Merge pull request #3600 from MicrosoftDocs/main638799876282295718sync_temp

For protected branch, push strategy should use PR and merge to target branch method to work around git push error

Author: learn-build-service-prod[bot]

azure-local/deploy/deployment-azure-arc-gateway-overview.md

@@ -3,7 +3,7 @@ title: Overview of Azure Arc gateway for Azure Local, version 23H2 (preview)
 description: Learn what is Azure Arc gateway for Azure Local, version 23H2 (preview). 
 author: alkohli
 ms.topic: how-to
-ms.date: 02/20/2025
+ms.date: 04/10/2025
 ms.author: alkohli
 ms.service: azure-local
 ---
@@ -12,15 +12,13 @@ ms.service: azure-local
 
 ::: moniker range=">=azloc-24111"
 
-> Applies to: Azure Local 2411.1 and later
+> Applies to: Azure Local version 2411.1 and later
 
 [!INCLUDE [azure-local-banner-23h2](../includes/azure-local-banner-23h2.md)]
 
 This article provides an overview of the Azure Arc gateway for Azure Local. The Arc gateway can be enabled on new deployments of Azure Local running software version 2408 and later. This article also describes how to create and delete the Arc gateway resource in Azure.
 
-You can use the Arc gateway to significantly reduce the number of required endpoints needed to deploy and manage Azure Local instances. Once you create the Arc gateway, you can connect to and use it for new deployments of Azure Local.
-
-For information on how to deploy the Azure Arc gateway for standalone servers (not Azure Local machines), see [Simplify network configuration requirements through Azure Arc gateway](/azure/azure-arc/servers/arc-gateway).
+You can use the Arc gateway to significantly reduce the number of required endpoints needed to deploy and manage Azure Local instances. When you create the Arc gateway, you can connect to and use it for new deployments of Azure Local.
 
 [!INCLUDE [important](../includes/hci-preview.md)]
 
@@ -32,7 +30,7 @@ The Arc gateway works by introducing the following components:
 
 - **Arc proxy** – A new component that is added to the Arc Agentry. This component runs as a service (Called  the **Azure Arc Proxy**) and works as a forward proxy for the Azure Arc agents and extensions. The gateway router doesn't need any configuration from your side. This router is part of the Arc core agentry and runs within the context of an Arc-enabled resource.
 
-Once you integrate the Arc gateway with release 2411 of Azure Local deployments, each machine gets Arc proxy along with other Arc Agents.
+When you integrate the Arc gateway with version 2411 of Azure Local deployments, each machine gets Arc proxy along with other Arc Agents.
 
 When Arc gateway is used, the *http* and *https* traffic flow changes as follows:
 
@@ -52,11 +50,11 @@ When Arc gateway is used, the *http* and *https* traffic flow changes as follows
 
 1. With the proxy settings in place, ARB, and AKS outbound traffic is forwarded to Arc Proxy running on one of the Azure Local machines over the routable IP.
 
-1. Once the traffic reaches Arc proxy, the remaining flow takes the same path as described. If traffic to the target service is allowed, it is sent to Arc gateway. If not, it is sent to the enterprise proxy (or direct outbound if no proxy set). Note that for AKS specifically, this path is used for downloading docker images for Arc Agentry and Arc Extension Pods.
+1. Once the traffic reaches Arc proxy, the remaining flow takes the same path as described. If traffic to the target service is allowed, it is sent to Arc gateway. If not, it is sent to the enterprise proxy (or direct outbound if no proxy set). For AKS specifically, this path is used for downloading docker images for Arc Agentry and Arc Extension Pods.
 
-**Traffic flow for Arc VMs**
+**Traffic flow for Azure Local VMs**
 
-*Http* and *https* traffic are forwarded to the enterprise proxy. Arc proxy inside the Arc VM is not yet supported in this version.
+*Http* and *https* traffic are forwarded to the enterprise proxy. Arc proxy inside an Azure Local VM enabled by Arc is not yet supported in this version.
 
