text:
Document Summarization Quickstart : Errors encountered

Issue Transfer
This issue has been transferred from the Azure SDK for .NET repository, #33886.
Please be aware that @yuvrajharsha is the author of the original issue and include them for any questions or replies.
Details

Package Name:
Package Version:
Operating System:
.NET runtime version:

[Enter feedback here]
Hello,
I installed VS 17.4.4 for mac and as per instructions, given in the following link for 'Document Summarization', I ran the given C# code but encountered following 8 errors
https://learn.microsoft.com/en-us/azure/cognitive-services/language-service/summarization/quickstart?tabs=document-summarization&pivots=programming-language-csharp
/Program.cs(17,17): Error CS0117: 'TextAnalyticsActions' does not contain a definition for 'ExtractSummaryActions' (CS0117) (Summarisation)
/Program.cs(50,50): Error CS0246: The type or namespace name 'ExtractSummaryAction' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
/Program.cs(80,80): Error CS0246: The type or namespace name 'ExtractSummaryAction' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
/Program.cs(37,37): Error CS0246: The type or namespace name 'ExtractSummaryActionResult' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
/Program.cs(98,98): Error CS1061: 'AnalyzeActionsResult' does not contain a definition for 'ExtractSummaryResults' and no accessible extension method 'ExtractSummaryResults' accepting a first argument of type 'AnalyzeActionsResult' could be found (are you missing a using directive or an assembly reference?) (CS1061) (Summarisation)
/Program.cs(26,26): Error CS0246: The type or namespace name 'ExtractSummaryActionResult' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
/Program.cs(30,30): Error CS0246: The type or namespace name 'ExtractSummaryResult' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
/Program.cs(34,34): Error CS0246: The type or namespace name 'SummarySentence' could not be found (are you missing a using directive or an assembly reference?) (CS0246) (Summarisation)
Could you please help me run the example code for Document Summarization. Looking forward to your support. Thank you.
Best regards,
Yuvraj Harsha

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: acf1d359-23da-2f07-af0d-d16284f738ba
Version Independent ID: eba6f1fd-cfe9-d038-b139-f02c0b48f4e0
Content: Quickstart: Use Document Summarization (preview) - Azure Cognitive Services
Content Source: articles/cognitive-services/language-service/summarization/quickstart.md
Service: cognitive-services
Sub-service: language-service
GitHub Login: @jboback
Microsoft Alias: aahi

@jsquire
Thanks for your feedback! We will investigate and update as appropriate.

#assign: jboback

@jsquire
I've delegated this to content author @jboback, who will review it and offer their insightful opinions.

Hi @jsquire, thanks for forwarding the feedback from Yuvraj. I've created a work item and will check in with the team about the issue to see if we can improve the docs.

#please-close

authors: AjayBathini-MSFT Naveenommi-MSFT aahill jboback jsquire


text:
Suppose incorrect contents.

[Enter feedback here]
cx has raised a questions regarding the MDFC documentation https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-cloud
In the list, we have the support matrix on blob storage, data lake storage & storage accounts.

The question is, we miss Azure File Storage but instead "Storage accounts". Shall we confirm if that is what we expect to put in the doc or any typo? Thanks~

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 92c4c36f-cc36-8503-584d-ad81c68e060f
Version Independent ID: 1243a726-c7be-68ed-20b0-bd339df3ae21
Content: Microsoft Defender for Cloud interoperability with Azure services, Azure clouds, and client operating systems
Content Source: articles/defender-for-cloud/support-matrix-defender-for-cloud.md
Service: defender-for-cloud
GitHub Login: @bmansheim
Microsoft Alias: benmansheim

@Simonciao
Thanks for your feedback! We will investigate and update as appropriate.

Thanks @YashikaTyagii ,
Would be much appreciated if you could help with this and get the doubt clarified.

Hi @Simonciao
Thank you for bringing this to our attention. The support matrix includes Blob Storage, Data Lake Storage, and Storage Accounts, but not Azure File Storage. Therefore, it seems that the document you shared is correct and there is no typo.

Dear @Naveenommi-MSFT ,
Thanks!
If you could view the screenshot below, the support matrix should include Blob storage, Data Lake Storage and Azure files.
Storage accounts should be an overview which covers Blob storage, Azure Files, etc.

Would you please double confirm and let me know where we get the support matrix?

@Simonciao
Thank you for bringing this to our attention.
I've delegated this to content author @bmansheim, who will review it and offer their insightful opinions.

Thanks @Naveenommi-MSFT and @bmansheim ,
Would be expecting some further update on this!

Fixed in https://github.com/MicrosoftDocs/azure-docs-pr/pull/234607

#please-close

source: gharchive/issue

authors: Naveenommi-MSFT Simonciao YashikaTyagii bmansheim

repo: MicrosoftDocs/azure-docs

license_type: permissive

license_source: github-api


text:
TableOutput for Isolated Process does not work, please add a warning (or remove the section)

[Enter feedback here]
The TableOutput for Isolated Process does not work, please add a warning (or remove the section) to prevent people from wasting time.
There is a long track for this issue that started months ago, and evolved into other issues, still not resolved though:
https://github.com/Azure/azure-functions-dotnet-worker/issues/1305
https://github.com/Azure/azure-sdk-for-net/issues/33902
https://github.com/Azure/azure-functions-dotnet-worker/issues/1405

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: c80f5d88-cfb9-b940-d993-935e42528d94
Version Independent ID: 6023328b-2109-7269-befa-7681dda7c5da
Content: Azure Tables output bindings for Azure Functions
Content Source: articles/azure-functions/functions-bindings-storage-table-output.md
Service: azure-functions
GitHub Login: @ggailey777
Microsoft Alias: glenga

@marcelmedina
Thanks for your feedback! We will investigate and update as appropriate.

@mattchenderson do we need to adjust the  Table output binding documentation wrt the open issues for isolated worker process noted by @marcelmedina?

authors: Naveenommi-MSFT ggailey777 marcelmedina


text:
bearer should be Bearer

At https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api there are instructions to setup your Log Analytics request header with Authorization: bearer .  The problem is, when the 1st letter in bearer is lower case you get the following error.
Microsoft documentation says:
Use the token in requests to the Log Analytics endpoint:
POST /v1/workspaces/your workspace id/query?timespan=P1D
Host: https://api.loganalytics.azure.com
Content-Type: application/json
Authorization: bearer
Body:
{
"query": "AzureActivity |summarize count() by Category"
}

Error returned if 1st letter in bearer is lower case.
{
"error": {
"message": "Valid authentication was not provided",
"code": "AuthorizationRequiredError",
"correlationId": "e73fa45e-a3ac-4bde-8af0-3205e77a8074"
}
}
Recommendation - update content at web site so bearer is alway Bearer.

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 00ceee8d-f5ae-6d30-8a07-9f5def035fe7
Version Independent ID: ea531828-e26a-3c60-3b66-429ec06f895e
Content: API access and authentication - Azure Monitor
Content Source: articles/azure-monitor/logs/api/access-api.md
Service: azure-monitor
Sub-service: logs
GitHub Login: @guywi-ms
Microsoft Alias: guywild

@mtarkow3
Thanks for your feedback! We will investigate and update as appropriate.


text:
Typo in sample deployment yaml

Typo in sample deployment yaml

The line should be:
spec:

instead of:
spec::

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 4e19e732-65d3-6f83-7669-cc86f2f71064
Version Independent ID: 9ffe3b59-cd00-a1b1-9e81-f4f19eb817d8
Content: Quickstart: Deploy an AKS cluster with Enclave Confidential Container Intel SGX nodes by using the Azure CLI
Content Source: articles/confidential-computing/confidential-enclave-nodes-aks-get-started.md
Service: virtual-machines
Sub-service: confidential-computing
GitHub Login: @angarg05
Microsoft Alias: ananyagarg

@sturrent
Thanks for your feedback! We will investigate and update as appropriate.

authors: AjayBathini-MSFT sturrent


text:
Mapping of subnet during recovery

We noticed that when an explicit ip and subnet configuration on the replicated VM is needed for proper recovery in the current situation. However, this, in our expierence, was not the case. We never, let's say before october last year, specified an ip address or subnet and ASR seem to figure out to which subnet it needed to map the replicated VM during failover. We've always assumed it's was able to do so by using a combination of production IP range/ip address to automatically determine the failover subnet/ip.
We're just wondering, did something change the ASR handles this in the last couple of months?

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: dbc136fa-e90c-108a-fada-68e8621e6b3e
Version Independent ID: 605b1a94-8bef-f7f3-5eaa-ec8b5bb8fc4a
Content: Map virtual networks between two regions in Azure Site Recovery - Azure Site Recovery
Content Source: articles/site-recovery/azure-to-azure-network-mapping.md
Service: site-recovery
GitHub Login: @ankitaduttaMSFT
Microsoft Alias: ankitadutta

@jeroensluijter1979 There have been no recent changes to how Azure Site Recovery (ASR) handles IP address and subnet configuration during failover. By default, we create a new VNET with the default subnet. If there are others VNETS in the target, then you can customize. Either way after the replication is enabled, you can still change the target network.
If you are interested, the issue you noticed can be investigated further with the help of Azure technical support team by contacting them through support request. Here is the link - https://docs.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request to create support case.

@jeroensluijter1979 We haven't heard back from you, so we will now close this issue. If this remains an issue, please reply and we will gladly continue the discussion.


text:
Define possibilities for logging levels

I've set defaultLevel to Verbose and when I do log.Verbose(…) it still doesn't show in my host console (locally).
There's something missing here in the directions; either I'm using the wrong value, or this doesn't work as expected.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 13672b67-22ea-3dda-8b6b-3332c24e6030
Version Independent ID: fdc60aeb-9971-1d9f-a6ba-b3ad818cf0d5
Content: Monitor Azure Functions
Content Source: articles/azure-functions/functions-monitoring.md
Service: functions
GitHub Login: @tdykstra
Microsoft Alias: tdykstra

Thanks for the feedback! We are currently investigating and will update you shortly.

