Merge pull request #314865 from MicrosoftDocs/main

learn-build-service-prod[bot] · web-flow · commit 530859bb18fa · 2026-04-17T11:08:16.000Z
Auto Publish – main to live - 2026-04-17 11:00 UTC
diff --git a/articles/application-gateway/configuration-http-settings.md b/articles/application-gateway/configuration-http-settings.md
@@ -181,6 +181,9 @@ This capability establishes direct, one-to-one mapping between frontend and back
 >[!NOTE]
 >To enable NTLM or Kerberos passthrough authentication, ensure that the Dedicated Backend Connection setting is turned on. This configuration maintains a one-to-one mapping between frontend and backend connections, which is essential for preserving session integrity required by these authentication protocols.
 
+>[!NOTE]
+>If your environment includes legacy clients running older browsers like MSIE 6 or clients that send legacy User-Agent header (eg:MSIE6), enabling Dedicated Backend Connection will lead to connectivity issues. This is due to known defects in MSIE 6's HTTP/1.1 and keep-alive implementations, which can result in unexpected connection failures.To ensure a stable and reliable experience, upgrading these clients to a modern browser or client stack is  recommended.
+
 >[!IMPORTANT]
 >Dedicated backend connection leads to an increase in the number of backend connections and hence could require more resources to support the increased concurrent connections on Application Gateway and the backend servers. On Application Gateway, you must consider increasing the number of instances or enabling auto scale.
 >
diff --git a/articles/backup/backup-support-matrix-mars-agent.md b/articles/backup/backup-support-matrix-mars-agent.md
@@ -200,6 +200,7 @@ The following table lists the previous versions of the agent with their download
 [2.0.9207.0](https://download.microsoft.com/download/b/5/a/b5a29638-1cef-4906-b704-4d3d914af76e/MARSAgentInstaller.exe) | [5001305](https://support.microsoft.com/help/5001305)
 [2.0.9415.0](https://download.microsoft.com/download/MARSAgentInstaller.exe) |[5059322](https://support.microsoft.com/help/5059322) 
 [2.0.9506.0](https://download.microsoft.com/download/398f1a94-03fb-4de2-af98-dbe8ff925f49/MARSAgentInstaller.exe) | [5068415](https://support.microsoft.com/help/5068415)
+[2.0.9615.0](https://download.microsoft.com/download/2e59c45d-c285-4547-9285-f054591b43c5/MARSAgentInstaller.exe) | [5085049](https://support.microsoft.com/help/5085049)
 
 >[!NOTE]
 >MARS agent versions with minor reliability and performance improvements don't have a KB article.
diff --git a/articles/iot-operations/connect-to-cloud/overview-dataflow-comparison.md b/articles/iot-operations/connect-to-cloud/overview-dataflow-comparison.md
@@ -18,13 +18,13 @@ Azure IoT Operations provides two ways to process and route data: **data flows**
 
 ## What are data flows?
 
-A [data flow](overview-dataflow.md) is a simple, linear pipeline that moves data from a source to a destination with optional transformations. The transformation stage runs three operations in a fixed order: enrich, filter, then map. You configure a data flow by creating a `Dataflow` custom resource.
+A [data flow](overview-dataflow.md) is a simple, linear pipeline that moves data from a source to a destination with optional transformations. The transformation stage runs three operations in a fixed order: enrich, filter, then map. You configure a data flow by using the operations experience web UI, the Azure CLI, or Azure Resource Manager templates.
 
 Data flows are generally available and support all endpoint types.
 
 ## What are data flow graphs?
 
-A [data flow graph](concept-dataflow-graphs.md) is a composable, graph-based pipeline that connects multiple transforms in any topology you define. You can chain, branch, and merge processing steps. Each transform is a pre-built processing unit (map, filter, branch, window, enrichment) that you configure with rules. You configure a data flow graph by creating a `DataflowGraph` custom resource.
+A [data flow graph](concept-dataflow-graphs.md) is a composable, graph-based pipeline that connects multiple transforms in any topology you define. You can chain, branch, and merge processing steps. Each transform is a pre-built processing unit (map, filter, branch, window, enrichment) that you configure with rules. You configure a data flow graph by using the operations experience web UI, the Azure CLI, or Azure Resource Manager templates.
 
