You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/api-management/api-management-howto-disaster-recovery-backup-restore.md
+6-2Lines changed: 6 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ author: dlepow
7
7
8
8
ms.service: azure-api-management
9
9
ms.topic: how-to
10
-
ms.date: 09/06/2024
10
+
ms.date: 06/16/2025
11
11
ms.author: danlep
12
12
ms.custom: devx-track-azurepowershell
13
13
---
@@ -39,7 +39,11 @@ This article shows how to automate backup and restore operations of your API Man
39
39
40
40
## Prerequisites
41
41
42
-
* An API Management service instance. If you don't have one, see [Create an API Management service instance](get-started-create-service-instance.md).
42
+
* An API Management service instance in a supported service tier. If you don't have one, see [Create an API Management service instance](get-started-create-service-instance.md).
43
+
44
+
> [!NOTE]
45
+
> Currently, backup and restore aren't supported in API Management instances with associated [workspace gateways](workspaces-overview.md#workspace-gateway).
46
+
43
47
* An Azure storage account. If you don't have one, see [Create a storage account](../storage/common/storage-account-create.md).
44
48
*[Create a container](../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container) in the storage account to hold the backup data.
Copy file name to clipboardExpand all lines: articles/cost-management-billing/manage/assign-roles-azure-service-principals.md
+16-9Lines changed: 16 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.reviewer: prsaini
6
6
ms.service: cost-management-billing
7
7
ms.subservice: enterprise
8
8
ms.topic: how-to
9
-
ms.date: 04/10/2025
9
+
ms.date: 05/14/2025
10
10
ms.author: prsaini
11
11
---
12
12
@@ -72,15 +72,20 @@ Later in this article, you give permission to the Microsoft Entra app to act by
72
72
73
73
| Role | Actions allowed | Role definition ID |
74
74
| --- | --- | --- |
75
-
| EnrollmentReader |Enrollment readers can view data at the enrollment, department, and account scopes. The data contains charges for all of the subscriptions under the scopes, including across tenants. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e |
76
-
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
75
+
| EnrollmentReader |View data at the enrollment, department, and account scopes. The data contains charges for all of the subscriptions under the scopes, including across tenants. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | 24f8edb6-1668-4659-b5e2-40bb5f3a7d7e |
76
+
| EA purchaser | Purchase reservation orders and view reservation transactions. It has all the permissions of EnrollmentReader, which have all the permissions of DepartmentReader. It can view usage and charges across all accounts and subscriptions. Can view the Azure Prepayment (previously called monetary commitment) balance associated with the enrollment. | da6647fb-7651-49ee-be91-c43c4877f0c4 |
77
77
| DepartmentReader | Download the usage details for the department they administer. Can view the usage and charges associated with their department. | db609904-a47f-4794-9be8-9bd86fbffd8a |
78
78
| SubscriptionCreator | Create new subscriptions in the given scope of Account. | a0bcee42-bf30-4d1b-926a-48d21664ef71 |
79
+
| Partner Admin Reader | View data for all enrollments under the partner organization. This role is only available for the following APIs:<br>- [Balances](/rest/api/consumption/balances/get-by-billing-account)<br>- [Exports V2 (api-version 2025-03-01 only)](/rest/api/cost-management/exports)<br>- [Generate Cost Details Report](/rest/api/cost-management/generate-cost-details-report)<br>- [Marketplaces](/rest/api/consumption/marketplaces/list)<br>- [Consumption Price sheet](/rest/api/consumption/price-sheet)<br>- [Cost Management Price sheet Download](/rest/api/cost-management/price-sheet/download-by-billing-account)<br>- [Generate Reservation Details Report](/rest/api/cost-management/generate-reservation-details-report/by-billing-account-id)<br>- [Reservation Summaries](/rest/api/consumption/reservations-summaries)<br>- [Reservation Recommendations](/rest/api/consumption/reservation-recommendations/list)<br>- [Reservation Transactions](/rest/api/consumption/reservation-transactions) | 4f6144c0-a809-4c55-b3c8-7f9b7b15a1bf |
79
80
80
-
- An EnrollmentReader role can be assigned to a service principal only by a user who has an enrollment writer role. The EnrollmentReader role assigned to a service principal isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
81
-
- A DepartmentReader role can be assigned to a service principal only by a user who has an enrollment writer or department writer role.
