Merge pull request #3341 from MicrosoftDocs/main638633305477019940sync_temp

For protected branch, push strategy should use PR and merge to target branch method to work around git push error

Author: learn-build-service-prod[bot]

.openpublishing.redirection.json

@@ -1,5 +1,10 @@
 {
   "redirections": [
+    {
+      "source_path":"azure-stack/hci/deploy/tutorial-private-forest.md",
+      "redirect_url":"/azure-stack/hci",
+      "redirect_document_id": false
+    },
     {
       "source_path":"azure-stack/hci/manage/bitlocker-on-csv.md",
       "redirect_url":"/azure-stack/hci/manage/manage-bitlocker",

AKS-Hybrid/aks-edge-howto-connect-to-arc.md

@@ -4,21 +4,21 @@ description: Connect your AKS Edge Essentials clusters to Arc
 author: rcheeran
 ms.author: rcheeran
 ms.topic: how-to
-ms.date: 08/21/2024
+ms.date: 09/27/2024
 ms.custom: template-how-to
 ---
 
 # Connect your AKS Edge Essentials cluster to Arc
 
-This article describes how to connect your AKS Edge Essentials cluster to [Azure Arc](/azure/azure-arc/kubernetes/overview) so that you can monitor the health of your cluster on the Azure portal. If your cluster is connected to a proxy, you can use the scripts provided in the GitHub repo to connect your cluster to Arc [as described here.](./aks-edge-howto-more-configs.md)
+This article describes how to connect your AKS Edge Essentials cluster to [Azure Arc](/azure/azure-arc/kubernetes/overview) so that you can monitor the health of your cluster on the Azure portal. If your cluster is connected to a proxy, you can use the scripts provided in the GitHub repo to connect your cluster to Arc [as described here](./aks-edge-howto-more-configs.md).
 
 ## Prerequisites
 
-In addition to these prerequisites, be sure to meet all [network requirements for Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/network-requirements).
-
-- You need an Azure subscription with either the **Owner** role or a combination of **Contributor** and **User Access Administrator** roles. You can check your access level by navigating to your subscription on the Azure portal, selecting **Access control (IAM)** on the left-hand side of the Azure portal, and then selecting **View my access**. See [the Azure documentation](/azure/azure-resource-manager/management/manage-resource-groups-portal) for more information about managing resource groups.
-- Enable all required resource providers in the Azure subscription, such as **Microsoft.HybridCompute**, **Microsoft.GuestConfiguration**, **Microsoft.HybridConnectivity**, **Microsoft.Kubernetes**, **Microsoft.ExtendedLocation**, and **Microsoft.KubernetesConfiguration**.
-- Create and verify a resource group for AKS Edge Essentials Azure resources.
+- Before connecting to Arc, infrastructure administrators who are the owner or contributor role of the subscription will have to:
+  1. Enable all required resource providers in the Azure subscription, such as **Microsoft.HybridCompute**, **Microsoft.GuestConfiguration**, **Microsoft.HybridConnectivity**, **Microsoft.Kubernetes**, **Microsoft.ExtendedLocation**, and **Microsoft.KubernetesConfiguration**.
+  1. Create and verify a resource group for AKS Edge Essentials Azure resources.
+- To connect to Arc, Kubernetes operators need a [**Kubernetes Cluster - Azure Arc Onboarding**](/azure/role-based-access-control/built-in-roles/containers#kubernetes-cluster---azure-arc-onboarding) role for the identity at the resource group level. To disconnect from Arc, operators need an [**Azure Kubernetes Service Arc Contributor Role**](/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-arc-contributor-role) role for the identity at the resource group level. To check your access level, navigate to your subscription on the Azure portal, select **Access control (IAM)** on the left-hand side, and then select **View my access**. See [the Azure documentation](/azure/azure-resource-manager/management/manage-resource-groups-portal) for more information about managing resource groups. Infrastructure administrators with owner or contributor roles can also perform actions to connect or disconnect from Arc.
+- In addition to these prerequisites, make sure you meet all [network requirements for Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/network-requirements).
 
