Skip to content

Commit cfab6d4

Browse files
Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into sre/incedent-management
2 parents f669d33 + 84ed594 commit cfab6d4

File tree

514 files changed

+2994
-1219
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

514 files changed

+2994
-1219
lines changed

articles/api-management/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -680,6 +680,8 @@
680680
href: breaking-changes/git-configuration-retirement-march-2025.md
681681
- name: Direct management API retirement (March 2025)
682682
href: breaking-changes/direct-management-api-retirement-march-2025.md
683+
- name: Managed certificates suspension (August 2025)
684+
href: breaking-changes/managed-certificates-suspension-august-2025.md
683685
- name: ADAL-based identity provider retirement (September 2025)
684686
href: breaking-changes/identity-provider-adal-retirement-sep-2025.md
685687
- name: CAPTCHA endpoint update (September 2025)

articles/api-management/api-management-capacity.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,6 @@ In the v2 tiers, the following metrics are available:
4242

4343
* **Memory Percentage of Gateway** - The percentage of memory capacity used by the gateway units.
4444

45-
> [!NOTE]
46-
> Currently, the Memory Percentage of Gateway metric isn't supported in the Premium v2 tier.
47-
4845
Available aggregations for these metrics are as follows.
4946

5047
* **Avg** - Average percentage of capacity used across gateway processes in every [unit](upgrade-and-scale.md) of an API Management instance.

articles/api-management/api-management-howto-deploy-multi-region.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ This section provides considerations for multi-region deployments when the API M
168168
* Configure each regional network independently. The [connectivity requirements](virtual-network-reference.md) such as required network security group rules for a virtual network in an added region are generally the same as those for a network in the primary region.
169169
* Virtual networks in the different regions don't need to be peered.
170170
> [!IMPORTANT]
171-
> When configured in internal virtual network mode, each regional gateway must also have outbound connectivity on port 1433 to the Azure SQL database configured for your API Management instance, which is only in the *primary* region. Ensure that you allow connectivity to the FQDN or IP address of this Azure SQL database in any routes or firewall rules you configure for networks in your secondary regions; the Azure SQL service tag can't be used in this scenario. To find the Azure SQL database name in the primary region, go to the **Network** > **Network status** page of your API Management instance in the portal.
171+
> When configured in internal virtual network mode, each regional gateway must also have outbound connectivity on port 1433 to the Azure SQL database configured for your API Management instance, which is only in the *primary* region. Ensure that you allow connectivity to the FQDN or IP address of this Azure SQL database in any routes or firewall rules you configure for networks in your secondary regions; the Azure SQL service endpoint can't be used in this scenario. To find the Azure SQL database name in the primary region, go to the **Network** > **Network status** page of your API Management instance in the portal.
172172

173173
### IP addresses
174174

articles/api-management/api-management-region-availability.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: dlepow
66

77
ms.service: azure-api-management
88
ms.topic: concept-article
9-
ms.date: 06/17/2025
9+
ms.date: 07/21/2025
1010
ms.author: danlep
1111
ms.custom:
1212
- references_regions
@@ -32,6 +32,7 @@ Information in the following table is updated regularly. Capacity availability i
3232
| Australia Southeast ||| | |
3333
| Brazil South ||| | |
3434
| Central India ||| | |
35+
| Central US ||| | |
3536
| East Asia ||| ||
3637
| East US ||| | |
3738
| East US 2 |||||
@@ -49,6 +50,7 @@ Information in the following table is updated regularly. Capacity availability i
4950
| Sweden Central ||| | |
5051
| South India ||| | |
5152
| Switzerland North ||| | |
53+
| UAE North ||| | |
5254
| UK South |||||
5355
| UK West ||| | |
5456
| West Europe ||| ||
Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
title: Azure API Management - Managed certificates suspension for new custom domains (August 2025)
3+
description: Azure API Management is temporarily suspending managed certificates for new custom domains from August 15, 2025 to March 15, 2026 due to industry-wide changes in domain validation.
4+
services: api-management
5+
author: dlepow
6+
ms.service: azure-api-management
7+
ms.topic: reference
8+
ai-usage: ai-assisted
9+
ms.date: 07/18/2025
10+
ms.author: danlep
11+
---
12+
13+
# Managed certificates suspension for new custom domains (August 2025)
14+
15+
[!INCLUDE [premium-dev-standard-basic.md](../../../includes/api-management-availability-premium-dev-standard-basic.md)]
16+
17+
Azure managed certificates for new custom domains in API Management will be temporarily turned off from August 15, 2025 to March 15, 2026. Existing managed certificates will be autorenewed and remain unaffected.
18+
19+
In the classic service tiers, Azure API Management offers [free, managed TLS certificates for custom domains](../configure-custom-domain.md#domain-certificate-options), allowing customers to secure their endpoints without purchasing and managing their own certificates. Because of an industry-wide deprecation of CNAME-based Domain Control Validation (DCV), our Certificate Authority (CA), DigiCert, will migrate to a new validation platform to meet Multi-Perspective Issuance Corroboration (MPIC) requirements. This migration requires a temporary suspension of managed certificates for new custom domains.
20+
21+
## Is my service affected by this?
22+
23+
You're affected if you plan to create new managed certificates for new custom domains in Azure API Management between August 15, 2025 and March 15, 2026. Existing managed certificates will be autorenewed before August 15, 2025 and will continue to function normally. There's no impact to existing managed certificates or custom domains already using them.
24+
25+
## What is the deadline for the change?
26+
27+
The suspension of managed certificates for new custom domains will be enforced from August 15, 2025 to March 15, 2026. The capability to create managed certificates will resume after the migration to the new validation platform is complete.
28+
29+
## What do I need to do?
30+
31+
No action is required if you already have managed certificates for your custom domains. If you need to add new managed certificates, plan to do so before August 15, 2025 or after March 15, 2026. During the suspension period, you can still configure custom domains with certificates you manage from other sources.
32+
33+
## Help and support
34+
35+
If you have questions, get answers from community experts in [Microsoft Q&A](https://aka.ms/apim/azureqa/change/captcha-2022). If you have a support plan and need technical help, create a [support request](https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview).
36+
37+
## Related content
38+
39+
See all [upcoming breaking changes and feature retirements](overview.md).

