recommended to enable logging on the default Layer-2 DFW rule in a Production environment for any sustained period of time. If logging must be enabled on an L2 rule, it is advised to create a new L2 rule specific to the traffic flow in question and enable logging on that rule only. Please see [Broadcom Knowledge Base Article 326455.](https://knowledge.broadcom.com/external/article/326455/esxi-hosts-may-experience-operational-is.html).| N/A |
+| With VMware HCX versions 4.10.3 and earlier, attempts to download upgrade bundles or the Connector OVA directly from the HCX Manager UI (port 443) fail due to the decommissioning of the external image depot server. More information can be obtained in this Knowledge Base article from Broadcom: [Upgrade Bundle Download from 443 UI will Fail in All HCX versions prior to 4.11](https://knowledge.broadcom.com/external/article/395372)| April 2025 | We will begin upgrading all Azure VMware Solution customers to HCX 4.11.0 in the coming weeks, this will provide customers with access to the HCX Connector upgrade bundles, which will be stored on their vSAN datastore. Until then, all customers will need to submit a support request (SR) to obtain the required upgrade bundles. | May 2025 |
 |[VMSA-2025-0005](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518) VMware Tools for Windows update addresses an authentication bypass vulnerability (CVE-2025-22230). | April 2025 | To remediate CVE-2025-22230, apply version 12.5.1 of VMware Tools, use the Azure VMware Solution Run command ``Set-Tools-Repo.`` | May 2025 |
 | If you're a user of AV64, you may notice a “Status of other hardware objects” alarm on your hosts in vCenter Server. This alarm doesn't indicate a hardware issue. It's triggered when the System Event Log (SEL) reaches its capacity threshold according to vCenter Server. Despite the alarm, the host remains healthy with no hardware-related error signatures detected, and no high availability (HA) events are expected as a result. It's safe to continue operating your private cloud without interruption. The alarm has only two possible states—green and red—with no intermediate warning state. Once the status changes to red, it will remain red even if conditions improve to what would typically qualify as a warning. | April 2025 | This alarm should be treated as a warning and won't affect operability of your private cloud. Microsoft adjusts thresholds for the alarm, so it doesn't alert in vCenter Server. | May 2025 |
 | After deploying an AV48 private cloud, you may see a High pNIC error rate detected. Check the host's vSAN performance view for details if alert is active in the vSphere Client.  | April 2025  | The alert should be considered an informational message, since Microsoft manages the service. Select the **Reset to Green** link to clear it. | April 2025 |

articles/azure-vmware/azure-vmware-solution-known-issues.md

@@ -13,6 +13,11 @@ Microsoft regularly applies important updates to the Azure VMware Solution for n
 
 ## May 2025
 
+
+**vSAN ESA (Express Storage Architecture) support**
+
+Azure VMware Solution will now support vSAN ESA (Express Storage Architecture) as the default vSAN architecture for AV48 (including Stretched Clusters) and AV64 (Gen 2) host types.
+
 **HCX Upgrade and Hybridity Depot Decommissioning**
 
 The HCX Hybridity Depot has been decommissioned by Broadcom. All Azure VMware Solution customers will be upgraded to HCX 4.11.0 in the coming weeks. Until customers are fully upgraded to HCX 4.11.0, they must submit a support request (SR) to obtain the required HCX Connector upgrade bundles. Once customers are upgraded to HCX 4.11.0, previous and current HCX Connector upgrade bundles will be available directly to them from their vSAN datastore. 

articles/azure-vmware/azure-vmware-solution-platform-updates.md

@@ -139,7 +139,7 @@ For this task, see the general steps in [Create your first pipeline](/azure/devo
 
    This example selects **Azure DevOps**.
 
-1. On the **Inventory** tab, select **Non-production** > **Configure pipeline**.
+1. On the **Inventory** tab, select **Production** or **Non-production**, and then select **Configure pipeline**.
 
 1. On the **Configure** tab, select **Existing Azure Pipeline YAML file**.
 
@@ -284,7 +284,7 @@ Now, update your **business-process-pipelines-variables.yml** file to use the pr
 
 1. In Visual Studio Code, go to your logic app project, find the **pipelines** folder, and open the file named **business-process-pipelines-variables.yml** at the end of this path:
 
-   **deployment\businessprocesses\<*business-process-name*>\\pipelines\\**
+   **deployment\businessprocesses\\<*business-process-name*>\\pipelines\\**
 
    The **business-process-pipelines-variables.yml** file contains a node named **`businessProcessMapping`**. This node includes references to your business process stage mappings and specific logic apps. These references contain paths with Azure subscription IDs and names for resource groups and logic apps.
 
