Merge pull request #308041 from MicrosoftDocs/main

Auto Publish – main to live - 2025-11-09 12:00 UTC

Author: learn-build-service-prod[bot]

articles/sentinel/whats-new.md

@@ -1,8 +1,8 @@
 ---
 title: What's new in Microsoft Sentinel
 description: Learn about the latest new features and announcement in Microsoft Sentinel from the past few months.
-author: batamig
-ms.author: bagol
+author: guywi-ms
+ms.author: guywild
 ms.topic: concept-article
 ms.date: 09/28/2025
 #Customer intent: As a security team member, I want to stay updated on the latest features and enhancements in Microsoft Sentinel so that I can effectively manage and optimize my organization's security posture.
@@ -18,9 +18,37 @@ The listed features were released in the last six months. For information about
 
 [!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
 
-## October 2025
+## November 2025
+
+- [Call to action: update queries and automation by December 13, 2025 - standardized account entity naming in incidents and alerts](#call-to-action-update-queries-and-automation-by-december-13-2025---standardized-account-entity-naming-in-incidents-and-alerts)
+
+### Call to action: update queries and automation by December 13, 2025 - standardized account entity naming in incidents and alerts
+
+Microsoft Sentinel is updating how it identifies account entities in incidents and alerts. This change introduces a standardized naming logic to improve consistency and reliability across your analytics and automation workflows.
+
+> [!IMPORTANT]
+> This change might affect your analytic rules, automation rules, playbooks, workbooks, hunting queries, and custom integrations.
+
+Sentinel will now select the most reliable account identifier using the following priority:
 
+1. **UPN prefix** – the part before “@” in a User Principal Name
+   - Example: `john.doe@contoso.com` → `john.doe`
+
+1. **Name** – used if UPN prefix is unavailable
+1. **Display Name** – fallback if both above are missing
+
+Update your KQL queries and automation logic to follow the new precedence-aware pattern. Use the [`coalesce()`(/kusto/query/coalesce-function)](/kusto/query/coalesce-function) function to ensure compatibility:
+
+```kql
+coalesce(Account.UPNprefix, Account.Name, Account.DisplayName)
+```
+Test all changes in a nonproduction workspace before rolling out to production.
+
+
+## October 2025
 
+- [Export STIX threat intelligence objects (Preview)](#export-stix-threat-intelligence-objects-preview)
+- [Call to action: update queries and automation by December 13, 2025 - standardized account entity naming in incidents and alerts](#call-to-action-update-queries-and-automation-by-december-13-2025---standardized-account-entity-naming-in-incidents-and-alerts)
 
 ### Export STIX threat intelligence objects (Preview)
 

articles/storage/blobs/includes/object-replication-alert.md

@@ -0,0 +1,22 @@
+---
+title: "include file"
+description: "include file"
+services: storage
+author: stevenmatthew
+ms.service: azure-storage
+ms.subservice: common-concepts
+ms.topic: "include"
+ms.date: 11/07/2025
+ms.author: shaas
+ms.custom: "include file", references_regions
+---
+
+<!-- User feedback is being incorporated into customer-managed planned failover (preview) and the feature is temporarily unavailable in all regions. After completion, updated documentation will be released to reflect the regions in which the feature is available.-->
+
+> [!IMPORTANT]
+> OR Priority Replication is generally available and offered in all public cloud regions with the following exceptions:
+>
+> - West India
+> - Switzerland West
+>
+> To gain access to the Azure portal experience of Object Replication priority replication, see [Set up preview features in Azure subscription](/azure/azure-resource-manager/management/preview-features) and specify `AllowPriorityObjectReplicationInPortal` as the feature name. The provider name for this preview feature is `Microsoft.Storage`