articles/api-management/breaking-changes/overview.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: dlepow
66

77
ms.service: azure-api-management
88
ms.topic: reference
9-
ms.date: 05/30/2025
9+
ms.date: 07/17/2025
1010
ms.author: danlep
1111
---
1212

@@ -30,6 +30,7 @@ The following table lists all the upcoming breaking changes and feature retireme
3030
| [Git repository retirement][git2025] | March 15, 2025 |
3131
| [Direct management API retirement][mgmtapi2025] | March 15, 2025 |
3232
| [Workspaces preview breaking changes, part 2][workspaces2025march] | March 31, 2025 |
33+
| [Managed certificates suspension][managed-certificates-suspension-august-2025] | August 15, 2025 |
3334
| [ADAL-based Microsoft Entra ID identity provider retirement][msal2025] | September 30, 2025 |
3435
| [CAPTCHA endpoint update][captcha2025] | September 30, 2025 |
3536
| [Built-in analytics dashboard retirement][analytics2027] | March 15, 2027 |
@@ -50,3 +51,4 @@ The following table lists all the upcoming breaking changes and feature retireme
5051
[mgmtapi2025]: ./direct-management-api-retirement-march-2025.md
5152
[workspaces2024]: ./workspaces-breaking-changes-june-2024.md
5253
[workspaces2025march]: ./workspaces-breaking-changes-march-2025.md
54+
[managed-certificates-suspension-august-2025]: ./managed-certificates-suspension-august-2025.md

articles/app-service/configure-authentication-provider-aad.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -301,7 +301,7 @@ Requests that fail these built-in checks get an HTTP `403 Forbidden` response.
301301

302302
[fic-config]: #use-a-managed-identity-instead-of-a-secret-preview
303303

304-
Instead of configuring a client secret for your app registration, you can [configure an application to trust a managed identity (preview)][entra-fic]. Using an identity instead of a secret means you don't have to manage a secret. You don't have secret expiration events to handle, and you don't have the same level of risk associated with possibly disclosing or leaking that secret.
304+
Instead of configuring a client secret for your app registration, you can [configure an application to trust a managed identity][entra-fic]. Using an identity instead of a secret means you don't have to manage a secret. You don't have secret expiration events to handle, and you don't have the same level of risk associated with possibly disclosing or leaking that secret.
305305

306306
The identity allows you to create a *federated identity credential*, which can be used instead of a client secret as a *client assertion*. This approach is available only for workforce configurations. The built-in authentication feature currently supports federated identity credentials as a preview.
307307

@@ -313,6 +313,7 @@ You can use the steps in this section to configure your App Service or Azure Fun
313313

314314
> [!IMPORTANT]
315315
> The user-assigned managed identity that you create should only be assigned to the App Service or Azure Functions application through this registration. If you assign the identity to another resource, you're giving that resource unnecessary access to your app registration.
316+
316317
1. Note down the **Object ID** and **Client ID** values of the managed identity. You'll need the object ID to create a federated identity credential in the next step. You'll use the managed identity's client ID in a later step.
317318

