Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into vnet-old-review

asudbring · asudbring · commit fbfa2e56a284 · 2023-03-23T13:13:52.000-07:00
diff --git a/articles/active-directory/manage-apps/migrate-adfs-apps-to-azure.md b/articles/active-directory/manage-apps/migrate-adfs-apps-to-azure.md
diff --git a/articles/active-directory/roles/permissions-reference.md b/articles/active-directory/roles/permissions-reference.md
@@ -2096,7 +2096,7 @@ Users with this role have global read-only access on security-related feature, i
 In | Can do
 --- | ---
 [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal) | View security-related policies across Microsoft 365 services<br>View security threats and alerts<br>View reports
-[Identity Protection](../identity-protection/overview-identity-protection.md) | Read all security reports and settings information for security features<br><ul><li>Anti-spam<li>Encryption<li>Data loss prevention<li>Anti-malware<li>Advanced threat protection<li>Anti-phishing<li>Mail flow rules
+[Identity Protection](../identity-protection/overview-identity-protection.md) | View all Identity Protection reports and Overview
 [Privileged Identity Management](../privileged-identity-management/pim-configure.md) | Has read-only access to all information surfaced in Azure AD Privileged Identity Management: Policies and reports for Azure AD role assignments and security reviews.<br>**Cannot** sign up for Azure AD Privileged Identity Management or make any changes to it. In the Privileged Identity Management portal or via PowerShell, someone in this role can activate additional roles (for example, Global Administrator or Privileged Role Administrator), if the user is eligible for them.
 [Microsoft Purview compliance portal](/microsoft-365/compliance/microsoft-365-compliance-center) | View security policies<br>View and investigate security threats<br>View reports
 [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/prepare-deployment) | View and investigate alerts<br/>When you turn on role-based access control in Microsoft Defender for Endpoint, users with read-only permissions such as the Security Reader role lose access until they are assigned a Microsoft Defender for Endpoint role.
diff --git a/articles/aks/web-app-routing.md b/articles/aks/web-app-routing.md
@@ -396,7 +396,7 @@ spec:
 
 ### Create the ingress
 
-The Web Application Routing add-on creates an Ingress class on the cluster called `webapprouting.kubernetes.azure.com `. When you create an ingress object with this class, this activates the add-on. To obtain the certificate URI to use in the Ingress from Azure Key Vault, run the following command.
+The Web Application Routing add-on creates an Ingress class on the cluster called `webapprouting.kubernetes.azure.com `. When you create an ingress object with this class, this activates the add-on. The `kubernetes.azure.com/use-osm-mtls: "true"` annotation on the Ingress object creates an Open Service Mesh (OSM) [IngressBackend](https://release-v1-2.docs.openservicemesh.io/docs/guides/traffic_management/ingress/#ingressbackend-api) to configure a backend service to accept ingress traffic from trusted sources. OSM issues a certificate that Nginx will use as the client certificate to proxy HTTPS connections to TLS backends. The client certificate and CA certificate are stored in a Kubernetes secret that Nginx will use to authenticate service mesh backends. For more information, see [Open Service Mesh: Ingress with Kubernetes Nginx Ingress Controller](https://release-v1-2.docs.openservicemesh.io/docs/demos/ingress_k8s_nginx/). To obtain the certificate URI to use in the Ingress from Azure Key Vault, run the following command.
 
 ```azurecli-interactive
 az keyvault certificate show --vault-name <KeyVaultName> -n <KeyVaultCertificateName> --query "id" --output tsv
@@ -441,34 +441,6 @@ spec:
     secretName: keyvault-aks-helloworld
 ```
 
-### Create the ingress backend 
-
-Open Service Mesh (OSM) uses its [IngressBackend API](https://release-v1-2.docs.openservicemesh.io/docs/guides/traffic_management/ingress/#ingressbackend-api) to configure a backend service to accept ingress traffic from trusted sources. To proxy connections to HTTPS backends, you configure the Ingress and IngressBackend configurations to use https as the backend protocol. OSM issues a certificate that Nginx will use as the client certificate to proxy HTTPS connections to TLS backends. The client certificate and CA certificate are stored in a Kubernetes secret that Nginx will use to authenticate service mesh backends. For more information, see [Open Service Mesh: Ingress with Kubernetes Nginx Ingress Controller](https://release-v1-2.docs.openservicemesh.io/docs/demos/ingress_k8s_nginx/).
