Skip to content

Commit 81c31b3

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #313484 from MicrosoftDocs/main
Auto Publish – main to live - 2026-03-21 06:00 UTC
2 parents 146dbb0 + 870ecb9 commit 81c31b3

13 files changed

Lines changed: 139 additions & 72 deletions

‎articles/dev-box/overview-what-is-microsoft-dev-box.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ author: RoseHJM
99
ms.date: 10/31/2025
1010
adobe-target: true
1111

12-
#Customer intent: #Customer intent: As a platform engineer, I want to understand what Microsoft Dev Box is and how it can help developer teams, so that I can efficiently set up and use cloud development environments for my teams.
12+
#Customer intent: As a platform engineer, I want to understand what Microsoft Dev Box is and how it helps developer teams, so that I can efficiently set up and use cloud development environments for my teams.
1313
---
1414

1515
# What is Microsoft Dev Box?

‎articles/high-performance-computing/index.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,12 +111,12 @@ productDirectory:
111111
links:
112112
- url: https://www.aka.ms/Microsoft-NVIDIA/HPCwire
113113
text: Microsoft - NVIDIA
114-
- url: https://insidehpc.com/2023/03/manufacturing-repatriation-how-hpc-class-technologies-from-microsoft-azure-and-amd-support-manufacturers-reshoring-strategies/
115-
text: Microsoft - AMD
116-
- url: https://insidehpc.com/2022/10/staying-at-the-cutting-edge-of-automotive-design-technology-with-azure-cloud-platform-and-amd/
117-
text: Azure Cloud and AMD for Manufacturing
118-
- url: https://insidehpc.com/2023/03/azure-amd-and-the-power-of-cloud-based-hpc-for-sustainability-rd-projects/
119-
text: Azure and AMD for Sustainability
114+
# - url: https://insidehpc.com/2023/03/manufacturing-repatriation-how-hpc-class-technologies-from-microsoft-azure-and-amd-support-manufacturers-reshoring-strategies/
115+
# text: Microsoft - AMD
116+
# - url: https://insidehpc.com/2022/10/staying-at-the-cutting-edge-of-automotive-design-technology-with-azure-cloud-platform-and-amd/
117+
# text: Azure Cloud and AMD for Manufacturing
118+
# - url: https://insidehpc.com/2023/03/azure-amd-and-the-power-of-cloud-based-hpc-for-sustainability-rd-projects/
119+
# text: Azure and AMD for Sustainability
120120

121121
# Card
122122
- title: Related Technologies

‎articles/migrate/postgresql-assessment-properties.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ General assessment properties in Azure Migrate (preview) help set up key configu
2626
| **Right-Sizing**  | **Performance history**  | Used with performance-based sizing. Performance history specifies the duration used when performance data is evaluated. |
2727
| **Right-Sizing** | **Percentile utilization**  | Used with performance-based sizing. Percentile utilization specifies the percentile value of the performance sample used for rightsizing. Learn more about [sampling mechanism](target-right-sizing.md). |
2828
| **Right-Sizing** | **Comfort factor**  | This is the buffer applied during assessment. It's a multiplying factor used with performance metrics of CPU, RAM, disk, and network data for VMs. It accounts for issues like seasonal usage, short performance history, and likely increases in future usage. The comfort factor is applied irrespective of type of assessment (As-is on premises or performance based). For **performance-based** assessment, it's multiplied with utilization value of the resources, whereas for **As-is on premises** assessment it's multiplied by allocated resources. <br> The default values change. <br> For example, a 10-core VM with 20% utilization normally results in a two-core VM. With a comfort factor of 2.0, the result is a four-core VM instead. |
29-
| **Pricing settings**  | **Default savings option**  | Specify the savings option that you want the assessment to consider to help optimize your Azure compute cost. </br> [Azure reservations](/azure/cost-management-billing/reservations/save-compute-costs-reservations?view=migrate&preserve-view=true) (One year or three years reserved) are a good option for the most consistently running resources. </br> [Azure Savings Plan](/azure/cost-management-billing/savings-plan/savings-plan-compute-overview?view=migrate&preserve-view=true) (One year or three years savings plan) provide additional flexibility and automated cost optimization. </br> When you select **None**, the Azure compute cost is based on the pay-as-you-go rate considering 730 hours as VM uptime, unless specified otherwise in VM uptime attribute.|
29+
| **Pricing settings**  | **Default savings option**  | Specify the savings option that you want the assessment to consider to help optimize your Azure compute cost. </br> [Azure reservations](/azure/cost-management-billing/reservations/save-compute-costs-reservations?view=migrate&preserve-view=true) (One year or three years reserved) are a good option for the most consistently running resources. </br> [Azure Savings Plan](/azure/cost-management-billing/savings-plan/savings-plan-overview?view=migrate&preserve-view=true) (One year or three years savings plan) provide additional flexibility and automated cost optimization. </br> When you select **None**, the Azure compute cost is based on the pay-as-you-go rate considering 730 hours as VM uptime, unless specified otherwise in VM uptime attribute.|
3030
| |**Offer/Licensing program**| The [Azure offer](https://azure.microsoft.com/support/legal/offer-details/) in which you're enrolled. The assessment estimates the cost for that offer. Select one of the pay-as-you-go, Enterprise Agreement support, or pay-as-you-go Dev/Test. </br> You need to select pay-as-you-go in offer/licensing program to be able to use Reserved Instances or Azure Savings Plan. When you select any savings option other than **None**, the *Discount (%)* and *VM uptime* properties aren't applicable. The monthly cost estimates are calculated by multiplying 744 hours in the VM uptime field with the hourly price of the recommended SKU.|
3131
| |**Currency** | The billing currency for your account.|
3232
| |**Discount (%)** | Any subscription-specific discounts you receive on top of the Azure offer. The default setting is 0%. |
@@ -39,4 +39,4 @@ General assessment properties in Azure Migrate (preview) help set up key configu
3939

4040
- [Least privilege PostgreSQL account](postgresql-least-privilege-configuration.md).
4141
- [PostgreSQL workloads for Migration to Azure](tutorial-assess-postgresql.md).
42-
- [Review PostgreSQL assessment](tutorial-review-postgresql-report.md).
42+
- [Review PostgreSQL assessment](tutorial-review-postgresql-report.md).

‎articles/networking/security/includes/25535.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,13 @@ ms.custom: Network-Secure-Recommendation
1313
# userimpact: Low
1414
# implementationcost: Medium
1515
---
16-
Azure Firewall is a cloud-native network security service that provides centralized inspection, logging, and enforcement for outbound traffic. However, using Azure Firewall alone for outbound connectivity can lead to SNAT port exhaustion under high-traffic workloads. The recommendation is to deploy NAT Gateway alongside Azure Firewall — Azure Firewall handles outbound security inspection (threat intelligence filtering, intrusion detection and prevention, TLS inspection, and egress policy enforcement), while NAT Gateway provides scalable SNAT ports for the actual outbound traffic flow. In a secure network architecture, outbound traffic from VNet-integrated workloads such as VMs, AKS clusters, App Service, and Functions should be explicitly routed through Azure Firewall before reaching external services, with NAT Gateway configured on the AzureFirewallSubnet to handle outbound translation. Without this combined approach, organizations risk either uninspected outbound traffic or SNAT port exhaustion leading to dropped connections. This check verifies that effective network routes direct outbound traffic to the firewall's private IP address for eligible workloads across all subscriptions.
16+
Azure Firewall is a cloud-native network security service that provides centralized inspection, logging, and enforcement for outbound traffic. In a secure network architecture, outbound traffic from VNet-integrated workloads such as VMs, AKS clusters, App Service, and Functions should be explicitly routed through Azure Firewall before reaching external services. This routing ensures that outbound security inspection — including threat intelligence filtering, intrusion detection and prevention, TLS inspection, and egress policy enforcement — is applied to all outbound flows. Without this routing, outbound traffic bypasses the firewall entirely, leaving the environment exposed to data exfiltration and command-and-control communication. This check verifies that effective network routes direct outbound traffic to the firewall's private IP address for eligible workloads across all subscriptions.
17+
18+
For high-traffic workloads that risk SNAT port exhaustion, consider deploying [Azure NAT Gateway alongside Azure Firewall](/azure/firewall/integrate-with-nat-gateway). NAT Gateway provides up to 64,512 SNAT ports per public IP address compared to Azure Firewall's 2,496 SNAT ports per public IP per instance. When associated with the AzureFirewallSubnet, NAT Gateway handles outbound translation while Azure Firewall continues to inspect traffic — with no double NAT.
1719

1820
**Remediation action**
1921

20-
- [Configure Azure Firewall routing](/azure/firewall/tutorial-firewall-deploy-portal#configure-routing)
22+
- [Configure Azure Firewall routing](/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route)
2123
- [Manage route tables and routes](/azure/virtual-network/manage-route-table)
2224
- [Control App Service outbound traffic with Azure Firewall](/azure/app-service/network-secure-outbound-traffic-azure-firewall)
2325
- [Azure Firewall security rules](/azure/firewall/rule-processing)

‎articles/networking/security/includes/25537.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ ms.custom: Network-Secure-Recommendation
1515
---
1616
Azure Firewall Threat Intelligence-based filtering alerts and denies traffic from and to known malicious IP addresses, fully qualified domain names (FQDNs), and URLs sourced from the Microsoft Threat Intelligence feed. When enabled, Azure Firewall evaluates traffic against threat intelligence rules before applying network address translation (NAT), network, or application rules. This check verifies that Threat Intelligence is enabled in "Alert and deny" mode in the Azure Firewall policy. Without this feature enabled, the environment remains exposed to known malicious IPs, domains, and URLs, creating risk of compromise or data exfiltration.
1717

