Merge pull request #313526 from MicrosoftDocs/main

Auto Publish – main to live - 2026-03-23 17:00 UTC

Author: learn-build-service-prod[bot]

articles/confidential-computing/TOC.yml

@@ -67,8 +67,6 @@
       href: migrate-nested-confidential-vms.md
     - name: Virtual Machine Metablob Disk
       href: virtual-machine-metablob-disk.md
-    - name: How to disable Virtual Machine Metablob Disk
-      href: disable-confidential-vm-metadata-blob.md
     - name: Quickly create confidential VMs
       items:
       - name: Create a Confidential VM through the Azure portal

articles/cyclecloud/index.yml

@@ -45,7 +45,7 @@ landingContent:
     linkLists:            
       - linkListType: whats-new
         links:
-          - text: CycleCloud 8.8.2 is now available (Release Notes)
+          - text: CycleCloud 8.8.3 is now available (Release Notes)
             url: release-notes.md
           - text: CycleCloud Workspace for Slurm Release Notes
             url: release-notes/ccws/release-notes.md

articles/cyclecloud/release-notes.md

@@ -2,13 +2,13 @@
 title: Current Release Notes - Azure CycleCloud 8.8.x
 description: Read the product release notes for the current Azure CycleCloud release. This article covers releases 8.8.x, 8.7.x, 8.6.x, 8.5.x, 8.4.x, 8.2.x and 8.1.x.
 author: adriankjohnson
-ms.date: 02/06/2026
+ms.date: 03/17/2026
 ms.author: adjohnso
 ---
 
 # Azure CycleCloud 8.x
 
-The current version is 8.8.2.
+The current version is 8.8.3.
 
 ## Azure CycleCloud 8.x release highlights
 
@@ -33,6 +33,7 @@ The following table lists the release notes for the individual 8.x releases:
 
 | CycleCloud Release Notes Version  | Release date  |
 | :-------------------------------: | :-----------: |
+| [**8.8.3**](release-notes/8-8-3.md) | 03/17/26 |
 | [**8.8.2**](release-notes/8-8-2.md) | 02/06/26 |
 | [**8.8.1**](release-notes/8-8-1.md) | 12/12/25 |
 | [**8.8.0**](release-notes/8-8-0.md) | 12/08/25 |

articles/cyclecloud/release-notes/8-8-3.md

@@ -0,0 +1,18 @@
+---
+title: Release Notes v8.8.3
+description: Product release notes for Azure CycleCloud v8.8.3
+author: alabonte7
+ms.date: 03/17/2026
+ms.author: alabont
+---
+
+# CycleCloud version 8.8.3
+
+The release 8.8.3 addresses several key issues including a failure in installing the CLI due to azcopy download errors.
+
+## Resolved Issues
+
+- Installing CycleCloud CLI would fail due to an error downloading azcopy
+- Nodes failed to converge in non-public clouds
+- When users' login expired or when users weren't signed-in, some CycleCloud GUI URLs didn't correctly redirect to the sign in page
+- The disabled legacy `reboot_node` command was removed from the CLI. The new `restart_node` command replaces it

articles/cyclecloud/toc.yml

@@ -267,6 +267,8 @@ items:
         href: /previous-versions/azure/cyclecloud/release-notes-previous
       - name: Older Releases
         href: /previous-versions/azure/cyclecloud/release-notes-archive
+      - name: 8.8.3 Release Notes
+        href: ./release-notes/8-8-3.md
       - name: 8.8.2 Release Notes
         href: ./release-notes/8-8-2.md
       - name: 8.8.1 Release Notes

articles/energy-data-services/concepts-reference-data-values.md

@@ -5,7 +5,7 @@ author: marielherz
 ms.author: marielherzog
 ms.service: azure-data-manager-energy
 ms.topic: overview
-ms.date: 12/18/2025
+ms.date: 02/16/2026
 ms.custom: template-concept
 ---
 
@@ -67,6 +67,17 @@ Azure Data Manager for Energy updates Reference Data Values (RDVs) by automatica
 | **OPEN** | Customer‑extended or modified entries are preserved; new OSDU® baseline entries are added without overwriting user changes. | Balances shared semantics with user‑driven extensibility. |
 | **LOCAL** | Behaviors follow the instance’s provisioning choice; custom values remain unchanged, and new OSDU® suggestions are added only if LOCAL was enabled. | Protects business‑specific meaning and avoids unintended modification. |
 
+### Expired Legal Tags and RDV Upgrades
+
+During automated RDV upgrades, Azure Data Manager for Energy validates the legal tags associated with existing reference data records before applying updates. If a data partition contains records with expired legal tags, the following behavior applies:
+
+- **Existing RDVs with expired legal tags are skipped** — The upgrade process skips updates for records whose legal tags have expired, rather than failing the entire upgrade for the data partition. These records remain at their current version until the legal tag issue is resolved.
+- **New RDVs are still added** — New reference data values introduced in the latest OSDU® milestone are added successfully, as they receive new legal tags and aren't affected by pre-existing expired tags.
+- **No data loss occurs** — Skipped records aren't deleted or modified. Once you renew or replace the expired legal tags, the records are eligible for upgrade in the next milestone cycle.
+
+> [!NOTE]
+> To ensure all reference data values are upgraded during milestone updates, verify that no legal tags in your data partitions are expired. You can identify expired legal tag validation failures in the **storage service logs** for your Azure Data Manager for Energy instance.
+
 For information on the current milestone supported by and available OSDU® services in Azure Data Manager for Energy, refer [OSDU® services available in Azure Data Manager for Energy](osdu-services-on-adme.md).
 
 ## Next steps

articles/firewall/protect-azure-virtual-desktop.md

@@ -5,7 +5,7 @@ author: duongau
 ms.service: azure-firewall
 services: firewall
 ms.topic: how-to
-ms.date: 02/05/2026
+ms.date: 03/26/2026
 ms.author: duau
 # Customer intent: As an IT administrator, I want to configure Azure Firewall for Azure Virtual Desktop, so that I can securely manage outbound access and enhance the protection of my virtual desktop environment.
 ---
@@ -16,7 +16,7 @@ Azure Virtual Desktop is a cloud virtual desktop infrastructure (VDI) service th
 
 :::image type="content" source="media/protect-windows-virtual-desktop/windows-virtual-desktop-architecture-diagram.png" alt-text="A diagram showing the architecture of Azure Firewall with Azure Virtual Desktop." lightbox="media/protect-windows-virtual-desktop/windows-virtual-desktop-architecture-diagram.png":::
 
-Follow the guidelines in this article to provide extra protection for your Azure Virtual Desktop host pool using Azure Firewall.
+Follow the guidelines in this article to provide extra protection for your Azure Virtual Desktop host pool by using Azure Firewall.
 
 ## Prerequisites
 
@@ -27,25 +27,27 @@ Follow the guidelines in this article to provide extra protection for your Azure
 To learn more about Azure Virtual Desktop terminology, see [Azure Virtual Desktop terminology](/azure/virtual-desktop/terminology).
 
 > [!WARNING]
-> Azure Virtual Desktop disconnections may occur during Azure Firewall scale-ins if all traffic is routed to the Azure Firewall using a default route. We recommend having direct access to the gateway and broker for Azure Virtual Desktop to avoid these disconnections. To resolve this issue, add a route to the route table applied to the Azure Virtual Desktop subnet with the *destination type* set to **Service tag**, the *destination service* set to **WindowsVirtualDesktop**, and the *next hop* set to **Internet**.
+> Azure Virtual Desktop disconnections can occur during Azure Firewall scale-ins if you route all traffic to the Azure Firewall by using a default route. To avoid these disconnections, make sure you have direct access to the gateway and broker for Azure Virtual Desktop. Use one of the following options based on your deployment:
+> - **Hub-and-spoke**: Add a route to the route table applied to the Azure Virtual Desktop subnet with the *destination type* set to **Service tag**, the *destination service* set to **WindowsVirtualDesktop**, and the *next hop* set to **Internet**.
+> - **Azure Virtual WAN**: Add a route to the route table applied to the subnet (spoke virtual network) that hosts the Azure Virtual Desktop workloads with the *destination type* set to **Service tag**, the *destination service* set to **WindowsVirtualDesktop**, and the *next hop* set to **Internet**.
 
 ## Host pool outbound access to Azure Virtual Desktop
 
-The Azure virtual machines you create for Azure Virtual Desktop must have access to several Fully Qualified Domain Names (FQDNs) to function properly. Azure Firewall uses the Azure Virtual Desktop FQDN tag `WindowsVirtualDesktop` to simplify this configuration. You need to create an Azure Firewall Policy and create Rule Collections for Network Rules and Applications Rules. Give the Rule Collection a priority and an *allow* or *deny* action.
+The Azure virtual machines you create for Azure Virtual Desktop must have access to several fully qualified domain names (FQDNs) to function properly. Azure Firewall uses the Azure Virtual Desktop FQDN tag `WindowsVirtualDesktop` to simplify this configuration. You need to create an Azure Firewall Policy and create rule collections for network rules and application rules. Give the rule collection a priority and an *allow* or *deny* action.
 
-You need to create rules for each of the required FQDNs and endpoints. The list is available at [Required FQDNs and endpoints for Azure Virtual Desktop](/azure/virtual-desktop/required-fqdn-endpoint). In order to identify a specific host pool as *Source*, you can create an [IP Group](../firewall/ip-groups.md) with each session host to represent it. 
+You need to create rules for each of the required FQDNs and endpoints. The list is available at [Required FQDNs and endpoints for Azure Virtual Desktop](/azure/virtual-desktop/required-fqdn-endpoint). To identify a specific host pool as *Source*, you can create an [IP Group](../firewall/ip-groups.md) with each session host to represent it. 
 
