Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into rolyon-rbac-custom-roles-assignable-scopes

rolyon · rolyon · commit dbc5e32ec5c1 · 2022-08-19T13:11:20.000-07:00
diff --git a/articles/api-management/developer-portal-integrate-application-insights.md b/articles/api-management/developer-portal-integrate-application-insights.md
@@ -4,7 +4,7 @@ titleSuffix: Azure API Management
 description: Learn how to integrate Application Insights into your managed or self-hosted developer portal.
 author: dlepow
 ms.author: danlep
-ms.date: 03/25/2021
+ms.date: 08/16/2022
 ms.service: api-management
 ms.topic: how-to
 ---
@@ -18,7 +18,7 @@ A popular feature of Azure Monitor is Application Insights. It's an extensible A
 Follow these steps to plug Application Insights into your managed or self-hosted developer portal.
 
 > [!IMPORTANT]
-> Steps 1 and 2 are not required for managed portals. If you have a managed portal, skip to step 4.
+> Steps 1 -3 are not required for managed portals. If you have a managed portal, skip to step 4.
 
 1. Set up a [local environment](developer-portal-self-host.md#step-1-set-up-local-environment) for the latest release of the developer portal.
 
@@ -28,23 +28,33 @@ Follow these steps to plug Application Insights into your managed or self-hosted
     npm install @paperbits/azure --save
     ```
 
-1. In the `startup.publish.ts` file in the `src` folder, import and register the Application Insights module:
+1. In the `startup.publish.ts` file in the `src` folder, import and register the Application Insights module. Add the `AppInsightsPublishModule` after the existing modules in the dependency injection container:
 
     ```typescript
     import { AppInsightsPublishModule } from "@paperbits/azure";
     ...
+    const injector = new InversifyInjector();
+    injector.bindModule(new CoreModule());
+    ...
     injector.bindModule(new AppInsightsPublishModule());
+    injector.resolve("autostart");
     ```
 
-1. Retrieve the portal's configuration:
+1. Retrieve the portal's configuration using the [Content Item - Get](/rest/api/apimanagement/current-ga/content-item/get) REST API:
 
     ```http
-    GET /contentTypes/document/contentItems/configuration
+    GET https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.ApiManagement/service/{api-management-service-name}/contentTypes/document/contentItems/configuration?api-version=2021-08-01
     ```
+    
+    Output is similar to:
 
     ```json
     {
-        "nodes": [
+        "id": "/contentTypes/document/contentItems/configuration",
+        "type": "Microsoft.ApiManagement/service/contentTypes/contentItems",
+          "name": "configuration",
+          "properties": {
+          "nodes": [
             {
                 "site": {
                     "title": "Microsoft Azure API Management - developer portal",
@@ -55,17 +65,23 @@ Follow these steps to plug Application Insights into your managed or self-hosted
                 }
             }
         ]
+        }
     }
     ```
 
