Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into us354428-exec-docs-conversion

Author: asudbring

articles/app-service/reference-app-settings.md

@@ -176,7 +176,7 @@ This section shows the configurable runtime settings for each supported language
 | `CATALINA_BASE` | To use a custom Tomcat installation, set to the installation's location. | |
 | `WEBSITE_JAVA_MAX_HEAP_MB` | The Java maximum heap in MB. This setting is effective only when an experimental Tomcat version is used. | |
 | `WEBSITE_DISABLE_JAVA_HEAP_CONFIGURATION` | Manually disable `WEBSITE_JAVA_MAX_HEAP_MB` by setting this variable to `true` or `1`. | |
-| `WEBSITE_AUTH_SKIP_PRINCIPAL` | By default, the following Tomcat [HttpServletRequest interface](https://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpServletRequest.html) are hydrated when you enable the built-in [authentication](overview-authentication-authorization.md): `isSecure`, `getRemoteAddr`, `getRemoteHost`, `getScheme`, `getServerPort`. To disable it, set to `1`.  | |
+| `WEBSITE_AUTH_SKIP_PRINCIPAL` | By default, the following Tomcat [HttpServletRequest interface](https://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpServletRequest.html) are hydrated when you enable the built-in [authentication](overview-authentication-authorization.md): `isSecure`, `getRemoteAddr`, `getRemoteHost`, `getScheme`, `getServerPort`, `getLocalPort` and `getRequestURL`. To disable it, set to `1`.  | |
 | `WEBSITE_SKIP_FILTERS` | To disable all servlet filters added by App Service, set to `1`. ||
 | `IGNORE_CATALINA_BASE` | By default, App Service checks if the Tomcat variable `CATALINA_BASE` is defined. If not, it looks for the existence of `%HOME%\tomcat\conf\server.xml`. If the file exists, it sets `CATALINA_BASE` to `%HOME%\tomcat`. To disable this behavior and remove `CATALINA_BASE`, set this variable to `1` or `true`. ||
 | `PORT` | Read-only. For Linux apps, port that the Java runtime listens to in the container. | |

articles/backup/azure-kubernetes-service-cluster-backup-concept.md

@@ -37,6 +37,8 @@ Azure Backup now allows you to back up AKS clusters (cluster resources and persi
 
 - If Storage Account, to be provided as input for Extension installation, is under Virtual Network/Firewall, then BackupVault needs to be added as trusted access in Storage Account Network Settings. [Learn how to grant access to trusted Azure service](../storage/common/storage-network-security.md?tabs=azure-portal#grant-access-to-trusted-azure-services), which helps to store backups in the Vault datastore
 
+- The blob container provided in input during extension installation should not contain any files unrelated to backup.   
+
 Learn [how to manage the operation to install Backup Extension using Azure CLI](azure-kubernetes-service-cluster-manage-backups.md#backup-extension-related-operations).
 
 ## Trusted Access
@@ -70,10 +72,14 @@ To enable backup for an AKS cluster, see the following prerequisites: .
 
 - The Backup Extension during installation fetches Container Images stored in Microsoft Container Registry (MCR). If you enable a firewall on the AKS cluster, the extension installation process might fail due to access issues on the Registry. Learn [how to allow MCR access from the firewall](/azure/container-registry/container-registry-firewall-access-rules#configure-client-firewall-rules-for-mcr).
 
-- In case you have the cluster in a Private Virtual Network and Firewall, apply the following FQDN/application rules: `*.microsoft.com`, `*.azure.com`, `*.core.windows.net`, `*.azmk8s.io`, `*.digicert.com`, `*.digicert.cn`, `*.geotrust.com`, `*.msocsp.com`. Learn [how to apply FQDN rules](../firewall/dns-settings.md).
+- In case you have the cluster in a Private Virtual Network and Firewall, apply the following FQDN/application rules: `*.microsoft.com`, `mcr.microsoft.com`, `data.mcr.microsoft.com`, `crl.microsoft.com`, `mscrl.microsoft.com`, `oneocsp.microsoft.com` , `*.azure.com`, `management.azure.com`, `gcs.prod.monitoring.core.windows.net`, `*.prod.warm.ingest.monitor.core.windows.net`, `*.blob.core.windows.net`, `*.azmk8s.io`, `ocsp.digicert.com`, `cacerts.digicert.com`, `crl3.digicert.com`, `crl4.digicert.com`, `ocsp.digicert.cn`, `cacerts.digicert.cn`, `cacerts.geotrust.com`, `cdp.geotrust.com`, `status.geotrust.com`, `ocsp.msocsp.com`,  `*.azurecr.io`, `docker.io`, `*.dp.kubernetesconfiguration.azure.com`. Learn [how to apply FQDN rules](../firewall/dns-settings.md).
 