 > [!IMPORTANT]
-> We recommend that you don't use TLS inspection with Azure Virtual Desktop. For more information, see the [proxy server guidelines](/azure/virtual-desktop/proxy-server-support#dont-use-ssl-termination-on-the-proxy-server).
+> Don't use TLS inspection with Azure Virtual Desktop. For more information, see the [proxy server guidelines](/azure/virtual-desktop/proxy-server-support#dont-use-ssl-termination-on-the-proxy-server).
 
-## Azure Firewall Policy Sample
+## Azure Firewall Policy sample
 
-All the mandatory and optional rules mentioned previously can be easily deployed in a single Azure Firewall Policy using the template published at [https://github.com/Azure/RDS-Templates/tree/master/AzureFirewallPolicyForAVD](https://github.com/Azure/RDS-Templates/tree/master/AzureFirewallPolicyForAVD).
-Before deploying into production, we recommended reviewing all the network and application rules defined, ensure alignment with Azure Virtual Desktop official documentation and security requirements. 
+You can deploy all the mandatory and optional rules mentioned previously in a single Azure Firewall Policy by using the template published at [AzureFirewallPolicyForAVD](https://github.com/Azure/RDS-Templates/tree/master/AzureFirewallPolicyForAVD).
+Before deploying into production, review all the network and application rules defined to ensure alignment with Azure Virtual Desktop official documentation and security requirements. 
 
-## Host pool outbound access to the Internet
+## Host pool outbound access to the internet
 
-Depending on your organization needs, you might want to enable secure outbound internet access for your end users. If the list of allowed destinations is well-defined (for example, for [Microsoft 365 access](/microsoft-365/enterprise/microsoft-365-ip-web-service)), you can use Azure Firewall application and network rules to configure the required access. This routes end-user traffic directly to the internet for best performance. If you need to allow network connectivity for Windows 365 or Intune, see [Network requirements for Windows 365](/windows-365/enterprise/requirements-network#allow-network-connectivity) and [Network endpoints for Intune](/mem/intune/fundamentals/intune-endpoints).
+Depending on your organization's needs, you might want to enable secure outbound internet access for your end users. If the list of allowed destinations is well-defined (for example, for [Microsoft 365 access](/microsoft-365/enterprise/microsoft-365-ip-web-service)), use Azure Firewall application and network rules to configure the required access. This configuration routes end-user traffic directly to the internet for best performance. If you need to allow network connectivity for Windows 365 or Intune, see [Network requirements for Windows 365](/windows-365/enterprise/requirements-network#allow-network-connectivity) and [Network endpoints for Intune](/mem/intune/fundamentals/intune-endpoints).
 
 If you want to filter outbound user internet traffic by using an existing on-premises secure web gateway, you can configure web browsers or other applications running on the Azure Virtual Desktop host pool with an explicit proxy configuration. For example, see [How to use Microsoft Edge command-line options to configure proxy settings](/deployedge/edge-learnmore-cmdline-options-proxy-settings). These proxy settings only influence your end-user internet access, allowing the Azure Virtual Desktop platform outbound traffic directly via Azure Firewall.
 
@@ -55,4 +57,4 @@ Admins can allow or deny user access to different website categories. Add a rule
 
 ## Next step
 
-- Learn more about Azure Virtual Desktop: [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview)
+- To learn more about Azure Virtual Desktop, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview)

articles/hdinsight/hdinsight-component-retirements-and-action-required.md

@@ -44,6 +44,7 @@ HDInsight bundles open-source components and HDInsight platform into a package t
 |-|-|-|-|
 |[Basic and Standard A-series VMs Retirement](https://azure.microsoft.com/updates/basic-and-standard-aseries-vms-on-hdinsight-will-retire-on-31-august-2024/) |August 31, 2024 |[Av1-series retirement - Azure Virtual Machines](/azure/virtual-machines/sizes/migration-guides/av1-series-retirement) |Y|
 |[Azure Monitor experience (preview)](https://azure.microsoft.com/updates/v2/hdinsight-azure-monitor-experience-retirement/) | February 01, 2025 |[Azure Monitor Agent (AMA) migration guide for Azure HDInsight clusters](./azure-monitor-agent.md) |Y|
+| Dv2-series VM unavailability in Azure HDInsight | March 31, 2026 | Migrate existing HDInsight clusters to newer VM series such as [Eadsv5-series](/azure/virtual-machines/eav5-eadsv5-series) or [Easv4-series](/azure/virtual-machines/easv4-series). |Y|
 |[Enterprise Security Package](https://azure.microsoft.com/updates?id=497263) | July 31, 2026 | Migrate to alternative Azure offerings such as Microsoft Fabric |N/A|
 
 

articles/iot/tutorial-iot-industrial-solution-architecture.md

@@ -107,37 +107,20 @@ Select the **Deploy** button to deploy all required resources to your Azure subs
 The deployment process prompts you to provide a password for the virtual machine (VM) that hosts the production line simulation and the Edge infrastructure. The password should include three of: a lowercase character, an uppercase character, a number, and a special character. The password length must be between 12 and 72 characters.
 
