Merge branch 'main' into patch-9

Author: erjosito

articles/automation/automation-hrw-run-runbooks.md

@@ -208,18 +208,22 @@ By default, the Hybrid jobs run under the context of System account. However, to
 1. Change the value of **Hybrid Worker credentials** from **Default** to **Custom**.
 1. Select the credential and click **Save**.
 1. If the following permissions are not assigned for Custom users, jobs might get suspended. 
-    
-**Folders**
-- C:\ProgramData\AzureConnectedMachineAgent\Tokens (read) </br>
-- C:\Packages\Plugins\Microsoft.Azure.Automation.HybridWorker.HybridWorkerForWindows (read and execute)
 
+  | **Resource type** | **Folder permissions** |
+  | --- | --- |
+  |Azure VM | C:\Packages\Plugins\Microsoft.Azure.Automation.HybridWorker.HybridWorkerForWindows (read and execute) |
+  |Arc-enabled Server | C:\ProgramData\AzureConnectedMachineAgent\Tokens (read)</br> C:\Packages\Plugins\Microsoft.Azure.Automation.HybridWorker.HybridWorkerForWindows (read and execute) |
+        
+  >[!NOTE]
+  >Linux Hybrid Worker doesn't support Hybrid Worker credentials.
+    
 ## <a name="runas-script"></a>Install Run As account certificate
 
 As part of your automated build process for deploying resources in Azure, you might require access to on-premises systems to support a task or set of steps in your deployment sequence. To provide authentication against Azure using the Run As account, you must install the Run As account certificate.
 
 >[!NOTE]
->This PowerShell runbook currently does not run on Linux machines. It runs only on  Windows machines.
->
+>This PowerShell runbook currently does not run on Linux machines. It runs only on Windows machines.
+
 
 The following PowerShell runbook, called **Export-RunAsCertificateToHybridWorker**, exports the Run As certificate from your Azure Automation account. The runbook downloads and imports the certificate into the local machine certificate store on a Hybrid Runbook Worker that is connected to the same account. Once it completes that step, the runbook verifies that the worker can successfully authenticate to Azure using the Run As account.
 

articles/azure-functions/functions-get-started.md

@@ -2,7 +2,7 @@
 title: Getting started with Azure Functions
 description: Take the first steps toward working with Azure Functions.
 ms.topic: overview
-ms.date: 11/19/2020
+ms.date: 12/13/2022
 zone_pivot_groups: programming-languages-set-functions-lang-workers
 ---
 

articles/azure-functions/functions-how-to-use-azure-function-app-settings.md

@@ -3,7 +3,7 @@ title: Configure function app settings in Azure Functions
 description: Learn how to configure function app settings in Azure Functions.
 ms.assetid: 81eb04f8-9a27-45bb-bf24-9ab6c30d205c
 ms.topic: conceptual
-ms.date: 01/21/2021
+ms.date: 12/13/2022
 ms.custom: cc996988-fb4f-47, devx-track-azurecli, devx-track-azurepowershell
 ---
 
@@ -133,9 +133,16 @@ In the previous example replace `<RESOURCE_GROUP>` and `<FUNCTION_APP_NAME>` wit
 
 ## Plan migration
 
-You can use Azure CLI commands to migrate a function app between a Consumption plan and a Premium plan on Windows. The specific commands depend on the direction of the migration. Direct migration to a Dedicated (App Service) plan isn't currently supported.
+You can use either the Azure portal or Azure CLI commands to migrate a function app between a Consumption plan and a Premium plan on Windows. When migrating between plans, keep in mind the following considerations:
 
-This migration isn't supported on Linux.
++ Direct migration to a Dedicated (App Service) plan isn't currently supported.
++ Migration isn't supported on Linux. 
++ The source plan and the target plan must be in the same resource group and geographical region. For more information, see [Move an app to another App Service plan](../app-service/app-service-plan-manage.md#move-an-app-to-another-app-service-plan).
++ The specific CLI commands depend on the direction of the migration.
+
+### Migration in the portal
+
+In the Azure portal, navigate to your Consumption or Premium plan app and choose **Change App Service plan** under **App Service plan**. Select the other **Plan type**, create a new App Service plan of the new type, and select **OK**. For more information, see [Move an app to another App Service plan](../app-service/app-service-plan-manage.md#move-an-app-to-another-app-service-plan).
 
 ### Consumption to Premium
 
@@ -189,7 +196,7 @@ Use the following procedure to migrate from a Premium plan to a Consumption plan
     az functionapp delete --name <NEW_CONSUMPTION_APP_NAME> --resource-group <MY_RESOURCE_GROUP>
     ```
 
-1. If you no longer need your previous Premium function app plan, delete your original function app plan after confirming you have successfully migrated to the new one. Please note that if the plan is not deleted, you will still be charged for the Premium plan. Run the [az functionapp plan list](/cli/azure/functionapp/plan#az-functionapp-plan-list) command as follows to get a list of all Premium plans in your resource group.
+1. If you no longer need your previous Premium function app plan, delete your original function app plan after confirming you have successfully migrated to the new one. Note that if the plan isn't deleted, you'll still be charged for the Premium plan. Run the [az functionapp plan list](/cli/azure/functionapp/plan#az-functionapp-plan-list) command as follows to get a list of all Premium plans in your resource group.
 
