| Field | Description |
|---|---|
| +Account ID | +ID of the account. We prefix this ID with sa::. A service account name must be unique. Operations for Applications converts a service account ID to lower case to avoid confusion that can result from almost identical account names (e.g. Service-1 and service-1). Users can type upper case or lower case. |
+
| +Tokens | +List of API tokens that the service account can use to authenticate to the Operations for Applications service instance.
+
|
+
| Permissions | +Individual permissions assigned to this service account. Assign the service account with the Proxies permission, so that you can use it for the proxy setup of an integration that authenticates with an Operations for Applications API token. | +
+To activate or deactivate an account from the Service Accounts page:
+
|
+ |
+
+To activate or deactivate an account from the Edit Service Account page:
+
|
+ |
+
+To grant or revoke permissions from the Service Accounts page:
+
|
+ |
+
+To grant or revoke permissions from the Edit Service Account page:
+
|
+ |
+
| Task | Original Subscription | VMware Cloud Services Subscription |
|---|---|---|
| Upgrade from trial + | +
+
|
+
+
|
+
| Purchase more PPS + | +
+
|
+
+
|
+
| Invite new Super Admins + | +
+
|
+
+
|
+
| Create and manage service accounts and their Operations for Applications API tokens + | +
+
|
+
+
|
+
| Restore orphan dashboards and alerts + | +
+
|
+
+
|
+
| Restrict access to new dashboards and alerts + | +
+
|
+
+
|
+
| Set the service organization settings + | +
+
|
+
+
|
+
| Functionality | Original Subscription | VMware Cloud Services Subscription |
|---|---|---|
| User Login + | +Users log in to their Operations for Applications service instance by using the URL of the service cluster, https://<your_instance>.wavefront.com, and their Operations for Applications accounts. If their corporate domain is configured for SAML SSO with Operations for Applications, users log in with their corporate accounts.
+ |
+Users log in to their Operations for Applications service instance through the VMware Cloud Services Console with their VMware Cloud services accounts. If their corporate domain is federated with VMware Cloud services, users log in with their corporate accounts. For details, see Log In from the VMware Cloud Services Console. + | +
| User Accounts Management + | +
+Who: Users with the Accounts permission.
+ Where: In the Operations for Applications user interface. +How: You can invite new users with or without assigning roles and permissions. For details, see Manage User Accounts. + |
+
+Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
+ Where: In the VMware Cloud Services Console. +How: To add a user to your Operations for Applications service instance, you must assign that user: +
|
+
| Service Accounts and Server to Server OAuth Apps Management + | +Note: Only service accounts are supported.
+ Who: Users with the Accounts permission. +Where: In the Operations for Applications user interface. +How: Service accounts authenticate with API tokens. Service accounts can be assigned with roles and permissions, as well as can be added to groups. For details, see Manage Service Accounts. + |
+Note: Server to server OAuth apps are recommended and fully supported. Service accounts are with limited support and will be deprecated in the future.
+ Who: +
Where: +
How: +
|
+
| Permissions Management + | +Who: Users with the Accounts permission.
+ Where: In the Operations for Applications user interface. +How: Permissions can be assigned to roles as well as to individual user accounts and service accounts. +See: + +Note: The permissions list includes the Accounts, SAML IdP Admin, and API token permissions, because they are required for all of the authorization and authentication tasks which are done in the Operations for Applications. +In addition, the Accounts permission grants privileges for managing the Operations for Applications organization settings. +See the Permissions Reference. + |
+Who:
+
Where: +
How: Permissions can be assigned only to roles in the VMware Cloud services organization and service accounts - in the Operations for Applications environment. +See: + + +Note: The Accounts, SAML IdP Admin, and API token permissions don't exist, because most of the authorization and authentication tasks requiring these permissions are done in the VMware Cloud Services Console. +The Admin Operations for Applications permission grants privileges for managing service accounts, Operations for Applications API tokens, and the Operations for Applications organization settings. +See the Operations for Applications Permissions in VMware Cloud Services. + |
+
| Roles Management + | +Who: Users with the Accounts permission.
+ Where: In the Operations for Applications user interface. +How: Roles can be assigned with permissions. Roles can be assigned to user accounts, service accounts, and groups. For details, see Manage Roles and Permissions. + |
+
+Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
+ Where: In the VMware Cloud Services Console. +How: Roles can be assigned with permissions. Roles can be assigned to users, groups, API tokens, and server to server apps. There are: +
|
+
| Groups Management + | +Who: Users with the Accounts permission.