 - If you have any previous installation of *Velero* in the AKS cluster, you need to delete it before installing Backup Extension.
 
+- If you are using [Azure policies in your AKS cluster](/azure/aks/policy-reference), ensure that the extension namespace *dataprotection-microsoft* is excluded from these policies to allow backup and restore operations to run successfully.
+
+- If you are using Azure network security group to filter network traffic between Azure resources in an Azure virtual network then set an inbound rule to allow service tags *azurebackup* and *azurecloud*. 
+     
 
 ## Required roles and permissions
 

articles/cdn/edgio-retirement-faq.md

@@ -48,7 +48,7 @@ The following process is a recap of the migration options we sent to all users:
 
 If Azure CDN from Edgio customers don't [set the Feature Flag](../azure-resource-manager/management/preview-features.md) `DoNotForceMigrateEdgioCDNProfiles` before 7 January 2025, Microsoft will migrate existing Azure CDN from Edgio profiles to Azure Front Door Standard profiles. Migration is happening between January 7th and 14th, 2025. These migrations to Azure Front Door are performed on a "best effort" basis, and doing so might cause issues related to the billing, features, availability, and/or performance you're currently consuming with Azure CDN from Edgio. Hence, as noted previously, customers should migrate themselves and not rely on this automatic migration.
 Important notes regarding these "best effort" automatic migrations to Azure Front Door Standard:
--	Between January 7th and 14th, 2025 you'll receive an email notification confirming if your workloads have been successfully migrated to Azure Front Door Standard or if the migration was unsuccessful. If the migration was successful and you encounter issues with availability, performance, or feature functionality, contact Microsoft support for assistance. For customers whom the migration unsuccessful will be provided guidance on possible next steps they can take.
+-	Between January 7th and 14th, 2025 you'll receive an email notification confirming if your workloads have been successfully migrated to Azure Front Door Standard or if the migration was unsuccessful. If the migration was successful and you encounter issues with availability, performance, or feature functionality, contact Microsoft support for assistance. For customers whom the migration unsuccessful should reach out to Azure support for assistance and move to Akamai/another CDN provider if AFD is not suitable for their traffic.
 -	We're migrating customers to Azure Front Door Standard as it may be more cost-effective. If you need the extra features of Azure Front Door Premium, you can [upgrade your service](../frontdoor/tier-upgrade.md).
 -	Existing Azure CDN from Edgio domains (custom domains and/or *.azureedge.net domains) will be added as custom domains on the new Front Door endpoints and we'll switch the traffic from Edgio platform to Front Door platform.
 -	We are not able to roll back the automatic migration.
@@ -121,6 +121,10 @@ No.
 
 No. We're doing this migration on a "best effort" basis between January 7th and 14th, 2025 for customers who did not take action prior. Therefore we can't inform each customer regarding migration timings, but as noted previously after the migration we'll inform you as to whether it was successful.
 