@brandonh-msft I am not finding any reference in this doc to running log.verbose
Can you point me to the point in this doc where you are seeing that and having issues?

In a Function you can do the following:
[FunctionName("GameStateChanged")]
public static async Task GameStateChangedAsync(
[CosmosDBTrigger(...)]IReadOnlyList<Document> input,
TraceWriter log)
{
    log.Verbose("something verbose here");
    log.Info("something info here");
    log.Warning("something warning here");

but you will only see the .Warning and .Info calls, you won't see the Verbose ones. Neither in the console out, or in App Insights.
I've yet to find the combination of Logging Levels to get this to happen, and the docs don't give me the set of values that are valid (hence this bug)

What does your host.json look like?  Is it possible a category level is overriding the default level?

host.json is completely empty; standard Functions template.

I'm not. But when I tried (to get verbose messages to show up in the host or AppInsights) I did so by adding
"logger": {
        "categoryFilter": {
            "defaultLevel": "Verbose"
        }
    }

to my host.json file. This did nothing.

Try setting it to Trace instead of Verbose (per the Levels section that's the name of the lowest logging level).

my code:
log.Verbose(@"testing verbose message");
log.Info(@"testing Info message");
log.Error(@"testing Error message");
log.Warning(@"testing Warning message");

the output
[7/27/2018 7:00:55 PM] Reading host configuration file '...\bin\Debug\netstandard2.0\host.json'
[7/27/2018 7:00:55 PM] Host configuration file read:
[7/27/2018 7:00:55 PM] {
[7/27/2018 7:00:55 PM]   "logger": {
[7/27/2018 7:00:55 PM]     "categoryFilter": {
[7/27/2018 7:00:55 PM]       "defaultLevel": "Verbose"
[7/27/2018 7:00:55 PM]     }
[7/27/2018 7:00:55 PM]   }
[7/27/2018 7:00:55 PM] }
[7/27/2018 7:00:55 PM] Starting Host (...)
[7/27/2018 7:00:57 PM] Generating 1 job function(s)
[7/27/2018 7:00:57 PM] Found the following functions:
[7/27/2018 7:00:57 PM] FunctionClient.Greeter.GreetAsync
[7/27/2018 7:00:57 PM]
[7/27/2018 7:00:57 PM] Host initialized (5213ms)
[7/27/2018 7:00:58 PM] Host started (5593ms)
[7/27/2018 7:00:58 PM] Job host started
Listening on http://0.0.0.0:7071/
Hit CTRL-C to exit...

Http Functions:

        Greet: http://localhost:7071/api/Greet

[7/27/2018 7:01:03 PM] Executing 'Greet' (Reason='This function was programmatically called via the host APIs.', Id=f687c40f-a2c7-4572-9a3d-2e1525411983)
[7/27/2018 7:01:04 PM] testing Info message
[7/27/2018 7:01:04 PM] testing Error message
[7/27/2018 7:01:04 PM]
[7/27/2018 7:01:04 PM] testing Warning message

With Trace:
the output
[7/27/2018 7:03:19 PM] Host configuration applied.
[7/27/2018 7:03:19 PM] Reading host configuration file '...\bin\Debug\netstandard2.0\host.json'
[7/27/2018 7:03:19 PM] Host configuration file read:
[7/27/2018 7:03:19 PM] {
[7/27/2018 7:03:19 PM]   "logger": {
[7/27/2018 7:03:19 PM]     "categoryFilter": {
[7/27/2018 7:03:19 PM]       "defaultLevel": "Trace"
[7/27/2018 7:03:19 PM]     }
[7/27/2018 7:03:19 PM]   }
[7/27/2018 7:03:19 PM] }
[7/27/2018 7:03:19 PM] Starting Host (...)
[7/27/2018 7:03:19 PM] Debug file watch initialized.
[7/27/2018 7:03:19 PM] File event source initialized.
[7/27/2018 7:03:20 PM] Function metadata read.
[7/27/2018 7:03:20 PM] Binding providers loaded.
[7/27/2018 7:03:20 PM] Binding providers initialized.
[7/27/2018 7:03:20 PM] Extension loading complete.
[7/27/2018 7:03:21 PM] Metadata provider created.
[7/27/2018 7:03:21 PM] Adding Function descriptor provider for language dotnet.
[7/27/2018 7:03:22 PM] Function descriptors created.
[7/27/2018 7:03:22 PM] Generating 1 job function(s)
[7/27/2018 7:03:22 PM] Found the following functions:
[7/27/2018 7:03:22 PM] FunctionClient.Greeter.GreetAsync
[7/27/2018 7:03:22 PM]
[7/27/2018 7:03:22 PM] Host initialized (6120ms)
[7/27/2018 7:03:23 PM] Host started (6461ms)
[7/27/2018 7:03:23 PM] Job host started
Listening on http://0.0.0.0:7071/
Hit CTRL-C to exit...

Http Functions:

        Greet: http://localhost:7071/api/Greet

[7/27/2018 7:03:54 PM] Executing 'Greet' (Reason='This function was programmatically called via the host APIs.', Id=b13989bf-b126-466d-8898-4693fbf378b0)
[7/27/2018 7:03:54 PM] testing verbose message
[7/27/2018 7:03:54 PM] testing Info message
[7/27/2018 7:03:54 PM] testing Error message
[7/27/2018 7:03:54 PM]
[7/27/2018 7:03:54 PM] testing Warning message

The confusing here lies in that the TraceWriter object has both Verbose and Trace methods but we only show log levels pointing to Trace. The overload for .Trace, additionally, is very much different than the others which lead me to believe Info, Warning, etc were all "shortcuts" to an underlying call to Trace.
Request: At the very least we should point out that, to get Verbose-logged messages, one has to enable Trace-level logging in host.json as that isn't clear today.

we should point out that, to get Verbose-logged messages, one has to enable Trace-level logging in host.json

I agree and I've made a pull request with that change.  It should be live this afternoon or tomorrow.  Thanks for reporting the issue; I'm sure others have run into it as well.


text:
Additional best practices

Please consider adding the best practices that Stefan covered at Ignite: https://myignite.techcommunity.microsoft.com/sessions/66630

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 6f96b069-9ae7-ca2f-3c0a-25631ae6f02c
Version Independent ID: 6b9c76e3-18cf-6795-dbfd-356379d88dfb
Content: Best Practices for Azure App Service
Content Source: articles/app-service/app-service-best-practices.md
Service: app-service
GitHub Login: @dariagrigoriu
Microsoft Alias: dariagrigoriu

Hi @Teodelas, thanks for the feedback! I have assigned the issue to the content author to evaluate and update as appropriate.

Thanks for your dedication to our documentation. It appears the link is no longer valid. Unfortunately, at this time we have been unable to review your issue in a timely manner and we sincerely apologize for the delayed response. We are closing this issue for now, but if you feel that it's still a concern, please respond and let us know. If you determine another possible update to our documentation, please don't hesitate to reach out again. #please-close


text:
Can someone please fix this demo?

I am still getting the error "in line 11" when trying to perform step #4 in "Send simulated telemetry". I just wish someone would fix the body of the demo and not lead us all down a bunch of closed cases that have ambiguous solutions.
C:\azure-iot-samples-python-master\iot-hub\Quickstarts\simulated-device>python SimulatedDevice.py
Traceback (most recent call last):
File "SimulatedDevice.py", line 11, in <module>
import iothub_client
File "C:\Users\user1\AppData\Local\Programs\Python\Python37-32\lib\site-packages\iothub_client_init_.py", line 1, in <module>
from .iothub_client import *
ImportError: DLL load failed: The specified module could not be found.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: d9565ceb-e636-e815-f7cf-ff9523fabc2f
Version Independent ID: 7c6b3210-d878-0347-27af-199c2c00daa9
Content: Send telemetry to Azure IoT Hub quickstart (Python)
Content Source: articles/iot-hub/quickstart-send-telemetry-python.md
Service: iot-hub
GitHub Login: @wesmc7777
Microsoft Alias: wesmc

@zapdog43 Thanks for the feedback! We are currently investigating and will update you shortly.

Thanks Ashok. This is on Windows 10 with the most up to date Windows 10 Python download

Python 3.7.3 (32 bit)

@wesmc7777 Please have a look at this issue and provide your insights.

@zapdog43 you need Python 3.6 with VC++ packages for now : https://github.com/Azure/azure-iot-sdk-python/issues/41#issuecomment-441878396

had the same problem when using python 3.7 (32 bit), confirmed that it works when switching to python 3.6 (64 bit)

We are aware of dependency limitations with the current builds of the library. These are noted here

Mac OS: Python 3.7.0 (or 2.7) + libboost-1.67 + curl 7.61.1 (all installed via homebrew) Any other distribution/OS probably embed different versions of boost & dependencies which won't work and will result in an ImportError at runtime.

We are fully aware that this is a less than ideal situation and we are currently working on a full python implementation that will have the wide platform support that is expected of any respectable python library. While we intend to support this wrapper-based version of the SDK until the new one is full-featured, we will be deprecating it shortly thereafter. We will update this readme with the link to the new preview version when it is available.

@zapdog43 We hope your query is addressed. As mentioned, we will update the readme with more details.
We will now proceed to close this thread. If there are further questions regarding this matter, please comment and we will gladly continue the discussion.

@wesmc7777 what's the progress like on the new library? It's frustrating to check back after almost 4 months and still run into the same problems. I'm running Ubuntu 18.04 so it looks like I'm still screwed.