 > [!NOTE]
-> To reduce cost, the deployment creates a single Windows 11 Enterprise VM for both the production line simulation and the Edge infrastructure. In a production scenario, the production line simulation isn't required, and for the base OS you should use Windows IoT Enterprise Long Term Servicing Channel.
-
-When the deployment completes, use RDP to connect to the deployed Windows VM. You can download the RDP file from the **Connect** options on the page for your VM in the Azure portal. Sign in using the credentials you provided during the deployment, open a Windows command prompt, and use the following command to install the Windows Subsystem for Linux (WSL):
-
-```cmd  
-wsl --install
-```
-
-When the command finishes, reboot your VM and sign in again. A command prompt finishes the WSL installation and you're prompted to enter a new username and password for WSL. Then, in WSL, use the following command to install K3S, a lightweight Kubernetes runtime:
-
-```bash
-curl -sfL https://get.k3s.io | sh
-```
-
-Your VM is now ready to run the production line simulation.
+> To reduce cost, the deployment creates a single Linux VM for both the production line simulation and the edge infrastructure. In a production scenario, the production line simulation isn't required, and for the base OS you should use Azure Local.
 
 ## Run the production line simulation
 
-In the VM, open a Windows command prompt, enter *wsl*, and press **Enter**. Navigate to the `/mnt/c/ManufacturingOntologies-main/Tools/FactorySimulation` directory and run the **StartSimulation** shell script:
+Use SSH to connect to the deployed VM using the credentials you provided during the deployment (you may need to enable Just-in-time access in the Azure portal first). Navigate to the `/opt/ManufacturingOntologies-main/Tools/FactorySimulation` directory and run the **StartSimulation** shell script:
 
 ```bash
 sudo ./StartSimulation.sh "<Your Event Hubs connection string>"
 ```
 
 `<Your Event Hubs connection string>` is your Event Hubs namespace connection string. To learn more, see [Get an Event Hubs connection string](/azure/event-hubs/event-hubs-get-connection-string). A connection string looks like: `Endpoint=sb://ontologies.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=abcdefgh=`
 
-> [!NOTE]
-> If the external IP address for a Kubernetes service shows as `<pending>`, use the following command to assign the external IP address of the `traefik` service: `sudo kubectl patch service <theService> -n <the service's namespace> -p '{"spec": {"type": "LoadBalancer", "externalIPs":["<the traefik external IP address>"]}}'`.
-
 > [!TIP]
-> To prevent WSL and K3s from automatically shutting down, keep your WSL command prompt open.
+> If the external IP address for some Kubernetes services shows as `<pending>`, use the following command to assign the external IP address of the `traefik` service: `sudo kubectl patch service <theService> -n <the service's namespace> -p '{"spec": {"type": "LoadBalancer", "externalIPs":["<the traefik external IP address>"]}}'`.
 
 ## UA Cloud Library
 
@@ -198,16 +181,9 @@ edges
 
 ## Optionally deploy Azure IoT Operations on the edge
 
-By default, the production line simulation sends data directly to the **data** hub endpoint in your Event Hubs namespace.
-
-To manage this process, you can use Azure IoT Operations on the edge instead. Azure IoT Operations is a unified data plane for the edge. It includes a set of modular, scalable, and highly available data services that run on Azure Arc-enabled edge Kubernetes clusters.
-
-Before you deploy Azure IoT Operations, confirm that you started the production line simulation. Then, follow these steps in [Azure IoT Operations deployment details](/azure/iot-operations/deploy-iot-ops/overview-deploy).
-
-> [!TIP]
-> You can use VM and K3S instance you deployed previously in this tutorial to deploy and run Azure IoT Operations.
+You can use Azure IoT Operations on the edge. Azure IoT Operations is a unified data plane for the edge. It includes a set of modular, scalable, and highly available data services that run on Azure Arc-enabled edge Kubernetes clusters.
 
-### Configure your Azure IoT Operations deployment
+Follow these steps in [Azure IoT Operations deployment details](/azure/iot-operations/deploy-iot-ops/overview-deploy).
 
 You can configure your Azure IoT Operations deployment by using the [operations experience](https://iotoperations.azure.com/) web UI. Add the asset endpoints, assets, and data flows to process the data from the production line simulation and route it to the **data** hub in your Event Hubs namespace.