18+
> [!NOTE]
19+
> "Alert and deny" mode requires Azure Firewall Standard or Premium. Azure Firewall Basic supports alert mode only. For a full feature comparison, see [Choose the right Azure Firewall SKU](/azure/firewall/choose-firewall-sku).
20+
1821
**Remediation action**
1922

2023
- [Azure Firewall threat intelligence configuration](/azure/firewall-manager/threat-intelligence-settings)

‎articles/networking/security/includes/26885.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Azure DDoS Protection provides advanced mitigation capabilities for public IP ad
1717

1818
**Remediation action**
1919

20-
- [Configure Azure DDoS Protection metrics and diagnostic logs](/azure/ddos-protection/diagnostic-logging)
20+
- [Configure Azure DDoS Protection metrics and diagnostic logs](/azure/ddos-protection/ddos-view-diagnostic-logs)
2121
- [Configure diagnostic settings for Azure resources](/azure/azure-monitor/essentials/diagnostic-settings)
2222
- [Azure DDoS Protection overview](/azure/ddos-protection/ddos-protection-overview)
2323
- [Create and configure Azure DDoS Network Protection using the Azure portal](/azure/ddos-protection/manage-ddos-protection)

‎articles/networking/security/includes/26886.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,5 @@ When Azure DDoS Protection is enabled for public IP addresses, diagnostic loggin
1717

1818
**Remediation action**
1919

20-
- [Configure Azure DDoS Protection diagnostic logging](/azure/ddos-protection/diagnostic-logging)
21-
- [View and configure DDoS diagnostic logs](/azure/ddos-protection/diagnostic-logging#configure-ddos-diagnostic-logs)
22-
- [Azure DDoS Protection monitoring and logging](/azure/ddos-protection/monitor-ddos-protection)
23-
- [View and analyze DDoS logs](/azure/ddos-protection/monitor-ddos-protection)
20+
- [View and configure DDoS Protection diagnostic logs](/azure/ddos-protection/ddos-view-diagnostic-logs)
21+
- [Monitor Azure DDoS Protection](/azure/ddos-protection/monitor-ddos-protection)

‎articles/networking/security/index.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ highlightedContent:
2525
itemType: overview # controls the icon image and super-title text
2626
url: /azure/networking/security/network-security
2727
# Card
28+
- title: Azure network security Zero Trust recommendations
29+
itemType: concept
30+
url: /azure/networking/security/zero-trust-network-security
31+
# Card
2832
- title: Azure best practices for network security
2933
itemType: concept
3034
url: ../../security/fundamentals/network-best-practices.md

‎articles/networking/security/zero-trust-application-gateway-waf.md‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,37 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)] | High | Low | Low |
23-
| [!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)] | High | Low | Low |
24-
| [!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)] | High | Low | Low |
25-
| [!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)] | High | Low | Low |
26-
| [!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)] | High | Low | Low |
27-
| [!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)] | High | Low | Medium |
28-
| [!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)] | Medium | Low | Low |
29-
| [!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)] | High | Low | Low |
20+
### Application Gateway WAF is enabled in prevention mode
21+
22+
[!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)]
23+
24+
### Request body inspection is enabled in Application Gateway WAF
25+
26+
[!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)]
27+
28+
### Default rule set is enabled in Application Gateway WAF
29+
30+
[!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)]
31+
32+
### Bot protection rule set is enabled and assigned in Application Gateway WAF
33+
34+
[!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)]
35+
36+
### HTTP DDoS protection rule set is enabled in Application Gateway WAF
37+
38+
[!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)]
39+
40+
### Rate limiting is enabled in Application Gateway WAF
41+
42+
[!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)]
43+
44+
### JavaScript challenge is enabled in Application Gateway WAF
45+
46+
[!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)]
47+
48+
### Diagnostic logging is enabled in Application Gateway WAF
49+
50+
[!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)]
3051

3152
## Related content
3253

‎articles/networking/security/zero-trust-azure-firewall.md‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,25 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)] | High | Low | Medium |
23-
| [!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)] | High | Low | Low |
24-
| [!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)] | High | Low | Low |
25-
| [!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)] | High | Low | Low |
26-
| [!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)] | High | Low | Low |
20+
### Outbound traffic from VNet-integrated workloads is routed through Azure Firewall
21+
22+
[!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)]
23+
24+
### Threat intelligence is enabled in deny mode on Azure Firewall
25+
26+
[!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)]
27+
28+
### IDPS inspection is enabled in deny mode on Azure Firewall
29+
30+
[!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)]
31+
32+
### Inspection of outbound TLS traffic is enabled on Azure Firewall
33+
34+
[!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)]
35+
36+
### Diagnostic logging is enabled in Azure Firewall
37+
38+
[!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)]
2739

2840
## Related content
2941

0 commit comments

Comments
 (0)