+ Where: In the Operations for Applications user interface. +How: A group of user and service accounts can be assigned with one or more roles. For details, see Create a Group. + |
+
+Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
+ Where: In the VMware Cloud Services Console. +How: A group of users can be assigned with organization and service roles. A group can be shared with other VMware Cloud organizations. In a federated environment, you can add enterprise groups from your corporate domain. For details, see How do I work with groups in the VMware Cloud services documentation. + |
+
| Self-Service SAML SSO | +
+Who: Users with the SAML IdP Admin permission.
+ Where: In the Operations for Applications user interface. +How: Operations for Applications includes predefined authentication integrations. For details, see Single-Tenant Authentication and Self-Service SAML SSO. + |
+
+Who: A user with the VMware Cloud Organization Owner role together with an Enterprise Administrator.
+ Where: In the VMware Cloud Services Console. +How: The VMware Cloud Organization Owner user kicks off the self-service federation workflow on behalf of the VMware Cloud organization and invites the Enterprise Administrator to complete the setup. For details, see Setting Up Enterprise Federation with VMware Cloud Services Console in the VMware Cloud services documentation. + |
+
| Generating API Tokens + | +Note: Only Operations for Applications API tokens are supported.
+ Who: +
Where: In the Operations for Applications user interface. +How:
|
+Note: It is recommended to use VMware Cloud services API tokens and server to server OAuth app credentials for obtaining VMware Cloud services access tokens. Operations for Applications API tokens are with limited support and will be deprecated in a future release.
+ Who: +
Where: +
How: +
|
+
| API Tokens Management | +
+Who:
+
Where: In the Operations for Applications user interface. +How:
|
+
+Who:
+
Where: +
How: +
|
+
| Operations for Applications REST API Access | +
+Who: Everyone who has an Operations for Applications API token associated with a user account or a service account.
+ Where: An API client. +How: Interacting with the Operations for Application REST API requires an Operations for Application API token. +
|
+
+Who: Everyone who has a VMware Cloud services API token or the credentials of a server to server OAuth app.
+ Where: An API client. +How: Interacting with the Operations for Application REST API requires a VMware Cloud services access token. +
|
+
| Operations for Applications Organization Settings | +
+Who: Users with the Accounts permission.
+ Where: In the Operations for Applications user interface. +How: As a user with the Accounts permission, you can configure: +
|
+
+Who: Users with the Admin Operations for Applications service role.
+ Where: In the Operations for Applications user interface. +How: As a user with the Admin service role, you can configure: +
|
+
| Wavefront Proxy Installation + | +Note: The Wavefront proxy authenticates with an Operations for Applications API token.
+ Who: Users with the Proxies permission. +Where: In the Operations for Applications user interface. +How: As a user with the Proxies permission, you must configure the proxy to authenticate to Operations for Applications with an Operations for Applications API token that have the Proxies permission. For details, see Install a Proxy from the UI. + |
+Note: The Wavefront proxy authenticates with a VMware Cloud services access token obtained from server to server OAuth app credentials or from a VMware Cloud services API token. Proxy authentication with an Operations for Applications API token is still possible and supported only for a limited list of integrations.
+ Who: +
Where: +
How: As a user with the Proxies service role, you configure the proxy to authenticate to Operations for Applications. The proxy obtains a VMware Cloud services access token with the Proxies service role or use an Operations for Applications API token of a service account with the Proxies permission. To obtain a VMware Cloud services access token: +
|
+
| Integrations Installation + | +Note: All integrations that use a Wavefront proxy authenticate with an Operations for Applications API token.
+ Who: Users or service accounts with the Proxies permission who have an active Operations for Applications API token. +Where: In the Operations for Applications user interface. +How: Follow the instructions on the Setup tab of the integration that you want to install. + |
+Note: Most of the integrations that use a Wavefront proxy authenticate with a VMware Cloud services access token. A limited list of integrations still use proxy authentication with an Operations for Applications API token.
+ Who: Users with the Proxies Operations for Applications service role who must have one of the following: +
Where: In the Operations for Applications user interface. +How: Follow the instructions on the Setup tab of the integration that you want to install. + |
+
| Metrics Security Policy Management + | +Who: Users with the Metrics permission.
+ Where: In the Operations for Applications user interface. +How: Privileged users can block or allow access to metrics for: +
|
+Who: Users with the Metrics Operations for Applications service role.
+ Where: In the Operations for Applications user interface. +How: Privileged users can block or allow access to metrics for: +
|
+
for an overview. Note that this video was created in 2020 and some of the information in it might have changed. It also uses the 2020 version of the UI.
+Watch this video for an overview. Note that this video was created in 2020 and some of the information in it might have changed. It also uses the 2020 version of the UI, which is applicable to original subscriptions and there are some [differences between original and VMware Cloud services subscriptions](csp-ui-differences.html#metrics-security-policy-rule-creation-page).
@@ -36,9 +36,7 @@ Metrics security policy rules allows fine-grained support for limiting access to With a metrics security policy, you can block or allow access: * To metrics, optionally filtered by source or point tag -* Based on individual accounts ([user accounts](csp_user_management.html) and [service accounts](csp_server_to_server_apps.html)) or [groups](csp_users_roles.html#manage-user-groups). - -{% include note.html content="Service accounts in Operations for Applications correspond to server to server apps in VMware Cloud services." %} +* Based on individual accounts - [user accounts](csp_user_management.html) and service accounts (which includes the [server to server apps](csp_server_to_server_apps.html) in VMware Cloud services as well as the [service accounts](csp_service_accounts.html)), or [groups](csp_users_roles.html#manage-user-groups). When an account attempts to access metrics, the backend looks at the rules in priority order. Higher priority rules overwrite lower priority rules. @@ -181,7 +179,7 @@ Before you create rules, plan your strategy. * **Metrics Dimensions** allow you to determine what to block or allow. - Specify one or more metric prefixes. You can specify an exact match (e.g. `requests` or `request.`) or a wildcard match (e.g. `*.cpu.loadavg.*`, `cpu.*`). - Specify a combination of metric sources or point tags to narrow down the metrics. For example, you can block visibility into production environments for some developers, or you can block some development environments metrics for contractors. -* **Access** allows you to allow or block access for a combination of accounts (user accounts and service accounts) or groups. +* **Access** allows you to allow or block access for a combination of accounts (user accounts, server to server apps, and service accounts) or groups. See the Examples further below. @@ -207,7 +205,7 @@ You create a metrics security policy rule following these steps. See the annotat Here's an annotated screenshot that shows the main actions: - + diff --git a/pages/doc/csp_migration.md b/pages/doc/csp_migration.md new file mode 100644 index 000000000..91833f1d4 --- /dev/null +++ b/pages/doc/csp_migration.md @@ -0,0 +1,417 @@ +--- +title: Onboarding Original Subscriptions to VMware Cloud Services +keywords: administration +tags: [administration] +sidebar: doc_sidebar +permalink: csp_migration.html +summary: Learn about how we migrate the authorization and authentication from Operations for Applications to VMware Cloud services. +--- + +Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. We are in the process of incrementally onboarding all original subscriptions to VMware Cloud services. + +## What Should I Do Before the Onboarding? + +Currently, all original Operations for Applications subscriptions are integrated with VMware Cloud services for billing and subscription management. Therefore, you must already have a [VMware Cloud organization](csp_getting_started.html#whats-a-vmware-cloud-organization) with at least one user with the [VMware Cloud **Organization Owner** role](csp_getting_started.html#whats-a-vmware-cloud-organization-role). + +Before the onboarding: +* Get familiar with the VMware Cloud service platform. See [Getting Started with Operations for Applications on VMware Cloud Services](csp_getting_started.html). +* Verify that your VMware Cloud **Organization Owner** user can log in to the [VMware Cloud Services Console](https://console.cloud.vmware.com). + + - If you are the VMware Cloud **Organization Owner** user and cannot log in, try using the **Forgot Password** option. + - If your VMware Cloud **Organization Owner** user is unreachable or you don't know the name of your VMware Cloud **Organization Owner** user, contact our Technical Support team for assistance. +* If you have a [SAML SSO integration](auth_self_service_sso.html), as a VMware Cloud **Organization Owner** user, you must federate your currently integrated enterprise domain with your VMware Cloud organization. For details, see the [Setting Up Enterprise Federation with VMware Cloud Services Guide](https://docs.vmware.com/en/VMware-Cloud-services/services/setting-up-enterprise-federation-cloud-services/GUID-76FAECB3-CFAA-461E-B9C9-2A49C39CD17F.html) in the VMware Cloud services documentation. + + {% include warning.html content="If you do not federate your currently integrated enterprise domain, after onboarding to VMware Cloud services all users will lose access to the service."%} + +
 |
|
|
|
|
|
+ + + + + + +After onboarding to VMware Cloud services, you should incrementally replace your service accounts in Operations for Applications with server to server OAuth apps in VMware Cloud services. + + The flowchart on the right shows the overall process for creating a server to server OAuth app and replacing a service account with it. + |
+
+
+ |
+
| Scope + | +Description + | +
| + Organization Role + | +Organization Member is sufficient in most of the cases. + | +
| + Custom Roles + | +Optional. Use only if you previously created a custom role with the necessary Operations for Applications permissions. + | +
| Service Roles + | +Required for service access. Assign the Operations for Applications service roles that correspond to the permissions of the service account that you want to replace.
