Merge pull request #260825 from MicrosoftDocs/main

Publish to live, Monday 4 AM PST, 12/11

Author: ttorble

articles/azure-monitor/alerts/alerts-metric-logs.md

@@ -54,7 +54,7 @@ Before Metric for Logs gathered on Log Analytics data works, the following must
 
  Metric alerts can be created and managed using the Azure portal, Resource Manager Templates, REST API, PowerShell, and Azure CLI. Since Metric Alerts for Logs, is a variant of metric alerts - once the prerequisites are done, metric alert for logs can be created for specified Log Analytics workspace. All characteristics and functionalities of [metric alerts](./alerts-metric-near-real-time.md) will be applicable to metric alerts for logs, as well; including payload schema, applicable quota limits, and billed price.
 
-For step-by-step details and samples - see [creating and managing metric alerts](./alerts-metric.md). Specifically, for Metric Alerts for Logs - follow the instructions for managing metric alerts and ensure the following:
+For step-by-step details and samples - see [creating and managing metric alerts](./alerts-create-metric-alert-rule.md). Specifically, for Metric Alerts for Logs - follow the instructions for managing metric alerts and ensure the following:
 
 - Target for metric alert is a valid *Log Analytics workspace*
 - Signal chosen for metric alert for selected *Log Analytics workspace* is of type **Metric**

articles/azure-monitor/alerts/alerts-overview.md

@@ -103,6 +103,33 @@ The system compiles a list of recommended alert rules based on:
 > - AKS resources
 > - Log Analytics workspaces
 
+## Alerting at-scale
+
+You can use any of the following methods for creating alert rules at-scale. Each choice has advantages and disadvantages that could have an effect on cost and on maintenance of the alert rules. 
+
+### Metric alerts
+You can use [one metric alert rule to monitor multiple resources](alerts-metric-multiple-time-series-single-rule.md) of the same type that exist in the same Azure region. Individual notifications are sent for each monitored resource. For a list of Azure services that are currently supported for this feature, see [Supported resources for metric alerts in Azure Monitor](alerts-metric-near-real-time.md).
+
+For metric alert rules for Azure services that don't support multiple resources, use automation tools such as the Azure CLI, PowerShell, or Azure Resource Manager templates to create the same alert rule for multiple resources. For sample ARM templates, see [Resource Manager template samples for metric alert rules in Azure Monitor](resource-manager-alerts-metric.md).
+
+Each metric alert rule is charged based on the number of time series that are monitored.
+
+### Log alerts
+
+Use [log alert rules](alerts-create-log-alert-rule.md) to monitor all resources that send data to the Log Analytics workspace. These resources can be from any subscription or region. Use data collection rules when setting up your Log Analytics workspace to collect the required data for your log alerts rule. 
+
+You can also create resource-centric alerts instead of workspace-centric alerts by using **Split by dimensions**. When you split on the resourceId column, you will get one alert per resource that meets the condition.
+
+Log alert rules that use splitting by dimensions are charged based on the number of time series created by the dimensions resulting from your query. If the data is already collected to an Log Analytics workspace, there is no additional cost. 
+
+If you use metric data at scale in the Log Analytics workspace, pricing will change based on the data ingestion.
+
+### Using Azure policies for alerting at scale
+
+You can use [Azure policies](/azure/governance/policy/overview) to set up alerts at-scale. This has the advantage of easily implementing alerts at-scale. You can see how this is implementated with [Azure Monitor baseline alerts](https://aka.ms/amba).
+
+Keep in mind that if you use policies to create alert rules, you may have the increased overhead of maintaining a large alert rule set.
+
 ## Azure role-based access control for alerts
 
 You can only access, create, or manage alerts for resources for which you have permissions.

articles/azure-monitor/essentials/activity-log-insights.md

@@ -4,7 +4,7 @@ description: Learn how to monitor changes to resources and resource groups in an
 author: guywi-ms
 services: azure-monitor
 ms.topic: how-to
-ms.date: 08/24/2022
+ms.date: 12/11/2023
 ms.author: guywild
 ms.reviewer: orens
 

articles/azure-monitor/essentials/activity-log.md

@@ -4,8 +4,7 @@ description: View the Azure Monitor activity log and send it to Azure Monitor Lo
 author: guywi-ms
 services: azure-monitor
 ms.topic: conceptual
-ms.custom: ignite-2022
-ms.date: 07/01/2022
+ms.date: 12/11/2023
 ms.author: guywild
 ms.reviewer: orens
 ---
@@ -16,7 +15,7 @@ The Azure Monitor activity log is a [platform log](./platform-logs-overview.md)
 
 For more functionality, create a diagnostic setting to send the activity log to one or more of these locations for the following reasons:
 
-- Send to [Azure Monitor Logs](../logs/data-platform-logs.md) for more complex querying and alerting and for longer retention, up to two years.
+- Send to [Azure Monitor Logs](../logs/data-platform-logs.md) for more complex querying and alerting and for [longer retention of up to twelve years](../logs/data-retention-archive.md).
 - Send to Azure Event Hubs to forward outside of Azure.
 - Send to Azure Storage for cheaper, long-term archiving.
 

articles/azure-monitor/logs/customer-managed-keys.md

@@ -278,11 +278,13 @@ When linking your Storage Account for saved queries, the service stores saved-qu
 