Hi @bhjolly there is some progress done you can see the rewrite of the Python SDK here https://github.com/azure/azure-iot-sdk-python-preview if you have any questions about it please open an issue on that repository so the engineering team can address them

authors: Alberto-Vega-MSFT AshokPeddakotla-MSFT DaanJJansen bhjolly ivanignatiev wesmc7777 zapdog43


text:
Question about Service Tag "AzureCloud"

Hi all,
I have a question regarding service tag "AzureCloud". You wrote "[...] all datacenter public IP addresses. If you specify AzureCloud for the value, traffic is allowed or denied to Azure public IP addresses.". From my understanding, all datacenter public IP addresses means even all service public IP addresses - so for instance public IP addresses for Azure SQL database or even cognitive services. So in case I want to allow all Azure traffic, but no internet access, I just have to create to outbound rules? The first would be an Allow-Rule with destination "AzureCloud" and the second one a Deny-Rule with service tag "Internet". Is this correct?
Thanks for the help! Best regards, Daniel

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 5e905802-0b08-4b3b-25ec-0f88c023bc32
Version Independent ID: f31325e5-49ea-b28c-336e-10f2a3fc12b4
Content: Azure security groups overview
Content Source: articles/virtual-network/security-overview.md
Service: virtual-network
GitHub Login: @malopMSFT
Microsoft Alias: malop;kumud

@nnamedieh , I will test this out in my lab and post my findings here.

@nnamedieh , It seems like you will not be able to use Service Tags for Outbound Rules in NSG. So, you need to think of other alternative such as Azure Firewall.

@msrini-MSFT thanks for your quick response. You mean that Service tag "AzureCloud" does not cover all Azure services with public IP, just a few like compute or sql? Then I really have to look for another solution. Thank you!

@nnamedieh , I meant you will not able able to choose Service tags for outbound rules. You can navigate to any NSG and to the outbound rules. You will not able to able to find the Service Tag option.

@nnamedieh , As mentioned in the above comment, you will not be able to use Service Tags for Outbound rules in NSG. So you need to look into other solutions like Azure Firewall. I will close this issue, please tag me if you have any questions.

authors: msrini-MSFT nnamedieh


text:
The last two sentences are unclear

Hello,
The last two sentences are unclear and seem to be out of order.
"If the target network chosen is the failover vnet” and 2nd point to say “If the target network chosen is different from the failover vnet but has the same subnet range as failover vnet”
Can we update this to make this statement more clear?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: dbc136fa-e90c-108a-fada-68e8621e6b3e
Version Independent ID: 605b1a94-8bef-f7f3-5eaa-ec8b5bb8fc4a
Content: Map virtual networks between two Azure regions in Azure Site Recovery
Content Source: articles/site-recovery/azure-to-azure-network-mapping.md
Service: site-recovery
GitHub Login: @mayurigupta13
Microsoft Alias: mayg

@mikedeatworld Thanks for the feedback! I have assigned the issue to the content author to evaluate and update as appropriate.

Last two lines are appended by mistake. They are part of the table and explained in details. Thank you for the feedback.
#please-close


text:
CHEF content doesn't have a clear support boundary and where do get additional support

There should be a clearer statement on where to get support in the documents. There recently was a case where the customer had an issue, we ruled out the agent, and we didn't have anything customer facing on docs.microsoft.com to direct them to support. Found this great documentation!

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 2172da12-7976-478a-cefc-1c13cfc9e8f0
Version Independent ID: 12f10e01-a5ca-b0f1-656b-ea9beb7d328c
Content: Using Chef with Azure
Content Source: articles/chef/chef-overview.md
Service: virtual-machines-linux
GitHub Login: @TomArcherMsft
Microsoft Alias: tarcher

Thanks for the feedback! I have assigned the issue to the content author to investigate further and update the document as appropriate.

@ScottAzure Chef is not supported internally and the Chef team has not replied to this.
@MicahMcKittrick-MSFT #please-close


text:
Routing to backend containers

Can you please add examples for how to route requests to backend containers and explain how balancing works? E.g. let's say I have two container services, one for videos and one for images, each with X instances running somewhere in the cluster - does APIM auto-discover the instances? How does APIM balance requests between them?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 4dd6ed51-33aa-e8af-d483-4df816dd2c7f
Version Independent ID: f889b18f-8a9a-97c0-98ad-13f7496a797c
Content: Azure Service Fabric with API Management overview
Content Source: articles/service-fabric/service-fabric-api-management-overview.md
Service: service-fabric
GitHub Login: @vturecek
Microsoft Alias: vturecek

@Eldar1205 Thanks for the question! We're investigating this and will get back to you shortly.

@Eldar1205 I am assigning the issue to the author for adding his comments on the issue.

@vturecek Can you please look into this request on adding examples to the document and add your comments accordingly.

Hi @Eldar1205, unfortunately we don't have the capacity at the moment to make these changes. We'll circle back around with an update sometime in the future.

#please-close

authors: BhargaviAnnadevara-MSFT Eldar1205 Nickomang VikasPullagura-MSFT


text:
Not able to set End Time for recurrence Auto Scale through ARM Templates

Based on our Auto Scale requirement where we need to setup Auto Scaling settings for Azure App service Plans. The profiles should be

To Scale up or Scale Down based on CpuPercentage metricTrigger
To Scale Down during Non Business hours (12PM to 6AM) to single instance -> recurrence
schedule trigger.

As we are not able to set the end time for the second auto scale settings through ARM templates, the first CpuPercentage metricTrigger is showing as "This scale condition is not running because you have other scale condition(s) without an end time"
Is there a way to add End Time for recurrence Auto Scale through ARM Templates?

@BryanTrach-MSFT
Hey Bryan,
Sorry for the delay. I have attached the template which we are using to create the app service plan.
Please let us know whether End Time can be passed in the auto scale settings of ARM template.
app_service_plan_creation.txt

Please note that we scope issues on this repro to feedback related to the docs. If you have a product question, please post it on MSDN or Stack Overflow. Thank you for your understanding.

@karthik623521 Please note that we scope issues on this repro to feedback related to the docs. If you have a product question, please post it on MSDN or Stack Overflow. Thank you for your understanding.

@BryanTrach-MSFT Thank you!


text:
cannot validate access token

[Enter feedback here]
I use the following the code to validate access token. But I always get the error "Signature validation failed"
validate token
public JwtSecurityToken Validate(string token)
        {
            string stsDiscoveryEndpoint = "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration";

            ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());

            OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;

            TokenValidationParameters validationParameters = new TokenValidationParameters
            {
                ValidateAudience = false,
                ValidateIssuer = false,
                IssuerSigningKeys = config.SigningKeys,
                ValidateLifetime = false
            };

            JwtSecurityTokenHandler tokendHandler = new JwtSecurityTokenHandler();

            SecurityToken jwt;

            var result = tokendHandler.ValidateToken(token, validationParameters, out jwt);

            return jwt as JwtSecurityToken;
        }

Startup.cs
public partial class Startup
    {
        private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
        private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
        private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
        private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];
        private static string redirectUri = postLogoutRedirectUri;
        private static string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];
        string authority = aadInstance + tenantId;

        public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = clientId,
                    Authority = authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri,

                    Notifications = new OpenIdConnectAuthenticationNotifications()
                    {
                        AuthenticationFailed = (context) =>
                        {
                            return System.Threading.Tasks.Task.FromResult(0);
                        },
                        AuthorizationCodeReceived = OnAuthorizationCodeReceived
                    }

                }
                );

            // This makes any middleware defined above this line run before the Authorization rule is applied in web.config
            app.UseStageMarker(PipelineStage.Authenticate);
        }
        private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
        {
            context.HandleResponse();
            context.Response.Redirect("/?errormessage=" + context.Exception.Message);
            return Task.FromResult(0);
        }

        private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification)
        {
            var idClient = ConfidentialClientApplicationBuilder.Create(clientId)
                .WithRedirectUri(redirectUri)
                .WithClientSecret(clientSecret)
                .Build();

            string[] scopes = { "https://graph.microsoft.com/user.read" };

            var result = await idClient.AcquireTokenByAuthorizationCode(
                scopes, notification.Code).ExecuteAsync();

            GenUtil.token = result.AccessToken;
        }

        private static string EnsureTrailingSlash(string value)
        {
            if (value == null)
            {
                value = string.Empty;
            }

            if (!value.EndsWith("/", StringComparison.Ordinal))
            {
                return value + "/";
            }

            return value;
        }

    }
}

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 2471c08b-befe-8e1a-df08-f13e116c231e
Version Independent ID: 0d827d33-2906-6352-9398-13863def9354
Content: Microsoft identity platform access tokens reference
Content Source: articles/active-directory/develop/access-tokens.md
Service: active-directory
Sub-service: develop
GitHub Login: @rwike77
Microsoft Alias: ryanwi

According to my test, now I cannot validate Microsoft graph api access token with my code.

Hey @test123114 I see, we need more information to determine what's going on because we don't have your tokens or network traces.
The issue is most likely that whichever endpoint you're trying to validate the access token against doesn't have the KID. (i.e. : https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration)
Have you made sure that your tenant ID and client id are correct?
Please see this doc on more clarification on how that works : https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-openid-connect-code#openid-connect-metadata-document
i.e. :
https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration?appid=<your-app-id>

@test123114 I'm following up on this issue, can you please respond in regards to the previous replies on this thread? Thanks

@test123114 Please let us know if there are anymore questions within the scope of this git issue. If not, I will be closing out this git issue by end of day today. Please reopen this git issue if you have anymore concerns. Thanks


text:
Issue Installing az.sql Module...

When running:
Install-Module -Name Az.Sql -RequiredVersion 1.1.1-preview -AllowPrerelease -Force
I get an error:
Install-Module : Cannot process argument transformation on parameter 'RequiredVersion'. Cannot convert value "1.1.1-preview" to type
"System.Version". Error: "Input string was not in a correct format."
and it does not allow the -AllowPreRelease parameter either...

