Merge pull request #103758 from MicrosoftDocs/master

ShannonLeavitt · web-flow · commit d12880206cf9 · 2020-02-10T15:51:45.000+04:00
Merge master to live, 4 AM
diff --git a/articles/active-directory-b2c/custom-policy-get-started.md b/articles/active-directory-b2c/custom-policy-get-started.md
@@ -69,7 +69,7 @@ You need to register these two applications in your Azure AD B2C tenant only onc
 
 ### Register the IdentityExperienceFramework application
 
-To register an application in your Azure AD B2C tenant, you can use the current **Applications** experience, or our new unified **App registrations (Preview)** experience. [Learn more about the new experience](https://aka.ms/b2cappregintro).
+To register an application in your Azure AD B2C tenant, you can use the **App registrations (Legacy)** experience, or our new unified **App registrations (Preview)** experience. [Learn more about the new experience](https://aka.ms/b2cappregintro).
 
 #### [Applications](#tab/applications/)
 
diff --git a/articles/active-directory-b2c/one-time-password-technical-profile.md b/articles/active-directory-b2c/one-time-password-technical-profile.md
@@ -9,7 +9,7 @@ manager: celestedg
 ms.service: active-directory
 ms.workload: identity
 ms.topic: reference
-ms.date: 02/03/2020
+ms.date: 02/10/2020
 ms.author: marsma
 ms.subservice: B2C
 ---
@@ -164,3 +164,10 @@ The following example `TechnicalProfile` is used for verifying a code:
     </InputClaims>
 </TechnicalProfile>
 ```
+
+## Next steps
+
+See the following article for example of using one-time password technial profile with custom email verification:
+
+- [Custom email verification in Azure Active Directory B2C](custom-email.md)
+
diff --git a/articles/aks/control-kubeconfig-access.md b/articles/aks/control-kubeconfig-access.md
@@ -60,7 +60,7 @@ AKS_CLUSTER=$(az aks show --resource-group myResourceGroup --name myAKSCluster -
 
 # Get the account credentials for the logged in user
 ACCOUNT_UPN=$(az account show --query user.name -o tsv)
-ACCOUNT_ID=$(az ad user show --upn-or-object-id $ACCOUNT_UPN --query objectId -o tsv)
+ACCOUNT_ID=$(az ad user show --id $ACCOUNT_UPN --query objectId -o tsv)
 
 # Assign the 'Cluster Admin' role to the user
 az role assignment create \
diff --git a/articles/azure-arc/servers/overview.md b/articles/azure-arc/servers/overview.md
@@ -7,7 +7,7 @@ ms.subservice: azure-arc-servers
 author: mgoedtel
 ms.author: magoedte
 keywords: azure automation, DSC, powershell, desired state configuration, update management, change tracking, inventory, runbooks, python, graphical, hybrid
-ms.date: 01/29/2020
+ms.date: 02/03/2020
 ms.custom: mvc
 ms.topic: overview
 ---
@@ -50,6 +50,12 @@ The following versions of the Windows and Linux operating system are officially
 >This preview release of the Connected Machine agent for Windows only supports Windows Server configured to use the English language.
 >
 
+### Required permissions
+
+- To onboard machines, you are a member of the **Azure Connected Machine Onboarding** role.
+
+- To read, modify, re-onboard, and delete a machine, you are a member of the **Azure Connected Machine Resource Administrator** role. 
+
 ### Azure subscription and service limits
 
 Before configuring your machines with Azure Arc for servers (preview), you should review the Azure Resource Manager [subscription limits](../../azure-resource-manager/management/azure-subscription-service-limits.md#subscription-limits---azure-resource-manager) and [resource group limits](../../azure-resource-manager/management/azure-subscription-service-limits.md#resource-group-limits) to plan for the number of machines to be connected.
diff --git a/articles/azure-arc/servers/quickstart-onboard-portal.md b/articles/azure-arc/servers/quickstart-onboard-portal.md
@@ -6,7 +6,7 @@ ms.service: azure-arc
 ms.subservice: azure-arc-servers
 author: mgoedtel
 ms.author: magoedte
-ms.date: 01/29/2020
+ms.date: 02/09/2020
 ms.custom: mvc
 ms.topic: quickstart
 ---
@@ -183,5 +183,6 @@ To disconnect a machine from Azure Arc for servers (preview), do the following:
 
 ## Next steps
 
-> [!div class="nextstepaction"]
-> [Assign a policy to connected machines](../../governance/policy/assign-policy-portal.md)
+- Learn how to manage your machine using [Azure Policy](../../governance/policy/overview.md), for such things as VM [guest configuration](../../governance/policy/concepts/guest-configuration.md), verifying the machine is reporting to the expected Log Analytics workspace, enable monitoring with [Azure Monitor with VMs](../../azure-monitor/insights/vminsights-enable-at-scale-policy.md), and much more.
