Skip to content

Commit d4b7461

Browse files
ttorblettorble
authored
Merge pull request #291007 from MicrosoftDocs/main
Publish to live, Monday 4 AM PST, 11/25
2 parents 4afbef6 + 2e7ce78 commit d4b7461

File tree

14 files changed

+230
-46
lines changed

14 files changed

+230
-46
lines changed

‎articles/backup/backup-azure-arm-restore-vms.md

Lines changed: 55 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -330,34 +330,69 @@ For more information, see [Back up and restore Active Directory domain controlle
330330

331331
Managed identities eliminate the need for the user to maintain the credentials. Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication.
332332

333-
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities used as one of the input parameters is only used for accessing the storage accounts, which are used as staging location during restore and not for any other Azure resource controlling. These managed identities have to be associated to the vault.
333+
Azure Backup offers the flexibility to restore the managed Azure VM with [managed identities](../active-directory/managed-identities-azure-resources/overview.md). You can choose to select [system-managed identities](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the [**Restore configuration** blade](#create-a-vm) of Azure VM. Managed identities are used for accessing the storage accounts and automated cleanup of any resources created during restore process in case of restore failures. These managed identities have to be associated to the vault.
334334

335335
:::image type="content" source="./media/backup-azure-arm-restore-vms/select-system-managed-identities-or-user-managed-identities.png" alt-text="Screenshot for choice to select system-managed identities or user-managed identities.":::
336336

337-
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account.
337+
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account and Resource Group.
338338

339339
```json
340340
"permissions": [
341-
{
342-
"actions": [
343-
"Microsoft.Authorization/*/read",
344-
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
345-
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
346-
"Microsoft.Storage/storageAccounts/blobServices/containers/write"
347-
],
348-
"notActions": [],
349-
"dataActions": [
350-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
351-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
352-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
353-
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
354-
],
355-
"notDataActions": []
356-
}
357-
]
341+
{
342+
"actions": [
343+
"Microsoft.Authorization/*/read",
344+
"Microsoft.Compute/disks/read",
345+
"Microsoft.Compute/disks/write",
346+
"Microsoft.Compute/disks/delete",
347+
"Microsoft.Compute/disks/beginGetAccess/action",
348+
"Microsoft.Compute/disks/endGetAccess/action",
349+
"Microsoft.Compute/locations/diskOperations/read",
350+
"Microsoft.Compute/virtualMachines/read",
351+
"Microsoft.Compute/virtualMachines/write",
352+
"Microsoft.Compute/virtualMachines/delete",
353+
"Microsoft.Compute/virtualMachines/instanceView/read",
354+
"Microsoft.Compute/virtualMachines/extensions/read",
355+
"Microsoft.Compute/virtualMachines/extensions/write",
356+
"Microsoft.Compute/virtualMachines/extensions/delete",
357+
"Microsoft.Insights/alertRules/*",
358+
"Microsoft.Network/locations/operationResults/read",
359+
"Microsoft.Network/locations/operations/read",
360+
"Microsoft.Network/locations/usages/read",
361+
"Microsoft.Network/networkInterfaces/delete",
362+
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
363+
"Microsoft.Network/networkInterfaces/join/action",
364+
"Microsoft.Network/networkInterfaces/read",
365+
"Microsoft.Network/networkInterfaces/write",
366+
"Microsoft.Network/networkSecurityGroups/read",
367+
"Microsoft.Network/networkSecurityGroups/securityRules/read",
368+
"Microsoft.Network/publicIPAddresses/delete",
369+
"Microsoft.Network/publicIPAddresses/join/action",
370+
"Microsoft.Network/publicIPAddresses/read",
371+
"Microsoft.Network/publicIPAddresses/write",
372+
"Microsoft.Network/virtualNetworks/read",
373+
"Microsoft.Network/virtualNetworks/subnets/join/action",
374+
"Microsoft.Network/virtualNetworks/subnets/read",
375+
"Microsoft.Resources/deployments/*",
376+
"Microsoft.Resources/subscriptions/resourceGroups/read",
377+
"Microsoft.Storage/checkNameAvailability/read",
378+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
379+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
380+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
381+
"Microsoft.Storage/storageAccounts/listKeys/action",
382+
"Microsoft.Storage/storageAccounts/read",
383+
"Microsoft.Storage/storageAccounts/write"
384+
],
385+
"notActions": [],
386+
"dataActions": [
387+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
388+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
389+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
390+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
391+
],
392+
358393
```
359394

