Skip to content

Commit ed57b35

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #311526 from MicrosoftDocs/main
Auto Publish – main to live - 2026-02-08 12:00 UTC
2 parents 9cde5b4 + 10fde9a commit ed57b35

5 files changed

Lines changed: 106 additions & 6 deletions

File tree

‎articles/api-management/breaking-changes/managed-certificates-suspension-august-2025.md‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: dlepow
66
ms.service: azure-api-management
77
ms.topic: reference
88
ai-usage: ai-assisted
9-
ms.date: 01/26/2026
9+
ms.date: 02/06/2026
1010
ms.author: danlep
1111
---
1212

@@ -36,11 +36,37 @@ If you need to add new managed certificates, plan to do so before August 15, 202
3636

3737
If you already have managed certificates for your custom domains, do the following to ensure continued access:
3838

39-
- Ensure that your API Management service allows [inbound traffic from DigiCert IP addresses on port 80](#allow-access-to-digicert-ip-addresses). This access is now required for the certificate autorenewal process.
39+
1. Ensure that your API Management service [allows inbound traffic from DigiCert IP addresses on port 80](#step-1-allow-access-to-digicert-ip-addresses). This access is now required for the certificate autorenewal process.
40+
1. [Configure DNS records](#step-2-configure-dns-records) to resolve your custom domain name.
41+
1. [Allow API Management service access to port 80](#step-3-allow-api-management-service-access-to-port-80) if you have inbound network restrictions in place.
4042

43+
### Step 1: Allow access to DigiCert IP addresses
4144

4245
[!INCLUDE [api-management-managed-certificate-ip-access.md](../../../includes/api-management-managed-certificate-ip-access.md)]
4346

47+
### Step 2: Configure DNS records
48+
49+
Configure DNS records for your custom domain to point to your API Management gateway. The type of DNS record you need to add depends on your API Management tier.
50+
51+
#### DNS records for Developer, Basic, Standard, or Premium tier
52+
53+
1. Add either a [CNAME](/azure/api-management/configure-custom-domain?tabs=custom#cname-record) or A-record with your DNS provider.
54+
55+
1. Add DigiCert as an authorized certificate authority (CA) in Azure DNS. For this, create a specific CAA record set within your domain's DNS zone using the Azure portal or other management tools.
56+
57+
#### DNS records for Consumption tier
58+
59+
1. Add either a [CNAME](/azure/api-management/configure-custom-domain?tabs=custom#cname-record) or [TXT](/azure/api-management/configure-custom-domain?tabs=managed#txt-record) record with your DNS provider. If you configure both, the TXT record takes precedence.
60+
1. Add DigiCert as an authorized certificate authority (CA) in Azure DNS. For this, you need to create a specific CAA record set within your domain's DNS zone using the Azure portal or other management tools
61+
62+
### Step 3: Allow API Management service access to port 80
63+
64+
If you have inbound network restrictions configured for your API Management service, allow the Azure API Management resource provider access on port 80. This is required to allow inbound traffic to support certificate revocation list (CRL) checks, certificate renewal, and management communication.
65+
66+
1. In the Azure portal, go to **Network security groups**.
67+
1. Select the network security group associated with your API Management subnet.
68+
1. Under **Settings** > **Inbound security rules**, add a new rule allowing traffic on port 80 from the **ApiManagement** service tag to the API Management instance.
69+
4470
## Help and support
4571

4672
If you have questions, get answers from community experts in [Microsoft Q&A](https://aka.ms/apim/azureqa/change/captcha-2022). If you have a support plan and need technical help, create a [support request](https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview).

‎articles/api-management/configure-custom-domain.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ API Management offers a free, managed TLS certificate for your domain, if you do
126126
* Supports only public domain names
127127
* Can only be configured when updating an existing API Management instance, not when creating an instance
128128

129+
### Allow access to DigiCert IP addresses
130+
129131
[!INCLUDE [api-management-managed-certificate-ip-access.md](../../includes/api-management-managed-certificate-ip-access.md)]
130132

131133
---

‎articles/sentinel/datalake/sentinel-lake-connectors.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,80 @@ Tables created by using the Logs Ingestion API or Azure Monitor Agent (AMA) and
4949