+
+- Learn more about the [Log Analytics agent](../../azure-monitor/platform/log-analytics-agent.md). The Log Analytics agent for Windows and Linux is required when you want to proactively monitor the OS and workloads running on the machine, manage it using Automation runbooks or solutions like Update Management, or use other Azure services like [Azure Security Center](../../security-center/security-center-intro.md).
diff --git a/articles/azure-arc/servers/quickstart-onboard-powershell.md b/articles/azure-arc/servers/quickstart-onboard-powershell.md
diff --git a/articles/azure-functions/functions-networking-options.md b/articles/azure-functions/functions-networking-options.md
@@ -106,7 +106,7 @@ To provide a higher level of security, you can restrict a number of Azure servic
 
 ### Restricting your storage account to a virtual network
 
-When you create a function app, you must create or link to a general-purpose Azure Storage account that supports Blob, Queue, and Table storage. You can't currently use any virtual network restrictions on this account. If you configure a virtual network service endpoint on the storage account you're using for your function app, that will break your app.
+When you create a function app, you must create or link to a general-purpose Azure Storage account that supports Blob, Queue, and Table storage. You can't currently use any virtual network restrictions on this account. If you configure a virtual network service endpoint on the storage account you're using for your function app, that will break your app.This functionality is currently available using the Premium Plan and a virtual network integration.
 
 [Learn more about storage account requirements.](./functions-create-function-app-portal.md#storage-account-requirements)
 
diff --git a/articles/backup/backup-azure-restore-files-from-vm.md b/articles/backup/backup-azure-restore-files-from-vm.md
@@ -51,6 +51,8 @@ To restore files or folders from the recovery point, go to the virtual machine a
 
     ![File recovery menu](./media/backup-azure-restore-files-from-vm/executable-output.png)
 
+8. For Linux machines, a python script is generated. One needs to download the script and copy it to the relevant/compatible Linux server. You may have to modify the permissions to execute it with ```chmod +x <python file name>```. Then run the python file with ```./<python file name>```.
+
 Refer to the [Access requirements](#access-requirements) section to make sure the script is run successfully.
 
 ### Identifying volumes
diff --git a/articles/backup/tutorial-restore-disk.md b/articles/backup/tutorial-restore-disk.md
@@ -44,6 +44,7 @@ To see a list of available recovery points, use [az backup recoverypoint list](h
 az backup recoverypoint list \
     --resource-group myResourceGroup \
     --vault-name myRecoveryServicesVault \
+    --backup-management-type AzureIaasVM
     --container-name myVM \
     --item-name myVM \
     --query [0].name \
diff --git a/articles/cost-management-billing/manage/spending-limit.md b/articles/cost-management-billing/manage/spending-limit.md
@@ -54,7 +54,7 @@ To remove your spending limit, follow these steps:
 
 The spending limit could prevent you from deploying or using certain third-party and Microsoft services. Here are the situations where you should remove the spending limit on your subscription.
 
--  You plan to deploy first party images like Oracle or services such as Azure DevOps Services. This situation causes you to reach your spending limit almost immediately and causes your subscription to be disabled.
+-  You plan to deploy third-party images like Oracle or services such as Azure DevOps Services. This situation causes you to reach your spending limit almost immediately and causes your subscription to be disabled.
 - You have services that you don't want disrupted. When you reach your spending limit, Azure resources that you deployed are removed from production and your Azure virtual machines are stopped and de-allocated. If you have services that you don't want disrupted, you must remove your spending limit.
 - You have services and resources with settings like virtual IP addresses that you don't want to lose. These settings are lost when your reach your spending limit and the services and resources are de-allocated.
 
diff --git a/articles/machine-learning/how-to-train-tensorflow.md b/articles/machine-learning/how-to-train-tensorflow.md
@@ -255,7 +255,7 @@ distributed_training = TensorflowConfiguration()