-
-Create a file named **ingressbackend.yaml** and copy in the following YAML.
-
-```yaml
-apiVersion: policy.openservicemesh.io/v1alpha1
-kind: IngressBackend
-metadata:
-  name: aks-helloworld
-  namespace: hello-web-app-routing
-spec:
-  backends:
-  - name: aks-helloworld
-    port:
-      number: 80
-      protocol: https
-    tls:
-      skipClientCertValidation: false
-  sources:
-  - kind: Service
-    name: nginx
-    namespace: app-routing-system
-  - kind: AuthenticatedPrincipal
-    name: ingress-nginx.ingress.cluster.local
-```
-
 ### Create the resources on the cluster
 
 Use the [kubectl apply][kubectl-apply] command to create the resources.
diff --git a/articles/azure-functions/durable/quickstart-python-vscode.md b/articles/azure-functions/durable/quickstart-python-vscode.md
@@ -178,6 +178,10 @@ You now have a Durable Functions app that can be run locally and deployed to Azu
 
 ::: zone pivot="python-mode-decorators" 
 
+> [!NOTE]
+> Using [Extension Bundles](../functions-bindings-register.md#extension-bundles) is not currently supported when trying out the Python V2 programming model with Durable Functions, so you will need to manage your extensions manually.
+> To do this, remove the `extensionBundle` section of your `host.json` as described [here](../functions-run-local.md#install-extensions) and run `func extensions install --package Microsoft.Azure.WebJobs.Extensions.DurableTask --version 2.9.1` on your terminal. This will install the Durable Functions extension for your app and will allow you to try out the new experience.
+
 To create a basic Durable Functions app using these 3 function types, replace the contents of `function_app.py` with the following Python code.
 
 ```Python
diff --git a/articles/ddos-protection/TOC.yml b/articles/ddos-protection/TOC.yml
@@ -36,22 +36,28 @@
     href: telemetry.md
 - name: Concepts
   items:
-  - name: Types of attacks
-    href: types-of-attacks.md
-  - name: Fundamental best practices
-    href: fundamental-best-practices.md
   - name: Azure DDoS Protection features
     href: ddos-protection-features.md
-  - name: Components of a DDoS response strategy
-    href: ddos-response-strategy.md
   - name: Reference architectures
     href: ddos-protection-reference-architectures.md
+  - name: Monitoring Azure DDoS Protection 
+    href: monitor-ddos-protection-reference.md
   - name: Business continuity
     href: ddos-disaster-recovery-guidance.md
+  - name: Fundamental best practices
+    href: fundamental-best-practices.md
+  - name: Components of a DDoS response strategy
+    href: ddos-response-strategy.md
   - name: Security baseline
     href: /security/benchmark/azure/baselines/azure-ddos-protection-security-baseline?toc=%2fazure%2fddos-protection%2ftoc.json?toc=/azure/ddos-protection/TOC.json
-  - name: Monitoring Azure DDoS Protection 
-    href: monitor-ddos-protection-reference.md
+  - name: Types of attacks
+    href: types-of-attacks.md
+  - name: Inline L7 DDoS protection with Gateway Load Balancer and partner NVAs
+    href: inline-protection-glb.md
+  - name: Onboard partners
+    href: ddos-protection-partner-onboarding.md
+  - name: Manage permissions and restrictions
+    href: manage-permissions.md   
 - name: How-to guides
   items:
     - name: Configure Monitoring and Logging
@@ -62,7 +68,7 @@
           href: alerts.md  
         - name: Configure diagnostic logging alerts
           href: ddos-diagnostic-alert-templates.md
-        - name: Configure DDoS diagnostic logging
+        - name: Configure diagnostic logging
           href: diagnostic-logging.md    
     - name: View Monitoring and Logging
       items: 
@@ -72,14 +78,8 @@
           href: ddos-view-diagnostic-logs.md
     - name: Test with simulation partners
       href: test-through-simulations.md
-    - name: Manage permissions and restrictions
-      href: manage-permissions.md
     - name: Engage DDoS Rapid Response (DRR)
       href: ddos-rapid-response.md
-    - name: Inline L7 DDoS protection with Gateway Load Balancer and partner NVAs
-      href: inline-protection-glb.md
-    - name: Onboard partners
-      href: ddos-protection-partner-onboarding.md
 - name: Reference
   items:
   - name: Azure Policy built-ins
diff --git a/articles/ddos-protection/alerts.md b/articles/ddos-protection/alerts.md
@@ -126,9 +126,5 @@ You can keep your resources for the next tutorial. If no longer needed, delete t
