Merge pull request #229586 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)

Author: huypub

articles/active-directory/authentication/concept-sspr-writeback.md

@@ -38,7 +38,7 @@ Password writeback provides the following features:
 * **Supports side-by-side domain-level deployment** using [Azure AD Connect](tutorial-enable-sspr-writeback.md) or [cloud sync](tutorial-enable-cloud-sync-sspr-writeback.md) to target different sets of users depending on their needs, including users who are in disconnected domains.  
 
 > [!NOTE]
-> Administrator accounts that exist within protected groups in on-premises AD can be used with password writeback. Administrators can change their password in the cloud but can't reset a forgotten password. For more information about protected groups, see [Protected accounts and groups in AD DS](/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory).
+> The on-premises service account that handles password write-back requests cannot change the passwords for users that belong to protected groups. Administrators can change their password in the cloud but they cannot use password write-back to reset a forgotten password for their on-premises user. For more information about protected groups, see [Protected accounts and groups in AD DS](/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory).
 
 To get started with SSPR writeback, complete either one or both of the following tutorials:
 

articles/active-directory/authentication/howto-authentication-passwordless-troubleshoot.md

@@ -98,20 +98,20 @@ The following events logs and registry key info is collected:
 
 ### Deployment Issues
 
-To troubleshoot issues with deploying the Azure AD Kerberos Server, use the new PowerShell module included with Azure AD Connect.
+To troubleshoot issues with deploying the Azure AD Kerberos Server, use the logs for the new [AzureADHybridAuthenticationManagement](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement) PowerShell module.
 
 #### Viewing the logs
 
-The Azure AD Kerberos Server PowerShell cmdlets use the same logging as the standard Azure AD Connect Wizard. To view information or error details from the cmdlets, complete the following steps:
+The Azure AD Kerberos Server PowerShell cmdlets in the [AzureADHybridAuthenticationManagement](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement) module use the same logging as the standard Azure AD Connect Wizard. To view information or error details from the cmdlets, complete the following steps:
 
-1. On the Azure AD Connect Server, browse to `C:\ProgramData\AADConnect\`. This folder is hidden by default.
+1. On the machine where the [AzureADHybridAuthenticationManagement](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement) module was used, browse to `C:\ProgramData\AADConnect\`. This folder is hidden by default.
 1. Open and view the most recent `trace-*.log` file located in the directory.
 
 #### Viewing the Azure AD Kerberos Server Objects
 
 To view the Azure AD Kerberos Server Objects and verify they are in good order, complete the following steps:
 
-1. On the Azure AD Connect Server, open PowerShell and navigate to `C:\Program Files\Microsoft Azure Active Directory Connect\AzureADKerberos\`
+1. On the Azure AD Connect Server or any other machine where the [AzureADHybridAuthenticationManagement](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement) module is installed, open PowerShell and navigate to `C:\Program Files\Microsoft Azure Active Directory Connect\AzureADKerberos\`
 1. Run the following PowerShell commands to view the Azure AD Kerberos Server from both Azure AD and on-premises AD DS.
 
     Replace *corp.contoso.com* with the name of your on-premises AD DS domain.

articles/azure-resource-manager/bicep/child-resource-name-type.md

@@ -29,7 +29,7 @@ The **full name** of the child resource uses the pattern:
 {parent-resource-name}/{child-resource-name}
 ```
 
-If you have more two levels in the hierarchy, keep repeating parent names:
+If you have more than two levels in the hierarchy, keep repeating parent names:
 
 ```bicep
 {parent-resource-name}/{child-level1-resource-name}/{child-level2-resource-name}

articles/bastion/connect-native-client-windows.md

@@ -141,6 +141,9 @@ Use the example that corresponds to the type of target VM to which you want to c
    az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId>"
    ```
 
+> [!IMPORTANT]
+> Remote connection to VMs that are joined to Azure AD is allowed only from Windows 10 or later PCs that are Azure AD registered (starting with Windows 10 20H1), Azure AD joined, or hybrid Azure AD joined to the *same* directory as the VM. 
+
    **SSH:**
 
    The extension can be installed by running, ```az extension add --name ssh```. To sign in using an SSH key pair, use the following example.

articles/data-factory/data-movement-security-considerations.md

@@ -56,7 +56,7 @@ In this article, we review security considerations in the following two data mov
 
 - **Store encrypted credentials in an Azure Data Factory managed store**. Data Factory helps protect your data store credentials by encrypting them with certificates managed by Microsoft. These certificates are rotated every two years (which includes certificate renewal and the migration of credentials). For more information about Azure Storage security, see [Azure Storage security overview](../storage/blobs/security-recommendations.md).
 - **Store credentials in Azure Key Vault**. You can also store the data store's credential in [Azure Key Vault](https://azure.microsoft.com/services/key-vault/). Data Factory retrieves the credential during the execution of an activity. For more information, see [Store credential in Azure Key Vault](store-credentials-in-key-vault.md).
-- 
+
 Centralizing storage of application secrets in Azure Key Vault allows you to control their distribution. Key Vault greatly reduces the chances that secrets may be accidentally leaked. Instead of storing the connection string in the app's code, you can store it securely in Key Vault. Your applications can securely access the information they need by using URIs. These URIs allow the applications to retrieve specific versions of a secret. There's no need to write custom code to protect any of the secret information stored in Key Vault. 
 