+### I am not able to stop my Azure CDN from Edgio anymore. What is happening?
+
+For profiles that didn't apply the feature flag, configuration was frozen on January 3rd. These profiles will no longer be allowed to stop their endpoints. You can delete the profile instead. Do note that for Azure CDN from Edgio, stopping an endpoint has always meant as a configuration deletion. When an endpoint is disabled or stopped for any reason, all resources configured through the Edgio supplemental portal will be cleaned up. These configurations can't be restored automatically by restarting the endpoint. 
+
 ## Next steps
 
 [Set up preview features](../azure-resource-manager/management/preview-features.md)

articles/communication-services/concepts/numbers/phone-number-management-for-norway.md

@@ -22,7 +22,7 @@ Use the below tables to find all the relevant information on number availability
 | :---------- | :------------------- | :------------------- | :------------------- | :--------------------- |
 | Toll-Free   |-  | - | General Availability | General Availability\* |
 | Local       | -                    | -                    | General Availability | General Availability\* |
-|Alphanumeric Sender ID\**|General Availability  |-|-|-|
+
 
 \* Please refer to [Inbound calling capabilities page](../telephony/inbound-calling-capabilities.md) for details.
 

articles/firewall-manager/secured-virtual-hub.md

@@ -5,15 +5,15 @@ author: vhorne
 ms.service: azure-firewall-manager
 services: firewall-manager
 ms.topic: concept-article
-ms.date: 06/13/2023
+ms.date: 01/07/2025
 ms.author: victorh
 ---
 
 # What is a secured virtual hub?
 
 A virtual hub is a Microsoft-managed virtual network that enables connectivity from other resources. When a virtual hub is created from a Virtual WAN in the Azure portal, a virtual hub VNet and gateways (optional) are created as its components.
 
-A *secured* virtual hub is an [Azure Virtual WAN Hub](../virtual-wan/virtual-wan-about.md#resources) with associated security and routing policies configured by Azure Firewall Manager. Use secured virtual hubs to easily create hub-and-spoke and transitive architectures with native security services for traffic governance and protection. Multiple secured hubs can be deployed within the same region or across regions part of the same Virtual WAN resource. Use Firewall Manager in the Azure Portal to add additional secured hubs. 
+A *secured* virtual hub is an [Azure Virtual WAN Hub](../virtual-wan/virtual-wan-about.md#resources) with associated security and routing policies configured by Azure Firewall Manager. Use secured virtual hubs to easily create hub-and-spoke and transitive architectures with native security services for traffic governance and protection. Multiple secured hubs can be deployed within the same region or across regions part of the same Virtual WAN resource. Use Firewall Manager in the Azure portal to add more secured hubs. 
 
 You can use a secured virtual hub to filter traffic between virtual networks (V2V), branch-to-branch (B2B)<sup>*</sup>, branch offices (B2V) and traffic to the Internet (B2I/V2I). A secured virtual hub provides automated routing. There's no need to configure your own UDRs (user defined routes) to route traffic through your firewall.
 

articles/hdinsight/azure-monitor-agent.md

@@ -3,7 +3,7 @@ title: Azure Monitor Agent (AMA) migration guide for Azure HDInsight clusters
 description: Learn how to migrate to Azure Monitor Agent (AMA) in Azure HDInsight clusters.
 ms.service: azure-hdinsight
 ms.topic: how-to
-ms.date: 12/03/2024
+ms.date: 01/07/2024
 ---
 
 # Azure Monitor Agent (AMA) migration guide for Azure HDInsight clusters
@@ -513,6 +513,8 @@ We also improved the out-of-box dashboards both at the cluster-level. There's a
 
     * Microsoft will not patch the Azure Monitor integration (preview) clusters except for critical security issues. 
 
+* `HDInsightGatewayAuditLogs_CL` table will no longer be functional from September 14, 2026, as The [Azure Monitor HTTP Data Collector API](/previous-versions/azure/azure-monitor/logs/data-collector-api?tabs=powershell) is being deprecated.
+  
 ## Appendix: Table mapping
 
 For the log table mappings from the classic Azure Monitor integration to the new one, see [Log table mapping](./monitor-hdinsight-reference.md#log-table-mapping). 