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 791209cf-9b22-43d4-706e-d8ecfffbd07a
Version Independent ID: 09944dbe-df29-27ad-b599-e31f7ddc6572
Content: PowerShell: Enable BYOK TDE - Azure SQL Database Managed Instance
Content Source: articles/sql-database/scripts/transparent-data-encryption-byok-sql-managed-instance-powershell.md
Service: sql-database
Sub-service: security
GitHub Login: @MladjoA
Microsoft Alias: mlandzic

@cmosqu Thank you for reaching out.
The PowershellGet module on your machine seems to be outdated.
Please install the latest version first and then try again.
Install-Module PowerShellGet -Force

When does TDE BYOK come out of preview into GA? Is it a production ready feature?
Sent from my iPhone

On Nov 5, 2019, at 10:26 PM, Kalyan Chanumolu notifications@github.com wrote:

@cmosqu Thank you for reaching out.
The PowershellGet module on your machine seems to be outdated.
Please install the latest version first and then try again.
Install-Module PowerShellGet -Force
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

@cmosqu , TDE with customer-managed key is now generally available, you can see the announcement here: https://azure.microsoft.com/en-us/updates/general-avilability-transparent-data-encryption-with-customer-managed-keys-for-azure-sql-database-managed-instance/
Preview version of the Az PowerShell module is not requirement anymore. This document will be updated during the day, stating that versions 2.3.2 and newer of Az module support cmdlets used in the script.

This is great except that in the link itself the word availability is misspelled. You may want to fix that for optics.

On Nov 6, 2019, at 10:06 AM, Mladen Andzic (Msft) notifications@github.com wrote:

@cmosqu , TDE with customer-managed key is now generally available, you can see the announcement here: https://azure.microsoft.com/en-us/updates/general-avilability-transparent-data-encryption-with-customer-managed-keys-for-azure-sql-database-managed-instance/
Preview version of the Az PowerShell module is not requirement anymore. This document will be updated during the day, stating that versions 2.3.2 and newer of Az module support cmdlets used in the script.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

Thanks for letting us know @cmosqu . I checked the content and there is no same issue there. Will check whether fixing URL is advisable once it's published and probably shared many times.

@cmosqu We will proceed to close this issue now.
If there are further questions regarding this matter, please comment and we will gladly continue the discussion.

Getting this same error when performing Get-Module -FullyQualifiedName $ModuleFQDN, where $ModuleFQDN is a hashtable {ModuleName="Az.Sql";ModuleVersion="1.1.1-preview"}.
I'm checking to see if a specific version of a module is already available before trying to Import, and I'm getting:

Cannot bind parameter 'FullyQualifiedName'. Cannot convert value "System.Collections.Hashtable" to type "Microsoft.PowerShell.Commands.ModuleSpecification". Error: "Cannot convert value "1.1.1-preview" to type "System.Version"

There's no -RequiredVersion parameter for Get-Module, so as far as I can tell, searching with the FQDN is the only way to match Name and Version of a given module.

Hi there. Just wanted to point out two things:

In the below portion of the script, when you set the AKV Access Policy on a new key vault, it does not allow the creator of the vault to view or do anything anymore unless you specifically add that user to the access policy as a separate step or from the Azure portal separately... It would be great if you commented this in the script with a link for additional resources or an example of how to deal with this.

The script to install the powershell module still has the reference to the preview version so if that is not required now that BYOK is no longer in preview, it should be removed.

Script Code to create Access policy:
Authorize Managed Instance to use the AKV (wrap/unwrap key and get public part of key, if public part exists):
$objectid = (Set-AzSqlInstance -ResourceGroupName $resourcegroup -Name "MyManagedInstance" -AssignIdentity).Identity.PrincipalId
Set-AzKeyVaultAccessPolicy -BypassObjectIdValidation -VaultName $vaultname -ObjectId $objectid -PermissionsToKeys get,wrapKey,unwrapKey

authors: KalyanChanumolu-MSFT MladjoA cmosqu fillip1983


text:
Grammar error

Under the header: "Copy the instrumentation key", the sentence: "You will need copy to add the instrumentation key to your application's code" needs to be revised to make more sense

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 62abe2ea-d97b-66dd-27ff-3c2bda5b6ceb
Version Independent ID: 07e29ff9-c7a0-07bf-df25-7669a080c85f
Content: Create a new Azure Application Insights resource - Azure Monitor
Content Source: articles/azure-monitor/app/create-new-resource.md
Service: azure-monitor
Sub-service: application-insights
GitHub Login: @mrbullwinkle
Microsoft Alias: mbullwin

@kschairer ,
Thanks for brining this to our attention. We will investigate it further and update you shortly.

Raised a PR to update the document accordingly. https://github.com/MicrosoftDocs/azure-docs-pr/pull/103990
So the doc should be updated once it is approved.
Thanks again for bringing this to our attention. We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

authors: MonikaReddy-MSFT kschairer


text:
Grammatical Errors

This page is riddled with grammatical errors. Please have an editor review this page.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: d0982c5d-272e-caf3-bee2-8ae53a830f53
Version Independent ID: 2d1b6d7f-0316-3817-8831-acd8ed396607
Content: Azure virtual machine extensions and features
Content Source: articles/virtual-machines/extensions/overview.md
Service: virtual-machines-linux
GitHub Login: @axayjo
Microsoft Alias: akjosh

@nickboucher
Thanks for the feedback! I have assigned the issue to the content author to investigate further and update the document as appropriate.

@nickboucher Thanks for the feedback! There is a new owner for this area, who will probably be reworking this content extensively. But, in the meantime, I've done a pass on simplifying the language etc. https://github.com/MicrosoftDocs/azure-docs-pr/pull/124770
#please-close

authors: cynthn jakaruna-MSFT nickboucher


text:
Regions available for Azure Files authentication to Active directory feature

We use Australia (East) for our Storage account and azure file instance.. While trying to setup the authentication for the storage account to AD we get an error when using the Join-AzStorageAccountForAuth command.
"Unable to generate a Kerberos key for storage account. This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in location (australiaeast).
Can i get an idea of what location i can use to setup (we are in australia).

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: fba964be-3f77-d80c-f1a5-35bb1430bb8f
Version Independent ID: fe70b11e-10fe-5a8c-1fad-b22a83693503
Content: Enable Active Directory authentication over SMB for Azure Files
Content Source: articles/storage/files/storage-files-identity-auth-active-directory-enable.md
Service: storage
GitHub Login: @roygara
Microsoft Alias: rogarana

@mikewillodea , Thank you for your feedback. We will investigate and get back to you shortly.

@mikewillodea Try to build a fresh VM [use a free laptop!] and join it to the AD-DS that you are trying to use for the Azure Files Auth. If that works, then you have a different problem.

@sujayvsarma i Don’t actually want to join the storage account to AD-DS just active directory I believe there is a significant difference in this new feature if I’m not wrong.?

Let me first quote from the document you linked to:

The join-AzStorageAccountForAuth cmdlet will perform the equivalent of an offline domain join on behalf of the indicated storage account.

So if you try the domain-join on your own, you will know what the problem is.

Ok Sujay I will try that and see how I go.

@mikewillodea Azure Files AD authentication (preview) is available in most public regions.
Azure Files AD authentication is not available in:
West US
West US 2
East US
East US 2
West Europe
North Europe
You may also refer to the suggestions mentioned in the link

@SumanthMarigowda-MSFT How is that adding value to the question or try to resolve the customer's problem?

Thanks I’ve managed to get my region working now.

@mikewillodea :) What got it fixed ?

@mikewillodea We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

authors: SumanthMarigowda-MSFT mikewillodea msrini-MSFT sujayvsarma


text:
What stops someone else from writing a managed app that accesses your key vault?

Is the Appliance Resource Provider tied to a specific managed app definition?  if so, how?
It seems like anyone could just write a managed app that points at your key vault and get right in.
Thank you.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 2fd769b4-4c68-88be-bf6c-30ad3c355b82
Version Independent ID: e5b2d116-ac1c-84ef-eeec-e9107019b982
Content: Use Key Vault when deploying managed app - Azure Managed Applications
Content Source: articles/azure-resource-manager/managed-applications/key-vault-access.md
Service: managed-applications
GitHub Login: @tfitzmac
Microsoft Alias: tomfitz

@xaxxon Thanks for the comment. We are looking into this and will get back to you shortly.

@xaxxon Apologies for delayed response, assigning this to our document author @tfitzmac to further help answer your query and see if any document enhancement is needed.

#reassign:davidsmatlak

@xaxxon Thanks for your feedback about the documentation. Unfortunately, your issue wasn't reviewed in a timely manner. Your issue remains open and will be reviewed, and the timeline for resolution may vary based on resourcing. There was a recent change to the content's author and I'm working through the open GitHub issues and updating documentation. I'll post a comment when I'm working on your issue.

The Applicance Resource Provider is a service principal in your Azure Active Directory tenant. In the article, you assign a role to the service principal to access to the key vault. In the Add service as contributor section I added some content about the service principal and in the Next steps included links to more information about key vault security and how it works with Azure Active Directory and Azure role-based access control.
I submitted pull request for this issue and after the pull request is merged, this issue will automatically close. After the merge, the updated document will be online within 24 hours.

authors: BharathNimmala-MSFT SadiqhAhmed-MSFT davidsmatlak xaxxon


text:
New managed Azure Active Directory integration article fails to mention preview flag

I finished setting up RBAC through AD with kubenetes roles last week. I revisited the page today to find (legacy) on it with a link to this article.
When attempting to upgrade my cluster I get the following message
C:\Users\devgi>az aks update -g <RG> -n <cluster name> --enable-aad --aad-admin-group-object-ids <object id> --aad-tenant-id <tenant id> Operation failed with status: 'Bad Request'. Details: aadProfile.managed requires Microsoft.ContainerService/AAD-V2 feature flag.
Why is this the case? This feature flag appears to relate to Azure enabled RBAC but I am doing my roles through kubernetes. Why would I need this feature enabled?
Why am I required to enable a preview feature flag when this article does not indicate this is in preview? My organization has a strong stance against using preview features in production.
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 22a4b366-3eac-83f8-05bb-1302ce5c9235
Version Independent ID: 73a9c88b-784d-2f96-becc-14e8d751834f
Content: Use Azure AD in Azure Kubernetes Service - Azure Kubernetes Service
Content Source: articles/aks/managed-aad.md
Service: container-service
GitHub Login: @mlearned
Microsoft Alias: thomasge

Thanks for the feedback! I have assigned the issue to the content author to investigate further and update the document as appropriate.