82
-
- A SubscriptionCreator role can be assigned to a service principal only by a user who is the owner of the enrollment account (EA administrator). The role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
83
-
- The EA purchaser role isn't shown in the Azure portal. It gets created by programmatic means and is only for programmatic use.
81
+
- The following user roles are required to assign each service principal role:
82
+
-**EnrollmentReader:** user assigning must have _enrollment writer_ role.
83
+
-**DepartmentReader:** user assigning must have _enrollment writer_ or _department writer_ role.
84
+
-**SubscriptionCreator:** user assigning must be the _enrollment account owner_ (EA administrator).
85
+
-**EA purchaser:** user assigning must have _enrollment writer_ role.
86
+
-**Partner Admin Reader:** user assigning must have _partner administrator_ role.
87
+
88
+
All of these roles are created by programmatic means, aren't shown in the Azure portal, and are only for programmatic use.
84
89
85
90
When you grant an EA role to a service principal, you must use the `billingRoleAssignmentName` required property. The parameter is a unique GUID that you must provide. You can generate a GUID using the [New-Guid](/powershell/module/microsoft.powershell.utility/new-guid) PowerShell command. You can also use the [Online GUID / UUID Generator](https://guidgenerator.com/) website to generate a unique GUID.
86
91
@@ -96,7 +101,9 @@ A service principal can have only one role.
96
101
97
102
1. Provide the following parameters as part of the API request.
98
103
99
-
-`billingAccountName`: This parameter is the **Billing account ID**. You can find it in the Azure portal on the **Cost Management + Billing** overview page.
104
+
-`billingAccountName`: This parameter is the **Billing account ID**. You can find it in the Azure portal on the **Cost Management + Billing** overview page.
105
+
- For the **Partner Admin Reader** role, use the format `pcn.{PCN}` for the billing account name, where `{PCN}` is your partner organization's Partner Customer Number.
106
+
- For all other roles, use the standard billing account ID as shown in the Azure portal.
# Prepare your Azure Arc-enabled Kubernetes cluster
14
14
15
-
An Azure Arc-enabled Kubernetes cluster is a prerequisite for deploying Azure IoT Operations. This article describes how to prepare a cluster before you deploy Azure IoT Operations. This article includes guidance for both Ubuntuand Windows.
15
+
An Azure Arc-enabled Kubernetes cluster is a prerequisite for deploying Azure IoT Operations. This article describes how to prepare a cluster before you deploy Azure IoT Operations. This article includes guidance for Ubuntu, Windows, Azure Local, and Tanzu Kubernetes Grid (TKG).
16
16
17
17
The steps in this article prepare your cluster for a secure settings deployment, which is a longer but production-ready process. If you want to deploy Azure IoT Operations quickly and run a sample workload with only test settings, see the [Quickstart: Run Azure IoT Operations in GitHub Codespaces with K3s](../get-started-end-to-end-sample/quickstart-deploy.md) instead. For more information about test settings and secure settings, see [Deployment details > Choose your features](./overview-deploy.md#choose-your-features).
18
18
19
19
## Prerequisites
20
20
21
-
Microsoft supports Azure Kubernetes Service (AKS) Edge Essentials for deployments on Windows and K3s for deployments on Ubuntu. If you want to deploy Azure IoT Operations to a multi-node solution, use K3s on Ubuntu.
21
+
Microsoft supports Azure Kubernetes Service (AKS) Edge Essentials for deployments on Windows, K3s for deployments on Ubuntu, AKS deployments on Azure Local, and Tanzu Kubernetes release (TKr) on TKG. If you want to deploy Azure IoT Operations to a multi-node solution, use K3s on Ubuntu.
22
22
23
23
### [Ubuntu](#tab/ubuntu)
24
24
25
25
To prepare an Azure Arc-enabled Kubernetes cluster, you need:
26
26
27
-
* An Azure subscription with either the Owner role or a combination of Contributor and User Access Administrator roles. You can check your access level by navigating to your subscription, selecting Access control (IAM) on the left-hand side of the Azure portal, and then selecting View my access. If you don't have an Azure subscription, [create one for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
28
-
29
-
* An Azure resource group. Only one Azure IoT Operations instance is supported per resource group. To create a new resource group, use the [az group create](/cli/azure/group#az-group-create) command. For the list of currently supported Azure regions, see [Supported regions](../overview-iot-operations.md#supported-regions).