articles/storage/blobs/object-replication-overview.md

@@ -55,7 +55,7 @@ Object replication asynchronously copies block blobs in a container according to
 > [!IMPORTANT]
 > Because block blob data is replicated asynchronously, the source account and destination account aren't immediately in sync. 
 >
-> OR now supports priority replication, which prioritizes the replication of the operations in an OR Policy. A Service Level Agreement (SLA) guarantees replication performance when the OR policy's source and destination accounts are located within the same continent. The SLA ensures 99.0% of operations are replicated within 15 minutes from source to destination container under the OR policy during the billing month. To learn more about priority replication, visit the [Object Replication Priority Replication](object-replication-priority-replication.md) article.
+> OR now supports priority replication, which prioritizes the replication of all operations in an OR Policy. When OR priority replication is enabled the replication performance of all operations are significantly improved. When a replication policy's source and destination account are within the same continent, OR priority replication also replicates 99.0% of objects within 15 minutes for supported workloads. For more information, visit the [SLA terms](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1&msockid=0d36bfb9b86d68ee3afdae84b944695f) and the [Object Replication Priority Replication](object-replication-priority-replication.md) article.
 >
 > You can also check the replication status on the source blob to determine whether replication is complete. For more information, see [Check the replication status of a blob](object-replication-configure.md#check-the-replication-status-of-a-blob).
 

articles/storage/blobs/object-replication-priority-replication.md

@@ -17,17 +17,14 @@ ms.custom: references_regions
 
 Object replication (OR) currently copies all operations from a source storage account to one or more destination accounts asynchronously, with no guaranteed completion time. However, with the introduction of object replication priority replication, users can now choose to prioritize the replication of the operations in their replication policy.
 
-Priority replication comes with a Service Level Agreement (SLA) guarantee if your policy's source and destination account are located within the same continent. The SLA ensures 99.0% of operations replicate from the source account to the destination account within 15 minutes during a billing month. Refer to the official [SLA terms](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1&msockid=0d36bfb9b86d68ee3afdae84b944695f) for a comprehensive list of eligibility requirements.
+When a replication's source and destination account are within the same continent, OR priority replication also replicates 99.0% of objects within 15 minutes for supported workloads. For more information, see [SLA terms](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1&msockid=0d36bfb9b86d68ee3afdae84b944695f) for a comprehensive list of eligibility requirements.
 
+[!INCLUDE [object-replication-alert](includes/object-replication-alert.md)]
 
-> [!IMPORTANT]
-> This feature is generally available and offered in all regions.
->
-> To gain access to the Azure portal experience of Object Replication priority replication, see [Set up preview features in Azure subscription](/azure/azure-resource-manager/management/preview-features) and specify AllowPriorityObjectReplicationInPortal as the feature name. The provider name for this preview feature is `Microsoft.Storage`.
 
 ## Benefits of priority replication
 
-Priority replication significantly improves the performance and observability for Azure Object Replication (OR). Moreover, priority replication comes with a Service Level Agreement (SLA) that provides users with a performance guarantee provided the source and destination storage accounts are located within the same continent. The SLA guarantees that 99.0% of operations are replicated from the source to the destination storage account within 15 minutes during a billing month. This level of assurance is especially valuable for scenarios involving disaster recovery, business continuity, and high-availability architectures.
+Object Replication (OR) priority replication significantly improves the replication performance and observability for Azure Object Replication. Moreover, priority replication comes with a Service Level Agreement (SLA) that provides users with a performance guarantee provided the source and destination storage accounts are located within the same continent. For supported workloads OR priority replication also replicates 99.0% of objects within 15 minutes. This level of assurance is especially valuable for scenarios involving disaster recovery, business continuity, and high-availability architectures.
 
 In addition to performance guarantees, priority replication automatically enables OR metrics, which enhances visibility into replication progress. These metrics allow users to monitor the number of operations and bytes pending replication, segmented into time buckets such as 0–5 minutes, 5–10 minutes, and beyond. This detailed insight helps teams proactively manage replication health and identify potential delays. To learn more about OR metrics, see the [replication metrics](object-replication-overview.md#replication-metrics) article.
 