@devgibsonsp: Our release including managed-AAD GA is delayed. We just restored required preview flags in our docs.
Sorry, for the inconvenience it may cause. Checkout: https://aka.ms/aks/managed-aad

#please-close

Hi, @TomGeske  when are you going to release a fix?

@ElkRom: I think preview flags should be added back to docs. Our deployment to remove those is currently ongoing and it will take a few days to land in all regions.

This is blocking AKS deployment via ARM template as well.  As part of our build we all the Azure ARM Validation, which fails with the error below:
There were errors in your deployment. Error code: InvalidTemplateDeployment.
##[error]The template deployment 'aks-20200806-224317-7320' is not valid according to the validation procedure. The tracking id is '839efe29-e112-447d-a7d0-966d6c1730b9'. See inner errors for details.
##[error]Details:
##[error]BadRequest: Provisioning of resource(s) for container service [our-clusterName] in resource group [our-cluster-RG-name] failed. Message: {
"code": "BadRequest",
"message": "aadProfile.managed requires Microsoft.ContainerService/AAD-V2 feature flag."
}. Details:
##[error]Check out the troubleshooting guide to see if your issue is addressed: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment?view=azure-devops#troubleshooting
##[error]Task failed while creating or updating the template deployment.

Yes, correctly. Roll out is still ongoing. Should finish in a couple of days in all regions.

@TomGeske  is there a way to monitor which regions require the feature flag and which don't?  Our AKS cluster is West US

authors: ElkRom Karishma-Tiwari-MSFT TomGeske devgibsonsp kevinwedwards


text:
Unattend installation - the working version :-)

Hi, the way it's described here is not 100% correct. Here is a working version.
cmd /c 'C:\Users\student\Downloads\AADConnectAuthAgentSetup.exe REGISTERCONNECTOR="false" /q'
#$cred = Get-Credential
Set-Location "C:\Program Files\Microsoft Azure AD Connect Authentication Agent"
.\RegisterConnectoguyr.ps1 -modulePath "C:\Program Files\Microsoft Azure AD Connect Authentication Agent\Modules" -moduleName "AppProxyPSModule" -Authenticationmode Credentials -Usercredentials $cred -Feature PassthroughAuthentication

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 8698cc7c-3b24-db1f-4adf-b60aeb03c97a
Version Independent ID: bf51a630-8219-8e06-e375-6425659e69eb
Content: Azure AD Pass-through Authentication - Quick start
Content Source: articles/active-directory/connect/active-directory-aadconnect-pass-through-authentication-quick-start.md
Service: active-directory
GitHub Login: @swkrish
Microsoft Alias: billmath

@guyhorn1964 Thanks for the feedback! I have assigned the issue to the content author to investigate further and update the document as appropriate.

@swkrish bumping this to get your attention on this issue.

@guyhorn1964 Thank you for catching this.  I have created a work item for this, as it will take me some time to build this environment out again.  I will re-open this and update it once I have more information.  Thank you.
#please-close

authors: MicahMcKittrick-MSFT billmath guyhorn1964 mtillman


text:
401 - Invalid token - The issuer is invalid

I call my webapi that has configuration that sets the tenantId and get a 401 and in the WWW-Authenticate header I see the following error (with that tenantId!):
WW-Authenticate: Bearer error="invalid_token", error_description="The issuer 'https://login.microsoftonline.com/{tenantId}/v2.0' is invalid"
The SharePoint App (which makes the web api call),  the Azure AD app (which is the client used for authenticating) and the webapi are all in the same tenant. Note that I didn't set the Authorization on the Azure App because that results in a 401 I cannot debug.
I use the code in the web api startup:
services.AddAuthentication(AzureADDefaults.JwtBearerAuthenticationScheme)
.AddAzureADBearer(options => Configuration.Bind("AzureAd", options));
Any idea what I could be doing wrong?
The Azure AD app - accessTokenAcceptedVersion is set to 2
I'm creating the access token with the MSAL20 library:  "@azure/msal-browser" and this looks like a correct access token.
With the same code (but ofcourse different settings) I can call the Graph API correctly and get mail data.
Any help would be much appreciated!
Caroline
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 906f1086-776e-9abe-b6cc-bf93e84dc238
Version Independent ID: 50b27c9e-8f8a-3425-a1bb-b5d30e9d95e4
Content: Configure protected web API apps - Microsoft identity platform
Content Source: articles/active-directory/develop/scenario-protected-web-api-app-configuration.md
Service: active-directory
Sub-service: develop
GitHub Login: @jmprieur
Microsoft Alias: jmprieur

Ok, for anyone else having this issue:
Change the tenantId in your settings to the Scope URL under Expose an API.
In my case that was: https://{webapi}.azurewebsites.net/user_impersonation
(I now get an Audience is invalid error though.. )

@2ATCaroline
Thanks for your feedback! We will investigate and update as appropriate.

I solved the audience error by changing the AddAuthentication in the Startup with the following:
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApi(Configuration);
services.Configure(JwtBearerDefaults.AuthenticationScheme, options =>
{
var existingOnTokenValidatedHandler = options.Events.OnTokenValidated;
options.Events.OnTokenValidated = async context => {
options.TokenValidationParameters.ValidateAudience = true;
await existingOnTokenValidatedHandler(context);
options.TokenValidationParameters.ValidAudiences = new[] { "{audienceId}" };
};
});

@2ATCaroline
Thank you for the quick reply!
I missed your first response message with your resolution. However, I'm glad you were able to resolve your issue! I'll go ahead and close out this thread.
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.


text:
Which region should i select for WVD service health alert ?

Which region should I select for WVD service health alert ?
Sould it be USregions where brokering services and metadata locations located (please list all of required regions in this case), or / in addition it should be my local regions where my session host located ?
Thank you

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: dd65d7a9-9276-67bc-75df-9dff526b07fa
Version Independent ID: ec99ba00-2b8d-6be0-1be5-ce8822ff8344
Content: Set up service alerts for Windows Virtual Desktop - Azure
Content Source: articles/virtual-desktop/set-up-service-alerts.md
Service: virtual-desktop
GitHub Login: @Heidilohr
Microsoft Alias: helohr

@megaalc
Thanks for your Question! We are currently investigating and will get back on this.

@megaalc Apologies for delayed response on this.
I checked with internal team on this. The general recommendation from the Azure Service Health team is to not restrict by region. So, this is not restricted by region. Please try in any region as there are not restrictions.

Hope the provided information is helpful.
We will now close this issue. If there are further questions regarding this, please tag me in a comment. I will reopen it and we will continue the discussion.

authors: VikasPullagura-MSFT megaalc


text:
Region or SKU unavailable - Help + Support on azure portal does not have the problem type shown on this page

This page shows the problem type to be Unable to access my subscription or resource but azure portal does not have this problem type, it only has unable to access my subscription which does not have any sub-problem type.
The docs are out of sync with the experience on azure portal.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 2c3ad66f-14bd-bd67-40d2-9b6f29cd633c
Version Independent ID: 922adbe4-fefb-e895-d7dd-42279d24ff66
Content: Region or SKU series unavailable - Azure supportability
Content Source: articles/azure-portal/supportability/sku-series-unavailable.md
Service: azure-supportability
GitHub Login: @stevendotwang
Microsoft Alias: xingwan

Hello @Jcardif , thanks for taking time to share your valuable feedback! We are taking a look into this and will get back to you soon.

Assigning to content author @stevendotwang @mgblythe for content review and updating document accordingly.

@Jcardif - We'll be redirecting this article to https://support.microsoft.com/help/4339658/azure-region-access-request-process for the time being, and will look at adding it back if it makes sense to have two separate articles.
#please-close

@Jcardif - We'll be redirecting this article to https://support.microsoft.com/help/4339658/azure-region-access-request-process for the time being, and will look at adding it back if it makes sense to have two separate articles.
#please-close

authors: HarshitaSingh-MSFT Jcardif SwathiDhanwada-MSFT mgblythe


text:
Some commands are deprecated

Tried to follow this but got into some errors that are related to the quick evolution of Istio. One example is that istioctl lo longer has the authn command.
This should be updated to work with Istio 1.7/1.8.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 04e91998-d53d-5074-5c67-0f9f031bc26c
Version Independent ID: 989fa4fe-e7a8-2003-6a89-73beaade1b80
Content: Use Istio for intelligent routing - Azure Kubernetes Service
Content Source: articles/aks/servicemesh-istio-scenario-routing.md
Service: container-service
GitHub Login: @paulbouwer
Microsoft Alias: pabouwer

@lmqferreira Thanks for the feedback! I have assigned the issue to content author to check and update the document as appropriate. We will update you accordingly.

@lmqferreira Thanks for the feedback! I have assigned the issue to content author to check and update the document as appropriate. We will update you accordingly.

@paulbouwer Can you please check and add your comments on this doc update request as applicable

@paulbouwer Can you please check and add your comments on this doc update request as applicable

@lmqferreira - thank you for submitting feedback on this set of content. As you mentioned, it is an ongoing task to keep samples compliant with rapidly iterating Istio releases.
@psmanhas - we have been discussing deprecating this content around canary releases as part of a reworking of this service mesh section. We have discussed directing readers to Flagger which automates all of these steps. Flagger is a Progressive Delivery Operator for Kubernetes which can run automated application analysis, testing, promotion and rollback for the following deployment strategies:

Canary (progressive traffic shifting)
A/B Testing (HTTP headers and cookies traffic routing)
Blue/Green (traffic switching and mirroring)

@lmqferreira - thank you for submitting feedback on this set of content. As you mentioned, it is an ongoing task to keep samples compliant with rapidly iterating Istio releases.
@psmanhas - we have been discussing deprecating this content around canary releases as part of a reworking of this service mesh section. We have discussed directing readers to Flagger which automates all of these steps. Flagger is a Progressive Delivery Operator for Kubernetes which can run automated application analysis, testing, promotion and rollback for the following deployment strategies:

Canary (progressive traffic shifting)
A/B Testing (HTTP headers and cookies traffic routing)
Blue/Green (traffic switching and mirroring)

Thank you for the feedback.
We've added a task to our backlog and will prioritize accordingly.
#please-close

authors: lmqferreira paulbouwer psmanhas zr-msft


text:
Create association with Azure VM

Hi
I have create a windows VM 2016 datacentre with the purpose of creating a data collection rule and association to the VM. I created the data collection rule via az REST API to send the required data to a Log Analytics Workspace(az rest --method PUT --url). When I run this template it does create an association from the data collection rule to Windows VM but it does not install Azure Monitor Agent onto the Windows VM.
Can you please advise me am I getting my configuration wrong.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 3fe6c578-ed63-4ada-d2f8-f8479258869d
Version Independent ID: dd31d882-7198-f032-2253-36e5993073b7
Content: Resource Manager template samples for data collection rules - Azure Monitor
Content Source: articles/azure-monitor/samples/resource-manager-data-collection-rules.md
Service: azure-monitor
Sub-service: logs
GitHub Login: @bwren
Microsoft Alias: bwren

@Aaronmcd1978 Thanks for your comment. We will review the issue and get back to you shortly.