30
-
31
-
```azurecli
32
-
az group create --location <REGION> --resource-group <RESOURCE_GROUP> --subscription <SUBSCRIPTION_ID>
33
-
```
34
-
35
-
* Azure CLI version 2.53.0 or newer installed on your cluster machine. Use `az --version` to check your version and `az upgrade` to update if necessary. For more information, see [How to install the Azure CLI](/cli/azure/install-azure-cli).
36
-
37
-
* The latest version of the **connectedk8s** extension for Azure CLI:
38
-
39
-
```bash
40
-
az extension add --upgrade --name connectedk8s
41
-
```
27
+
[!INCLUDE [Cluster prerequisites for Ubuntu and Tanzu](../includes/cluster-prerequisites.md)]
42
28
43
29
* Hardware that meets the system requirements:
44
30
@@ -73,7 +59,22 @@ To prepare an Azure Arc-enabled Kubernetes cluster, you need:
*[Azure Arc-enabled Kubernetes system requirements](/azure/azure-arc/kubernetes/system-requirements).
62
+
63
+
### [TKG with a management cluster](#tab/tkgm)
64
+
65
+
To prepare a TKG workload cluster, you need:
66
+
67
+
[!INCLUDE [Cluster prerequisites for Ubuntu and Tanzu](../includes/cluster-prerequisites.md)]
68
+
69
+
-[TKG with a standalone management cluster.](https://techdocs.broadcom.com/us/en/vmware-tanzu/standalone-components/tanzu-kubernetes-grid/2-5/tkg/mgmt-index.html)
@@ -128,13 +129,13 @@ To prepare a K3s Kubernetes cluster on Ubuntu:
128
129
129
130
Connect your cluster to Azure Arc so that it can be managed remotely.
130
131
131
-
1.On the machine where you deployed the Kubernetes cluster, sign into Azure CLI with your Microsoft Entra user account that has the required role(s) for the Azure subscription:
132
+
1.From a machine that has `kubectl` access to your cluster, sign into Azure CLI with your Microsoft Entra user account that has the required role(s) for the Azure subscription:
132
133
133
-
```azurecli
134
+
```azurecli
134
135
az login
135
136
```
136
137
137
-
If at any point you get an error that says *Your device is required to be managed to access your resource*, run `az login` again and make sure that you sign in interactively with a browser.
138
+
If at any point you get an error that says *Your device is required to be managed to access your resource*, run `az login` again and make sure that you sign in interactively with a browser.
138
139
139
140
1. After you sign in, the Azure CLI displays all of your subscriptions and indicates your default subscription with an asterisk `*`. To continue with your default subscription, select `Enter`. Otherwise, type the number of the Azure subscription that you want to use.
140
141
@@ -238,6 +239,105 @@ By default, a Kubernetes cluster is created with a node pool that can run Linux
238
239
239
240
Then, once you have an Azure Arc-enabled Kubernetes cluster, you can [deploy Azure IoT Operations](howto-deploy-iot-operations.md).
240
241
242
+
### [TKG with a management cluster](#tab/tkgm)
243
+
244
+
To prepare a TKG workload cluster, you need:
245
+
246
+
- A single-node or multi-node TKG workload cluster. For guidance, see the [Tanzu documentation](https://techdocs.broadcom.com/us/en/vmware-tanzu/standalone-components/tanzu-kubernetes-grid/2-5/tkg/workload-clusters-index.html).
247
+
248
+
### Update pod security admission settings
249
+
250
+
Before deploying Azure IoT Operations, you will need to update the Pod Security Admission settings on your TKG cluster. Applying this file will pre-create namespace labels and set pod security to `privileged`.
Connect your cluster to Azure Arc so that it can be managed remotely.
261
+
262
+
1. On the machine where you deployed the Kubernetes cluster, sign into Azure CLI with your Microsoft Entra user account that has the required role(s) for the Azure subscription:
263
+
264
+
265
+
```azurecli
266
+
az login
267
+
```
268
+
269
+
1. After you sign in, the Azure CLI displays all of your subscriptions and indicates your default subscription with an asterisk `*`. To continue with your default subscription, select `Enter`. Otherwise, type the number of the Azure subscription that you want to use.