@@ -96,6 +93,10 @@ To enable OR Priority Replication when creating a new OR policy, complete the fo
 
 # [Azure PowerShell](#tab/powershell)
 
+Before running the following commands, ensure you have the latest Azure PowerShell version installed. You can find installation instructions at [Azure PowerShell](/powershell/azure/install-azure-powershell).
+
+You can use the `Set-AzStorageObjectReplicationPolicy` cmdlet together with the `New-AzStorageObjectReplicationPolicyRule` cmdlet to enable OR Priority Replication on a new policy. Use the example script below, or refer to the [Set-AzStorageObjectReplicationPolicy](/powershell/module/az.storage/set-azstorageobjectreplicationpolicy?view=azps-14.6.0&preserve-view=true) for more details.
+
 ```powershell
 
 # Login to your Azure account
@@ -128,6 +129,10 @@ $srcPolicy.PriorityReplication.Enabled
 
 # [Azure CLI](#tab/cli)
 
+Before running the following commands, ensure you have the latest Azure CLI version installed. You can find installation instructions at [Azure CLI](/cli/azure/install-azure-cli).
+
+You can use the `az storage account or-policy create` command to create a new Object Replication policy with priority replication enabled. Use the example script below, or refer to the [az storage account create](/cli/azure/storage/account?view=azure-cli-latest&preserve-view=true#az-storage-account-create) documentation for more details.
+
 ```azurecli-interactive
 
 # Login to your Azure account
@@ -181,7 +186,9 @@ In the Azure portal, navigate to the storage account you want to modify. In the
 
 # [Azure PowerShell](#tab/powershell)
 
-Open PowerShell and ensure you have the latest Azure PowerShell module installed. 
+Before running the following commands, ensure you have the latest Azure PowerShell version installed. You can find installation instructions at [Azure PowerShell](/powershell/azure/install-azure-powershell).
+
+You can use the `Set-AzStorageObjectReplicationPolicy` cmdlet to enable or disable OR Priority Replication on an existing policy. Use the example script below, or refer to the [Set-AzStorageObjectReplicationPolicy](/powershell/module/az.storage/set-azstorageobjectreplicationpolicy?view=azps-14.6.0&preserve-view=true) for more details.
 
 ```powershell
 
@@ -235,6 +242,10 @@ $srcPolicy.PriorityReplication.Enabled
 
 # [Azure CLI](#tab/cli)
 
+Before running the following commands, ensure you have the latest Azure CLI version installed. You can find installation instructions at [Azure CLI](/cli/azure/install-azure-cli).
+
+You can use the `az storage account or-policy update` command to enable or disable an existing Object Replication policy. Use the example script below, or refer to the [az storage account update](/cli/azure/storage/account?view=azure-cli-latest&preserve-view=true#az-storage-account-update) documentation for more details.
+
 ```azurecli-interactive
 
 # First, login to your Azure account

articles/storage/common/includes/geo-replication-alert.md

@@ -0,0 +1,22 @@
+---
+title: "include file"
+description: "include file"
+services: storage
+author: stevenmatthew
+ms.service: azure-storage
+ms.subservice: common-concepts
+ms.topic: "include"
+ms.date: 11/07/2025
+ms.author: shaas
+ms.custom: "include file", references_regions
+---
+
+<!-- User feedback is being incorporated into customer-managed planned failover (preview) and the feature is temporarily unavailable in all regions. After completion, updated documentation will be released to reflect the regions in which the feature is available.-->
+
+> [!IMPORTANT]
+> Priority replication is available in all public regions that support GRS/GZRS with the following exceptions:
+>
+> - West India
+> - Switzerland West
+>
+> To determine if a region supports GZRS, see the [Azure regions list](/azure/reliability/regions-list#azure-regions-list-1). To support GZRS, a region must support availability zones and have a paired region.

articles/storage/common/storage-redundancy-priority-replication.md

@@ -25,21 +25,9 @@ Azure Blob Storage Geo Priority Replication is designed to meet the stringent co
 
 For supported workloads, a Service Level Agreement (SLA) also backs geo priority replication, and applies to any account that has Geo priority replication enabled. It guarantees that the Last Sync Time (LST) for your account's Block Blob data remains lagged 15 minutes or less for 99.0% of the billing month. In addition to prioritized replication traffic, the feature includes enhanced monitoring and detailed telemetry.
 