 Traffic flows are illustrated in the following diagram:
 
@@ -83,12 +81,11 @@ The list of supported endpoints by the Arc gateway in Azure Local will increase
 You can use the Arc gateway in the following scenario for Azure Local versions 2411.1 or later:
 
 - Enable Arc gateway during deployment of new Azure Local instances running versions 2411.1 or later.
+- The Arc gateway resource must be created on the same subscription where you are planning to deploy your Azure Local instance.
 
-Unsupported scenarios for Azure Local, versions 2408, 2411 and 2411.1 include:
-
-- Azure Local instances updated from versions 2402 or 2405 to versions 2408 or 2411 can't take advantage of all the new endpoints supported by this Arc gateway preview. Host components, Arc extensions, ARB, and AKS required endpoints are only supported when enabling the Arc gateway as part of a new version 2408 deployment.
+Unsupported scenarios for Azure Local include:
 
-- Enabling Arc gateway after deployment cannot take advantage of all the new endpoints supported by this Arc gateway preview. Host, Arc extensions, ARB, and AKS required endpoints are only supported when enabling the Arc gateway as part of a new deployment.
+- Enabling Arc gateway after deployment is not supported.
 
 ## Azure Local endpoints not redirected
 
@@ -139,15 +136,15 @@ You can create an Arc gateway resource using the Azure portal, Azure CLI, or Azu
 
 1. Sign in to [Azure portal](https://ms.portal.azure.com/).
 1. Go to the **Azure Arc > Azure Arc gateway** page, then select **Create**.
-1. Select the subscription and resource group where you want the Arc gateway resource to be managed within Azure. An Arc gateway resource can be used by any Arc-enabled resource in the same Azure tenant.
+1. Select the subscription where you are planning to deploy your Azure Local instance.
 1. For **Name**, enter the name for the Arc gateway resource.
-1. For **Location**, enter the region where the Arc gateway resource should live. An Arc gateway resource can be used by any Arc-enabled resource in the same Azure tenant.
+1. For **Location**, enter the region where the Arc gateway resource should live. An Arc gateway resource is used by any Arc-enabled resource in the same Azure tenant.
 1. Select **Next**.
 1. On the **Tags** page, specify one or more custom tags to support your standards.
 1. Select **Review & Create**.
 1. Review your details, and then select **Create**.
 
-The gateway creation process takes nine to ten minutes to complete.
+The gateway creation process takes nine to 10 minutes to complete.
 
 
 # [CLI](#tab/cli)
@@ -184,10 +181,10 @@ The gateway creation process takes 9-10 minutes to complete.
 
 ## Detach or change the Arc gateway association from the machine
 
-To detach the gateway resource from your Arc-enabled server, set the gateway resource ID to `null`. If you want to attach your Arc-enabled server to another Arc gateway resource just update the name and resource ID with the new Arc gateway information:
+To detach the gateway resource from your Arc-enabled server, set the gateway resource ID to `null`. To attach your Arc-enabled server to another Arc gateway resource just update the name and resource ID with the new Arc gateway information:
 
 ```azurecli
-az arcgateway settings update --resource-group <Resource Group> --subscription <subscription name> --base-provider Microsoft.HybridCompute --base-resource-type machines --base-resource-name <Arc-Server's name> --gateway-resource-id "
+az arcgateway settings update --resource-group <Resource Group> --subscription <subscription name> --base-provider Microsoft.HybridCompute --base-resource-type machines --base-resource-name <Arc-enabled server name> --gateway-resource-id "
 ```
 
 ## Delete the Arc gateway resource
@@ -212,6 +209,6 @@ This operation can take a couple of minutes.
 
 ::: moniker range="<=azloc-24111"
 
-This feature is available only in Azure Local 2411.1 or later.
+This feature is available only in Azure Local version 2411.1 or later.
 