@@ -312,21 +312,18 @@ After you finish these steps, your business process pipelines now appear in the
 
 ## Set up permissions and access to Azure Data Explorer
 
-Azure Business Process Tracking uses Azure Data Explorer as the backend data store. So, you need to make sure that your service connection can connect, access, and update Data Explorer cluster, database, and tables.
+Azure Business Process Tracking uses Azure Data Explorer as the backend data store. So, you need to make sure that your service connection can connect, access, and update Data Explorer cluster, database, and tables by completing the following steps:
 
-1. On the cluster, check whether your service connection has the **Contributor** role or access. If not, assign your service connection the appropriate role on your cluster.
+On the Data Explorer database where your service connection needs to create a table, make sure that your service connection has **Database Admin** role.
 
-   For more information, see the following documentation:
+1. In your Azure Database Explorer cluster, go to your Data Explorer database.
+1. On the database menu, under **Overview**, select **Permissions**.
+1. Add your service connection, and assign the **Database Admin** role.
 
-   - [Azure roles, Microsoft Entra roles, and classic subscription administrator roles](/azure/role-based-access-control/rbac-and-directory-admin-roles)
-   - [Role-based access control (Azure Data Explorer)](/kusto/access-control/role-based-access-control?view=azure-data-explorer#roles-and-permissions&preserve-view=true)
+For more information, see the following documentation:
 
-1. On the cluster database where your service connection needs to create a table, make sure that your service connection has administrator privileges.
-
-   For more information, see the following documentation:
-
-   - [Azure roles, Microsoft Entra roles, and classic subscription administrator roles](/azure/role-based-access-control/rbac-and-directory-admin-roles)
-   - [Role-based access control (Azure Data Explorer)](/kusto/access-control/role-based-access-control?view=azure-data-explorer#roles-and-permissions&preserve-view=true)
+- [Azure roles, Microsoft Entra roles, and classic subscription administrator roles](/azure/role-based-access-control/rbac-and-directory-admin-roles)
+- [Role-based access control (Azure Data Explorer)](/kusto/access-control/role-based-access-control?view=azure-data-explorer#roles-and-permissions&preserve-view=true)
 
 ## Create infrastructure pipeline for your business process
 

articles/business-process-tracking/set-up-continuous-integration-deployment.md

@@ -39,8 +39,8 @@ The SQL Server connector has different versions, based on [logic app type and ho
 
 | Logic app | Environment | Connector version |
 |-----------|-------------|-------------------|
-| **Consumption** | Multitenant Azure Logic Apps | Managed connector, which appears in the connector gallery under **Runtime** > **Shared**. For more information, review the following documentation: <br><br>- [SQL Server managed connector reference](/connectors/sql) <br>- [Managed connectors in Azure Logic Apps](managed.md) |
-| **Standard** | Single-tenant Azure Logic Apps and App Service Environment v3 (Windows plans only) | Managed connector, which appears in the connector gallery under **Runtime** > **Shared**, and built-in connector, which appears in the connector gallery under **Runtime** > **In-App** and is [service provider-based](../logic-apps/custom-connector-overview.md#service-provider-interface-implementation). The built-in connector differs in the following ways: <br><br>- The built-in connector can directly connect to an SQL database and access Azure virtual networks by using a connection string without an on-premises data gateway. <br><br>For more information, review the following documentation: <br><br>- [SQL Server managed connector reference](/connectors/sql/) <br>- [SQL Server built-in connector reference](/azure/logic-apps/connectors/built-in/reference/sql/) <br>- [Built-in connectors in Azure Logic Apps](built-in.md) |
+| **Consumption** | Multitenant Azure Logic Apps | Managed connector, which appears in the connector gallery under the **Shared** filter. For more information, review the following documentation: <br><br>- [SQL Server managed connector reference](/connectors/sql) <br>- [Managed connectors in Azure Logic Apps](managed.md) |
+| **Standard** | Single-tenant Azure Logic Apps and App Service Environment v3 (Windows plans only) | Managed connector, which appears in the connector gallery under **Runtime** > **Shared**, and built-in connector, which appears in the connector gallery under the **Built-in** filter and is [service provider-based](../logic-apps/custom-connector-overview.md#service-provider-interface-implementation). The built-in connector differs in the following ways: <br><br>- The built-in connector can directly connect to an SQL database and access Azure virtual networks by using a connection string without an on-premises data gateway. <br><br>For more information, review the following documentation: <br><br>- [SQL Server managed connector reference](/connectors/sql/) <br>- [SQL Server built-in connector reference](/azure/logic-apps/connectors/built-in/reference/sql/) <br>- [Built-in connectors in Azure Logic Apps](built-in.md) |
 
 ### Limitations