latest updates

Author: David Curwin

articles/backup/backup-azure-backup-import-export.md

@@ -69,6 +69,15 @@ This section describes the offline-backup workflow so that your data can be deli
 
     ![Import screen](./media/backup-azure-backup-import-export/offlinebackup_inputs.png)
 
+2. Select the option **Transfer using my own disks**.
+
+    >[!NOTE]
+    >We recommend using the Azure Data Box option to transfer initial backup data offline. This option saves the effort required to procure your own Azure-compatible disks by delivering Microsoft-proprietary, secure and tamper-proof Azure Data box devices to which backup data can be directly written to by the MARS Agent.
+
+3. Click **Next** and fill in the inputs carefully:
+
+    ![Enter your disk details](./media/backup-azure-backup-import-export/your-disk-details.png)
+
    The description of the inputs is as follows:
 
     * **Staging Location**: The temporary storage location to which the initial backup copy is written. Staging location might be on a network share or a local computer. If the copy computer and source computer are different, we recommended that you specify the full network path of the staging location.
@@ -79,15 +88,15 @@ This section describes the offline-backup workflow so that your data can be deli
 
    Provide the inputs on the screen and click **Next**. Save the provided *Staging location* and the *Azure Import Job Name*, as this information is required to prepare the disks.
 
-2. When prompted, sign into your Azure subscription. You must sign in so that Azure Backup can create the Azure Active Directory application, and provide the required permissions to access the Azure Import Service.
+4. When prompted, sign into your Azure subscription. You must sign in so that Azure Backup can create the Azure Active Directory application, and provide the required permissions to access the Azure Import Service.
 
-    ![Backup now](./media/backup-azure-backup-import-export/azurelogin.png)
+    ![Backup now](./media/backup-azure-backup-import-export/azure-login.png)
 
-3. Complete the workflow, and in the Azure Backup agent console click **Back Up Now**.
+5. Complete the workflow, and in the Azure Backup agent console click **Back Up Now**.
 
     ![Backup now](./media/backup-azure-backup-import-export/backupnow.png)
 
-4. In the Confirmation page of the wizard, click **Back Up**. The initial backup is written to the staging area as part of the setup.
+6. In the Confirmation page of the wizard, click **Back Up**. The initial backup is written to the staging area as part of the setup.
 
    ![Confirm that you're ready to Back up now](./media/backup-azure-backup-import-export/backupnow-confirmation.png)
 
@@ -200,4 +209,3 @@ Once the initial backup is complete, you can safely delete the data imported to
 ## Next steps
 
 * For any questions on the Azure Import/Export workflow, refer to [Use the Microsoft Azure Import/Export service to transfer data to Blob storage](../storage/common/storage-import-export-service.md).
-

articles/backup/backup-azure-backup-server-import-export-.md

@@ -71,20 +71,53 @@ Ensure that the following prerequisites are met before initiating the Offline Ba
 
     The tool will create an Azure Offline Backup AD Application if one does not exist.
 
-    If an Application already exists, this executable will ask you to manually upload the certificate to the application in the tenant. Follow the steps below in this section to upload the certificate manually to the app.
+    If an Application already exists, this executable will ask you to manually upload the certificate to the application in the tenant. Follow the steps below in [this section](#manually-upload-offline-backup-certificate) to upload the certificate manually to the application.
 
 * The AzureOfflineBackup.exe tool will generate an OfflineApplicationParams.xml file.  Copy this file to the server with MABS or DPM.
-* Install the [latest MARS agent](https://aka.ms/azurebackup_agent) on the DPM/Venus server.
+* Install the [latest MARS agent](https://aka.ms/azurebackup_agent) on the DPM/Azure Backup (MABS) server.
 * Register the server to Azure.
 * Run the following command:
 
     ```cmd
     AzureOfflineBackupCertGen.exe AddRegistryEntries SubscriptionId:<subscriptionid> xmlfilepath:<path of the OfflineApplicationParams.xml file>  storageaccountname:<storageaccountname configured with Azure Data Box>
     ```
 