 ::: moniker-end

azure-local/manage/azure-arc-vm-management-overview.md

@@ -41,12 +41,23 @@ Although Hyper-V provides capabilities to manage your on-premises VMs, Azure Loc
 Consider the following limitations when you're managing VMs on Azure Local:
 
 - Taking checkpoints on VMs running on Azure Local by using on-premises tools, such as Windows Admin Center or Hyper-V Manager, will adversely affect the management of these VMs from Azure.
+
 - Updates to VM configurations, such as vCPU, memory, network interface, or data disk via on-premises tools, won't be reflected on the Azure management plane.
+
 - Moving a resource group isn't supported for VMs on Azure Local and its associated resources (such as network interfaces and disks).
+
 - Creation of VMs by using Windows Server 2012 and Windows Server 2012 R2 images isn't supported via the Azure portal. You can do it only via the Azure CLI. For more information, see [Additional parameters for Windows Server 2012 and Windows Server 2012 R2 images](./create-arc-virtual-machines.md#additional-parameters-for-windows-server-2012-and-windows-server-2012-r2-images).
 
 - Azure Local VMs only support IPv4 addresses. IPv6 addresses aren't supported.
 
+- Once a logical network is created, you can't update the following:
+  - DNS server
+  - Default gateway
+  - IP pools
+  - IP address space
+  - VLAN ID
+  - Virtual switch name
+
 ## Components of Azure Local VM management
 
 Azure Local VM management has several components, including:

azure-local/manage/azure-site-recovery.md

@@ -4,7 +4,7 @@ description: Use Azure Site Recovery to protect Hyper-V VM workloads running on
 ms.topic: article
 author: alkohli
 ms.author: alkohli
-ms.date: 03/21/2024
+ms.date: 04/11/2025
 ---
 <!-- This article is used by the Windows Server Docs, all links must be site relative (except include files). For example, /azure-stack/hci/manage/azure-site-recovery -->
 
@@ -108,7 +108,7 @@ On your Azure Local target system, follow these steps to prepare infrastructure:
     1. Accept the defaults for other settings.
 
         > [!IMPORTANT]
-        > You will need owner permissions on the Recovery services vault to assign permissions to the managed identity. You will need read/write permission on the Azure Local resource and its child resources.
+        > You'll need owner permissions on the Recovery services vault to assign permissions to the managed identity. You'll need read/write permission on the Azure Local resource and its child resources.
 
         Select **Review + Create** to start the vault creation. For more information, see [Create and configure a Recovery services vault](/azure/backup/backup-create-recovery-services-vault).
 
@@ -147,7 +147,7 @@ After the infrastructure preparation is complete, follow these steps to select t
     1. For **Subscription**, enter or select the subscription.
     1. For **Post-failover resource group**, select the resource group name to which you fail over. When the failover occurs, the VMs in Azure are created in this resource group.
     1. For **Post-failover deployment model**, select **Resource Manager**. The Azure Resource Manager deployment is used when the failover occurs.
-    1. For **Storage account**, enter or select an existing storage account associated with the subscription that you have chosen. This account could be a standard or a premium storage account that is used for the VM’s replication.
+    1. For **Storage**, select the type of Azure storage you are replicating to. We recommend using managed disk.
 
         :::image type="content" source="media/azure-site-recovery/enable-replication-2.png" alt-text="Screenshot of target environment tab in Azure portal for Azure Local resource." lightbox="media/azure-site-recovery/enable-replication-2.png":::
 
@@ -164,7 +164,7 @@ After the infrastructure preparation is complete, follow these steps to select t
 
     :::image type="content" source="media/azure-site-recovery/enable-replication-4.png" alt-text="Screenshot of virtual selection tab in Azure portal for Azure Local resource." lightbox="media/azure-site-recovery/enable-replication-4.png":::
 
-1. On the **Replication settings** tab, select the operating system type, operating system disk and the data disks for the VM you intend to replicate to Azure, and then select **Next**.
+1. On the **Replication settings** tab, select the operating system type, operating system disk, and the data disks for the VM you intend to replicate to Azure, and then select **Next**.
 