318319
1. Follow the Microsoft Entra ID [instructions to configure a federated identity credential on an existing application](/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity#configure-a-federated-identity-credential-on-an-existing-application). Those instructions also include sections for updating application code, which you can skip.
Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
---
2+
title: Configure App Service plans for zone redundancy
3+
description: Learn how to configure your App Service plan for zone redundancy. Understand how your App Service plan instances are distributed across availability zones and how to check for zone redundancy support.
4+
ms.topic: conceptual
5+
ms.service: azure-app-service
6+
ms.date: 07/15/2025
7+
author: anaharris
8+
ms.author: anaharris
9+
10+
---
11+
# Configure App Service plans for zone redundancy
12+
13+
Azure App Service provides built-in reliability features to help ensure your applications are available and resilient. This article describes how to create your App Service plan with zone redundancy. It also covers how to disable and enable zone redundancy on existing plans, and how to check for zone redundancy support. To learn more about how App Service supports zone redundancy, see [Reliability in Azure App Service](../reliability/reliability-app-service.md).
14+
15+
## Create a new App Service plan with zone redundancy
16+
17+
To create a new App Service plan with zone redundancy:
18+
19+
# [Azure portal](#tab/portal)
20+
21+
Follow the guidance in [Create an App Service plan](../app-service/app-service-plan-manage.md#create-an-app-service-plan). Make sure to select *Enabled* for **Zone redundancy**.
22+
23+
:::image type="content" source="./media/configure-zone-redundancy/app-service-create-zr-plan.png" alt-text="Screenshot of zone redundancy enablement during App Service plan creation in the Azure portal.":::
24+
25+
# [Azure CLI](#tab/azurecli)
26+
27+
Set the `--zone-redundant` argument. You must also specify the `--number-of-workers` argument, which is the number of instances, and set a value greater than or equal to 2.
28+
29+
```azurecli
30+
az appservice plan create \
31+
-n <app-service-plan-name> \
32+
-g <resource-group-name> \
33+
--zone-redundant \
34+
--number-of-workers 2 \
35+
--sku P1V3
36+
```
37+
38+
# [Bicep](#tab/bicep)
39+
40+
Set the `zoneRedundant` property to `true`. You must also define the `sku.capacity` property to a value of 2 or greater. If you don't define the `sku.capacity` property, the value defaults to 1.
41+
42+
```bicep
43+
resource appServicePlan 'Microsoft.Web/serverfarms@2024-11-01' = {
44+
name: appServicePlanName
45+
location: location
46+
sku: {
47+
name: sku
48+
capacity: 2
49+
}
50+
kind: 'linux'
51+
properties: {
52+
reserved: true
53+
zoneRedundant: true
54+
}
55+
}
56+
```
57+
58+
---
59+
60+
## Set zone redundancy for an existing App Service plan
61+
62+
1. If you want to enable zone redundancy on an existing App Service plan, [check for zone redundancy support for your App Service plan](#check-for-zone-redundancy-support-on-an-app-service-plan).
63+
1. If your App Service plan supports zone redundancy, you can enable or disable it by using the Azure portal, Azure CLI, or Bicep/Resource Manager.
64+
65+
# [Azure portal](#tab/portal)
66+
67+
1. In the [Azure portal](https://portal.azure.com), navigate to your App Service plan.
68+
1. Select **Settings > Scale out (App Service plan)** in the left navigation pane.
69+
1. Select **Zone redundancy** if you wish to enable zone redundancy. Deselect if you wish to disable it.
70+
71+
Changing the zone redundancy status of an App Service plan is almost instantaneous. You don't experience downtime or performance problems during the process.
72+
73+
:::image type="content" source="./media/configure-zone-redundancy/app-service-plan-zone-redundancy-portal.png" alt-text="Screenshot of zone redundancy property for an App Service plan in the Azure portal.":::
74+
75+
> [!IMPORTANT]
76+
> If you have *Rules Based* scaling enabled, you can't use the Azure portal to enable zone redundancy. You must use the Azure CLI or Bicep/Resource Manager instead.
77+
78+
# [Azure CLI](#tab/azurecli)
79+
80+
- To *enable zone redundancy*, set the `zoneRedundant` property to `true`. You must also specify the `sku.capacity` argument, which is the number of instances, and set a value greater than or equal to 2.
81+
82+
```azurecli
83+
az appservice plan update \
84+
-n <app-service-plan-name> \
85+
-g <resource-group-name> \
86+
--set zoneRedundant=true sku.capacity=2
87+
```
88+
89+
- To *disable zone redundancy*, set the `zoneRedundant` property to `false`.
90+
91+
```azurecli
92+