-1. Extend the site configuration from the previous step with Application Insights configuration:
+1. Extend the site configuration from the previous step with Application Insights configuration. Update the configuration using the [Content Item - Create or Update](/rest/api/apimanagement/current-ga/content-item/create-or-update) REST API. Pass the Application Insights instrumentation key in an `integration` node in the request body.
+
 
     ```http
-    PUT /contentTypes/document/contentItems/configuration
+    PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.ApiManagement/service/{api-management-service-name}/contentTypes/document/contentItems/configuration?api-version=2021-08-01
     ```
 
     ```json
     {
+        "id": "/contentTypes/document/contentItems/configuration",
+        "type": "Microsoft.ApiManagement/service/contentTypes/contentItems",
+        "name": "configuration",
+        "properties": {  
         "nodes": [
             {
                 "site": { ... },
@@ -76,9 +92,12 @@ Follow these steps to plug Application Insights into your managed or self-hosted
                 }
             }
         ]
+        }
     }
     ```
 
+1. After you update the configuration, [republish the portal](api-management-howto-developer-portal-customize.md#publish) for the changes to take effect.
+
 ## Next steps
 
 Learn more about the developer portal:
diff --git a/articles/api-management/developer-portal-integrate-google-tag-manager.md b/articles/api-management/developer-portal-integrate-google-tag-manager.md
@@ -20,7 +20,7 @@ Follow the steps in this article to plug Google Tag Manager into your managed or
 Follow these steps to plug Google Tag Manager into your managed or self-hosted developer portal.
 
 > [!IMPORTANT]
-> Steps 1 and 2 are not required for managed portals. If you have a managed portal, skip to step 4.
+> Steps 1 - 3 are not required for managed portals. If you have a managed portal, skip to step 4.
 
 1. Set up a [local environment](developer-portal-self-host.md#step-1-set-up-local-environment) for the latest release of the developer portal.
 
diff --git a/articles/cosmos-db/cassandra/cli-samples.md b/articles/cosmos-db/cassandra/cli-samples.md
@@ -5,7 +5,7 @@ author: seesharprun
 ms.service: cosmos-db
 ms.subservice: cosmosdb-cassandra
 ms.topic: sample
-ms.date: 02/21/2022
+ms.date: 08/19/2022
 ms.author: sidandrews
 ms.reviewer: mjbrown 
 ms.custom: devx-track-azurecli
@@ -41,6 +41,7 @@ These samples apply to all Azure Cosmos DB APIs. These samples use a SQL (Core)
 | [Secure with IP firewall](../scripts/cli/common/ipfirewall.md)| Create a Cosmos account with IP firewall configured.|
 | [Secure new account with service endpoints](../scripts/cli/common/service-endpoints.md)| Create a Cosmos account and secure with service-endpoints.|
 | [Secure existing account with service endpoints](../scripts/cli/common/service-endpoints-ignore-missing-vnet.md)| Update a Cosmos account to secure with service-endpoints when the subnet is eventually configured.|
+| [Find existing free-tier account](../scripts/cli/common/free-tier.md)| Find whether there is an existing free-tier account in your subscription.|
 |||
 
 ## Next steps
diff --git a/articles/cosmos-db/graph/cli-samples.md b/articles/cosmos-db/graph/cli-samples.md
@@ -5,7 +5,7 @@ author: seesharprun
 ms.service: cosmos-db
 ms.subservice: cosmosdb-graph
 ms.topic: sample
-ms.date: 02/21/2022
+ms.date: 08/19/2022
 ms.author: sidandrews
 ms.reviewer: mjbrown 
 ms.custom: devx-track-azurecli
@@ -41,6 +41,7 @@ These samples apply to all Azure Cosmos DB APIs. These samples use a SQL (Core)
 | [Secure with IP firewall](../scripts/cli/common/ipfirewall.md)| Create a Cosmos account with IP firewall configured.|
 | [Secure new account with service endpoints](../scripts/cli/common/service-endpoints.md)| Create a Cosmos account and secure with service-endpoints.|
 | [Secure existing account with service endpoints](../scripts/cli/common/service-endpoints-ignore-missing-vnet.md)| Update a Cosmos account to secure with service-endpoints when the subnet is eventually configured.|
+| [Find existing free-tier account](../scripts/cli/common/free-tier.md)| Find whether there is an existing free-tier account in your subscription.|
 |||
 
 ## Next steps
diff --git a/articles/cosmos-db/mongodb/cli-samples.md b/articles/cosmos-db/mongodb/cli-samples.md