     :::image type="content" source="media/azure-site-recovery/enable-replication-5.png" alt-text="Screenshot of Replication settings tab in Azure portal for Azure Local resource." lightbox="media/azure-site-recovery/enable-replication-5.png":::
 
@@ -243,8 +243,8 @@ Here's a list of known issues and the associated workarounds in this release:
 |----|----------------------|---------------------------|
 | 1. | When you register Azure Site Recovery with a system, a machine fails to install Azure Site Recovery or register to the Azure Site Recovery service.  | In this instance, your VMs may not be protected. Verify that all machines in the system are registered in the Azure portal by going to the **Recovery Services vault** \> **Jobs** \> **Site Recovery Jobs**. |
 | 2. | Azure Site Recovery agent fails to install. No error details are seen at the system or machine levels in the Azure Local portal. | When the Azure Site Recovery agent installation fails, it is because of the one of the following reasons:  <br><br> - Installation fails as Hyper-V isn't set up on the host. </br><br> - The Hyper-V host is already associated to a Hyper-V site and you're trying to install the extension with a different Hyper-V site. </br>  |
-| 3. | Azure Site Recovery agent fails to install. Error message of "Microsoft Azure Site Recovery Provider installation has failed with exit code - 1." appears in the portal with the failed installation. | The installation fails when WDAC is enforced. <br><br> - Setting WDAC to "Audit" mode will allow the installation to complete.  To set the WDAC mode to be Audit, you can follow the instructions in [Manage WDAC settings with PowerShell](/azure-stack/hci/manage/manage-wdac#manage-wdac-settings-with-powershell) |
-| 4. | Failback of an Arc VM to an alternate cluster fails. | Failback of an Arc VM to an alternate cluster is not supported |
+| 3. | Azure Site Recovery agent fails to install. Error message of "Microsoft Azure Site Recovery Provider installation has failed with exit code - 1." appears in the portal with the failed installation. | The installation fails when WDAC is enforced. <br><br> - Setting WDAC to "Audit" mode allows the installation to complete. To set the WDAC mode to be Audit, you can follow the instructions in [Manage WDAC settings with PowerShell](/azure-stack/hci/manage/manage-wdac#manage-wdac-settings-with-powershell) |
+| 4. | Failback of an Arc VM to an alternate cluster fails. | Failback of an Arc VM to an alternate cluster isn't supported |
 
 ## Next steps
 

azure-local/manage/create-logical-networks.md

@@ -75,6 +75,16 @@ The prerequisites for the Azure portal are the same as those for the Azure CLI.
 
 You can create a logical network using either the Azure Command-Line Interface (CLI) or by using the Azure portal.
 
+> [!NOTE]
+> Once a logical network is created, you can't update the following:
+>
+> - DNS server
+> - Default gateway
+> - IP pools
+> - IP address space
+> - VLAN ID
+> - Virtual switch name
+
 # [Azure CLI](#tab/azurecli)
 
 Complete the following steps to create a logical network using Azure CLI.

azure-local/plan/configure-custom-settings-active-directory.md

@@ -51,7 +51,9 @@ Here's a table that contains the permissions required for the deployment user an
 You can use PowerShell cmdlets to assign appropriate permissions to deployment user over OU. The following example shows how you can assign the required permissions to a *deploymentuser* over the OU *HCI001* that resides in the Active Directory domain *contoso.com*.
 