-<!--
-> [!IMPORTANT]
-> This feature is generally available but is currently only offered in a limited number of regions.
->
-> Priority replication is available only within the following regions:
-> - East US 2
-> - West US 2
-> - North Europe
-> - West Europe
-> - Japan East
-> - Japan West
-> - Central India
-> - Switzerland North
-> - UAE North
--->
+Refer to the official [SLA terms](https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1&msockid=0d36bfb9b86d68ee3afdae84b944695f) for a comprehensive list of eligibility requirements.
+
+[!INCLUDE [replication-disclaimer](includes/geo-replication-alert.md)]
 
 ## Benefits of geo priority replication
 
@@ -76,6 +64,9 @@ To ensure transparency and empower customers to track the performance of Geo pri
 
 After geo priority replication is enabled and you register for the Geo Blob Lag metric (preview) you have the ability to view the new metric.
 
+> [!IMPORTANT]
+> Geo Blob Lag metrics can take up to 24 hours to begin displaying after registering for the feature.
+
 :::image type="content" source="media/storage-redundancy-priority-replication/replication-enabled-sml.png" alt-text="Screenshot showing the geo priority replication enabled status for existing accounts." lightbox="media/storage-redundancy-priority-replication/replication-enabled-lrg.png":::
 
 ## Enable and disable Geo-Redundant Storage replication
@@ -95,6 +86,10 @@ To enable Geo Priority Replication when creating a new storage account, complete
 
 # [Azure PowerShell](#tab/powershell)
 
+Before running the following commands, ensure you have the latest Azure PowerShell version installed. You can find installation instructions at [Azure PowerShell](/powershell/azure/install-azure-powershell).
+
+You can use the `New-AzStorageAccount` cmdlet to create a new storage account with Geo Priority Replication enabled. Use the example script below, or refer to the [New-AzStorageAccount documentation](/powershell/module/az.storage/new-azstorageaccount?view=azps-14.6.0&preserve-view=true#example-22-create-a-storage-account-with-blob-geo-priority-replication-enabled) for more details.
+
 ```powershell
 
 # Login to your Azure account
@@ -112,6 +107,10 @@ $account = New-AzStorageAccount -ResourceGroupName $rgname `
 ```
 # [Azure CLI](#tab/cli)
 
+Before running the following commands, ensure you have the latest Azure CLI version installed. You can find installation instructions at [Azure CLI](/cli/azure/install-azure-cli).
+
+You can use the `az storage account create` command to create a new storage account with Geo Priority Replication enabled. Use the example script below, or refer to the [az storage account create](/cli/azure/storage/account?view=azure-cli-latest&preserve-view=true#az-storage-account-create) documentation for more details.
+
 ```azurecli-interactive
 
 # Login to your Azure account
@@ -158,6 +157,10 @@ To enable or disable Geo Priority Replication for an existing storage account, c
 
 # [Azure PowerShell](#tab/powershell)
 
+Before running the following commands, ensure you have the latest Azure PowerShell version installed. You can find installation instructions at [Azure PowerShell](/powershell/azure/install-azure-powershell).
+
+You can use the `Set-AzStorageAccount` cmdlet to enable Geo Priority Replication on an existing storage account. Use the example script below, or refer to the [Set-AzStorageAccount](/powershell/module/az.storage/set-azstorageaccount?view=azps-14.6.0&preserve-view=true#-enableblobgeopriorityreplication) documentation for more details.
+
 ```powershell
 # Login to your Azure account
 Connect-AzAccount
@@ -175,6 +178,10 @@ $account = Set-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $
 
 # [Azure CLI](#tab/cli)
 
+Before running the following commands, ensure you have the latest Azure CLI installed. You can find installation instructions at [Azure CLI](/cli/azure/install-azure-cli).
+
+You can use the `az storage account update` command to enable or disable Geo Priority Replication on an existing storage account. Use the example script below, or refer to the [az storage account update](/cli/azure/storage/account?view=azure-cli-latest&preserve-view=true#az-storage-account-update) documentation for more details.
+
 ```azurecli-interactive
 
 # Login to your Azure account