@@ -5,7 +5,7 @@ author: seesharprun
 ms.service: cosmos-db
 ms.subservice: cosmosdb-mongo
 ms.topic: sample
-ms.date: 02/21/2022
+ms.date: 08/18/2022
 ms.author: sidandrews
 ms.reviewer: mjbrown 
 ms.custom: devx-track-azurecli
@@ -41,6 +41,7 @@ These samples apply to all Azure Cosmos DB APIs. These samples use a SQL (Core)
 | [Secure with IP firewall](../scripts/cli/common/ipfirewall.md)| Create a Cosmos account with IP firewall configured.|
 | [Secure new account with service endpoints](../scripts/cli/common/service-endpoints.md)| Create a Cosmos account and secure with service-endpoints.|
 | [Secure existing account with service endpoints](../scripts/cli/common/service-endpoints-ignore-missing-vnet.md)| Update a Cosmos account to secure with service-endpoints when the subnet is eventually configured.|
+| [Find existing free-tier account](../scripts/cli/common/free-tier.md)| Find whether there is an existing free-tier account in your subscription.|
 |||
 
 ## Next steps
diff --git a/articles/cosmos-db/sql/cli-samples.md b/articles/cosmos-db/sql/cli-samples.md
@@ -5,7 +5,7 @@ author: seesharprun
 ms.service: cosmos-db
 ms.subservice: cosmosdb-sql
 ms.topic: sample
-ms.date: 02/21/2022
+ms.date: 08/19/2022
 ms.author: sidandrews
 ms.reviewer: mjbrown 
 ms.custom: devx-track-azurecli, seo-azure-cli
@@ -42,6 +42,7 @@ These samples apply to all Azure Cosmos DB APIs. These samples use a SQL (Core)
 | [Secure with IP firewall](../scripts/cli/common/ipfirewall.md)| Create a Cosmos account with IP firewall configured.|
 | [Secure new account with service endpoints](../scripts/cli/common/service-endpoints.md)| Create a Cosmos account and secure with service-endpoints.|
 | [Secure existing account with service endpoints](../scripts/cli/common/service-endpoints-ignore-missing-vnet.md)| Update a Cosmos account to secure with service-endpoints when the subnet is eventually configured.|
+| [Find existing free-tier account](../scripts/cli/common/free-tier.md)| Find whether there is an existing free-tier account in your subscription.|
 |||
 
 ## Next steps
diff --git a/articles/cosmos-db/table/cli-samples.md b/articles/cosmos-db/table/cli-samples.md
@@ -5,7 +5,7 @@ author: seesharprun
 ms.service: cosmos-db
 ms.subservice: cosmosdb-table
 ms.topic: sample
-ms.date: 02/21/2022
+ms.date: 08/19/2022
 ms.author: sidandrews
 ms.reviewer: mjbrown 
 ms.custom: devx-track-azurecli
@@ -41,6 +41,7 @@ These samples apply to all Azure Cosmos DB APIs. These samples use a SQL (Core)
 | [Secure with IP firewall](../scripts/cli/common/ipfirewall.md)| Create a Cosmos account with IP firewall configured.|
 | [Secure new account with service endpoints](../scripts/cli/common/service-endpoints.md)| Create a Cosmos account and secure with service-endpoints.|
 | [Secure existing account with service endpoints](../scripts/cli/common/service-endpoints-ignore-missing-vnet.md)| Update a Cosmos account to secure with service-endpoints when the subnet is eventually configured.|
+| [Find existing free-tier account](../scripts/cli/common/free-tier.md)| Find whether there is an existing free-tier account in your subscription.|
 |||
 
 ## Next steps
diff --git a/articles/dns/private-resolver-endpoints-rulesets.md b/articles/dns/private-resolver-endpoints-rulesets.md
@@ -29,7 +29,7 @@ The IP address associated with an inbound endpoint is always part of the private
 
 Outbound endpoints egress from Azure and can be linked to [DNS Forwarding Rulesets](#dns-forwarding-rulesets).
 
-Outbound endpoints are also part of the private virtual network address space where the private resolver is deployed. An endpoint is associated with a subnet, but isn't provisioned with an IP address like the inbound endpoint.  No other resources can exist in the same subnet with the inbound endpoint. The following screenshot shows an inbound endpoint inside the subnet `snet-E-outbound`.
+Outbound endpoints are also part of the private virtual network address space where the private resolver is deployed. An outbound endpoint is associated with a subnet, but isn't provisioned with an IP address like the inbound endpoint.  No other resources can exist in the same subnet with the outbound endpoint. The following screenshot shows an outbound endpoint inside the subnet `snet-E-outbound`.
 