articles/iot-hub/how-to-cloud-to-device-messaging.md

@@ -1,12 +1,12 @@
 ---
 title: Send cloud-to-device messages
 titleSuffix: Azure IoT Hub
-description: How to send cloud-to-device messages from a back-end app and receive them on a device app using the Azure IoT SDKs for C#, Python, Java, Node.js, and C.
+description: How to send cloud-to-device messages from a back-end app and receive them on a device app using the Azure IoT SDKs for C#, Python, Java, and Node.js.
 author: kgremban
 ms.author: kgremban
 ms.service: azure-iot-hub
 ms.topic: how-to
-ms.date: 12/19/2024
+ms.date: 1/6/2025
 zone_pivot_groups: iot-hub-howto-c2d-1
 ms.custom: [amqp, mqtt, "Role: Cloud Development", "Role: IoT Device"]
 ---

articles/load-balancer/troubleshoot-load-balancer-imds.md

@@ -23,7 +23,7 @@ This article describes common deployment errors and how to resolve those errors
 | 400 | Unexpected request. Check the query parameters and retry. | The error code indicates that the request format isn't configured properly.</br> Learn [How to retrieve load balancer metadata using the Azure Instance Metadata Service (IMDS)](howto-load-balancer-imds.md#sample-request-and-response) to fix the request body and issue a retry. |
 | 404 | No load balancer metadata is found. Check if your virtual machine is using any nonbasic SKU load balancer and retry later. | The error code indicates that your virtual machine isn't associated with a load balancer or the load balancer is basic SKU instead of standard.</br> For more information, see [Quickstart: Create a public load balancer to load balance VMs using the Azure portal](quickstart-load-balancer-standard-public-portal.md?tabs=option-1-create-load-balancer-standard) to deploy a standard load balancer.|
 | 404 | API isn't found: Path = "\<UrlPath>", Method = "\<Method>" | The error code indicates a misconfiguration of the path.</br> Learn [How to retrieve load balancer metadata using the Azure Instance Metadata Service (IMDS)](howto-load-balancer-imds.md#sample-request-and-response) to fix the request body and issue a retry. |
-| 405 | Http method isn't allowed: Path = "\<UrlPath>", Method = "\<Method>" | The error code indicates an unsupported HTTP verb.</br> For more information, see [Azure Instance Metadata Service (IMDS)](/azure/virtual-machines/windows/instance-metadata-service?tabs=windows#http-verbs) for supported verbs. |
+| 405 | HTTP method isn't allowed: Path = "\<UrlPath>", Method = "\<Method>" | The error code indicates an unsupported HTTP verb.</br> For more information, see [Azure Instance Metadata Service (IMDS)](/azure/virtual-machines/windows/instance-metadata-service?tabs=windows#http-verbs) for supported verbs. |
 | 429 | Too many requests | The error code indicates a rate limit.</br> For more information on rate limiting, see [Azure Instance Metadata Service (IMDS)](/azure/virtual-machines/windows/instance-metadata-service?tabs=windows#rate-limiting).|
 | 400 | Request body is larger than MaxBodyLength: … | The error code indicates a request larger than the MaxBodyLength.</br> For more information on body length, see [How to retrieve load balancer metadata using the Azure Instance Metadata Service (IMDS)](howto-load-balancer-imds.md#sample-request-and-response).|
 | 400 | Parameter key length is larger than MaxParameterKeyLength: … | The error code indicates a parameter key length larger than the MaxParameterKeyLength.</br> For more information on body length, see [How to retrieve load balancer metadata using the Azure Instance Metadata Service (IMDS)](howto-load-balancer-imds.md#sample-request-and-response). |

articles/migrate/vmware/tutorial-import-vmware-using-rvtools-xlsx.md

@@ -61,6 +61,8 @@ To create a project and register the Azure Migrate appliance, you must have an A
 
 Follow the instructions on [how to set up an Azure Migrate project](../tutorial-discover-import.md#set-up-a-project).
 
+> [!NOTE]
+> Import using RVTools is not supported for Migrate projects configured with private endpoints.
 
 ## Import the servers using the RVTools XLSX file (preview)
 

articles/operator-nexus/concepts-cluster-management-upgrade.md

@@ -21,7 +21,7 @@ For Compute management, Microsoft delivers new software to the extensions and ag
 
 ## Impact to customer workloads
 
-The intent of these releases is no disruption to running workloads and on-premises resources retain availability throughout the upgrade. Therefore, the customer should see no impact. 
+The intent of these releases is no disruption to running workloads, instantiating new workloads, and on-premises resources retain availability throughout the upgrade. Therefore, the customer should see no impact. 
 
 ## Duration of on-premises updates