 **Considerations before setting Customer-managed key for queries**
 * You need to have "write" permissions on your workspace and Storage Account.
-* Make sure to create your Storage Account in the same region as your Log Analytics workspace is located.
-* The saves queries in storage is considered as service artifacts and their format may change.
-* Linking a Storage Account for queries removed existing saves queries from your workspace. Copy saves queries that you need before this configuration. You can view your saved queries using  [PowerShell](/powershell/module/az.operationalinsights/get-azoperationalinsightssavedsearch).
+* Make sure to create your Storage Account in the same region as your Log Analytics workspace is located, with Customer-managed key encryption. This is important since saved queries are stored in table storage and it can only be encrypted at Storage Account creation.
+* Queries saved in [query pack](./query-packs.md) aren't encrypted with Customer-managed key. Select **Save as Legacy query** when saving queries instead, to protect them with Customer-managed key.
+* Saves queries in storage are considered service artifacts and their format may change.
+* Linking a Storage Account for queries removes existing saves queries from your workspace. Copy saves queries that you need before this configuration. You can view your saved queries using [PowerShell](/powershell/module/az.operationalinsights/get-azoperationalinsightssavedsearch).
 * Query 'history' and 'pin to dashboard' aren't supported when linking Storage Account for queries.
-* You can link a single Storage Account to a workspace, which can be used for both saved queries and log alerts queries.
+* You can link a single Storage Account to a workspace for both saved queries and log alerts queries.
+* Log alerts are saved in blob storage and Customer-managed key encryption can be configured at Storage Account creation, or later.
 * Fired log alerts won't contain search results or alert query. You can use [alert dimensions](../alerts/alerts-unified-log.md#split-by-alert-dimensions) to get context in the fired alerts.
 
 **Configure BYOS for saved queries**

articles/azure-monitor/logs/private-storage.md

@@ -60,12 +60,14 @@ The storage account and the key vault must be in the same region, but they also
 #### Apply CMKs to your storage accounts
 To configure your Azure Storage account to use CMKs with Key Vault, use the [Azure portal](../../storage/common/customer-managed-keys-configure-key-vault.md?toc=%252fazure%252fstorage%252fblobs%252ftoc.json), [PowerShell](../../storage/common/customer-managed-keys-configure-key-vault.md?toc=%252fazure%252fstorage%252fblobs%252ftoc.json), or the [Azure CLI](../../storage/common/customer-managed-keys-configure-key-vault.md?toc=%252fazure%252fstorage%252fblobs%252ftoc.json).
 
-## Link storage accounts to your Log Analytics workspace
-
 > [!NOTE]
-> - When linking storage account for privacy and compliance typically, saved queries and log alerts are deleted from workspace permanently and can't be restored. To prevent lose of existing saved queries and log alerts, copy saved queries and log alerts using a template as described in [Workspace move procedure](./move-workspace-region.md). 
-> - A single storage account can be linked for custom log and IIS logs, query, and alert.
-> - When linking storage account for custom log and IIS logs ingestion, you might need to consider linking more storage accounts depending on the ingestion rate. You can link up to five storage accounts to a workspace.
+> - When linking Storage Account for query, existing saved queries in workspace are deleted permanently for privacy. You can copy existing saved queries before storage link using [PowerShell](/powershell/module/az.operationalinsights/get-azoperationalinsightssavedsearch).
+> - Queries saved in [query pack](./query-packs.md) aren't encrypted with Customer-managed key. Select **Save as Legacy query** when saving queries instead, to protect them with Customer-managed key.
+> - Saved queries are stored in table storage and encrypted with Customer-managed key when encryption is configured at Storage Account creation.
+> - Log alerts are saved in blob storage where configuration of Customer-managed key encryption can be at Storage Account creation, or later.
+> - You can use a single Storage Account for all purposes, query, alert, custom log and IIS logs. Linking storage for custom log and IIS logs might require more Storage Accounts for scale, depending on the ingestion rate and storage limits. You can link up to five Storage Accounts to a workspace.
+
+## Link storage accounts to your Log Analytics workspace
 
 ### Use the Azure portal
 On the Azure portal, open your workspace menu and select **Linked storage accounts**. A pane shows the linked storage accounts by the use cases previously mentioned (ingestion over Private Link, applying CMKs to saved queries or to alerts).

articles/azure-monitor/logs/query-packs.md

@@ -6,7 +6,7 @@ ms.topic: conceptual
 author: guywi-ms
 ms.author: guywild
 ms.reviewer: roygal
-ms.date: 06/22/2022
+ms.date: 12/11/2023
 
 ---
 
@@ -50,6 +50,9 @@ To add query packs to your Log Analytics workspace:
 ## Create a query pack
 You can create a query pack by using the REST API or from the **Log Analytics query packs** pane in the Azure portal. To open the **Log Analytics query packs** pane in the portal, select **All services** > **Other**.
 
+> [!NOTE]
+> Queries saved in [query pack](./query-packs.md) aren't encrypted with Customer-managed key. Select **Save as Legacy query** when saving queries instead, to protect them with Customer-managed key.
+
 ### Create a token
 You must have a token for authentication of the API request. There are multiple methods to get a token. One method is to use `armclient`.
 

articles/azure-signalr/TOC.yml

@@ -57,6 +57,8 @@
     href: concept-service-mode.md
   - name: Connection string
     href: concept-connection-string.md
+  - name: Client negotiation
+    href: signalr-concept-client-negotiation.md
   - name: Scale ASP.NET Core SignalR
     href: signalr-concept-scale-aspnet-core.md
   - name: Serverless
@@ -218,4 +220,4 @@
   - name: Twitter
     href: https://twitter.com/SignalR
   - name: ASP.NET forums
-    href: https://social.msdn.microsoft.com/Forums/en-US/home?forum=aspsignalr
+    href: https://social.msdn.microsoft.com/Forums/en-US/home?forum=aspsignalr