 1. Select the alerts created in this tutorial, then select **Delete**. 
 ## Next steps
 
-In this article, you learned how to configure metric alerts through Azure Monitor.
-
-To learn how to test and simulate a DDoS attack, see the simulation testing guide:
-
-> [!div class="nextstepaction"]
-> [Test through simulations](test-through-simulations.md)
+* [Test through simulations](test-through-simulations.md)
+* [View alerts in Microsoft Defender for Cloud](ddos-view-alerts-defender-for-cloud.md)
diff --git a/articles/ddos-protection/ddos-configure-log-analytics-workspace.md b/articles/ddos-protection/ddos-configure-log-analytics-workspace.md
@@ -63,9 +63,4 @@ For more information, see [Log Analytics workspace overview](../azure-monitor/lo
 
 ## Next steps
 
-In this article, you learned how to configure a Log Analytics workspace for Azure DDoS Protection.
-
-To learn how to configure diagnostic logging, see the diagnostic logging guide:
-
-> [!div class="nextstepaction"]
-> [Test through simulations](test-through-simulations.md)
+* [configure diagnostic logging alerts](ddos-diagnostic-alert-templates.md)
diff --git a/articles/ddos-protection/ddos-diagnostic-alert-templates.md b/articles/ddos-protection/ddos-diagnostic-alert-templates.md
@@ -94,9 +94,5 @@ You can keep your resources for the next guide. If no longer needed, delete the
 
 ## Next steps
 
-In this article, you learned how to configure diagnostic logging alerts through Azure Monitor.
-
-To learn how to test and simulate a DDoS attack, see the simulation testing guide:
-
-> [!div class="nextstepaction"]
-> [Test through simulations](test-through-simulations.md)
+* [Test through simulations](test-through-simulations.md)
+* [View alerts in Microsoft Defender for Cloud](ddos-view-alerts-defender-for-cloud.md)
diff --git a/articles/ddos-protection/ddos-disaster-recovery-guidance.md b/articles/ddos-protection/ddos-disaster-recovery-guidance.md
@@ -43,4 +43,4 @@ To create a virtual network, see [Create a virtual network](../virtual-network/m
 
 ## Next steps
 
-- Learn how to [create a DDoS protection plan](manage-ddos-protection.md).
+- Learn how to [configure diagnostic logging](diagnostic-logging.md).
diff --git a/articles/ddos-protection/ddos-protection-features.md b/articles/ddos-protection/ddos-protection-features.md
@@ -80,4 +80,4 @@ Learn how your services will respond to an attack by [testing through simulation
 
 ## Next steps
 
-- Learn how to [create an Azure DDoS Protection plan](manage-ddos-protection.md).
+- Learn more about [reference architectures](ddos-protection-reference-architectures.md).
diff --git a/articles/ddos-protection/ddos-protection-reference-architectures.md b/articles/ddos-protection/ddos-protection-reference-architectures.md
@@ -128,4 +128,4 @@ For more information about hub-and-spoke topology, see [Hub-spoke network topolo
 
 ## Next steps
 
-- Learn how to [create a DDoS protection plan](manage-ddos-protection.md).
+- Learn how to [configure Network Protection](manage-ddos-protection.md).
diff --git a/articles/ddos-protection/ddos-protection-sku-comparison.md b/articles/ddos-protection/ddos-protection-sku-comparison.md
@@ -60,5 +60,6 @@ The following table shows features and corresponding SKUs.