 > [!NOTE]
 > You need the **Contributor** role to be able to delete the resources within the resource group. Commands to disconnect from Arc will fail without this role assignment.
@@ -29,7 +29,7 @@ In addition to these prerequisites, be sure to meet all [network requirements fo
 
 Run the following commands in an elevated PowerShell window to install the dependencies in PowerShell:
 
-```PowerShell
+```powershell
 Install-Module Az.Resources -Repository PSGallery -Force -AllowClobber -ErrorAction Stop  
 Install-Module Az.Accounts -Repository PSGallery -Force -AllowClobber -ErrorAction Stop 
 Install-Module Az.ConnectedKubernetes -Repository PSGallery -Force -AllowClobber -ErrorAction Stop  
@@ -41,21 +41,21 @@ Provide details of your Azure subscription in the [**aksedge-config.json**](http
 
 > [!IMPORTANT]
 > Client secrets are a form of password. Proper management is critical to the security of your environment.
-> * When you create the client secret, set a very short expiration time, based on the registration timing and scope for your deployment.
-> * Be sure to protect the client secret value and the configuration file from general access.
-> * Consider that if a cluster's configuration file is backed up while it has the client secret stored, the client secret is available to anyone with access to the backup.
-> * Once you register a cluster, remove the client secret from the configuration file for that cluster.
-> * Once you register all clusters in scope for your task, you should rotate the client secret and/or delete the service principal from your Microsoft Entra ID environment.
+> - When you create the client secret, set a very short expiration time, based on the registration timing and scope for your deployment.
+> - Be sure to protect the client secret value and the configuration file from general access.
+> - Consider that if a cluster's configuration file is backed up while it has the client secret stored, the client secret is available to anyone with access to the backup.
+> - Once you register a cluster, remove the client secret from the configuration file for that cluster.
+> - Once you register all clusters in scope for your task, you should rotate the client secret and/or delete the service principal from your Microsoft Entra ID environment.
 
 | Attribute | Value type      |  Description |
 | :------------ |:-----------|:--------|
-|`ClusterName` | string | Provide a name for your cluster. The default value is `hostname_cluster`. |
+|`ClusterName` | string | The name of your cluster. The default value is `hostname_cluster`. |
 |`Location` | string | The location of your resource group. Choose the location closest to your deployment. |
 |`SubscriptionId` | GUID | Your subscription ID. In the Azure portal, select the subscription you're using and copy/paste the subscription ID string into the JSON. |
-|`TenantId` | GUID | Your tenant ID. In the Azure portal, search Microsoft Entra ID, which should take you to the **Default Directory** page. From here, you can copy/paste the tenant ID string into the JSON. |
+|`TenantId` | GUID | Your tenant ID. In the Azure portal, search **Microsoft Entra ID**, which should take you to the **Default Directory** page. From here, you can copy/paste the tenant ID string into the JSON. |
 |`ResourceGroupName` | string | The name of the Azure resource group to host your Azure resources for AKS Edge Essentials. You can use an existing resource group, or if you add a new name, the system creates one for you. |
-|`ClientId` | GUID | Provide the application ID of the Azure service principal to use as credentials. AKS Edge Essentials uses this service principal to connect your cluster to Arc. You can use the **App Registrations** page in the Microsoft Entra resource page on the Azure portal, to list and manage the service principals in a tenant. Be aware that the service principal requires the **Kubernetes Cluster - Azure Arc Onboarding** role at either the subscription or resource group level. For more information, see [Microsoft Entra identity requirements for service principals](/azure/azure-arc/kubernetes/system-requirements#microsoft-entra-identity-requirements). |
-|`ClientSecret` | string | Provide the password for the service principal. |
+|`ClientId` | GUID | Provide the application ID of the Azure service principal to use as credentials. AKS Edge Essentials uses this service principal to connect your cluster to Arc. You can use the **App Registrations** page in the Microsoft Entra resource page on the Azure portal to list and manage the service principals in a tenant. Be aware that the service principal requires the **Kubernetes Cluster - Azure Arc Onboarding** role at either the subscription or resource group level. For more information, see [Microsoft Entra identity requirements for service principals](/azure/azure-arc/kubernetes/system-requirements#microsoft-entra-identity-requirements). |
+|`ClientSecret` | string | The password for the service principal. |
 