 ![View outbound endpoints](./media/private-resolver-endpoints-rulesets/east-outbound-endpoint.png)
 
@@ -44,13 +44,18 @@ Rulesets have the following associations:
 
 A ruleset can't be linked to a virtual network in another region. 
 
-When you link a ruleset to a virtual network, resources within that virtual network will use the DNS forwarding rules enabled in the ruleset. The linked virtual network must peer with the virtual network where the outbound endpoint exists. This configuration is typically used in a hub and spoke design, with spoke vnets peered to a hub vnet that has one or more private resolver endpoints. In this hub and spoke scenario, the spoke vnet does not need to be linked to the private DNS zone in order to resolve resource records in the zone, because the forwarding ruleset rule for the private zone sends queries to the hub vnet's inbound endpoint. For example: **azure.contoso.com** to **10.10.0.4**.
+When you link a ruleset to a virtual network, resources within that virtual network will use the DNS forwarding rules enabled in the ruleset. The linked virtual network must peer with the virtual network where the outbound endpoint exists. This configuration is typically used in a hub and spoke design, with spoke vnets peered to a hub vnet that has one or more private resolver endpoints. In this hub and spoke scenario, the spoke vnet does not need to be linked to the private DNS zone in order to resolve resource records in the zone. In this case, the forwarding ruleset rule for the private zone sends queries to the hub vnet's inbound endpoint. For example: **azure.contoso.com** to **10.10.0.4**.
 
 The following screenshot shows a DNS forwarding ruleset linked to two virtual networks: a hub vnet: **myeastvnet**, and a spoke vnet: **myeastspoke**.
 
 ![View ruleset links](./media/private-resolver-endpoints-rulesets/ruleset-links.png)
 
-Virtual network links for DNS forwarding rulesets enable resources in vnets to use forwarding rules when resolving DNS names. Vnets that are linked from a ruleset but don't have their own private resolver must have a peering connection to the vnet that contains the private resolver. The vnet with the private resolver must also be linked from any private DNS zones for which there are ruleset rules.
+Virtual network links for DNS forwarding rulesets enable resources in vnets to use forwarding rules when resolving DNS names. Vnets that are linked from a ruleset, but don't have their own private resolver, must have a peering connection to the vnet that contains the private resolver. The vnet with the private resolver must also be linked from any private DNS zones for which there are ruleset rules.
+
+For example, resources in the vnet `myeastspoke` can resolve records in the private DNS zone `azure.contoso.com` if:
+- The vnet `myeastspoke` peers with `myeastvnet` 
+- The ruleset provisioned in `myeastvnet` is linked to `myeastspoke` and `myeastvnet`
+- A ruleset rule is configured and enabled in the linked ruleset to resolve `azure.contoso.com` using the inbound endpoint in `myeastvnet`
 
 ### Rules
 
diff --git a/articles/dns/tutorial-dns-private-resolver-failover.md b/articles/dns/tutorial-dns-private-resolver-failover.md
@@ -127,7 +127,7 @@ Now that DNS resolution is working from on-premises to Azure using two different
    > [!NOTE]
    > The DNS server that you use to configure forwarding should be a server that client devices on your network will use for DNS resolution. If the server you're configuring is not the default, you'll need to query it's IP address directly (ex: nslookup test.azure.contoso.com 10.100.0.2) after forwarding is configured.
 
-1. Open an elevated Windows PowerShell prompt and prompt commands. Replace **azure.contoso.com** with the name of your private zone, and replace the IP addresses below with the IP addresses for your private resolvers.
+1. Open an elevated Windows PowerShell prompt and issue the following command. Replace **azure.contoso.com** with the name of your private zone, and replace the IP addresses below with the IP addresses of your private resolvers.
 
     ```PowerShell
     Add-DnsServerConditionalForwarderZone -Name "azure.contoso.com" -MasterServers 10.20.0.4,10.10.0.4
diff --git a/articles/key-vault/policy-reference.md b/articles/key-vault/policy-reference.md
@@ -1,7 +1,7 @@
 ---