 Data flow graphs support MQTT, Kafka, and OpenTelemetry endpoints.
 
diff --git a/articles/iot-operations/connect-to-cloud/overview-dataflow.md b/articles/iot-operations/connect-to-cloud/overview-dataflow.md
@@ -13,7 +13,7 @@ ms.date: 03/19/2026
 
 # Process and route data with data flows
 
-Data flows simplify the setup of data paths to move, transform, and enrich data. By using data flows, you can connect various data sources and perform data operations. The data flow component is part of Azure IoT Operations, which you deploy as an Azure Arc extension. You configure a data flow by using Kubernetes custom resource definitions (CRDs).
+Data flows simplify the setup of data paths to move, transform, and enrich data. By using data flows, you can connect various data sources and perform data operations. The data flow component is part of Azure IoT Operations, which you deploy as an Azure Arc extension. You configure a data flow by using the operations experience web UI, the Azure CLI, or Azure Resource Manager templates.
 
 You can write configurations for various use cases, such as:
 
@@ -50,13 +50,13 @@ You can apply transformations to data during the processing stage to perform var
 
 ### Configuration and deployment
 
-Specify the configuration by using Kubernetes CRDs. Based on this configuration, the data flow operator creates data flow instances to ensure high availability and reliability.
+Specify the configuration by using the operations experience web UI, the Azure CLI, or Azure Resource Manager templates. Based on this configuration, the data flow operator creates data flow instances to ensure high availability and reliability.
 
 ## Benefits
 
 - **Simplified setup**: Easily connect data sources and destinations.
 - **Flexible transformations**: Perform a wide range of data operations.
-- **Scalable configuration**: Use Kubernetes CRDs for scalable and manageable configurations.
+- **Scalable configuration**: Use Azure tools for scalable and manageable configurations.
 - **High availability**: Kubernetes native resource ensures reliability.
 
 By using data flows, you can efficiently manage your data paths. You can ensure that data is accurately sent, transformed, and enriched to meet your operational needs.
diff --git a/articles/iot-operations/deploy-iot-ops/howto-deploy-iot-operations.md b/articles/iot-operations/deploy-iot-ops/howto-deploy-iot-operations.md
@@ -218,6 +218,7 @@ az iot ops get-versions
 
 ## Next steps
 
+- See these scripts in GitHub to automate a [production-ready deployment with secure settings](https://github.com/Azure-Samples/explore-iot-operations/blob/main/quickstart/readme.md).
 - If your components need to connect to Azure endpoints like SQL or Fabric, learn how to [Manage secrets for your Azure IoT Operations deployment](../deploy-iot-ops/howto-manage-secrets.md).
 - To upgrade your Azure IoT Operations deployment to a newer version, see [Upgrade Azure IoT Operations](./howto-upgrade.md).
 
diff --git a/articles/iot-operations/discover-manage-assets/concept-assets-devices.md b/articles/iot-operations/discover-manage-assets/concept-assets-devices.md
@@ -72,6 +72,8 @@ An asset is a configuration resource that represents a physical device or asset
 - An Azure Resource Manager resource in the cloud.
 - A Kubernetes custom resource at the edge.
 
+The cloud is always the source of truth for asset configuration. Always create and modify assets through Azure—by using the operations experience, the Azure portal, the Azure CLI, or ARM/Bicep templates. Don't create or edit the Kubernetes custom resources directly on the cluster.
+
 When you define an asset by using the operations experience or the Azure IoT Operations CLI, set up schema information like data points, tags, events, and streams for each asset.
 
 The type of inbound endpoint that the asset connects to determines what schema elements you define for the asset. For example, if the asset connects to an OPC UA server, define tags and events. If the asset connects to a media resource, define streams.
diff --git a/articles/iot-operations/discover-manage-assets/overview-manage-assets.md b/articles/iot-operations/discover-manage-assets/overview-manage-assets.md
@@ -107,6 +107,9 @@ Device Registry uses namespaces to organize assets and devices. Each Azure IoT O
 
 Manage devices and assets through the operations experience or through Azure APIs and tools like Azure Resource Graph. Changes made in the cloud sync to the edge and appear as custom resources in the Kubernetes cluster.
 
+> [!IMPORTANT]
+> The cloud is always the source of truth for device and asset configuration. Always create and modify devices and assets through Azure—by using the operations experience, the Azure portal, the Azure CLI, or ARM/Bicep templates. Don't create or edit Kubernetes custom resources directly on the cluster. Resources created directly on the cluster don't sync to the cloud, and direct edits to existing custom resources on the cluster can cause the cloud and edge to go out of sync.
+
 ### Akri services
 
