Merge branch 'main' into copilot/fix-85f15788-a0b8-4e52-bc90-ebff04f64f28

arthurclares · web-flow · commit 5b8f6d0029ed · 2025-09-15T11:49:57.000+01:00
diff --git a/.github/workflows/ado-sync-workitems.yml b/.github/workflows/ado-sync-workitems.yml
@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
@@ -20,12 +20,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
@@ -52,12 +52,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # main
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # main
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -55,7 +55,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
+        uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3
diff --git a/.github/workflows/hugo-build-pr-check.yml b/.github/workflows/hugo-build-pr-check.yml
@@ -32,7 +32,7 @@ jobs:
       HUGO_VERSION: 0.124.1
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
@@ -45,7 +45,7 @@ jobs:
         run: sudo snap install dart-sass-embedded
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           submodules: recursive
           fetch-depth: 0
diff --git a/.github/workflows/hugo-site-build.yml b/.github/workflows/hugo-site-build.yml
@@ -41,7 +41,7 @@ jobs:
       HUGO_VERSION: 0.140.0
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
@@ -54,7 +54,7 @@ jobs:
         run: sudo snap install dart-sass-embedded
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           submodules: recursive
           fetch-depth: 0
@@ -84,7 +84,7 @@ jobs:
         working-directory: .
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: ./public
 
@@ -101,7 +101,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -21,12 +21,12 @@ jobs:
       id-token: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/validate-queries.yml b/.github/workflows/validate-queries.yml
@@ -25,12 +25,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: "refs/pull/${{ github.event.number }}/merge"
 
diff --git a/.github/workflows/validate-recommendations.yml b/.github/workflows/validate-recommendations.yml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up Python 3.x
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/azure-resources/ContainerService/managedClusters/kql/005ccbbd-aeab-46ef-80bd-9bd4479412ec.kql b/azure-resources/ContainerService/managedClusters/kql/005ccbbd-aeab-46ef-80bd-9bd4479412ec.kql
@@ -1,9 +1,18 @@
 // Azure Resource Graph Query
 // Returns each AKS cluster with nodepools that have user nodepools with less than 2 nodes
 resources
-| where type == "microsoft.containerservice/managedclusters"
+| where type =~ "Microsoft.ContainerService/managedClusters"
 | mv-expand agentPoolProfile = properties.agentPoolProfiles
-| extend taints = tostring(parse_json(agentPoolProfile.nodeTaints))
-| extend nodePool = tostring(parse_json(agentPoolProfile.name))
-| where taints !has "CriticalAddonsOnly=true:NoSchedule" and  agentPoolProfile.minCount < 2
-| project recommendationId="005ccbbd-aeab-46ef-80bd-9bd4479412ec", name, id=id, tags,param1=strcat("nodePoolName: ", nodePool), param2=strcat("nodePoolMinNodeCount: ", agentPoolProfile.minCount)
+| extend
+    taints = tostring(parse_json(agentPoolProfile.nodeTaints)),
+    nodePool = tostring(parse_json(agentPoolProfile.name))
+| where taints !has "CriticalAddonsOnly=true:NoSchedule"
+| where (agentPoolProfile.enableAutoScaling == true and agentPoolProfile["minCount"] < 2) or (agentPoolProfile.enableAutoScaling == false and agentPoolProfile["count"] < 2)
+| project
+    recommendationId = "005ccbbd-aeab-46ef-80bd-9bd4479412ec",
+    name,
+    id,
+    tags,
+    param1 = strcat("nodePoolName: ", nodePool),
+    param2 = strcat("enableAutoScaling: ", agentPoolProfile.enableAutoScaling),
+    param3 = iff(tobool(agentPoolProfile.enableAutoScaling), strcat("nodePoolMinNodeCount: ", agentPoolProfile["minCount"]), strcat("nodePoolNodeCount: ", agentPoolProfile["count"]))
diff --git a/azure-resources/Network/loadBalancers/kql/6d82d042-6d61-ad49-86f0-6a5455398081.kql b/azure-resources/Network/loadBalancers/kql/6d82d042-6d61-ad49-86f0-6a5455398081.kql
@@ -5,6 +5,6 @@ resources
 | mv-expand bpool = properties.backendAddressPools
 | extend BackendAddresses = array_length(bpool.properties.loadBalancerBackendAddresses)
 | where BackendAddresses <= 1
-| extend lbId = id, lbName = name, poolName = tostring(bpool.name)
-| summarize anyPool = any(poolName), anyTags = any(tags) by lbId, lbName
-| project recommendationId = "6d82d042-6d61-ad49-86f0-6a5455398081", name = lbName, id = lbId, tags = anyTags, param1 = strcat("backendPoolName: ", anyPool)
+| extend lbId = id, lbName = name, poolName = tostring(bpool.name), lbTags = tostring(tags)
+| summarize impactedPools = make_list(poolName) by lbId, lbName, lbTags
+| project recommendationId = "6d82d042-6d61-ad49-86f0-6a5455398081",name = lbName,id = lbId,tags = lbTags,param1 = strcat("backendPoolNames: ", strcat_array(impactedPools, ", "))
diff --git a/azure-resources/Network/loadBalancers/recommendations.yaml b/azure-resources/Network/loadBalancers/recommendations.yaml
@@ -1,6 +1,6 @@
 - description: Use Standard Load Balancer SKU
   aprlGuid: 38c3bca1-97a1-eb42-8cd3-838b243f35ba
-  recommendationTypeId: null
+  recommendationTypeId: 332e07de-da0d-4ee7-b1c4-ca9016005e1d
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Network/loadBalancers
@@ -17,7 +17,7 @@
 
 - description: Ensure the Backend Pool contains at least two instances
   aprlGuid: 6d82d042-6d61-ad49-86f0-6a5455398081
-  recommendationTypeId: null
+  recommendationTypeId: 5b132ebc-bd86-46fc-b2ee-95bc3e2d3017
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Network/loadBalancers
diff --git a/azure-resources/Network/networkWatchers/kql/1e28bbc1-1eb7-486f-8d7f-93943f40219c.kql b/azure-resources/Network/networkWatchers/kql/1e28bbc1-1eb7-486f-8d7f-93943f40219c.kql
@@ -1 +1,14 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is deployed but Connection Monitor is not deployed
+Resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId, name, id
+| join kind = leftouter (
+resources
+| where type =~ 'microsoft.network/networkwatchers/connectionmonitors'
+| summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+      | where isnull(nwlocation) or isempty(nwlocation)
+| project recommendationId = "1e28bbc1-1eb7-486f-8d7f-93943f40219c", name, id, tags=''
diff --git a/azure-resources/Network/networkWatchers/kql/4e133bd0-8762-bc40-a95b-b29142427d73.kql b/azure-resources/Network/networkWatchers/kql/4e133bd0-8762-bc40-a95b-b29142427d73.kql
@@ -1 +1,15 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is not deployed
+Resources
+| where location <> 'global'
+| summarize by location, subscriptionId
+| project location, subscriptionId
+| join kind = leftouter (
+    resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+    | where isnull(nwlocation) or isempty(nwlocation)
+    | project recommendationId = "4e133bd0-8762-bc40-a95b-b29142427d73", name = strcat('NetworkWatcher_',location) , id=subscriptionId, tags='', param1 = strcat("missingLocation: ", location)
diff --git a/azure-resources/Network/privateDnsZones/kql/3538aa48-c40b-455b-a93b-269fe6e65be2.kql b/azure-resources/Network/privateDnsZones/kql/3538aa48-c40b-455b-a93b-269fe6e65be2.kql
@@ -1,2 +1,4 @@
-// under-development
-
+// Azure Resource Graph Query
+// This query will return Time-To-Live (TTL) for the DNS recordsets. Make sure it is set appropriately to ensure RTOs
+dnsresources
+| project recommendationId = "3538aa48-c40b-455b-a93b-269fe6e65be2", name, id, tags, param1 = strcat("Time-To-Live: ", tostring(properties.ttl))
diff --git a/azure-resources/Network/virtualNetworkGateways/recommendations.yaml b/azure-resources/Network/virtualNetworkGateways/recommendations.yaml
@@ -68,7 +68,7 @@
 
 - description: Configure customer-controlled ExpressRoute gateway maintenance
   aprlGuid: 3e115044-a3aa-433e-be01-ce17d67e50da
-  recommendationTypeId: null
+  recommendationTypeId: b4af9e04-3570-41f1-b4cf-b7af07224799
   recommendationControl: HighAvailability
   recommendationImpact: Medium
   recommendationResourceType: Microsoft.Network/virtualNetworkGateways
diff --git a/azure-resources/Network/virtualWans/_index.md b/azure-resources/Network/virtualWans/_index.md
@@ -1,7 +1,7 @@
 ---
 title: virtualWans
 geekdocCollapseSection: true
-geekdocHidden: false
+geekdocHidden: true
 ---
 
 {{< azure-resources-recommendationlist name="azure-resources-recommendationlist" >}}
diff --git a/azure-resources/Oracledatabase/cloudexadatainfrastructures/kql/c99d730b-8754-447f-bd5d-3e8850a12235.kql b/azure-resources/Oracledatabase/cloudexadatainfrastructures/kql/c99d730b-8754-447f-bd5d-3e8850a12235.kql
@@ -1 +1,6 @@
-// under-development
+// Azure Resource Graph Query
+// This resource graph query will return rows if Oracle Database@Azure Infrastructure life cycle state is not Available
+resources
+| where type == "oracle.database/cloudexadatainfrastructures"
+| where properties.lifecycleState !~ "Available"
+| project recommendationId = "c99d730b-8754-447f-bd5d-3e8850a12235",id=tostring(id),name,tags, param1 = "ODAAInfraAvail: False"
diff --git a/azure-resources/Oracledatabase/cloudexadatavmclusters/kql/4b33324a-70cd-4bac-bdae-da4c382c436b.kql b/azure-resources/Oracledatabase/cloudexadatavmclusters/kql/4b33324a-70cd-4bac-bdae-da4c382c436b.kql
@@ -1 +1,6 @@
-// under-development
+// Azure Resource Graph Query
+// This resource graph query will return rows if Oracle Database@Azure Cluster life cycle state is not Available
+resources
+| where type == "oracle.database/cloudvmclusters"
+| where properties.lifecycleState !~ "Available"
+| project recommendationId = "4b33324a-70cd-4bac-bdae-da4c382c436b",id=tostring(id),name,tags, param1 = "ODAAClusterAvail: False"
diff --git a/azure-resources/Storage/storageAccounts/kql/e6c7e1cc-2f47-264d-aa50-1da421314472.kql b/azure-resources/Storage/storageAccounts/kql/e6c7e1cc-2f47-264d-aa50-1da421314472.kql
@@ -2,7 +2,6 @@
 // This query will return all storage accounts that are not using Zone or Region replication
 Resources
 | where type =~ "Microsoft.Storage/storageAccounts"
-| where location in~ ("australiaeast", "brazilsouth", "canadacentral", "centralindia", "centralus", "eastasia", "eastus", "eastus2", "francecentral", "germanywestcentral", "israelcentral", "italynorth", "japaneast", "japanwest", "koreacentral", "mexicocentral", "newzealandnorth", "northeurope", "norwayeast", "polandcentral", "qatarcentral", "southafricanorth", "southcentralus", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", "westeurope", "westus2", "westus3", "usgovvirginia", "chinanorth3")
 | where sku.name in~ ("Standard_LRS", "Premium_LRS")
 | project recommendationId = "e6c7e1cc-2f47-264d-aa50-1da421314472", name, id, tags, param1 = strcat("sku: ", sku.name)
 
diff --git a/azure-resources/Subscription/subscriptions/kql/c041d596-6c97-4c5f-b4b3-9cd37628f2e2.kql b/azure-resources/Subscription/subscriptions/kql/c041d596-6c97-4c5f-b4b3-9cd37628f2e2.kql
@@ -1,12 +1,12 @@
 // Azure Resource Graph Query
-// Count VM instances with a tag that contains "Citrix VDA" and create output if that count is >2000 for each subscription.
-// The Citrix published limit is 2500. This query runs an 80% check.
+// Count VM instances with a tag that contains "Citrix VDA" and create output if that count is >4000 for each subscription.
+// The Citrix published limit is 5000. This query runs an 80% check.
 
 resources
 | where type == 'microsoft.compute/virtualmachines'
 | where tags contains 'Citrix VDA'
 | summarize VMs=count() by subscriptionId
-| where VMs > 2000
+| where VMs > 4000
 | join (resourcecontainers| where type =='microsoft.resources/subscriptions' | project subname=name, subscriptionId) on subscriptionId
 | project recommendationId='c041d596-6c97-4c5f-b4b3-9cd37628f2e2', name= subname, id = subscriptionId, param1='Too many instances.', param2= VMs
 
diff --git a/azure-resources/Subscription/subscriptions/recommendations.yaml b/azure-resources/Subscription/subscriptions/recommendations.yaml
@@ -1,4 +1,4 @@
-- description: Do not create more than 2000 Citrix VDA servers per subscription
+- description: Do not create more than 4000 Citrix VDA servers per subscription
   aprlGuid: c041d596-6c97-4c5f-b4b3-9cd37628f2e2
   recommendationTypeId: null
   recommendationControl: OtherBestPractices
diff --git a/azure-resources/Web/serverFarms/recommendations.yaml b/azure-resources/Web/serverFarms/recommendations.yaml
@@ -17,7 +17,7 @@
 
 - description: Use Standard or Premium tier
   aprlGuid: b2113023-a553-2e41-9789-597e2fb54c31
-  recommendationTypeId: null
+  recommendationTypeId: dc298556-8232-4aa8-bfe0-5204c5017be0
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Web/serverFarms
diff --git a/azure-specialized-workloads/oracle/_index.md b/azure-specialized-workloads/oracle/_index.md
@@ -9,7 +9,7 @@ geekdocHidden: false
 | Recommendation                                                                                   | Provider Namespace |  Resource Type  |
 | :----------------------------------------------------------------------------------------------- | :----------------: | :-------------: |
 | [Ensure ODAA infrastructure is in Available state under normal operations](../../../Azure-Proactive-Resiliency-Library-v2/azure-resources/Oracledatabase/cloudexadatainfrastructures/#) |       Oracledatabase        |  cloudexadatainfrastructures  |
-| [Ensure ODAA clusters are in Available state under normal operations](../../../Azure-Proactive-Resiliency-Library-v2/azure-resources/Oracledatabase/cloudvmclusters/#) |      Oracledatabase       | cloudvmclusters |
+| [Ensure ODAA clusters are in Available state under normal operations](../../../Azure-Proactive-Resiliency-Library-v2/azure-resources/Oracledatabase/cloudexadatavmclusters/#) |      Oracledatabase       | cloudvmclusters |
 
 <br>
 
diff --git a/azure-specialized-workloads/oracle/kql/02bfe908-d958-451a-a603-bef8277ae56a.kql b/azure-specialized-workloads/oracle/kql/02bfe908-d958-451a-a603-bef8277ae56a.kql
@@ -1 +1,6 @@
-// cannot-be-validated-with-arg
+// Azure Resource Graph Query
+// This resource graph query will return rows if Oracle Database@Azure Infrastructure Maintenance is not Rolling
+resources
+| where type == "oracle.database/cloudexadatainfrastructures"
+| where properties.maintenanceWindow.patchingMode !~ "Rolling"
+| project recommendationId = "02bfe908-d958-451a-a603-bef8277ae56a",id=tostring(id),name,tags, param1 = "ODAAInfraMaintRolling: False"
diff --git a/azure-specialized-workloads/oracle/recommendations.yaml b/azure-specialized-workloads/oracle/recommendations.yaml
@@ -106,22 +106,22 @@
     - name: Business continuity and disaster recovery considerations for Oracle Database@Azure
       url: "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/oracle-iaas/oracle-disaster-recovery-oracle-database-azure"
 
-- description: Set up Oracle Key Vault in a highly available cluster for customer-managed encryption keys.
+- description: Store encryption keys in Azure Key Vault for Exadata workloads
   aprlGuid: bbe4014f-c49d-475d-9c48-76cb3c190483
   recommendationTypeId: null
-  recommendationControl: HighAvailability
+  recommendationControl: Security
   recommendationImpact: High
   recommendationResourceType: Microsoft.Subscription/subscriptions
   recommendationMetadataState: Active
   longDescription: |
-    Provide redundancy for VMs used as OKV, note that this is only relevant if customer is using own keys and only if OCI vault is not used. A minimum 4-node OKV cluster deployment is recommended across two AZs or regions, aligned with the BCDR architecture.
-  potentialBenefits: Protect access to keys in case of VM or AZ/region failure.
+    Store Oracle TDE master encryption keys for Exadata workloads in Azure Key Vault to centralize key management, improve security, and support compliance with enterprise-grade controls.
+  potentialBenefits: Storing keys in AKV improves security and reliability.
   pgVerified: false
   automationAvailable: false
   tags: [ORACLE]
   learnMoreLink:
-    - name: Security guidelines for Oracle Database@Azure
-      url: "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/oracle-iaas/oracle-security-overview-odaa"
+    - name: Integrate Oracle Exadata Database@Azure with Azure Key Vault
+      url: https://learn.microsoft.com/azure/oracle/oracle-db/manage-oracle-transparent-data-encryption-azure-key-vault
 
 - description: Ensure Oracle Database@Azure Infrastructure is updated in a rolling manner.
   aprlGuid: 02bfe908-d958-451a-a603-bef8277ae56a
diff --git a/docs/layouts/shortcodes/azure-resources-recommendationlist.html b/docs/layouts/shortcodes/azure-resources-recommendationlist.html