 distributed_training.worker_count = 2
 
 # Tensorflow constructor
-estimator= TensorFlow(source_directory=project_folder,
+tf_est= TensorFlow(source_directory=project_folder,
                       compute_target=compute_target,
                       script_params=script_params,
                       entry_script='script.py',
diff --git a/articles/media-services/latest/release-notes.md b/articles/media-services/latest/release-notes.md
@@ -11,7 +11,7 @@ editor: ''
 ms.service: media-services
 ms.workload: na
 ms.topic: article
-ms.date: 12/13/2019
+ms.date: 02/03/2020
 ms.author: juliako
 ---
 
@@ -32,14 +32,33 @@ To stay up-to-date with the most recent developments, this article provides you
 > Currently, you cannot use the Azure portal to manage v3 resources. Use the [REST API](https://aka.ms/ams-v3-rest-sdk), CLI, or one of the supported SDKs.
 
 For more information, see [Migration guidance for moving from Media Services v2 to v3](migrate-from-v2-to-v3.md#known-issues).
-
+ 
 ## January 2020
 
 ### Improvements in media processors
 
 - Improved support for interlaced sources in Video Analysis – such content is now de-interlaced correctly before being sent to inference engines.
 - When generating thumbnails with the “Best” mode, the encoder now searches beyond 30 seconds to select a frame that is not monochromatic.
- 
+
+### Azure Government cloud updates
+
+Media Services GA’ed in the following Azure Government regions: *USGov Arizona* and *USGov Texas*.
+
+## December 2019
+
+Added CDN support for *Origin-Assist Prefetch* headers for both live and video on-demand streaming; available for customers who have direct contract with Akamai CDN. Origin-Assist CDN-Prefetch feature involves the following HTTP header exchanges between Akamai CDN and Azure Media Services origin:
+
+|HTTP header|Values|Sender|Receiver|Purpose|
+| ---- | ---- | ---- | ---- | ----- |
+|CDN-Origin-Assist-Prefetch-Enabled | 1 (default) or 0 |CDN|Origin|To indicate CDN is prefetch enabled|
+|CDN-Origin-Assist-Prefetch-Path| Example: <br/>Fragments(video=1400000000,format=mpd-time-cmaf)|Origin|CDN|To provide prefetch path to CDN|
+|CDN-Origin-Assist-Prefetch-Request|1 (prefetch request) or 0 (regular request)|CDN|Origin|To indicate the request from CDN is a prefetch|
+
+To see part of the header exchange in action, you can try the following steps:
+
+1. Use Postman or curl to issue a request to Media Services origin for an audio or video segment or fragment. Make sure to add the header CDN-Origin-Assist-Prefetch-Enabled: 1 in the request.
+2. In the response, you should see the header CDN-Origin-Assist-Prefetch-Path with a relative path as its value.
+
 ## November 2019
 
 ### Live transcription Preview
diff --git a/articles/network-watcher/media/traffic-analytics/selection-of-nsgs-that-require-enablement-of-nsg-flow-logging.png b/articles/network-watcher/media/traffic-analytics/selection-of-nsgs-that-require-enablement-of-nsg-flow-logging.png
diff --git a/articles/network-watcher/traffic-analytics.md b/articles/network-watcher/traffic-analytics.md
@@ -147,7 +147,7 @@ To analyze traffic, you need to have an existing network watcher, or [enable a n
 
 Before enabling NSG flow logging, you must have a network security group to log flows for. If you don't have a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md#create-a-network-security-group) to create one.
 
-On the left side of the Azure portal, select **Monitor**, then **Network watcher**, and then select **NSG flow logs**. Select the network security group that you want to enable an NSG flow log for, as shown in the following picture:
+In Azure portal, go to **Network watcher**, and then select **NSG flow logs**. Select the network security group that you want to enable an NSG flow log for, as shown in the following picture:
 
 ![Selection of NSGs that require enablement of NSG flow log](./media/traffic-analytics/selection-of-nsgs-that-require-enablement-of-nsg-flow-logging.png)
 
diff --git a/articles/service-fabric/scripts/service-fabric-powershell-add-application-certificate.md b/articles/service-fabric/scripts/service-fabric-powershell-add-application-certificate.md
@@ -59,7 +59,7 @@ $content = [System.Convert]::ToBase64String($contentbytes)
 $SecretValue = ConvertTo-SecureString -String $content -AsPlainText -Force
 
 # Upload the certificate to the key vault as a secret
-$Secret = Set-AzureKeyVaultSecret -VaultName $VaultName -Name $CertName -SecretValue $SecretValue
+$Secret = Set-AzKeyVaultSecret -VaultName $VaultName -Name $CertName -SecretValue $SecretValue
 