 Akri services in Azure IoT Operations:
diff --git a/articles/iot-operations/discover-manage-assets/overview-opc-ua-connector.md b/articles/iot-operations/discover-manage-assets/overview-opc-ua-connector.md
@@ -48,7 +48,7 @@ The connector for OPC UA supports the following features as part of Azure IoT Op
 | Certificate trust list | Yes | For secure, encrypted OPC UA connections |
 | OpenTelemetry integration | Yes | |
 | Automatic reconnection | Yes | Reconnects to OPC UA servers after failures |
-| Multiple server connections | Yes | Configured using Kubernetes `device` CRs |
+| Multiple server connections | Yes | Configured using `device` resources |
 | OPC UA PubSub format | Yes | JSON-encoded data value changes |
 | CloudEvents headers | Yes | Message headers as MQTT user properties |
 | OPC UA events | Yes | Predefined event fields |
diff --git a/articles/iot-operations/end-to-end-tutorials/tutorial-add-assets.md b/articles/iot-operations/end-to-end-tutorials/tutorial-add-assets.md
@@ -26,7 +26,7 @@ In this tutorial, you use the operations experience web UI to create your assets
 
 An instance of Azure IoT Operations with secure settings enabled deployed in a Kubernetes cluster. To create an instance, use one of the following to deploy Azure IoT Operations:
 
-- [Quickstart: Run Azure IoT Operations in GitHub Codespaces with K3s](../get-started-end-to-end-sample/quickstart-deploy.md) provides simple instructions to deploy an Azure IoT Operations instance that you can use for the tutorials. These instructions include deploying the connector for OPC UA that's a prerequisite for this tutorial. Then, to enable secure settings follow the steps in [Enable secure settings in Azure IoT Operations](../deploy-iot-ops/howto-enable-secure-settings.md).
+- Use these scripts in GitHub for an automated [deployment with secure settings](https://github.com/Azure-Samples/explore-iot-operations/blob/main/quickstart/readme.md).
 - [Deployment overview](../deploy-iot-ops/overview-deploy.md) provides detailed instructions to deploy an Azure IoT Operations instance on Windows using Azure Kubernetes Service Edge Essentials or Ubuntu using K3s. Follow the steps in the deployment article for a secure settings deployment and to install the latest version.
 
 > [!IMPORTANT]
diff --git a/articles/iot-operations/get-started-end-to-end-sample/quickstart-deploy.md b/articles/iot-operations/get-started-end-to-end-sample/quickstart-deploy.md
@@ -26,6 +26,7 @@ We use GitHub Codespaces as a virtual environment for this quickstart so that yo
 > Codespaces are easy to set up quickly and tear down later, but they're not suitable for production, performance evaluation, or scale testing. Use GitHub Codespaces for exploration only.
 >
 > The Codespaces environment is sufficient to complete the quickstart steps, but doesn't support advanced configurations like _secure settings_.
+> See these scripts in GitHub for a [production-ready deployment with secure settings](https://github.com/Azure-Samples/explore-iot-operations/blob/main/quickstart/readme.md).
 
 ## Prerequisites
 
diff --git a/articles/iot-operations/manage-mqtt-broker/overview-broker.md b/articles/iot-operations/manage-mqtt-broker/overview-broker.md
@@ -53,6 +53,9 @@ For configuration, the MQTT broker uses several Kubernetes custom resources to d
 - A Broker resource can have up to three [BrokerListeners](/rest/api/iotoperations/broker-listener), each of which listens for incoming MQTT connections on the specified service type (`NodePort`, `LoadBalancer`, or `ClusterIP`). Each BrokerListener resource can have multiple ports.
 - Each port within a BrokerListener resource can be associated with a [BrokerAuthentication](/rest/api/iotoperations/broker-authentication) resource and a [BrokerAuthorization](/rest/api/iotoperations/broker-authorization) resource. These authentication and authorization policies determine which clients can connect to the port and what actions they can perform on the broker.
 
+> [!IMPORTANT]
+> Use the Azure portal or Azure CLI to manage broker listeners.
+
 The relationship between Broker and BrokerListener is *one-to-many*, while the relationship between BrokerListener and BrokerAuthentication/BrokerAuthorization is *many-to-many*. The entity relationship diagram for these resources is:
 
 <!-- ```mermaid
diff --git a/articles/iot-operations/overview-iot-operations.md b/articles/iot-operations/overview-iot-operations.md
@@ -118,3 +118,4 @@ To visualize and analyze sensor data and messages from your devices and assets,
 ## Related content
 
 * [Get started with an end-to-end sample](get-started-end-to-end-sample/quickstart-deploy.md)
+* [Deploy a production-ready cluster](https://github.com/Azure-Samples/explore-iot-operations/blob/main/quickstart/readme.md)
diff --git a/articles/iot-operations/troubleshoot/tips-tools.md b/articles/iot-operations/troubleshoot/tips-tools.md
@@ -27,6 +27,9 @@ However, in a debug or test environment you can  manage the components of Azure
 - Unless you enable resource sync in Azure IoT Operations using `az iot ops enable-rsync` command, changes made to the resources using Kubernetes deployment manifests are not synced to Azure. To learn more about resource sync, see [Resource sync](/azure/azure-arc/data/resource-sync).
 - Even if resource sync is enabled, brand new resources created using Kubernetes deployment manifests are not synced to Azure. Only changes to existing resources are synced.
 