 > [!NOTE]
 > You only need to perform this configuration once per Azure subscription. You don't need to repeat the procedure for each Kubernetes cluster.
@@ -70,7 +70,7 @@ Connect-AksEdgeArc -JsonConfigFilePath .\aksedge-config.json
 ```
 
 > [!NOTE]
-> This step can take up to 10 minutes and PowerShell may become stuck on **Establishing Azure Connected Kubernetes for `your cluster name`**. PowerShell outputs `True` and returns to the prompt when the process is complete.
+> This step can take up to 10 minutes and PowerShell might become stuck on **Establishing Azure Connected Kubernetes for `your cluster name`**. PowerShell outputs `True` and returns to the prompt when the process is complete.
 
 :::image type="content" source="media/aks-edge/aks-edge-ps-arc-connection.png" alt-text="Screenshot showing PowerShell prompt while connecting to Arc." lightbox="media/aks-edge/aks-edge-ps-arc-connection.png":::
 

azure-local/TOC.yml

@@ -0,0 +1,2 @@
+- name: Index
+  href: index.yml

azure-local/breadcrumb/AzureLocal/toc.yml

@@ -0,0 +1,3 @@
+- name: Azure Local
+  tocHref: /azure-local
+  topicHref: /azure-local/index

azure-local/docfx.json

@@ -38,6 +38,7 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
+      "uhfHeaderId": "Azure",
       "breadcrumb_path": "~/breadcrumb/AzureLocal/toc.yml",
       "feedback_system": "Standard",
       "permissioned-type": "public"

azure-local/index.yml

@@ -0,0 +1,24 @@
+### YamlMime:Landing
+
+title: Azure Local documentation
+summary: Azure Local is a hyperconverged clustering solution that uses validated hardware to run virtualized workloads on-premises, making it easy for customers to consolidate aging infrastructure and connect to Azure for cloud services.
+
+metadata:
+  title: Azure Local documentation
+  description: Azure Local is a hyperconverged clustering solution that uses validated hardware to run virtualized workloads on-premises.
+#  ms.service: service #Required; service per approved list. service slug assigned to your service by ACOM.
+  ms.topic: landing-page
+  author: ronmiab
+  ms.author: robess
+  ms.date: 09/30/2024
+
+# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
+
+landingContent:
+  # Card (optional)
+  - title: About Azure Local
+    linkLists:
+      - linkListType: overview
+        links:
+          - text: What is Azure Local?
+            url: /azure/azure-stack/hci/overview

azure-stack/hci/assurance/azure-stack-fedramp-guidance.md

@@ -0,0 +1,46 @@
+---
+title: FedRAMP guidance for Azure Stack HCI
+description: Learn about FedRAMP compliance using Azure Stack HCI.
+ms.date: 9/23/2024
+ms.topic: conceptual
+ms.service: azure-stack
+ms.subservice: azure-stack-hci
+ms.author: nguyenhung
+author: dv00000
+ms.reviewer: alkohli
+---
+
+# Azure Stack HCI and FedRAMP
+
+This article explains the relationship between Azure Stack HCI and FedRAMP and how organizations can stay compliant with FedRAMP with Azure Stack HCI solutions.
+
+## What is FedRAMP?
+
+The US Federal Risk and Authorization Management Program (FedRAMP) provides a standard approach for assessing, monitoring, and authorizing cloud computing products and services. FedRAMP eases US federal agencies’ ability to adopt secure cloud solutions and facilitates Microsoft and other cloud services providers’ ability to offer services to federal agencies.
+
+For more information about FedRAMP, see [Azure & FedRAMP](/azure/compliance/offerings/offering-fedramp).
+
+## Azure Stack HCI and FedRAMP
+
+Azure Stack HCI is a hybrid infrastructure solution that hosts and operates workloads on the edge; and deploys, manages, and operates at scale with Azure cloud services. Therefore, from the lens of compliance obligations, we can segment Azure Stack HCI integrated systems into two categories: cloud services and on-premises systems.
+
+### On-premises solutions
+
+As FedRAMP is designed for cloud service offerings (CSOs), the hardware device and operating system of Azure Stack HCI is not applicable for FedRAMP. Customers are responsible for the authorization package that covers the physical devices. Other standards, such as  [Federal Information Processing Standard (FIPS) 140](/azure-stack/hci/assurance/azure-stack-security-standards#federal-information-processing-standard-fips-140) and [Common Criteria (CC)](/azure-stack/hci/assurance/azure-stack-security-standards#common-criteria-for-information-technology-security-evaluation-cc), are applicable to on-premises which may be useful for your accreditation processes.
+
+### Connected cloud services
+
+For cloud services that support Azure Stack HCI infrastructure and workloads on site, Azure has a rich portfolio of FedRAMP accreditation which you can utilize to support your compliance journey. Below are some commonly used cloud services for deploying, operating, and managing Azure Stack HCI which are in scope for the Azure FedRAMP High P-ATO.
+
+- Azure Arc-enabled Kubernetes
+- Azure Arc-enabled servers
+- Azure Backup
+- Azure Key Vault
+- Azure Monitor
+- Azure Policy
+- Azure Site Recovery
+- Azure Resource Manager
+- Azure Virtual Desktop
+- Microsoft Entra ID
+
+To learn more about other services in scope, refer to [Azure and other Microsoft cloud services compliance scope](/azure/azure-government/compliance/azure-services-in-fedramp-auditscope).