 > [!NOTE]
-> The script requires you to precreate user object [New-ADUser](/powershell/module/activedirectory/new-aduser?view=windowsserver2022-ps&preserve-view=true) and [OU](/powershell/module/activedirectory/new-adorganizationalunit?view=windowsserver2022-ps&preserve-view=true) in your Active Directory. For more information on how to block group policy inheritance, see [Set-GPInheritance](/powershell/module/grouppolicy/set-gpinheritance?view=windowsserver2022-ps&preserve-view=true).
+> The script requires you to precreate user object [New-ADUser](/powershell/module/activedirectory/new-aduser?view=windowsserver2022-ps&preserve-view=true) and [OU](/powershell/module/activedirectory/new-adorganizationalunit?view=windowsserver2022-ps&preserve-view=true) in your Active Directory. **The msFVE-RecoveryInformation must be set via PowerShell. Using the Active Directory delegation wizard is not applicable for that scenario.**
+>
+> For more information on how to block group policy inheritance, see [Set-GPInheritance](/powershell/module/grouppolicy/set-gpinheritance?view=windowsserver2022-ps&preserve-view=true).
 
 Run the following PowerShell cmdlets to import the Active Directory module and assign required permissions:
 

azure-local/whats-new.md

@@ -24,23 +24,27 @@ This is a baseline release with the following features and improvements:
 - **Registration and deployment changes**
   - **Extension installation**: Extensions are no longer installed during the registration of Azure Local machines. Instead, the extensions are installed in the machine validation step during the Azure Local instance deployment. For more information, see [Register with Arc via console](./deploy/deployment-arc-register-server-permissions.md) and [Deploy via Azure portal](./deploy/deploy-via-portal.md).
   - **Register via app**: You can bootstrap your Azure Local machines using the Configurator app. The local UI is now deprecated. For more information, see [Register Azure Local machines using Configurator app](./deploy/deployment-arc-register-configurator-app.md).
-    - Composed image is now supported for Other Equipment Manufacturers (OEMs).
+    - Composed image is now supported for Original Equipment Manufacturers (OEMs).
     - Several security enhancements were done for the Bootstrap service.
     - Service Principal Name (SPN) is deprecated for Arc registration.
-    - The Arc installer script is simplified to only use `Start-ArcBootstrap` to register Azure Local machines with Arc.
+
   - **Deployment of current version and previous versions**: Starting with this release, you can deploy the current version of Azure Local using the Azure portal. To deploy a previous version, use an Azure Resource Manager template that matches the version you wish to deploy. For more information, see [Deploy via ARM template](./deploy/deployment-azure-resource-manager-template.md).
+
 - **Environment checker related changes**
   - Environment checker is now integrated for connectivity tests.
   - Environment checker validates the composed image used for bootstrap.
   - Environment checker validates PowerShell modules as per the validated solution recipe in the Pre-Update checks.
+
 - **Updates and upgrade improvements**
   - The Solution Builder Extension update now supports both supported and non-supported SKUs for a given model.
   - A tag has been added to indicate whether an update is the latest or has been superseded.
-  - HTTP content will now be downloaded using a more resilient service (Download Service).
-  - OS content will be packaged with the release, rather than determining appliable content on the device at runtime. This change is aimed at minimizing failure points and supporting [sideloading](update/update-via-powershell-23h2.md#step-3-import-and-rediscover-updates).
+  - HTTP content is now downloaded using a more resilient service (Download Service).
+  - OS content is packaged with the release, rather than determining appliable content on the device at runtime. This change is aimed to minimize failure points and support [Importing content](update/update-via-powershell-23h2.md#step-3-import-and-rediscover-updates).
   - OS content will be installed using the CAU plug-ins that are shipped with OS.
   - Azure Local rebranding changes were made for this update.
+
 - **Azure Local VM changes**: You can now connect to an Azure Local VM using the SSH/RDP protocol without the need for line of sight (inside the host network). For more information, see [Connect to an Azure Local VM using SSH](./manage/connect-arc-vm-using-ssh.md).
+
 - **What's new for migration**: Documentation for improvements and features for VM migration to Azure Local is now available. For more information, see [What's new in migration](./migrate/migrate-whats-new.md).