5050
When you onboard to both Microsoft Defender and Microsoft Sentinel and then onboard to the data lake, you no longer see auxiliary log tables in Microsoft Defender’s Advanced hunting or in the Microsoft Sentinel Azure portal. The auxiliary table data is available in the data lake and you can query it by using KQL queries or Jupyter notebooks. Find KQL queries under **Microsoft Sentinel** > **Data lake exploration** in the Defender portal.
5151

52+
## Direct ingestion to the data lake tier
53+
54+
Depending on your organization's security needs, you might choose to ingest some log sources directly into the data
55+
lake. Directly ingesting logs to the data lake allows you to better manage costs by optimizing data retention and storage based on the value of the data for real-time detection versus long-term analysis.
56+
57+
Ingest high-volume logs that are less critical for real-time detection but valuable for deep analysis and forensics directly to the lake, and ingest only high-value logs to the analytics tier. Note that logs ingested to the analytics tier are also mirrored to the data lake.
58+
59+
Use the following table to prioritize which sources you should ingest directly to the data lake versus the analytics tier.
60+
61+
| Log source type | Typical log volume | Value for real-time threat detection and alerting | Value for threat hunting | Value for incident investigation and forensics | Ingest to data lake |
62+
|-------------------------------------------------|--------------------|-------------------------------------|----------------|-----------------------------------|-----------------------|
63+
| AAA (TACACS/Radius) | Medium | High | High | High | Yes |
64+
| Active Directory (on-premises) | High | High | High | High | No |
65+
| Application Logs | High | Medium | Medium | High | Yes |
66+
| AV Logs (Windows Events 5000s & 3rd party) | Medium | High | High | High | No |
67+
| Azure Activity | Medium | High | High | High | No |
68+
| Biometric Access System Logs | Low | Medium | Low | High | Yes |
69+
| Building Security System Logs | Low | Low | Low | Medium | Yes |
70+
| Call Center/VoIP Logs | Medium | Low | Low | Medium | Yes |
71+
| CASB | High | High | High | High | Yes |
72+
| Citrix/Horizon/ALBs | Medium | Medium | Medium | High | Yes |
73+
| Cloud IAM | Medium | High | High | High | No |
74+
| Cloud PaaS | High | High | High | High | Yes |
75+
| Cloud Security Controls | Medium | High | Medium | High | No |
76+
| Cloud Storage (S3, Blob, etc.) Logs | High | High | High | High | No |
77+
| CRM Audit Logs | Low-Medium | Low | Low | Medium | Yes |
78+
| Database Audit Tools | Medium | High | High | High | Yes |
79+
| DHCP Logs | Medium | Medium | Medium | High | Yes |
80+
| DLP Alerts | Low | High | High | High | Yes |
81+
| DNS Logs | High | High | High | High | Yes |
82+
| Endpoint Detection and Response (EDR) (Alerts) | Medium | High | High | High | No |
83+
| Endpoint Detection and Response (EDR) (Raw) | High | High | High | High | Yes |
84+
| Email Security (3rd party alerts) | Medium | High | Medium | High | No |
85+
| ERP Audit Logs | Low-Medium | Low | Low | Medium | Yes |
86+
| File Integrity | Low | Medium | Medium | High | Yes |
87+
| Firewall Threat/Malware/IPS/IDS | High | High | High | High | No |
88+
| Firewall Traffic Logs | High | High | High | High | Yes |
89+
| GitHub/GitLab/Code Repo Logs | Low-Medium | Medium | Medium | High | Yes |
90+
| Google Workspace Logs | Medium | Medium | Medium | High | Yes |
91+
| Identity (Entra ID, Okta, LDAP) | Medium | High | High | High | No |
92+
| IIS/Apache Logs | Medium | High | High | High | Yes |
93+
| IoT Device Logs | High | Medium | Medium | Medium | Yes |
94+
| Kubernetes/Container Logs (alerts, critical) | High | High | High | High | No |
95+
| Kubernetes/Container Logs (raw logs) | High | High | High | High | Yes |
96+
| LAN/WAN Router Switch | High | Medium | Medium | Medium | Yes |
97+
| Linux Server AuditD | Medium | High | High | High | No |
98+
| Mobile Device Management (Intune) | Medium | Medium | Medium | Medium | Yes |
99+
| Microsoft Office Logs (Teams, Office, SharePoint)| Medium | Medium | Medium | High | No |
100+
| Microsoft XDR Alerts (Defender: Office, Identity, Endpoint, CloudApp) | Medium | High | High | High | No |
101+
| Multifactor authentication (MFA) | Medium | High | Medium | High | No |
102+
| Netflow | High | Medium | High | Medium | Yes |
103+
| Network Detection (Corelight, Vectra, Darktrace)| High | High | High | High | No |
104+
| OT/ICS System Logs | Medium | High | High | High | Yes |
105+
| PAM (Privileged Access Management) | Low | High | High | High | No |
106+
| PIM (Privileged Identity Management) | Low | High | High | High | No |
107+
| POS System Logs | High | High | High | High | Yes |
108+
| Proxy Logging (URL filtering) | High | High | High | High | Yes |
109+
| Salesforce Audit Logs | Medium | Medium | Medium | High | Yes |
110+
| SD-WAN | Medium | Medium | Medium | Medium | Yes |
111+
| ServiceNow Audit Logs | Low | Low | Low | Medium | Yes |
112+
| SIEM/SOAR Platform Logs | Medium | High | High | High | No |
113+
| Slack/Teams Collaboration Logs | Medium | Low | Medium | Medium | Yes |
114+
| Sysmon (Endpoint, for EDR complement) | Medium | High | High | High | Yes |
115+
| Threat Intelligence Indicators | Low | High | High | High | No |
116+
| VDI Logs | Medium | Medium | Medium | High | Yes |
117+
| VPN | Medium | High | High | High | No |
118+
| Vulnerability Scanning | Low | Medium | Medium | Medium | Yes |
119+
| Web Application Firewall (WAF) Logs | Medium | High | High | High | Yes |
120+
| Windows Server Events | High | High | High | High | No |
121+
| XDR Source Logs (Defender: Office, Identity, Endpoint, CloudApp) | Medium | High | High | High | No |
122+
| Zoom Meeting Logs | Low-Medium | Low | Low | Medium | Yes |
123+
124+
125+
52126

53127
## Related articles
54128

‎articles/sentinel/entity-behaviors-layer.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,8 +217,8 @@ To enable and use the UEBA behaviors layer, you need these permissions:
217217
218218
| **User action** | **Permission required** |
219219
| ------------------------------------------------------------ | ------------------------------------------------------------ |
220-
| Enable behaviors | At least the **Security Administrator** role in Microsoft Entra ID. |
221-
| Query behaviors tables | <ul><li>**Security Reader** or **Security Operator** role in Microsoft Entra ID to run Advanced Hunting queries in the Defender portal</li><li>`Read` access to the `BehaviorInfo` and `BehaviorEntities` tables in your Sentinel workspace</li><li>`Read` access to source tables to drill down to raw events</li></ul> |
220+
| Enable behaviors | At least the **Security Administrator** role in Microsoft Entra ID and the **Microsoft Sentinel Contributor** role in your Sentinel workspace. |
221+
| Query behaviors tables | <ul><li>**Security Reader** or **Security Operator** role in Microsoft Entra ID to run Advanced Hunting queries in the Defender portal.</li><li>**Read** access to the `BehaviorInfo` and `BehaviorEntities` tables in your Sentinel workspace.</li><li>**Read** access to source tables to drill down to raw events.</li></ul> |
222222
223223
For more information about unified RBAC in the Defender portal, see [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac).
224224

‎includes/api-management-managed-certificate-ip-access.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ ms.author: danlep
77
ms.custom:
88
---
99

10-
### Allow access to DigiCert IP addresses
11-
1210
Starting January 2026, Azure API Management needs inbound access on port 80 to [specific DigiCert IP addresses](https://knowledge.digicert.com/alerts/ip-address-domain-validation?utm_medium=organic&utm_source=docs-digicert&referrer=https://docs.digicert.com/en/certcentral/manage-certificates/domain-control-validation-methods/automatic-domain-control-validation-check.html) to renew (rotate) your managed certificate.
1311

1412
If your API Management instance restricts incoming IP addresses, we recommend that you remove or modify existing IP restrictions by using one of the following methods based on your deployment architecture.

0 commit comments

Comments
 (0)