az appservice plan update \
93+
-n <app-service-plan-name> \
94+
-g <resource-group-name> \
95+
--set zoneRedundant=false
96+
```
97+
98+
# [Bicep](#tab/bicep)
99+
100+
- To *enable zone redundancy*, set the `zoneRedundant` property to `true`. You must also define the `sku.capacity` property to a value of 2 or greater. If you don't define the `sku.capacity` property, the value defaults to 1.
101+
102+
```bicep
103+
resource appServicePlan 'Microsoft.Web/serverfarms@2024-11-01' = {
104+
name: appServicePlanName
105+
location: location
106+
sku: {
107+
name: sku
108+
capacity: 2
109+
}
110+
kind: 'linux'
111+
properties: {
112+
reserved: true
113+
zoneRedundant: true
114+
}
115+
}
116+
```
117+
118+
- To *disable zone redundancy*, set the `zoneRedundant` property to `false`.
119+
120+
---
121+
122+
## Check for zone redundancy support on an App Service plan
123+
124+
To see whether an existing App Service plan supports zone redundancy:
125+
126+
1. Get the maximum number of availability zones that the App Service plan can use by using the Azure portal, Azure CLI, or Bicep/Resource Manager:
127+
128+
# [Azure portal](#tab/portal)
129+
130+
1. In the [Azure portal](https://portal.azure.com), navigate to your App Service plan.
131+
132+
1. Select **Scale out (App Service plan)**.
133+
134+
The maximum number of zones that your App Service plan can use is shown in **Maximum available zones**.
135+
136+
:::image type="content" source="./media/configure-zone-redundancy/app-service-plan-max-zones-portal.png" alt-text="Screenshot of maximum available zones property in the Scale out blade in the Azure portal for an App Service plan.":::
137+
138+
# [Azure CLI](#tab/azurecli)
139+
140+
Query the plan's `maximumNumberOfZones` property:
141+
142+
```azurecli
143+
az appservice plan show \
144+
-n <app-service-plan-name> \
145+
-g <resource-group-name> \
146+
--query properties.maximumNumberOfZones
147+
```
148+
149+
# [Bicep](#tab/bicep)
150+
151+
Query the plan's `maximumNumberOfZones` property:
152+
153+
```bicep
154+
resource appServicePlan 'Microsoft.Web/serverfarms@2024-11-01' existing = {
155+
name: '<app-service-plan-name>'
156+
}
157+
158+
#disable-next-line BCP083
159+
output maximumNumberOfZones int = appServicePlan.properties.maximumNumberOfZones
160+
```
161+
162+
---
163+
164+
1. Compare the number with the following table to determine whether your plan supports zone redundancy:
165+
166+
| Maximum Number of Zones | Zone redundancy support |
167+
| ------------------------ | ----------------------- |
168+
| Greater than 1 | Supported |
169+
| Equal to 1 | Not supported* |
170+
171+
\* If you're on a plan or a stamp that doesn't support availability zones, you must create a new App Service plan in a new resource group so that you land on the App Service footprint that supports zones.
172+
173+
## View physical zones for an App Service plan
174+
175+
When you have a zone-redundant App Service plan, the platform automatically places the instances across [physical availability zone](../reliability/availability-zones-overview.md#physical-and-logical-availability-zones). If you want to verify that your instances are spread across zones, you can check which physical availability zones your plan's instances use by using the Azure portal or Azure CLI:
176+
177+
# [Azure portal](#tab/portal)
178+
179+
1. In the [Azure portal](https://portal.azure.com), go to your App Service app. If you have multiple apps in a plan, you can select any app.
180+
181+
1. Select the **Health check** blade.
182+
183+
1. Select the **Instances** tab to view the physical zone placement for each of your instances.
184+
185+
:::image type="content" source="./media/configure-zone-redundancy/app-service-physical-zones.png" alt-text="Screenshot of the Instances tab in the Health Check blade with the physical zone information in the Azure portal for an App Service app.":::
186+
187+
# [Azure CLI](#tab/azurecli)
188+
189+
Use the [REST API](/rest/api/appservice/web-apps/get-instance-info), which returns the `physicalZone` value for each instance in the App Service plan:
190+
191+
```azurecli
192+
az rest --method get --url https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Web/sites/{appName}/instances?api-version=2024-04-01
193+
```
194+
195+
# [Bicep](#tab/bicep)
196+
197+
This operation is not supported in Bicep. Use the Azure CLI or Azure portal instead.
198+
199+
---
200+
201+
## Related content
202+
- [Reliability in Azure App Service](../reliability/reliability-app-service.md)
203+
- [Configure App Service Environment for zone redundancy](../app-service/environment/configure-zone-redundancy-environment.md)

0 commit comments

Comments
 (0)