270
+
271
+
1. Register the required resource providers in your subscription.
272
+
273
+
> [!NOTE]
274
+
> This step only needs to be run once per subscription. To register resource providers, you need permission to do the `/register/action` operation, which is included in subscription Contributor and Owner roles. For more information, see [Azure resource providers and types](../../azure-resource-manager/management/resource-providers-and-types.md).
275
+
276
+
```azurecli
277
+
az provider register -n "Microsoft.ExtendedLocation"
278
+
az provider register -n "Microsoft.Kubernetes"
279
+
az provider register -n "Microsoft.KubernetesConfiguration"
280
+
az provider register -n "Microsoft.IoTOperations"
281
+
az provider register -n "Microsoft.DeviceRegistry"
282
+
az provider register -n "Microsoft.SecretSyncController"
283
+
```
284
+
285
+
1. Use the [az connectedk8s connect](/cli/azure/connectedk8s) command to Arc-enable your Kubernetes cluster and manage it as part of your Azure resource group.
To prevent unplanned updates to Azure Arc and the system Arc extensions that Azure IoT Operations uses as dependencies, this command disables autoupgrade. Instead, [manually upgrade agents](/azure/azure-arc/kubernetes/agent-upgrade) as needed.
293
+
294
+
> [!IMPORTANT]
295
+
> If your environment uses a proxy server or Azure Arc Gateway, modify the `az connectedk8s connect` command with your proxy information:
296
+
>
297
+
> 1. Follow the instructions in either [Connect using an outbound proxy server](/azure/azure-arc/kubernetes/quickstart-connect-cluster#connect-using-an-outbound-proxy-server) or [Onboard Kubernetes clusters to Azure Arc with Azure Arc Gateway](/azure/azure-arc/kubernetes/arc-gateway-simplify-networking#onboard-kubernetes-clusters-to-azure-arc-with-your-arc-gateway-resource).
298
+
> 1. Add `169.254.169.254` to the `--proxy-skip-range` parameter of the `az connectedk8s connect` command. [Azure Device Registry](../discover-manage-assets/overview-manage-assets.md#store-assets-as-azure-resources-in-a-centralized-registry) uses this local endpoint to get access tokens for authorization.
299
+
>
300
+
> Azure IoT Operations doesn't support proxy servers that require a trusted certificate.
301
+
302
+
1. Get the cluster's issuer URL.
303
+
304
+
305
+
```azurecli
306
+
az connectedk8s show --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --query oidcIssuerProfile.issuerUrl --output tsv
307
+
```
308
+
309
+
Save the output of this command to use in the next steps.
310
+
311
+
1. Connect to the TKG management cluster. Edit the custom resource for the workload cluster with the issuer URL from the previous step.
312
+
313
+
```azurecli
314
+
kubectl edit cluster <CLUSTER_NAME>
315
+
```
316
+
317
+
1. Add the following content to the `config.yaml` file, replacing the <OIDC_ISSUER_URL> placeholder with your cluster's issuer URL.
318
+
> [!NOTE]
319
+
> The URL should be copied exactly as printed by the prior command, including any characters such as `/`.
1. Prepare for enabling the Azure Arc service, custom location, on your Arc cluster by getting the custom location object ID and saving it as the environment variable, OBJECT_ID. You must be logged into Azure CLI with a Microsoft Entra user account to successfully run the command, not a service principal. Run the following command **exactly as written**, without changing the GUID value.
327
+
328
+
```azurecli
329
+
export OBJECT_ID=$(az ad sp show --id bc313c14-388c-4e7d-a58e-70017303ee3b --query id -o tsv)
330
+
```
331
+
332
+
> [!NOTE]
333
+
>If you receive the error: "Unable to fetch oid of 'custom-locations' app. Proceeding without enabling the feature. Insufficient privileges to complete the operation," then your service principal might lack the necessary permissions to retrieve the object ID of the custom location. Log into Azure CLI with a Microsoft Entra user account that meets the prerequisites. For more information, see [Create and manage custom locations](https://aka.ms/enable-cl-sp).
334
+
335
+
1. Use the [az connectedk8s enable-features](/cli/azure/connectedk8s) command to enable the custom location feature on your Arc cluster. This command uses the OBJECT_ID environment variable saved from the previous step to set the value for the custom-locations-oid parameter. Run this command on the machine where you deployed the Kubernetes cluster:
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments