Merge pull request #252120 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)

Author: Taojunshen

articles/ai-services/openai/concepts/use-your-data.md

@@ -98,6 +98,7 @@ To add a new data source to your Azure OpenAI resource, you need the following A
 |---------|---------|
 |[Cognitive Services Contributor](../how-to/role-based-access-control.md#cognitive-services-contributor) | You want to use Azure OpenAI on your data. |
 |[Search Index Data Contributor](/azure/role-based-access-control/built-in-roles#search-index-data-contributor)     | You have an existing Azure Cognitive Search index that you want to use, instead of creating a new one.        |
+|[Search Service Contributor](/azure/role-based-access-control/built-in-roles#search-service-contributor)     | You plan to create a new Azure Cognitive Search index.        |
 |[Storage Blob Data Contributor](/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor)     | You have an existing Blob storage container that you want to use, instead of creating a new one.        |
 
 ## Document-level access control

articles/aks/auto-upgrade-node-image.md

@@ -109,7 +109,11 @@ For more information on Planned Maintenance, see [Use Planned Maintenance to sch
 
 * How can I check the current nodeOsUpgradeChannel value on a cluster?
 
-Run the `az aks show` command and check the "autoUpgradeProfile" to determine what value the `nodeOsUpgradeChannel` is set to. 
+Run the `az aks show` command and check the "autoUpgradeProfile" to determine what value the `nodeOsUpgradeChannel` is set to:
+
+```azurecli-interactive
+az aks show --resource-group myResourceGroup --name myAKSCluster --query "autoUpgradeProfile"
+```
 
 * How can I monitor the status of node OS auto-upgrades?
 

articles/aks/ingress-basic.md

@@ -77,7 +77,7 @@ SOURCE_REGISTRY=registry.k8s.io
 CONTROLLER_IMAGE=ingress-nginx/controller
 CONTROLLER_TAG=v1.8.1
 PATCH_IMAGE=ingress-nginx/kube-webhook-certgen
-PATCH_TAG=v2023040
+PATCH_TAG=v20230407
 DEFAULTBACKEND_IMAGE=defaultbackend-amd64
 DEFAULTBACKEND_TAG=1.5
 

articles/aks/open-ai-quickstart.md

@@ -297,7 +297,7 @@ Now that the application is deployed, you can deploy the Python-based microservi
                 memory: 46Mi
               limits:
                 cpu: 30m
-                memory: 50Mi
+                memory: 65Mi
     ---
     apiVersion: v1
     kind: Service

articles/automation/troubleshoot/managed-identity.md

@@ -108,7 +108,7 @@ CategoryInfo : CloseError: (:) [Connect-AzureRmAccount], HttpRequestException +
 The most common cause for this is that you didn't enable the identity before trying to use it. To verify this, run the following PowerShell runbook in the affected Automation account.
 
 ```powershell
-resource= "?resource=https://management.azure.com/"
+$resource= "?resource=https://management.azure.com/"
 $url = $env:IDENTITY_ENDPOINT + $resource
 $Headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
 $Headers.Add("X-IDENTITY-HEADER", $env:IDENTITY_HEADER)
@@ -143,4 +143,4 @@ If this article doesn't resolve your issue, try one of the following channels fo
 
 * Get answers from Azure experts through [Azure Forums](https://azure.microsoft.com/support/forums/).
 * Connect with [@AzureSupport](https://twitter.com/azuresupport). This is the official Microsoft Azure account for connecting the Azure community to the right resources: answers, support, and experts.
-* File an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/), and select **Get Support**.
+* File an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/), and select **Get Support**.

articles/governance/policy/concepts/remediation-structure.md

@@ -66,9 +66,9 @@ resource hierarchy or individual resource to remediate.
 
 ## Policy definition ID
 
-If the `policyAssignmentId` is for an initiative assignment, the **policyDefinitionReferenceId** property must be used to specify which policy definition(s) in the initiative the subject resource(s) are to be remediated. As a remediation can only remediation in a scope of one definition,
-this property is a _string_. The value must match the value in the initiative definition in the
-`policyDefinitions.policyDefinitionReferenceId` field.
+If the `policyAssignmentId` is for an initiative assignment, the **policyDefinitionReferenceId** property must be used to specify which policy definition in the initiative the subject resource(s) are to be remediated. As a remediation can only remediate in a scope of one definition,
+this property is a _string_ and not an array. The value must match the value in the initiative definition in the
+`policyDefinitions.policyDefinitionReferenceId` field instead of the global identifier for policy definition `Id`.
 
 ## Resource count and parallel deployments
 

articles/iot-hub-device-update/device-update-ubuntu-agent.md

@@ -83,7 +83,7 @@ For convenience, this tutorial uses a [cloud-init](../virtual-machines/linux/usi
 1. Open the configuration details (See how to [set up configuration file here](device-update-configuration-file.md) with the command below. Set your connectionType as 'AIS' and connectionData as empty string. Please note that all values with the 'Place value here' tag must be set. See [Configuring a DU agent](./device-update-configuration-file.md#example-du-configjson-file-contents).
 
    ```bash
-   sudo /etc/adu/du-config.json
+   sudo nano /etc/adu/du-config.json
    ```
 
 1. Restart the Device Update agent.

articles/sentinel/data-transformation.md

@@ -105,13 +105,13 @@ Only the following tables are currently supported for custom log ingestion:
 - [**ASimNetworkSessionLogs**](/azure/azure-monitor/reference/tables/asimnetworksessionlogs)
 - [**ASimWebSessionLogs**](/azure/azure-monitor/reference/tables/asimwebsessionlogs)
 
-## Known issues
+## Limitations
 
 Ingestion-time data transformation currently has the following known issues for Microsoft Sentinel data connectors:
 
 - Data transformations using *workspace transformation DCRs* are supported only per table, and not per connector.
 
-    There can only be one workspace transformation DCR for an entire workspace. Within that DCR, each table can use a separate input stream with its own transformation. However, if you have two different MMA-based data connectors sending data to the *Syslog* table, they will both have to use the same input stream configuration in the DCR.
+    There can only be one workspace transformation DCR for an entire workspace. Within that DCR, each table can use a separate input stream with its own transformation. However, if you have two different MMA-based data connectors sending data to the *Syslog* table, they will both have to use the same input stream configuration in the DCR. Splitting data to multiple destinations (Log Analytics workspaces) with a workspace transformation DCR is not possible.
 
 - The following configurations are supported only via API:
 
@@ -123,6 +123,8 @@ Ingestion-time data transformation currently has the following known issues for
 
 - KQL syntax: Not all operators are supported. For more information, see [**KQL limitations** and **Supported KQL features**](../azure-monitor/essentials/data-collection-transformations-structure.md#kql-limitations) in the Azure Monitor documentation.
 
+- You can only send logs from one specific data source to one workspace. To send data from a single data source to multiple workspaces (destinations) with a standard DCR, please create one DCR per workspace. 
+
 ## Next steps
 
 [Get started configuring ingestion-time data transformation in Microsoft Sentinel](configure-data-transformation.md).

articles/virtual-machines/extensions/features-windows.md

@@ -55,7 +55,7 @@ Extension packages are downloaded from the Azure Storage extension repository. E
 If you use a [supported version of the Azure VM Agent](/troubleshoot/azure/virtual-machines/support-extensions-agent-version), you don't need to allow access to Azure Storage in the VM region. You can use the VM Agent to redirect the communication to the Azure fabric controller for agent communications (via the `HostGAPlugin` feature through the privileged channel on private IP address [168.63.129.16](/azure/virtual-network/what-is-ip-address-168-63-129-16)). If you're on an unsupported version of the VM Agent, you need to allow outbound access to Azure Storage in that region from the VM.
 
 > [!IMPORTANT]
-> If you block access to IP address 168.63.129.16 by using the guest firewall or via a proxy, extensions fail. Failure occurs even if you use a supported version of the VM Agent or you configure outbound access. Ports 80, 443, and 32526 are required.
+> If you block access to IP address 168.63.129.16 by using the guest firewall or via a proxy, extensions fail. Failure occurs even if you use a supported version of the VM Agent or you configure outbound access. Ports 80 and 32526 are required.
 
 Agents can only be used to download extension packages and report status. For example, if an extension installation needs to download a script from GitHub (Custom Script Extension) or requires access to Azure Storage (Azure Backup), then you need to open other firewall or network security group (NSG) ports. Different extensions have different requirements because they're applications in their own right. For extensions that require access to Azure Storage or Azure Active Directory, you can allow access by using Azure NSG [service tags](/azure/virtual-network/network-security-groups-overview#service-tags).