360-
Or, add the role assignment on the staging location (Storage Account) to have [Storage account Backup Contributor](./blob-backup-configure-manage.md#grant-permissions-to-the-backup-vault-on-storage-accounts) and [Storage Blob data Contributor](../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) for the successful restore operation.
395+
Or, add the **VM restore operator** role assignment on the staging location (Storage Account) and target Resource Group for the successful restore operation.
361396

362397
:::image type="content" source="./media/backup-azure-arm-restore-vms/add-role-assignment-on-staging-location.png" alt-text="Screenshot for adding the role assignment on the staging location.":::
363398

‎articles/backup/backup-client-automation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ $CredsFilename = Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $Vault1
139139
In the latest Az module of PowerShell, because of underlying platform limitations, downloading the vault credentials requires a self-signed certificate. The following example shows how to provide a self-signed certificate and download the vault credentials.
140140

141141
```powershell
142-
$dt = $(Get-Date).ToString("M-d-yyyy")
142+
143143
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -FriendlyName 'test-vaultcredentials' -subject "Windows Azure Tools" -KeyExportPolicy Exportable -NotAfter $(Get-Date).AddHours(48) -NotBefore $(Get-Date).AddHours(-24) -KeyProtection None -KeyUsage None -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2") -Provider "Microsoft Enhanced Cryptographic Provider v1.0"
144144
$certficate = [convert]::ToBase64String($cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx))
145145
$CredsFilename = Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $Vault -Path $CredsPath -Certificate $certficate

‎articles/expressroute/metro.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: expressroute
55
author: duongau
66
ms.service: azure-expressroute
77
ms.topic: conceptual
8-
ms.date: 06/03/2024
8+
ms.date: 11/24/2024
99
ms.author: duau
1010
ms.custom: references_regions, ai-usage
1111
---
@@ -40,9 +40,9 @@ The following diagram allows for a comparison between the standard ExpressRoute
4040

4141
| Metro location | Peering locations | Location address | Zone | Local Azure Region | ER Direct | Service Provider |
4242
|--|--|--|--|--|--|--|
43-
| Amsterdam Metro | Amsterdam<br>Amsterdam2 | Equinix AM5<br>Digital Realty AMS8 | 1 | West Europe | &check; | Colt<sup>1</sup><br>Console Connect<sup>1</sup><br>Digital Realty<br>Equinix<br>euNetworks<br><br>Megaport<br> |
44-
| Singapore Metro | Singapore<br>Singapore2 | Equinix SG1<br>Global Switch Tai Seng | 2 | Southeast Asia | &check; | Console Connect<sup>1</sup><br>Equinix<br>Megaport |
45-
| Zurich Metro | Zurich<br>Zurich2 | Digital Realty ZUR2<br>Equinix ZH5 | 1 | Switzerland North | &check; | Colt<sup>1</sup><br>Digital Realty |
43+
| Amsterdam Metro | Amsterdam<br>Amsterdam2 | Equinix AM5<br>Digital Realty AMS8 | 1 | West Europe | &check; | Colt<br>Digital Realty<br>Equinix<br>euNetworks<br><br>Megaport<br> |
44+
| Singapore Metro | Singapore<br>Singapore2 | Equinix SG1<br>Global Switch Tai Seng | 2 | Southeast Asia | &check; | Colt<br>Equinix<br>Megaport |
45+
| Zurich Metro | Zurich<br>Zurich2 | Digital Realty ZUR2<br>Equinix ZH5 | 1 | Switzerland North | &check; | Colt<br>Digital Realty |
4646

4747
<sup>1<sup> These service providers will be available in the future.
4848

‎articles/frontdoor/front-door-caching.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,7 @@ The following request headers don't get forwarded to the origin when caching is
206206
- `Accept`
207207
- `Accept-Charset`
208208
- `Accept-Language`
209+
- `Vary`
209210

210211
> [!NOTE]
211212
> Requests that include authorization header will not be cached, unless the response contains a Cache-Control directive that allows caching. The following Cache-Control directives have such an effect: must-revalidate, public, and s-maxage.

‎articles/hdinsight/configure-azure-blob-storage.md

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Configure Azure Blob Storage on Azure HDInsight
33
description: Learn how to Configure Azure Blob storage on Azure HDInsight.
44
ms.service: azure-hdinsight
55
ms.topic: how-to
6-
ms.date: 11/15/2023
6+
ms.date: 11/25/2023
77

88
---
99
# Configure Azure Blob Storage as primary storage account in Azure HDInsight
@@ -82,7 +82,22 @@ Same thing can be achieved via ARM request if that is how you want to create HDI
8282
8383
}
8484
```
85-
85+
86+
## MSI based Script Action using primary Azure Blob Storage storage
87+
88+
Previously while adding the primary storage as Azure Blob Storage storage in the Azure HDInsight cluster, you can't provide MSI for authentication.
89+
Also to access a script action that isn't accessible anonymously, you need to mention the SAS Key in the script action parameters, so the Azure HDInsight Cluster can access the script for execution.
90+
91+
Now, you can add Azure Blob Storage storage in Azure HDInsight cluster as a primary storage using MSI.
92+
93+
Hence there's no need to provide the SAS key in the script action parameters, while adding the script action, if the script uploaded to the primary Azure Blob Storage storage account.
94+
95+
The script is downloaded and implemented. This will work even if the script isn't publicly accessible.
96+
97+
The new feature specifically supports scripts that aren't publicly accessible but don't require a SAS key or token. This provides an additional layer of security for scripts that need to be kept private.
98+
99+
The conventional script action in which is anonymously accessible or if a SAS key is passed along with the script URI, still works without any changes. For more information, see [Customize Azure HDInsight clusters by using script actions](./hdinsight-hadoop-customize-cluster-linux.md)
100+
86101
## Next steps
87102
88103
* [Use Azure Data Lake Storage Gen2 with Azure HDInsight clusters](./hdinsight-managed-identities.md)