     ```azurecli-interactive
     az functionapp plan list --resource-group <MY_RESOURCE_GROUP> --query "[?sku.family=='EP'].{PlanName:name,Sites:numberOfSites}" -o table

articles/azure-functions/functions-recover-storage-account.md

@@ -1,9 +1,8 @@
 ---
 title: 'Troubleshoot error: Azure Functions Runtime is unreachable'
 description: Learn how to troubleshoot an invalid storage account.
-
 ms.topic: article
-ms.date: 09/05/2018
+ms.date: 12/13/2022
 ---
 
 # Troubleshoot error: "Azure Functions Runtime is unreachable"

articles/azure-functions/security-concepts.md

@@ -1,7 +1,7 @@
 ---
 title: Securing Azure Functions
 description: Learn about how to make your function code running in Azure more secure from common attacks.
-ms.date: 4/13/2020
+ms.date: 12/13/2022
 ms.topic: conceptual
 
 #Customer intent: As a developer, I want to understand the security features and principles of Azure Functions so that I can make my cloud-based function code as secure as possible.
@@ -231,6 +231,10 @@ Restricting network access to your function app lets you control who can access
 
 Access restrictions allow you to define lists of allow/deny rules to control traffic to your app. Rules are evaluated in priority order. If there are no rules defined, then your app will accept traffic from any address. To learn more, see [Azure App Service Access Restrictions](../app-service/app-service-ip-restrictions.md?toc=/azure/azure-functions/toc.json).
 
+### Secure the storage account
+
+When you create a function app, you must create or link to a general-purpose Azure Storage account that supports Blob, Queue, and Table storage. You can replace this storage account with one that is secured with service endpoints or private endpoints. For more information, see [Restrict your storage account to a virtual network](./functions-networking-options.md#restrict-your-storage-account-to-a-virtual-network).
+
 ### Private site access
 
 [!INCLUDE [functions-private-site-access](../../includes/functions-private-site-access.md)]

articles/azure-functions/storage-considerations.md

@@ -2,7 +2,7 @@
 title: Storage considerations for Azure Functions
 description: Learn about the storage requirements of Azure Functions and about encrypting stored data. 
 ms.topic: conceptual
-ms.date: 04/21/2022
+ms.date: 12/13/2022
 ---
 
 # Storage considerations for Azure Functions
@@ -37,6 +37,8 @@ Every function app requires a storage account to operate. When that account is d
 
 For best performance, your function app should use a storage account in the same region, which reduces latency. The Azure portal enforces this best practice. If for some reason you need to use a storage account in a region different than your function app, you must create your function app outside of the portal. 
 
+The storage account must be accessible to the function app. If you need to use a secured storage account, consider [restricting your storage account to a virtual network](./functions-networking-options.md#restrict-your-storage-account-to-a-virtual-network).s
+
 ### Storage account connection setting
 
 The storage account connection is maintained in the [AzureWebJobsStorage application setting](./functions-app-settings.md#azurewebjobsstorage). 

articles/container-apps/azure-arc-enable-cluster.md

@@ -5,7 +5,7 @@ services: container-apps
 author: cebundy
 ms.service: container-apps
 ms.topic: tutorial
-ms.date: 11/29/2022
+ms.date: 12/16/2022
 ms.author: v-bcatherine
 
 ---
@@ -468,7 +468,7 @@ Before you can start creating apps in the custom location, you need an [Azure Co
     # [bash](#tab/bash)
 
     ```azurecli
-    az containerapps connected-env create \
+    az containerapp connected-env create \
         --resource-group $GROUP_NAME \
         --name $CONNECTED_ENVIRONMENT_NAME \
         --custom-location $CUSTOM_LOCATION_ID 
@@ -477,7 +477,7 @@ Before you can start creating apps in the custom location, you need an [Azure Co
     # [PowerShell](#tab/azure-powershell)
 
     ```azurecli
-    az containerapps connected-env create `
+    az containerapp connected-env create `
         --resource-group $GROUP_NAME `
         --name $CONNECTED_ENVIRONMENT_NAME `
         --custom-location $CUSTOM_LOCATION_ID       
@@ -488,7 +488,7 @@ Before you can start creating apps in the custom location, you need an [Azure Co
 1. Validate that the Container Apps connected environment is successfully created with the following command. The output should show the `provisioningState` property as `Succeeded`. If not, run it again after a minute.
 
     ```azurecli
-    az containerapps connected-env show --resource-group $GROUP_NAME --name $CONNECTED_ENVIRONMENT_NAME
+    az containerapp connected-env show --resource-group $GROUP_NAME --name $CONNECTED_ENVIRONMENT_NAME
     ```
 
 ## Next steps

articles/machine-learning/how-to-deploy-online-endpoints.md

@@ -424,7 +424,7 @@ To save time debugging, we *highly recommend* that you test-run your endpoint lo
 > - Local endpoints support only one deployment per endpoint. 
 
 > [!TIP]
-> You can use [Azure Machine Learning inference HTTP server Python package](how-to-inference-server-http.md) to debug your scoring script locally. Debugging with the inference server helps you to debug the scoring script before deploying to local endpoints so that you can debug without being affected by the deployment container configurations.
+> You can use [Azure Machine Learning inference HTTP server Python package](how-to-inference-server-http.md) to debug your scoring script locally **without Docker Engine**. Debugging with the inference server helps you to debug the scoring script before deploying to local endpoints so that you can debug without being affected by the deployment container configurations.
 
 ### Deploy the model locally