+> [!IMPORTANT]
+> In production, the cloud is always the source of truth. Always create and modify resources through Azure—by using the operations experience, the Azure portal, the Azure CLI, or ARM/Bicep templates. Creating resources directly on the cluster or editing existing Kubernetes custom resources can cause the cloud and edge to go out of sync and isn't supported in production environments.
+
 ### `kubectl`
 
 `kubectl` is the Kubernetes command-line tool for managing your cluster. It has many capabilities that you can learn about in the official [kubernetes documentation](https://kubernetes.io/docs/reference/kubectl/introduction/). This article describes the common uses for `kubectl` when you're working with Azure IoT Operations such as listing the running pods and viewing logs.
diff --git a/articles/sentinel/datalake/sentinel-mcp-get-started.md b/articles/sentinel/datalake/sentinel-mcp-get-started.md
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Security
 description: Learn how to set up and use Microsoft Sentinel's Model Context Protocol (MCP) collection of security tools to enable natural language queries and AI-powered security investigations 
 author: poliveria
 ms.topic: get-started
-ms.date: 01/30/2026
+ms.date: 04/17/2026
 ms.author: pauloliveria
 ms.service: microsoft-sentinel
 ms.subservice: sentinel-platform
@@ -55,5 +55,8 @@ After adding Microsoft Sentinel's collection of tools, use the following sample
 
 To understand how agents invoke these tools to answer these prompts, see [How Microsoft Sentinel MCP tools work alongside your agent](sentinel-mcp-data-exploration-tool.md#how-microsoft-sentinel-mcp-tools-work-alongside-your-agent).
 
+## Turn off Microsoft Sentinel MCP tool access
+To turn off your access to Microsoft Sentinel's collection of MCP tools, contact customer support.
+
 ## Next step
 - [Tool collection in Microsoft Sentinel MCP server](sentinel-mcp-tools-overview.md)
diff --git a/articles/service-connector/tutorial-django-webapp-postgres-cli.md b/articles/service-connector/tutorial-django-webapp-postgres-cli.md

Original file line number	Diff line number	Diff line change
`@@ -181,6 +181,9 @@ This capability establishes direct, one-to-one mapping between frontend and back`
`181`	`181`	`>[!NOTE]`
`182`	`182`	`>To enable NTLM or Kerberos passthrough authentication, ensure that the Dedicated Backend Connection setting is turned on. This configuration maintains a one-to-one mapping between frontend and backend connections, which is essential for preserving session integrity required by these authentication protocols.`
`183`	`183`
	`184`	`+>[!NOTE]`
	`185`	`+>If your environment includes legacy clients running older browsers like MSIE 6 or clients that send legacy User-Agent header (eg:MSIE6), enabling Dedicated Backend Connection will lead to connectivity issues. This is due to known defects in MSIE 6's HTTP/1.1 and keep-alive implementations, which can result in unexpected connection failures.To ensure a stable and reliable experience, upgrading these clients to a modern browser or client stack is recommended.`
	`186`	`+`
`184`	`187`	`>[!IMPORTANT]`
`185`	`188`	`>Dedicated backend connection leads to an increase in the number of backend connections and hence could require more resources to support the increased concurrent connections on Application Gateway and the backend servers. On Application Gateway, you must consider increasing the number of instances or enabling auto scale.`
`186`	`189`	`>`
Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,7 @@ We use GitHub Codespaces as a virtual environment for this quickstart so that yo`
`26`	`26`	`> Codespaces are easy to set up quickly and tear down later, but they're not suitable for production, performance evaluation, or scale testing. Use GitHub Codespaces for exploration only.`
`27`	`27`	`>`
`28`	`28`	`> The Codespaces environment is sufficient to complete the quickstart steps, but doesn't support advanced configurations like _secure settings_.`
	`29`	`+> See these scripts in GitHub for a [production-ready deployment with secure settings](https://github.com/Azure-Samples/explore-iot-operations/blob/main/quickstart/readme.md).`
`29`	`30`
`30`	`31`	`## Prerequisites`
`31`	`32`