-    For more information on the supported options for the AzureOfflineBackupCertGen.exe, see *ReadMeAzureCertGen.txt* and *addRegistry.PNG*
+* The command above will create the file `C:\Program Files\Microsoft Azure Recovery Services Agent\Scratch\MicrosoftBackupProvider\OfflineApplicationParams_<Storageaccountname>.xml`
 
-* The command above will create the file `C:\Program Files\Microsoft Azure Recovery Services Agent\Scratch\MicrosoftBackupProvider\OfflineApplicationParams_Storageaccountname.xml`
+## Manually upload Offline Backup Certificate
+
+Follow the steps below to manually upload the Offline Backup certificate to a previously created Azure Active Directory application meant for Offline Backup.
+
+1. Sign in to the Azure portal.
+2. Go to **Azure Active Directory** > **App registrations**
+3. Navigate to the **Owned Applications** tab and locate an application with the display name format `AzureOfflineBackup _<Azure User Id` as shown below:
+
+    ![Locate application on Owned Applications tab](./media/backup-azure-backup-import-export/owned-applications.png)
+
+4. Click on the application. Under the **Manage** tab on the left pane, go to **Certificates & secrets**.
+5. Check for pre-existing certificates or public keys. If there are none, you can safely delete the application by clicking on the **Delete** button on the application's **Overview** page. Following this, you can retry the steps to [Prepare the Server for the Offline Backup](#prepare-the-server-for-the-offline-backup-process) process and skip the steps below. Otherwise, execute the following steps from the DPM / Azure Backup Server (MABS) server where you wish to configure Offline Backup.
+6. Open the **Manage computer certificate application** > **Personal** tab and look for the certificate with the name `CB_AzureADCertforOfflineSeeding_<ResourceId>`
+7. Select the certificate above, right-click on **All Tasks** and then **Export**, without private key, in the .cer format.
+8. Go to the Azure Offline Backup application in the Azure portal.
+9. Click on **Manage** > **Certificates & secrets** > **Upload certificate**, and upload the certificate exported in the previous step.
+
+    ![Upload the certificate](./media/backup-azure-backup-import-export/upload-certificate.png)
+10. On the server, open the registry by typing **regedit** in the run window.
+11. Go to the registry entry *Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure Backup\Config\CloudBackupProvider*.
+12. Right-click on **CloudBackupProvider** and add a new string value with the name `AzureADAppCertThumbprint_<Azure User Id>`
+
+    >[!NOTE]
+    > Note: To find the Azure User Id, perform one of the following steps:
+    >
+    >1. From the Azure connected PowerShell run the `Get-AzureRmADUser -UserPrincipalName “Account Holder’s email as appears in the portal”` command.
+    >2. Navigate to the registry path: `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure Backup\DbgSettings\OnlineBackup; Name: CurrentUserId;`
+
+13. Right-click on the string added in the previous step and select **Modify**. In the value, provide the thumbprint of the certificate you exported in step 7 and click **OK**.
+14. To get the value of the thumbprint, double-click on the certificate, then select the **Details** tab and scroll down until you see the thumbprint field. Click on **Thumbprint** and copy the value.
+
+    ![Copy value from the thumbprint field](./media/backup-azure-backup-import-export/thumbprint-field.png)
+
+15. Continue to the [Workflow](#workflow) section to proceed with the Offline Backup process.
 
 ## Workflow
 
@@ -126,7 +159,7 @@ The information in this section helps you complete the offline-backup workflow s
 
 The *AzureOfflineBackupDiskPrep* utility is used to prepare the SATA drives that are sent to the nearest Azure Datacenter. This utility is available in installation directory of the Recovery Services agent in the following path:
 
-    *\\Microsoft Azure Recovery Services Agent\\Utils\\*
+`*\\Microsoft Azure Recovery Services Agent\Utils\*`
 
 1. Go to the directory, and copy the **AzureOfflineBackupDiskPrep** directory to a copy computer on which the SATA drives to be prepared are connected. Ensure the following with regards to the copy computer: