docs(architect): weekly KB update — 66 files refreshed (2026-04)

Updated 66 stale knowledge base reference files (10 critical, 56 high) across all 5 skills using Microsoft Learn MCP research. Key factual updates: - Groundedness Detection API: `correction` → `mitigating` param, `correctedText` → `correctionText` (breaking change) - Copilot Studio: GPT-4.1 mini now default (was GPT-4o mini); Claude Sonnet 4.5 + Opus 4.5 added (experimental, 200K ctx) - Agentic Retrieval: still public preview; 50M free tokens/month - Azure security baselines: "Cognitive Services" → "Foundry Tools" - Databricks: Delta Live Tables → Lakeflow Spark Declarative Pipelines - MLflow 3 GenAI: new Feedback/Expectation data model - Token tracking doc: "Azure OpenAI in Foundry Models through a gateway" - Agent Registry: Risks column (M365 E7), Graph API (preview) - Copilot DLP: new Entra AI Admin + Purview Data Security AI Admin roles - ISO/IEC 42001: scope expanded to M365 Copilot, Foundry, Security Copilot - Zero Trust: CAE now via Conditional Access, Strict Location Enforcement - Purview: new Fabric Copilots/agents governance section - AG-UI HITL: ApprovalRequiredAIFunction (C#), @tool approval_mode (Python) All files: Last updated → 2026-04, *(Verified MCP 2026-04)* markers added. Build registry: 1341 URLs from 387 files (+2 new URLs). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-09 22:41:26 +02:00 · 2026-04-09 22:41:26 +02:00 · 565043dbde
commit 565043dbde
parent f72592ebf3
73 changed files with 727 additions and 301 deletions
--- a/skills/ms-ai-governance/references/monitoring-observability/log-analytics-kql-ai-queries.md
+++ b/skills/ms-ai-governance/references/monitoring-observability/log-analytics-kql-ai-queries.md
@ -1,7 +1,7 @@
 # Log Analytics KQL Queries for AI

 **Kategori:** Monitoring & Observability
-**Dato:** 2026-02-05
+**Dato:** 2026-04
 **Forfatter:** Cosmo Skyberg, AI Solution Architect

 ## Oversikt
@ -32,6 +32,7 @@ TableName
 - `ABSBotRequests` — Azure Bot Service
 - `AmlComputeJobEvent` — Azure Machine Learning job events
 - `AmlComputeClusterEvent` — Azure ML cluster events
+- `AmlOnlineEndpointTrafficLog` — Azure ML online endpoint traffic *(Verified MCP 2026-04)*

 ### Azure OpenAI: Grunnleggende Diagnostics Query

@ -145,6 +146,44 @@ AmlComputeClusterEvent

 **Forklaring:** Identifiser peak node-bruk for å optimalisere cluster sizing og kostnader.

+### Azure Machine Learning: Failed Online Endpoint Requests
+
+*(Verified MCP 2026-04)*
+
+```kusto
+// Failed online endpoint requests siste dag
+AmlOnlineEndpointTrafficLog
+| where TimeGenerated > ago(1d) and ResponseCode != 200
+| project TimeGenerated, EndpointName, DeploymentName, ResponseCode, ResponseCodeReason
+| order by TimeGenerated desc
+```
+
+**Bruk:** Overvåk inference-endepunkter i produksjon. `ResponseCodeReason` gir detaljert feilinfo for debugging.
+
+### Azure Machine Learning: Anbefalte Alert Rules
+
+*(Verified MCP 2026-04)*
+
+Microsoft dokumenterer tre standard alert rules for Azure ML:
+
+| Alert type | Betingelse | Beskrivelse |
+|-----------|-----------|-------------|
+| Model Deploy Failed | Total > 0 | Én eller flere modelldeploy-jobber har feilet |
+| Quota Utilization Percentage | Average > 90% | Kvoteutnyttelse over 90% |
+| Unusable Nodes | Total > 0 | Én eller flere noder er i unusable-tilstand |
+
+**KQL for quota-overvåkning:**
+
+```kusto
+// Overvåk cluster quota-utnyttelse
+AmlComputeClusterEvent
+| where TimeGenerated > ago(1h)
+| summarize AvgQuotaUtilization = avg(todouble(QuotaUtilized) / todouble(QuotaAllocated) * 100)
+    by ClusterName
+| where AvgQuotaUtilization > 90
+| project ClusterName, AvgQuotaUtilization
+```
+
 ## Error Investigation Patterns

 ### Pattern 1: Error Spike Detection
@ -436,6 +475,77 @@ AzureDiagnostics

 **Best practice:** Bruk `take 10` eller `take 100` mens du utvikler queries. Fjern før produksjon.

+### 9. Bruk Query Details-panelet for ytelsesdiagnose
+
+*(Verified MCP 2026-04)*
+
+Log Analytics har et **Query Details**-panel (klikk "Query details" nede til høyre etter kjøring) med tre faner:
+
+- **Overview** — KPI-er: CPU, tidsomfang, alder på data, antall workspaces, antall regioner, parallellisme, **Memory peak** (nytt)
+- **Raw statistics** — Detaljert eksekusjonsstatistikk
+- **Errors** — Feil under kjøring
+
+**Execution time** er nå delt i tre komponenter:
+
+| Komponent | Betydning |
+|-----------|-----------|
+| Engine Execution Time | Tid i underliggende data-engine (Azure Data Explorer). Høy verdi → optimaliser selve queryen |
+| Service Execution Time | Intern Azure Monitor-prosessering og orkestrering |
+| Service Queue Time | Ventetid i kø pga. concurrency-grenser. Høy verdi → reduser samtidige queries |
+
+**Memory peak** er maksimal RAM observert under kjøring. Høy memory peak kan trigge `E_RUNAWAY_QUERY`- eller `E_LOW_MEMORY_CONDITION`-feil. Reduseres med tidlig filtrering og `shuffle`-hint på `join`/`summarize`.
+
+### 10. Bryt opp store `parse`-kommandoer
+
+*(Verified MCP 2026-04)*
+
+**Regel:** Maks 5 kolonne-ekstraksjoner per `parse`-setning. Over 5 øker prosesseringstiden markant.
+
+**❌ Tregere (mange ekstraksjoner i én setning):**
+
+```kusto
+LogData
+| parse Message with
+   * "field1=" Field1: string " field2=" Field2: string
+   " field3=" Field3: string " field4=" Field4: string
+   " field5=" Field5: string " field6=" Field6: string
+   " field7=" Field7: string " field8=" Field8: string *
+```
+
+**✅ Raskere (del opp i flere setninger):**
+
+```kusto
+LogData
+| parse Message with
+   * "field1=" Field1: string " field2=" Field2: string
+   " field3=" Field3: string " field4=" Field4: string
+   " field5=" Field5: string *
+| parse Message with
+   * " field6=" Field6: string " field7=" Field7: string
+   " field8=" Field8: string *
+```
+
+**Merk:** I transformasjoner er grensen 10 ekstraksjoner per `parse`-setning.
+
+### 11. Bruk `materialize()` for subqueries som gjenbrukes
+
+*(Verified MCP 2026-04)*
+
+Når samme datakilde brukes i flere subqueries, kan `materialize()` cache mellomresultater og forhindre multiple gjennomganger av kilde-data:
+
+```kusto
+let CachedData = materialize(
+    AzureDiagnostics
+    | where TimeGenerated > ago(1h)
+    | where ResourceProvider == "MICROSOFT.OPENAI"
+);
+CachedData | summarize ErrorCount = countif(ResultSignature != "200") by OperationName
+| join kind=inner (CachedData | summarize TotalCount = count() by OperationName) on OperationName
+| extend ErrorRate = todouble(ErrorCount) / TotalCount
+```
+
+**Effektivt når:** Output fra subquery er mye mindre enn input, og subquery kjøres flere ganger i samme query.
+
 ## Advanced Patterns

 ### Multi-region Aggregation
@ -626,12 +736,16 @@ AzureDiagnostics
 - **Test med `take`:** Begrens output under query-utvikling.
 - **Korreler på tvers av tjenester:** `join` for å finne cross-service dependencies.
 - **Visualiser med `render`:** `timechart`, `columnchart`, `anomalychart` for innsikt.
+- **Bruk Query Details-panel:** Engine/Service/Queue execution time + Memory peak for diagnose. *(Verified MCP 2026-04)*
+- **Maks 5 per `parse`:** Del opp store parse-setninger for å redusere prosesseringstid. *(Verified MCP 2026-04)*
+- **`materialize()` for gjentatte subqueries:** Cache mellomresultater, unngå multiple datascans. *(Verified MCP 2026-04)*
+- **`AmlOnlineEndpointTrafficLog`:** Ny tabell for inference-endepunktovervåkning i Azure ML. *(Verified MCP 2026-04)*

 ## Referanser

 - Microsoft Learn: [Monitor Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/monitor-openai)
 - Microsoft Learn: [Get started with log queries in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/get-started-queries)
- Microsoft Learn: [Optimize log queries in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-optimization)
+- Microsoft Learn: [Optimize log queries in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-optimization) *(Verified MCP 2026-04)*
 - Microsoft Learn: [Configure diagnostic logging for Azure AI Search](https://learn.microsoft.com/en-us/azure/search/search-monitor-enable-logging)
- Microsoft Learn: [Monitor Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/monitor-azure-machine-learning)
+- Microsoft Learn: [Monitor Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/monitor-azure-machine-learning) *(Verified MCP 2026-04)*
 - Microsoft Learn: [KQL quick reference](https://learn.microsoft.com/en-us/kusto/query/kql-quick-reference)