 ```
 
diff --git a/articles/virtual-network/what-is-ip-address-168-63-129-16.md b/articles/virtual-network/what-is-ip-address-168-63-129-16.md
@@ -31,10 +31,11 @@ IP address 168.63.129.16 is a virtual public IP address that is used to facilita
 
 ## Scope of IP address 168.63.129.16
 
-The public IP address 168.63.129.16 is used in all regions and all national clouds. This special public IP address is owned by Microsoft and will not change. It is allowed by the default network security group rule. We recommend that you allow this IP address in any local firewall policies in both inbound and outbound directions. The communication between this special IP address and the resources is safe because only the internal Azure platform can source a message from this IP address. If this address is blocked, unexpected behavior can occur in a variety of scenarios.
-The following ports at least must be opened to allow communication with WireServer: 80, 443 and 32526.
+The public IP address 168.63.129.16 is used in all regions and all national clouds. This special public IP address is owned by Microsoft and will not change. We recommend that you allow this IP address in any local (in the VM) firewall policies (outbound direction). The communication between this special IP address and the resources is safe because only the internal Azure platform can source a message from this IP address. If this address is blocked, unexpected behavior can occur in a variety of scenarios. 168.63.129.16 is a [virtual IP of the host node](../virtual-network/security-overview.md#azure-platform-considerations) and as such it is not subject to user defined routes.
 
-[Azure Load Balancer health probes](../load-balancer/load-balancer-custom-probe-overview.md) originates from this IP address. If you block this IP address, your probes will fail.
+- The VM Agent requires outbound communication over ports 80, 443, 32526 with WireServer (168.63.129.16). These should be open in the local firewall on the VM. The communication on these ports with 168.63.129.16 is not subject to the configured network security groups.
+- 168.63.129.16 can provide DNS services to the VM. If this is not desired, this traffic can be blocked in the local firewall on the VM. By default DNS communication is not subject to the configured network security groups unless specifically targeted leveraging the [AzurePlatformDNS](../virtual-network/service-tags-overview.md#available-service-tags) service tag.
+- When the VM is part of a load balancer backend pool, [health probe](../load-balancer/load-balancer-custom-probe-overview.md) communication should be allowed to originate from 168.63.129.16. The default network security group configuration has a rule that allows this communication. This rule leverages the [AzureLoadBalancer](../virtual-network/service-tags-overview.md#available-service-tags) service tag. If desired this traffic can be blocked by configuring the network security group however this will result in probes that fail.
 
 In a non-virtual network scenario (Classic), the health probe is sourced from a private IP and 168.63.129.16 is not used.
 
diff --git a/includes/virtual-machines-common-isolation.md b/includes/virtual-machines-common-isolation.md