 title: Built-in policy definitions for Key Vault
 description: Lists Azure Policy built-in policy definitions for Key Vault. These built-in policy definitions provide common approaches to managing your Azure resources.
-ms.date: 08/16/2022
+ms.date: 08/19/2022
 ms.topic: reference
 author: msmbaldwin
 ms.author: mbaldwin
diff --git a/articles/purview/how-to-deploy-profisee-purview-integration.md b/articles/purview/how-to-deploy-profisee-purview-integration.md
@@ -88,10 +88,10 @@ The reference architecture shows how both Microsoft Purview and Profisee MDM wor
 
 ## Microsoft Purview - Profisee integration deployment on Azure Kubernetes Service (AKS)
 
-1. Get the license file from Profisee by raising a support ticket on [https://support.profisee.com/](https://support.profisee.com/). Only pre-requisite for this step is your need to pre-determine the DNS resolved URL your Profisee setup on Azure. In other words, keep the DNS HOST NAME of the load balancer used in the deployment. It will be something like "[profisee_name].[region].cloudapp.azure.com".
+1. Get the license file from Profisee by raising a support ticket on [https://support.profisee.com/](https://support.profisee.com/). The only pre-requisite for this step is your need to pre-determine the DNS resolved URL your Profisee setup on Azure. In other words, keep the DNS HOST NAME of the load balancer used in the deployment. It will be something like "[profisee_name].[region].cloudapp.azure.com".
 For example, DNSHOSTNAME="purviewprofisee.southcentralus.cloudapp.azure.com". Supply this DNSHOSTNAME to Profisee support when you raise the support ticket and Profisee will revert with the license file. You'll need to supply this file during the next configuration steps below.
 
-1. [Create a user-assigned managed identity in Azure](../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md#create-a-user-assigned-managed-identity). You must have a managed identity created to run the deployment. This managed identity must have the following permissions when running a deployment. After the deployment is done, the managed identity can be deleted. Based on your ARM template choices, you'll need some or all of the following roles and permissions assigned to your managed identity:
+1. [Create a user-assigned managed identity in Azure](../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md#create-a-user-assigned-managed-identity). You must have a managed identity created to run the deployment. After the deployment is done, the managed identity can be deleted. Based on your ARM template choices, you'll need some or all of the following roles and permissions assigned to your managed identity:
     - Contributor role to the resource group where AKS will be deployed. It can either be assigned directly to the resource group **OR** at the subscription level and down.
     - DNS Zone Contributor role to the particular DNS zone where the entry will be created **OR** Contributor role to the DNS Zone resource group. This DNS role is needed only if updating DNS hosted in Azure.
     - Application Administrator role in Azure Active Directory so the required permissions that are needed for the application registration can be assigned.
@@ -224,4 +224,4 @@ An output response that looks similar as the above confirms successful installat
 ## Next steps
 
 Through this guide, we learned of the importance of MDM in driving and supporting Data Governance in the context of the Azure data estate, and how to set up and deploy a Microsoft Purview-Profisee integration.
-For more usage details on Profisee MDM, register for scheduled trainings, live product demonstration and Q&A on [Profisee Academy Tutorials and Demos](https://profisee.com/demo/)!
+For more usage details on Profisee MDM, register for scheduled trainings, live product demonstration and Q&A on [Profisee Academy Tutorials and Demos](https://profisee.com/demo/)!
diff --git a/articles/static-web-apps/overview.md b/articles/static-web-apps/overview.md
diff --git a/articles/virtual-wan/virtual-wan-faq.md b/articles/virtual-wan/virtual-wan-faq.md
diff --git a/includes/policy/reference/byrp/microsoft.keyvault.data.md b/includes/policy/reference/byrp/microsoft.keyvault.data.md
diff --git a/includes/policy/reference/byrp/microsoft.keyvault.md b/includes/policy/reference/byrp/microsoft.keyvault.md