@Aaronmcd1978 Thanks for your comment. We will review the issue and get back to you shortly.

@SwathiDhanwada-MSFT . When I enable Data collection rule in the Azure Portal is does install Azure Monitor Agent automatically. Please see the following comment copied from the following page  https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-data-collection-rules
"Create association with Azure VM
The following sample installs the Azure Monitor agent on a Windows Azure virtual machine. An association is created between an Azure virtual machine and a data collection rule."
"{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string",
"metadata": {
"description": "Name of the virtual machine."
}
},
"associationName": {
"type": "string",
"metadata": {
"description": "Name of the association."
}
},
"dataCollectionRuleId": {
"type": "string",
"metadata": {
"description": "Resource ID of the data collection rule."
}
}
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
"name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
"apiVersion": "2019-11-01-preview",
"properties": {
"description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
"dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
}
}
]
}
"
My question is it does not install Azure Monitor agent on a Windows Azure virtual machine. It does create an association between Azure Vm and DCR.
I realize Azure Monitor agent and data collection rules are in preview. But could you please advise if this template does install AMA agent or just creates an association.
Thank you for your help on this matter.

@SwathiDhanwada-MSFT . When I enable Data collection rule in the Azure Portal is does install Azure Monitor Agent automatically. Please see the following comment copied from the following page  https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-data-collection-rules
"Create association with Azure VM
The following sample installs the Azure Monitor agent on a Windows Azure virtual machine. An association is created between an Azure virtual machine and a data collection rule."
"{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string",
"metadata": {
"description": "Name of the virtual machine."
}
},
"associationName": {
"type": "string",
"metadata": {
"description": "Name of the association."
}
},
"dataCollectionRuleId": {
"type": "string",
"metadata": {
"description": "Resource ID of the data collection rule."
}
}
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
"name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
"apiVersion": "2019-11-01-preview",
"properties": {
"description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
"dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
}
}
]
}
"
My question is it does not install Azure Monitor agent on a Windows Azure virtual machine. It does create an association between Azure Vm and DCR.
I realize Azure Monitor agent and data collection rules are in preview. But could you please advise if this template does install AMA agent or just creates an association.
Thank you for your help on this matter.

Hello,
since I am stumbling over the same issue, I would like to add my experience here as well.
As I understand, the process is as the following:

Create Data Collection Rule (e.g. via Portal, Rest or ARM)
Create Data Collection Rule Association (via Portal, Rest or ARM)
a. this should install the extension
b. this should set system assigned Identity on VM, if not already there

What I did so far

Create a Data Collection Rule
Associate a VM in the portal manually within the Rule (VM1)
Associate a VM (VM2) via a Data Collection Rule association via ARM Template, similar as specified above by @Aaronmcd1978

Experience here:
VM1 (setup via portal)

Monitor Agent is installed automatically on VM1
System-assigned identity is created on VM1
Log Data shows up within Log Analytics Workspace within minutes

VM2 (setup via ARM)

Monitor Agent is not automatically installed on the VM2
Identity is
Log Data does not show up within LA Workspace

I extended my installation process so next to the Data Collection Rule Association (via ARM) I also install the Agent via ARM.
The monitor agent gets installed successfully, but it does not seem to pick up the Data Collection Rule association - at least I do not see any logs in the specified Log Analytics Workspace.
The portal shows all components setup correctly (checked via Azure Portal)

Data Collection Rule shows the VMs within its Sources, so association was created correctly
Monitor Extension shows to be installed correctly, at least no error is displayed
VM has a System-Assigned identity activated

I also know this feature is still in preview, but I would have expected the setup described should work.
Would be great to get more info here on how to debug or check if the configuration is correct.
Best Regards
Christoph

Hello,
since I am stumbling over the same issue, I would like to add my experience here as well.
As I understand, the process is as the following:

Create Data Collection Rule (e.g. via Portal, Rest or ARM)
Create Data Collection Rule Association (via Portal, Rest or ARM)
a. this should install the extension
b. this should set system assigned Identity on VM, if not already there

What I did so far

Create a Data Collection Rule
Associate a VM in the portal manually within the Rule (VM1)
Associate a VM (VM2) via a Data Collection Rule association via ARM Template, similar as specified above by @Aaronmcd1978

Experience here:
VM1 (setup via portal)

Monitor Agent is installed automatically on VM1
System-assigned identity is created on VM1
Log Data shows up within Log Analytics Workspace within minutes

VM2 (setup via ARM)

Monitor Agent is not automatically installed on the VM2
Identity is
Log Data does not show up within LA Workspace

I extended my installation process so next to the Data Collection Rule Association (via ARM) I also install the Agent via ARM.
The monitor agent gets installed successfully, but it does not seem to pick up the Data Collection Rule association - at least I do not see any logs in the specified Log Analytics Workspace.
The portal shows all components setup correctly (checked via Azure Portal)

Data Collection Rule shows the VMs within its Sources, so association was created correctly
Monitor Extension shows to be installed correctly, at least no error is displayed
VM has a System-Assigned identity activated

I also know this feature is still in preview, but I would have expected the setup described should work.
Would be great to get more info here on how to debug or check if the configuration is correct.
Best Regards
Christoph

Thanks for your detailed analysis @Aaronmcd1978 @XristophD . I am looking into it and will update you soon.

Thanks for your detailed analysis @Aaronmcd1978 @XristophD . I am looking into it and will update you soon.

Hi
When i create dcr with az REST API commands for windows Vm i still need to configure workspace to view event logs. When I create dcr the same way on a linux VM Syslogs are viewed automatically. Is there a reason for this ?

Hi
When i create dcr with az REST API commands for windows Vm i still need to configure workspace to view event logs. When I create dcr the same way on a linux VM Syslogs are viewed automatically. Is there a reason for this ?

Also when can we expect  DCR's to be able to deploy at scale via policies ect. ?

Also when can we expect  DCR's to be able to deploy at scale via policies ect. ?

@Aaronmcd1978 , what is your goal with Policies?
I guess it would be good to open another issue since your question is drifting away from the initial topic.
You already can deploy DCRs and DRC-Associations via ARM. The documentation officially states, that DCRs are not able to be deployed via ARM template yet, but this is not true, I already deploy them via ARM.
it might be that you need to take care of the related resources to be deployed:

system-assigned managed identity
monitoring agent
DCR association
(maybe others)

but in general, all of them are ready to be deployed.

@Aaronmcd1978 , what is your goal with Policies?
I guess it would be good to open another issue since your question is drifting away from the initial topic.
You already can deploy DCRs and DRC-Associations via ARM. The documentation officially states, that DCRs are not able to be deployed via ARM template yet, but this is not true, I already deploy them via ARM.
it might be that you need to take care of the related resources to be deployed:

system-assigned managed identity
monitoring agent
DCR association
(maybe others)

but in general, all of them are ready to be deployed.

@SwathiDhanwada-MSFT, @Aaronmcd1978

Thanks for your detailed analysis @Aaronmcd1978 @XristophD . I am looking into it and will update you soon.

I guess I figured my issue with the VMs not sending logs have been a network issue. As stated in the documentation, VMs with the Agent installed need to have connection to the endpoints:

*.ods.opinsights.azure.com
*.ingest.monitor.azure.com
*.control.monitor.azure.com

Deploying via ARM does not automatically create VM system-assigned identity nor installs the agent automatically. I adjusted my deployments and policy deployIfNotExists template to enable and install these resources.

@SwathiDhanwada-MSFT, @Aaronmcd1978

Thanks for your detailed analysis @Aaronmcd1978 @XristophD . I am looking into it and will update you soon.

I guess I figured my issue with the VMs not sending logs have been a network issue. As stated in the documentation, VMs with the Agent installed need to have connection to the endpoints:

*.ods.opinsights.azure.com
*.ingest.monitor.azure.com
*.control.monitor.azure.com

Deploying via ARM does not automatically create VM system-assigned identity nor installs the agent automatically. I adjusted my deployments and policy deployIfNotExists template to enable and install these resources.

@Xristoph I can also deploy via ARM template but the template in question does not install the Monitor agent as it suggest

@Xristoph I can also deploy via ARM template but the template in question does not install the Monitor agent as it suggest

@xristoph I can also see Event logs from Windows Virtual machine. It needs to be conigured from the workspace in Advanced settings.

@xristoph I can also see Event logs from Windows Virtual machine. It needs to be conigured from the workspace in Advanced settings.

@SwathiDhanwada-MSFT . When I enable Data collection rule in the Azure Portal is does install Azure Monitor Agent automatically. Please see the following comment copied from the following page https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-data-collection-rules
"Create association with Azure VM
The following sample installs the Azure Monitor agent on a Windows Azure virtual machine. An association is created between an Azure virtual machine and a data collection rule."
"{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string",
"metadata": {
"description": "Name of the virtual machine."
}
},
"associationName": {
"type": "string",
"metadata": {
"description": "Name of the association."
}
},
"dataCollectionRuleId": {
"type": "string",
"metadata": {
"description": "Resource ID of the data collection rule."
}
}
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
"name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
"apiVersion": "2019-11-01-preview",
"properties": {
"description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
"dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
}
}
]
}
"
My question is it does not install Azure Monitor agent on a Windows Azure virtual machine. It does create an association between Azure Vm and DCR.
I realize Azure Monitor agent and data collection rules are in preview. But could you please advise if this template does install AMA agent or just creates an association.
Thank you for your help on this matter.