 
 ## Next steps
 
-* [Quickstart: Create an Azure DDoS Protection Plan](manage-ddos-protection.md)
 * [Azure DDoS Protection features](ddos-protection-features.md)
+* [Reference architectures](ddos-protection-reference-architectures.md)
+
diff --git a/articles/ddos-protection/ddos-response-strategy.md b/articles/ddos-protection/ddos-response-strategy.md
@@ -69,4 +69,5 @@ If you suspect you're under a DDoS attack, escalate through your normal Azure Su
 
 ## Next steps
 
-- Learn how to [create a DDoS protection plan](manage-ddos-protection.md).
+- Learn how to [configure metric alerts through portal](alerts.md).
+- Learn how to [engage DDoS Rapid Response](ddos-rapid-response.md).
diff --git a/articles/ddos-protection/ddos-view-alerts-defender-for-cloud.md b/articles/ddos-protection/ddos-view-alerts-defender-for-cloud.md
@@ -43,4 +43,4 @@ In this How-To, you learned how to view alerts in Microsoft Defender for Cloud.
 To learn how to test and simulate a DDoS attack, see the simulation testing guide:
 
 > [!div class="nextstepaction"]
-> [Test through simulations](test-through-simulations.md)
+> [Engage with Azure DDoS Rapid Response](ddos-rapid-response.md)
diff --git a/articles/ddos-protection/diagnostic-logging.md b/articles/ddos-protection/diagnostic-logging.md
@@ -96,9 +96,5 @@ For more information on log schemas, see [View diagnostic logs](ddos-view-diagno
 
 ## Next steps
 
-In this guide, you learned how to configure Azure DDoS Protection diagnostic logs, including notifications, mitigation reports and mitigation flow logs.
-
-To learn how to configure attack alerts, continue to the next guide.
-
-> [!div class="nextstepaction"]
-> [Configure DDoS protection alerts](alerts.md)
+* [Test through simulations](test-through-simulations.md)
+* [View logs in Log Analytics workspace](ddos-view-diagnostic-logs.md)
diff --git a/articles/ddos-protection/fundamental-best-practices.md b/articles/ddos-protection/fundamental-best-practices.md
@@ -47,4 +47,4 @@ We often see customers' on-premises resources getting attacked along with their
 
 ## Next steps
 
-- Learn how to [create an Azure DDoS protection plan](manage-ddos-protection.md).
+* Learn more about [business continuity](ddos-disaster-recovery-guidance.md).
diff --git a/articles/ddos-protection/manage-permissions.md b/articles/ddos-protection/manage-permissions.md
@@ -44,7 +44,4 @@ For customers who have various subscriptions, and who want to ensure a single pl
 
 ## Next steps
 
-To learn how to view and configure telemetry for your DDoS protection plan, continue to the tutorials.
-
-> [!div class="nextstepaction"]
-> [View and configure DDoS protection telemetry](telemetry.md)
+* [View and configure DDoS protection telemetry](telemetry.md)
diff --git a/articles/ddos-protection/types-of-attacks.md b/articles/ddos-protection/types-of-attacks.md
@@ -24,4 +24,4 @@ Azure DDoS Protection protects resources in a virtual network including public I
 
 ## Next steps
 
-- Learn how to [create a DDoS protection plan](manage-ddos-protection.md).
+* [Components of a DDoS response strategy](ddos-response-strategy.md).
diff --git a/articles/purview/catalog-private-link-faqs.md b/articles/purview/catalog-private-link-faqs.md
@@ -6,7 +6,7 @@ ms.author: zeinam
 ms.service: purview
 ms.subservice: purview-data-catalog
 ms.topic: how-to
-ms.date: 12/09/2022
+ms.date: 03/13/2023
 # Customer intent: As a Microsoft Purview admin, I want to set up private endpoints and managed vnets for my Microsoft Purview account for secure access or ingestion.
 ---
 # FAQ about Microsoft Purview private endpoints and Managed VNets
@@ -78,11 +78,11 @@ In this case, to open the Microsoft Purview governance portal, either use a mach
 
 ### Is it possible to restrict access to the Microsoft Purview managed storage account and event hub namespace (for private endpoint ingestion only) but keep portal access enabled for users across the web?