+ If you already assigned a custom role, you must assign at least the Viewer Operations for Applications service role. + |
+
|
|
+ + +You should incrementally replace your Operations for Applications API tokens with the more secure VMware Cloud services access tokens. + +To replace an Operations for Applications API token associated with a service account, you must replace the service account with a server to server OAuth app. See [How to Replace a Service Account with a Server to Server App?](csp_migration.html#how-to-replace-a-service-account-with-a-server-to-server-app). + +The flowchart on the right shows the overall process for replacing an Operations for Applications API token with a VMware Cloud services API token. + |
+
+
+ |
+
| Scope + | +Description + | +
| + Organization Role + | +Organization Member is sufficient in most of the cases. + | +
| + Custom Roles + | +Optional. Use only if you have assigned a custom role. + | +
| Service Roles + | +Required for service access.
+ If you already assigned a custom role, you must assign at least the Viewer Operations for Applications service role. + |
+
|
|
|
| Area | Original Subscription | VMware Cloud Services Subscription |
|---|---|---|
| User Login - | -Users log in to their Operations for Applications service instance by using the URL of the service cluster, https://<your_instance>.wavefront.com. and their Operations for Applications accounts. If their corporate domain is configured for SAML SSO with Operations for Applications, users log in with their corporate accounts.
- |
-Users log in to their Operations for Applications service instance through the VMware Cloud Services Console with their VMware Cloud services accounts. If their corporate domain is federated with VMware Cloud services, users log in with their corporate accounts. For details, see Log In from the VMware Cloud Services Console. - | -
| Permissions - | -The Accounts, SAML IdP Admin, and API token permissions exist, because all of the authorization and authentication tasks requiring these permissions are done in the Operations for Applications UI. See the Permissions Reference. - | -The Accounts, SAML IdP Admin, and API token permissions don't exist, because all of the authorization and authentication tasks requiring these permissions are done in the VMware Cloud Services Console. See the Operations for Applications Permissions in VMware Cloud Services. - | -
| Roles and Permissions Management - | -Who: Users with the Accounts permission.
- Where: In the Operations for Applications user interface. -How: Permissions can be assigned to roles as well as to individual users and service accounts. Roles can be assigned to user accounts, service accounts, and groups. For details, see: - - |
-
-Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
- Where: In the VMware Cloud Services Console. -How: Permissions can be assigned only to roles. Roles can be assigned to users, groups, API tokens, and server to server apps. There are built-in Operations for Applications service roles, which are not editable. Custom roles can be created and assigned with permissions for one or more services. For details, see Manage Roles. - |
-
| User Accounts Management - | -
-Who: Users with the Accounts permission.
- Where: In the Operations for Applications user interface. -How: You can invite new users with or without assigning roles and permissions. For details, see Manage User Accounts. - |
-
-Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
- Where: In the VMware Cloud Services Console. -How: To add a user to your Operations for Applications service instance, you must assign that user: -
|
-
| Self-Service SAML SSO | -
-Who: Users with the SAML IdP Admin permission.
- Where: In the Operations for Applications user interface. -How: Operations for Applications includes predefined authentication integrations. For details, see Single-Tenant Authentication and Self-Service SAML SSO. - |
-
-Who: A user with the VMware Cloud Organization Owner role together with an Enterprise Administrator.
- Where: In the VMware Cloud Services Console. -How: The VMware Cloud Organization Owner user kicks off the self-service federation workflow on behalf of the VMware Cloud organization and invites the Enterprise Administrator to complete the setup. For details, see Setting Up Enterprise Federation with VMware Cloud Services Console in the VMware Cloud services documentation. - |
-
| Service Accounts and Server to Server Apps Management - | -
-Who: Users with the Accounts permission.
- Where: In the Operations for Applications user interface. -How: Service accounts authenticate with API tokens. Service accounts can be assigned with roles and permissions, as well as can be added to groups. For details, see Manage Service Accounts. - |
-
-Who: Users with the VMware Cloud Organization Owner role or the Developer additional role.
- Where: In the VMware Cloud Services Console. -How: Server to server OAuth apps in VMware Cloud services correspond to service accounts in Operations for Applications. A server to server app authenticates with OAuth credentials (ID and secret) and an access token is directly issued to the app. To add a service account to your Operations for Applications service instance, you must create a server to server OAuth app and assign that app: -
|
-
| Groups Management - | -Who: Users with the Accounts permission.
- Where: In the Operations for Applications user interface. -How: A group of user and service accounts can be assigned with one or more roles. For details, see Create a Group. - |
-
-Who: Users with the VMware Cloud Organization Owner or Organization Administrator role.
- Where: In the VMware Cloud Services Console. -How: A group of users can be assigned with organization and service roles. A group can be shared with other VMware Cloud organizations. In a federated environment, you can add enterprise groups from your corporate domain. For details, see How do I work with groups in the VMware Cloud services documentation. - |
-
| Generating API Tokens - | -
-Who: Depends on whether the API token is associated with a user account or a service account.
-
Where: In the Operations for Applications user interface. -How:
|
-
-Who: All users.
- Where: In the Cloud Services Console user interface. -How: Each user can generate VMware Cloud services API tokens for their user account. An API token can be assigned with roles from the list of roles that the user owns - organization roles, service roles, and custom roles. -For access to Operations for Applications, the VMware Cloud services API token must be assigned with an Operations for Applications service role and, optionally, a custom role with an Operations for Applications permission. -For details and instructions, see How do I generate API tokens in the VMware Cloud services documentation. - |
-
| API Tokens Management | -
-Who:
-
Where: In the Operations for Applications user interface. -How:
|
-
-Who:
-
Where: In the Cloud Services Console user interface. -How:
|
-
| Operations for Applications REST API Access | -
-Who: User and service accounts with an Operations for Applications API token.
- Where: An API client. -How: Interacting with the Operations for Application REST API requires an Operations for Application API token. -
|
-
-Who: Users with a VMware Cloud services API token and server to server apps with OAuth credentials (ID and secret).
- Where: An API client. -How: Interacting with the Operations for Application REST API requires a VMware Cloud services access token. -
|
-
| Operations for Applications Organization Settings | -
-Who: Users with the Accounts permission.
- Where: In the Operations for Applications user interface. -How: As a user with the Accounts permission, you can configure: -
|
-
-Who: Users with the Super Admin Operations for Applications service role and Super Admin mode enabled.
- Where: In the Operations for Applications user interface. -How: As a user with the Super Admin service role, you can configure: -
|
-
| Wavefront Proxy Authentication - | -Who: Users with the Proxies permission.
- Where: In the Operations for Applications user interface. -How: As a user with the Proxies permission, you must configure the proxy to authenticate to Operations for Applications with an Operations for Applications API token that have the Proxies permission. For details, see Install a Proxy from the UI. - |
-Who:
Where:
How: As a user with the Proxies permission, you must configure the proxy to authenticate to Operations for Applications. The proxy must retrieve a VMware Cloud services access token with the Proxies service role. There are two supported authentication types: -
|
-
| Metrics Security Policy Rules - | -Who: Users with the Metrics permission.
- Where: In the Operations for Applications user interface. -How: Privileged users can block or allow access to metrics for: -
|
-Who: Users with the Metrics Operations for Applications service role or a custom role with the Metrics permission.