 ### Data encryption in transit

articles/data-factory/whats-new.md

@@ -37,7 +37,7 @@ New top-level CDC resource - native CDC configuration in 3 simple steps [Learn m
 
 ### Orchestration
 
-Orchestyrate Synapse notebooks and Synapse spark job definitions natively [Learn more](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/orchestrate-and-operationalize-synapse-notebooks-and-spark-job/ba-p/3724379)
+Orchestrate Synapse notebooks and Synapse spark job definitions natively [Learn more](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/orchestrate-and-operationalize-synapse-notebooks-and-spark-job/ba-p/3724379)
 
 ### Region expansion
 

articles/event-hubs/event-hubs-faq.yml

@@ -221,7 +221,7 @@ sections:
       - question: |
           How is Event Hubs Capture billed?
         answer: |
-          Capture is enabled when any event hub in the namespace has the Capture option enabled. Event Hubs Capture is billed hourly per purchased throughput unit. As the throughput unit count is increased or decreased, Event Hubs Capture billing reflects these changes in whole hour increments. For more information about Event Hubs Capture billing, see [Event Hubs pricing information](https://azure.microsoft.com/pricing/details/event-hubs/).
+          Capture is enabled when any event hub in the namespace has the Capture option enabled. Event Hubs Capture is billed monthly per purchased throughput unit. As the throughput unit count is increased or decreased, Event Hubs Capture billing reflects these changes in whole hour increments. For more information about Event Hubs Capture billing, see [Event Hubs pricing information](https://azure.microsoft.com/pricing/details/event-hubs/).
           
       - question: |
           Do I get billed for the storage account I select for Event Hubs Capture?

articles/machine-learning/how-to-administrate-data-authentication.md

@@ -7,7 +7,7 @@ ms.service: machine-learning
 ms.subservice: enterprise-readiness
 ms.topic: how-to
 ms.author: xunwan
-author: xunwan
+author: SturgeonMi
 ms.reviewer: larryfr
 ms.date: 01/20/2023
 ms.custom: engagement-fy23
@@ -96,7 +96,7 @@ When an Azure Storage account is behind a virtual network, the storage firewall
 When the workspace uses a private endpoint and the storage account is also in the VNet, there are extra validation requirements when using studio:
 
 * If the storage account uses a __service endpoint__, the workspace private endpoint and storage service endpoint must be in the same subnet of the VNet.
-* If the storage account uses a __private endpoint__, the workspace private endpoint and storage service endpoint must be in the same VNet. In this case, they can be in different subnets.
+* If the storage account uses a __private endpoint__, the workspace private endpoint and storage private endpoint must be in the same VNet. In this case, they can be in different subnets.
 
 ## Azure Data Lake Storage Gen1
 

articles/machine-learning/how-to-configure-cli.md

@@ -31,7 +31,7 @@ The `ml` extension to the [Azure CLI](/cli/azure/) is the enhanced interface for
 
 ## Installation
 
-The new Machine Learning extension **requires Azure CLI version `>=2.15.0`**. Ensure this requirement is met:
+The new Machine Learning extension **requires Azure CLI version `>=2.38.0`**. Ensure this requirement is met:
 
 :::code language="azurecli" source="~/azureml-examples-main/cli/misc.sh" id="az_version":::
 

articles/mysql/single-server/concepts-query-store.md

@@ -127,10 +127,10 @@ This view returns all the data in Query Store. There is one row for each distinc
 | `execution_count` | bigint(20)| NO| The number of times the query got executed for this timestamp ID / during the configured interval period|
 | `warning_count` | bigint(20)| NO| Number of warnings this query generated during the internal|
 | `error_count` | bigint(20)| NO| Number of errors this query generated during the interval|
-| `sum_timer_wait` | double| YES| Total execution time of this query during the interval|
-| `avg_timer_wait` | double| YES| Average execution time for this query during the interval|
-| `min_timer_wait` | double| YES| Minimum execution time for this query|
-| `max_timer_wait` | double| YES| Maximum execution time|
+| `sum_timer_wait` | double| YES| Total execution time of this query during the interval in milliseconds|
+| `avg_timer_wait` | double| YES| Average execution time for this query during the interval in milliseconds|
+| `min_timer_wait` | double| YES| Minimum execution time for this query in milliseconds|
+| `max_timer_wait` | double| YES| Maximum execution time in milliseconds|
 | `sum_lock_time` | bigint(20)| NO| Total amount of time spent for all the locks for this query execution during this time window|
 | `sum_rows_affected` | bigint(20)| NO| Number of rows affected|
 | `sum_rows_sent` | bigint(20)| NO| Number of rows sent to client|