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ The following table provides a brief description of each built-in role. Click th
7171
> | <a name='virtual-machine-data-access-administrator-preview'></a>[Virtual Machine Data Access Administrator (preview)](./built-in-roles/compute.md#virtual-machine-data-access-administrator-preview) | Manage access to Virtual Machines by adding or removing role assignments for the Virtual Machine Administrator Login and Virtual Machine User Login roles. Includes an ABAC condition to constrain role assignments. | 66f75aeb-eabe-4b70-9f1e-c350c4c9ad04 |
7272
> | <a name='virtual-machine-local-user-login'></a>[Virtual Machine Local User Login](./built-in-roles/compute.md#virtual-machine-local-user-login) | View Virtual Machines in the portal and login as a local user configured on the arc server | 602da2ba-a5c2-41da-b01d-5360126ab525 |
7373
> | <a name='virtual-machine-user-login'></a>[Virtual Machine User Login](./built-in-roles/compute.md#virtual-machine-user-login) | View Virtual Machines in the portal and login as a regular user. | fb879df8-f326-4884-b1cf-06f3ad86be52 |
74+
> | [Virtual Machine Restore Operator](/azure/role-based-access-control/built-in-roles/compute#virtual-machine-operator) | Provides permissions to Recovery Services vault to staging storage account and target resource group for VM restore operations. | dfce897125e342e3ba336055438e3080 |
7475
> | <a name='windows-365-network-interface-contributor'></a>[Windows 365 Network Interface Contributor](./built-in-roles/compute.md#windows-365-network-interface-contributor) | This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces. | 1f135831-5bbe-4924-9016-264044c00788 |
7576
> | <a name='windows-365-network-user'></a>[Windows 365 Network User](./built-in-roles/compute.md#windows-365-network-user) | This role is used by Windows 365 to read virtual networks and join the designated virtual networks. | 7eabc9a4-85f7-4f71-b8ab-75daaccc1033 |
7677
> | <a name='windows-admin-center-administrator-login'></a>[Windows Admin Center Administrator Login](./built-in-roles/compute.md#windows-admin-center-administrator-login) | Let's you manage the OS of your resource via Windows Admin Center as an administrator. | a6333a3e-0164-44c3-b281-7a577aff287f |

0 commit comments

Comments
 (0)