This is documentation bug which will be corrected soon. As mentioned earlier, creating an association between virtual machine and data collection rule doesn't install the AMA agent. Here is sample template for installing AMA agent using ARM template.

@SwathiDhanwada-MSFT . When I enable Data collection rule in the Azure Portal is does install Azure Monitor Agent automatically. Please see the following comment copied from the following page https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-data-collection-rules
"Create association with Azure VM
The following sample installs the Azure Monitor agent on a Windows Azure virtual machine. An association is created between an Azure virtual machine and a data collection rule."
"{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string",
"metadata": {
"description": "Name of the virtual machine."
}
},
"associationName": {
"type": "string",
"metadata": {
"description": "Name of the association."
}
},
"dataCollectionRuleId": {
"type": "string",
"metadata": {
"description": "Resource ID of the data collection rule."
}
}
},
"resources": [
{
"type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
"name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
"apiVersion": "2019-11-01-preview",
"properties": {
"description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
"dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
}
}
]
}
"
My question is it does not install Azure Monitor agent on a Windows Azure virtual machine. It does create an association between Azure Vm and DCR.
I realize Azure Monitor agent and data collection rules are in preview. But could you please advise if this template does install AMA agent or just creates an association.
Thank you for your help on this matter.

This is documentation bug which will be corrected soon. As mentioned earlier, creating an association between virtual machine and data collection rule doesn't install the AMA agent. Here is sample template for installing AMA agent using ARM template.

Also when can we expect DCR's to be able to deploy at scale via policies ect. ?

I am checking this information with Product Group team and revert to you with response.

Also when can we expect DCR's to be able to deploy at scale via policies ect. ?

I am checking this information with Product Group team and revert to you with response.

@xristoph I can also deploy via ARM template but the template in question does not install the Monitor agent as it suggest

@Aaronmcd1978 Here is a sample template which creates system managed identity , AMA agent and associates DCR rule with the azure vm. Kindly check it out.
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vmName": {
            "type": "string",
            "metadata": {
                "description": "Name of the virtual machine."
            }
        },
        "associationName": {
            "type": "string",
            "metadata": {
                "description": "Name of the association."
            }
        },
        "location": {
            "type": "string"
        },
        "dataCollectionRuleId": {
            "type": "string",
            "metadata": {
                "description": "Resource ID of the data collection rule."
            }
        }
    },
    "resources": [
        {
            "apiVersion": "2018-06-01",
            "type": "Microsoft.Compute/virtualMachines",
            "name": "[parameters('vmName')]",
            "location": "[resourceGroup().location]",
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {}
        },
        {
            "name": "[concat(parameters('vmName'),'/AzureMonitorWindowsAgent')]",
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "location": "[parameters('location')]",
            "apiVersion": "2020-06-01",
            "properties": {
                "publisher": "Microsoft.Azure.Monitor",
                "type": "AzureMonitorWindowsAgent",
                "typeHandlerVersion": "1.0",
                "autoUpgradeMinorVersion": true
            }
        },
        {
            "type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
            "name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
            "apiVersion": "2019-11-01-preview",
            "properties": {
                "description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
                "dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
            }
        }
    ]
}

@xristoph I can also deploy via ARM template but the template in question does not install the Monitor agent as it suggest

@Aaronmcd1978 Here is a sample template which creates system managed identity , AMA agent and associates DCR rule with the azure vm. Kindly check it out.
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vmName": {
            "type": "string",
            "metadata": {
                "description": "Name of the virtual machine."
            }
        },
        "associationName": {
            "type": "string",
            "metadata": {
                "description": "Name of the association."
            }
        },
        "location": {
            "type": "string"
        },
        "dataCollectionRuleId": {
            "type": "string",
            "metadata": {
                "description": "Resource ID of the data collection rule."
            }
        }
    },
    "resources": [
        {
            "apiVersion": "2018-06-01",
            "type": "Microsoft.Compute/virtualMachines",
            "name": "[parameters('vmName')]",
            "location": "[resourceGroup().location]",
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {}
        },
        {
            "name": "[concat(parameters('vmName'),'/AzureMonitorWindowsAgent')]",
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "location": "[parameters('location')]",
            "apiVersion": "2020-06-01",
            "properties": {
                "publisher": "Microsoft.Azure.Monitor",
                "type": "AzureMonitorWindowsAgent",
                "typeHandlerVersion": "1.0",
                "autoUpgradeMinorVersion": true
            }
        },
        {
            "type": "Microsoft.Compute/virtualMachines/providers/dataCollectionRuleAssociations",
            "name": "[concat(parameters('vmName'),'/microsoft.insights/', parameters('associationName'))]",
            "apiVersion": "2019-11-01-preview",
            "properties": {
                "description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
                "dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
            }
        }
    ]
}

Hi
When i create dcr with az REST API commands for windows Vm i still need to configure workspace to view event logs. When I create dcr the same way on a linux VM Syslogs are viewed automatically. Is there a reason for this ?

@Aaronmcd1978 Can you please elaborate on this ? Are you mentioning that even with creating any data source in DCR , were you able to view Linux syslogs?

Hi
When i create dcr with az REST API commands for windows Vm i still need to configure workspace to view event logs. When I create dcr the same way on a linux VM Syslogs are viewed automatically. Is there a reason for this ?

@Aaronmcd1978 Can you please elaborate on this ? Are you mentioning that even with creating any data source in DCR , were you able to view Linux syslogs?

Hi
When i create dcr with az REST API commands for windows Vm i still need to configure workspace to view event logs. When I create dcr the same way on a linux VM Syslogs are viewed automatically. Is there a reason for this ?

@Aaronmcd1978 Can you please elaborate on this ? Are you mentioning that even with creating any data source in DCR , were you able to view Linux syslogs?

@SwathiDhanwada-MSFT Sorry I am able to view required logs now. I just have one more question Is the Azure Monitor agent available to create  Azure Policy like @xristoph  has mentioned ?

@Aaronmcd1978 Apologies for late response. Here are custom policies that deploy agent and associated DCR.
CustomPolicy_DeployLinuxAgentAndAssociateDCR - Copy.txt
CustomPolicy_DeployWindowsAgentAndAssociateDCR - Copy.txt
As there are no further changes to the documentation , we will close the issue for now. If there are further questions , please revert and we will be glad to assist you.

Can you please tell me how can I create between an Azure Arc-enabled server and a data collection rule. I have created param.json file and template.json but can you please tell me how to execute it from pwershell

authors: Aaronmcd1978 SwathiDhanwada-MSFT XristophD majidqureshicdn


text:
Error 53-What I am missing.

Hi Guys,
I keep getting Error 53. I am able to mount the Azure File Share using the same VNet using a P2S connection and no issue. But mounting the blob storage keeps giving me error 53.   I have followed the following steps.

The Storage account is enabled with NFS, the storage account is created after "AllowNSF3" is registered (Get-AzProviderFeature -ProviderNamespace Microsoft.Storage -FeatureName AllowNFSV3 shows registered).
The Storage account is created after NFS3.0 enabled as mentioned in the doc.
The Storage account is configured to work with selected Vnet. I know networking side everything is working because I have both S2S and P2S working on the same Vnet/VNetGateway
Firewall outbound ports(both UDP and TCP) 111, 2048, 2049 are open on a client computer

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: abfc0bd3-6245-82ad-e782-d2464a6ce8df
Version Independent ID: aa79abce-6e1b-15b6-04c1-b7413c4b5f58
Content: Mount Azure Blob storage by using the NFS 3.0 protocol (preview)
Content Source: articles/storage/blobs/network-file-system-protocol-support-how-to.md
Service: storage
Sub-service: blobs
GitHub Login: @normesta
Microsoft Alias: normesta

If you have selected Standard performance you have to choose one of the following regions: Australia East, Korea Central, and South Central US.


text:
Regarding changes in Django file.

Amazing Page with a detailed procedure but it would be really great if also you start from the very basics (already build Django project on the local system to azure).
There aren't many articles on the internet which explain the changes to be made to default settings that are already provided while creating the Django project for deploying in azure.
Whereas Her**ku documentation clearly explains everything from scratch.
overall 8,5/10

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 1a96d5fc-0dd1-a344-5416-44039cee39b8
Version Independent ID: 72844ca4-b087-de15-be00-e0d87020a48b
Content: Tutorial: Deploy a Python Django app with Postgres - Azure App Service
Content Source: articles/app-service/tutorial-python-postgresql-app.md
Service: app-service
GitHub Login: @cephalin
Microsoft Alias: cephalin

Nikhil,  Thanks for taking time to share your valuable feedback on this Azure doc. We really appreciate the suggestions.
The doc aims to show step-step instructions on how to deploy Django web app and connect it to an Azure Database for Postgres database. The tutorial is meant to show something more involved, but still allow readers to learn things beyond a specific framework. For example, here you learn how to set environment variables and access them, create and connect with Azure Database for PostgreSQL database, deploying code to App Service and updating the code. This doc doesn’t aim to teach Django, but provides a walkthrough with the sample app only.
You may wish to check these docs for more additional info:
Azure for Python Developers
Quickstart: Create a Python app using Azure App Service on Linux

Configure a Linux Python app for Azure App Service
Hope this explanation helps.

authors: AjayKumar-MSFT nikhilnaregal


text:
Screen prompts don't match for adding a "key"

Step 6:

In the Settings menu, click on Keys and add a new key (also known as client secret). Also copy it for use in a later section..