 
-No. When you set **Public network access** to **Deny**, access to the Microsoft Purview managed storage account and event hub namespace is automatically set for private endpoint ingestion only. When you set **Public network access** to **Allow**, access to the Microsoft Purview managed storage account and event hub namespace is automatically set for **All Networks**. You can't modify the private endpoint ingestion manually for the managed storage account or event hub namespace manually.
+Yes. You can configure Microsoft Purview firewall setting to Disabled for ingestion only (Preview). By choosing this option, public network access to your Microsoft Purview account through API and Microsoft Purview governance portal is allowed, however public network access is set to disabled on your Microsoft Purview account's Managed storage account and event hub.
 
-### If public network access is set to Allow, does it mean the managed storage account and event hub namespace can be publicly accessible?
+### If public network access is set to Allow, does it mean the managed storage account and event hub namespace are accessible by anyone?
 
-No. As protected resources, access to the Microsoft Purview managed storage account and event hub namespace is restricted to Microsoft Purview only. These resources are deployed with a deny assignment to all principals, which prevents any applications, users, or groups from gaining access to them.
+No. As protected resources, access to the Microsoft Purview managed storage account and event hub namespace is restricted to Microsoft Purview only using RBAC authenitcation schemes. These resources are deployed with a deny assignment to all principals, which prevents any applications, users, or groups from gaining access to them.
 
 To read more about Azure deny assignment, see [Understand Azure deny assignments](../role-based-access-control/deny-assignments.md).
 
diff --git a/articles/purview/frequently-asked-questions.yml b/articles/purview/frequently-asked-questions.yml
@@ -106,7 +106,7 @@ sections:
       - question: |
           Can Microsoft Purview (formerly Azure Purview) scan and classify emails, PDFs etc. in my SharePoint and OneDrive?
         answer: |
-          Currently, Microsoft Purview (formerly Azure Purview) doesn't support scanning SharePoint and OneDrive. Scanning for on-premises SharePoint sites and libraries is provided through the Azure Information Protection scanner. The scanner is available for use  through a customer's Microsoft 365 subscription with the following SKUs: AIP P1, EMS E3, and Microsoft 365 E3. If you have any one of these SKUs, you should have the right entitlements to start using the Azure Information Protection scanner.
+          Scanning for on-premises SharePoint sites and libraries is provided through the Azure Information Protection scanner. The scanner is available for use  through a customer's Microsoft 365 subscription with the following SKUs: AIP P1, EMS E3, and Microsoft 365 E3. If you have any one of these SKUs, you should have the right entitlements to start using the Azure Information Protection scanner. Currently, Microsoft Purview (formerly Azure Purview) doesn't support scanning SharePoint and OneDrive into the Microsoft Purview Data Catalog. 
           
       - question: |
           What is the compute used for the scan?
diff --git a/articles/synapse-analytics/spark/runtime-for-apache-spark-lifecycle-and-supportability.md b/articles/synapse-analytics/spark/runtime-for-apache-spark-lifecycle-and-supportability.md
diff --git a/articles/virtual-network/virtual-network-disaster-recovery-guidance.md b/articles/virtual-network/virtual-network-disaster-recovery-guidance.md
diff --git a/includes/virtual-wan-ipsec-include.md b/includes/virtual-wan-ipsec-include.md

Original file line number	Diff line number	Diff line change
`@@ -43,4 +43,4 @@ To create a virtual network, see [Create a virtual network](../virtual-network/m`
`43`	`43`
`44`	`44`	`## Next steps`
`45`	`45`
`46`		`-- Learn how to [create a DDoS protection plan](manage-ddos-protection.md).`
	`46`	`+- Learn how to [configure diagnostic logging](diagnostic-logging.md).`
Original file line number	Diff line number	Diff line change
`@@ -80,4 +80,4 @@ Learn how your services will respond to an attack by [testing through simulation`
`80`	`80`
`81`	`81`	`## Next steps`
`82`	`82`
`83`		`-- Learn how to [create an Azure DDoS Protection plan](manage-ddos-protection.md).`
	`83`	`+- Learn more about [reference architectures](ddos-protection-reference-architectures.md).`