I believe changing the wording to "add a new password" would better match what's on the screen.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 4a4b8453-d2bc-9c8d-bb16-26fa7e4c6363
Version Independent ID: 160642fc-b5a9-1ebe-7daf-105509b6e2f4
Content: Use the Graph API - Azure AD B2C
Content Source: articles/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.md
Service: active-directory-b2c
GitHub Login: @davidmu1
Microsoft Alias: davidmu

@nhwilly Thanks for your feedback! We will investigate and update as appropriate.

@nhwilly Thanks for reporting! I have assigned the issue to the author to investigate and update as appropriate.

Changed the steps to:

In the Settings menu, click Keys.
In the Passwords section, enter the key description and select a duration, and then click Save. Copy the key value (also known as Client Secret) for use in a later section.

#please-close

authors: MohitGargMSFT SaurabhSharma-MSFT davidmu1 nhwilly


text:
Debian 10 support

[Enter feedback here]
Are there any timelines for Debian 10 support for either Azure Monitor or VM Insights?
According to documentation, Azure Monitor Agent is supported in Debian 10, but there seems no way to make use of it just installing only Azure Monitor Agent, and attempt to enable monitoring from Azure Monitor ends up attempting to install also Log Analytics agent and Dependency agent, which are not supported.
Thanks!

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: c887fb7a-6d9d-b9f4-4896-5e2fb440ffca
Version Independent ID: 86a368f8-6d32-eba0-db92-8deeee732724
Content: Enable VM insights overview - Azure Monitor
Content Source: articles/azure-monitor/vm/vminsights-enable-overview.md
Service: azure-monitor
Sub-service: virtual-machines
GitHub Login: @bwren
Microsoft Alias: bwren

@juanandmsft Thanks for your feedback! We will investigate and update as appropriate.

@juanandmsft My sincere apologies for delay on getting back to this thread. I am validating this with our internal PG team and as soon as we have an update, will keep this thread updated.

@juanandmsft We really appreciate your patience on this , we did hear back from our product team. It seems that the scenario you called out  should not be happening at all. Installing AMA will not install LA agent or DA today.
However to better understand your issue, the recommendation was to create a support ticket on this and they can help you to further troubleshoot the issue. We will certainly internally track the issue and see if there are document enhancements needed post the resolution of issue and will adopt it accordingly.
At this point it appears that there's no further edits or updates needed to the documentation. We will go ahead and close this issue for now, however if you have any further feedback on the document please tag us in your reply and will be happy to reopen the thread and continue the conversation. Thank you


text:
Minor grammar

Under Prerequisites

If you don't have one of "theses" subscriptions should be "these".

Under Edit terms of use details

Require users to expand the terms of use – Setting this to On will force the end "use" to expand... should be "user".

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 618ca851-56c8-5ba1-35de-a7b8e7af8aa2
Version Independent ID: 5facc663-2e29-65ad-f208-982150351b22
Content: Terms of use - Azure Active Directory
Content Source: articles/active-directory/conditional-access/terms-of-use.md
Service: active-directory
Sub-service: compliance
GitHub Login: @MicrosoftGuyJFlo
Microsoft Alias: joflore

@infosecray  Thank you for your feedback . We will investigate and update the thread further.

authors: amanmcse infosecray


text:
Could you please clarify our understanding about this doc?

The FAQ section says enabling the customer managed keys does not incur an additional charge, but it also says "When using customer-managed keys, Request Units consumed by your database operations see an increase to reflect the additional processing required to perform encryption and decryption of your data".
Customer understood there are no initial charges but they wonder if there are any charges using COMSOS DB AFTER after enabling the customer managed keys.
Does  "enabling the customer managed keys does not incur an additional charge" mean no initial charges as well as the incurring charges in the future for COSMOS DB?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 5d8489d0-7ec1-59bb-053c-014af93c4095
Version Independent ID: ec72532b-c8ac-92c9-5bed-0e497660e4ea
Content: Configure customer-managed keys for your Azure Cosmos DB account
Content Source: articles/cosmos-db/how-to-setup-cmk.md
Service: cosmos-db
GitHub Login: @ThomasWeiss
Microsoft Alias: thweiss

@v-hakob When using customer-managed keys, the RUs consumed by your database operations see a slight increase. So an operation that used to charge 2.5 RUs may charge 2.8 RUs instead for example. In provisioned throughput mode, this doesn't have any direct cost impact because you pay for the throughput that you've provisioned, not for the RUs consumed - and this increase in RUs doesn't necessarily mean that you will have to increase the provisioned throughput as a result.

@ThomasWeiss , thank you for the quick response and explanation.

Sorry @ThomasWeiss, the cx asked if it uses the COSMOS DB free tier which is allowed one account per subscription.
You said it does not impact costs but I don't think you said it uses the free tier. Could you kindly clarify this? Thank you.

@v-hakob With the free tier, Cosmos DB users can provision up to 1,000 RU/s for free. Using customer-managed keys on a free tier account doesn't change anything about that - you still get 1,000 RU/s for free, but as mentioned above, the RU charge for individual database operations will be slightly higher.

Thank you @ThomasWeiss for the quick response. Sorry, I still need help.
For Azure Sentinel, as long as I see Step 3 in this doc, Azure Sentinel works with Cosmos DB just as an additional storage resource in addition to the Log Analytics clusters.
https://docs.microsoft.com/en-us/azure/sentinel/customer-managed-keys
The doc explains about the pricing for LA clusters but not for COSMOS DB at all. Do we expect any chargeable operations/any RUs in COSMOS DB when using CMK or Azure Sentinel?

@v-hakob I am not familiar with Azure Sentinel. I would suggest opening a GitHub issue against the page you've just referenced - the Azure Sentinel team should be able to better address your question.

@ThomasWeiss , noted. Thank you for the advice.

authors: ThomasWeiss v-hakob


text:
Error when deploying ApiMgmtDeployment template and parameter files

After deploying the first template/parameter files I am unable to deploy the second due to the subnet being in use? Is the first deployment putting the subnet in a state so it can't be changed for the second?
I get the following error message:
"Subnet Subnet-0 is in use by /subscriptions/[subscription]/resourceGroups/[resourceGroup]/providers/Micros
oft.Network/networkInterfaces/|providers|Microsoft.Compute|virtualMachineScaleSets|service|virtualMachines|0|networkInterfaces|NIC-[sfclustername]-0/ipConfigurations/NIC-[sfclustername]-0 and cannot be updated with resource navigation links for external resources."

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 93a7a08f-2b74-eece-b263-03ab211cf805
Version Independent ID: 73bbdc61-d007-687f-9f78-a0e5a9de1f28
Content: Integrate Azure Service Fabric with API Management
Content Source: articles/service-fabric/service-fabric-tutorial-deploy-api-management.md
Service: service-fabric
GitHub Login: @rwike77
Microsoft Alias: ryanwi

@kwilkins Thanks for the feedback! We are currently investigating and will update you shortly.

@rwike77 can you take a look at this one?

I'm taking another stab at this, I might have mistaken some parameters in the first script.  API Management has to be the sole resource on a subnet correct?

Okay so it was my misunderstanding of how the virtual network was configured. As much as the template deployment files do take care of everything, it is really hard to follow what is going on or how things work together. I'd love to see a step by step or deep dive on configuring APIM with Service Fabric, took me about 2 weeks to piece together what is going on.
One question I have: why can't we add an Microsoft.ApiManagement/service/backend through the portal? That seems like the only missing piece to configure through a web browser.
If this helps anyone reading this later, when deploying the network-apim, the virtual network name parameter should match what your service fabric cluster runs on, BUT you should be creating a new subnet(apim-subnet is default parameter) to configure your api management service to.
In the end I followed a slightly different set of steps since I already had a service fabric cluster and api management service existing that I wanted to use.

I had already created the API Management service so I uploaded the cluster certificate(Security -> Client Certificates)
I deployed the network-apim.json to setup the network security group and the additional subnet for the apim
Connect your APIM to the virtual network through the portal (Settings -> Virtual Network) and use the following setup: External, select the VNet for your cluster, select the apim-subnet linked with the new Network Security Group
I edited the apim.json template to remove the apim creation and certificate creation(this also involves removing references to these resources in all "dependsOn" sections from the other resources)

authors: MicahMcKittrick-MSFT kwilkins


text:
Update article to use empty subnet for webapp

vnet integration for App Service require and empty subnet with Microsoft.Web/serverFarms delegation. The current turorial tries to integrate into the subnet that already is delegated to postgres. Article should create a new subnet for web app before trying to integrate to it.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: f1891a95-019e-8644-ec3f-8723b778ec5c
Version Independent ID: 81c0513e-1628-e2c3-e65f-9b4d52ddfad4
Content: Tutorial on how to Deploy Django app with App Service and Azure Database for PostgreSQL - Flexible Server in virtual network
Content Source: articles/postgresql/flexible-server/tutorial-django-app-service-postgres.md
Service: postgresql
Sub-service: flexible-server
GitHub Login: @mksuni
Microsoft Alias: sumuth

Also reported here: https://github.com/Azure/azure-cli/issues/16939

@madsd Thanks for your comment. We will review the issue and get back to you shortly.

#reassign @kabharati

We sincerely apologize for the delayed response to this issue. I collaborate with the owners of the GitHub Issues related to PostgreSQL to help either get them resolved or determine how to update our documentation.
As such, is this GitHub Issue still a concern for you? If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion, and we will reopen the issue.
Please visit https://docs.microsoft.com/en-us/answers/support/ for more information on asking questions about the product or service.
Thank you.

Hi @markingmyname Yes, this is still a concern/problem

Thank you, @madsd.
@kabharati can we help investigate this, please?
thank you.

#assign @GennadNY

#assign: @GennadNY

Users gennadny are already assigned.

@markingmyname - makes sense - working on it

updated article
#please-close

Hey, I come here because I was following the tutorial and encountered the same issue. Just a reminder that this article was still not updated. Would be great if an updated version of the article would be pushed.

#please-open

article updated.
#please-close

authors: GennadNY PRMerger4 SwathiDhanwada-MSFT gcmestre madsd markingmyname