- Where: In the Operations for Applications user interface. -How: Privileged users can block or allow access to metrics for: -
|
-
| Integrations - | -All integrations are still supported. See the List of Integrations. - | -You still can see, but cannot configure some of our integrations. For the list of integrations that we support when your Operations for Applications service is onboarded to VMware Cloud services, see Integrations Supported for Onboarded Subscriptions. - | -
| Zabbix | [Zabbix Integration](zabbix.html) | -
| Special Service Role | +Service Role | Description |
|---|---|---|
When users with that service role enable Super Admin mode, they:
Tip: Combine the Super Admin service role with the roles that you want the user to have when Super Admin mode is disabled. |
Users with that service role:
|
+
+
- If your Operations for Applications service is a VMware Cloud services subscription, individual users and server to server apps. Service accounts in Operations for Applications correspond to server to server apps in VMware Cloud services. +
- If your Operations for Applications service is onboarded to VMware Cloud services, individual users, server to server apps, and service accounts.
- If your Operations for Applications service is an original subscription, individual user and service accounts.
- If your Operations for Applications service is onboarded to VMware Cloud services, groups of VMware Cloud services users.
+
You can also select the Everyone internal system group (which includes all users) or the Service Accounts internal system group (which includes all server to server apps that have access to your service as well as all service accounts in your service).
+ - If your Operations for Applications service is an original subscription, groups of user and service accounts, including the Everyone and Service Accounts system groups.
+- For VMware Cloud services subscriptions, users with the **Super Admin** service role (in Super Admin mode) and users with the **Admin** service role can enable the PromQL support.
+- For original Operations for Applications subscriptions, users with the **Accounts** permission can enable the PromQL support."%} + +* Users with an administrative role in Operations for Applications have control over user defaults: - On the **Organization Settings** page (New User Defaults) they can enable users to write queries in PromQL. - If queries in PromQL are enabled, they can also set other options. * Users can then type PromQL or WQL queries into the Query Editor. @@ -22,9 +26,7 @@ VMware Aria Operations for Applications (previously known as Tanzu Observability ## Set PromQL Organization Settings (Administrator Only) -{% include note.html content="Starting July 3, 2023, VMware Aria Operations for Applications is a service on the VMware Cloud services platform. For information about VMware Cloud services subscriptions and original subscriptions and the differences between them, see [Subscription Types](subscriptions-differences.html).
-- For VMware Cloud services subscriptions, only users with the **Super Admin** service role in Super Admin mode can enable the PromQL support.
-- For original Operations for Applications subscriptions, users with the **Accounts** permission can enable the PromQL support."%} +As a user with an administrative role, you can control user defaults. * If **PromQL Support** is *not enabled*, other users cannot use PromQL or change PromQL user preferences. * If **PromQL Support** is *enabled*, administrators can set additional New User Default query settings, and other users can override those settings. @@ -56,8 +58,6 @@ If an administrator has enabled PromQL support (discussed above), each user can If your default language is set to **PromQL**, you can build your queries only in the Query Editor. Chart Builder was designed for Wavefront query language and doesn't support PromQL. * Whether to show the translation to WQL when you click inside the Query Editor. - - ## Video: Wavefront Query Language and PromQL This short video
shows how you can create a PromQL chart and an alert. Note that this video was created in 2021 and some of the information in it might have changed. It also uses the 2021 version of the UI.
diff --git a/pages/doc/wavefront_release_notes.md b/pages/doc/wavefront_release_notes.md
index 60ba34344..031ed2aa3 100644
--- a/pages/doc/wavefront_release_notes.md
+++ b/pages/doc/wavefront_release_notes.md
@@ -15,6 +15,11 @@ This page lists new and updated features for the VMware Aria Operations for Appl
## Announcements
+### Onboarding Original VMware Aria Operations for Applications to VMware Cloud Services
+
+In October, 2023, we start to incrementally [onboard](csp_migration.html) all original subscriptions to VMware Cloud services. You will receive a notification in your Operations for Applications UI with the date scheduled for your service onboarding to VMware Cloud services. Make sure that you get familiar with the VMware Cloud services platform and prepare for the onboarding. See [What Should I Do Before the Onboarding?](csp_migration.html#what-should-i-do-before-the-onboarding).
+
+
### Free Trial of VMware Aria Operations for Applications on VMware Cloud Services
Starting September 20, 2023, all **new trial** instances of Operations for Applications are **onboarded** to VMware Cloud services. You can [start a free trial](start_trial.html) directly from the VMware Cloud Services Console.
@@ -32,7 +37,12 @@ For information about the two subscription types and how they differ, see [Subsc
{% include note.html content="We will support both original and onboarded subscriptions until all original subscriptions are onboarded to VMware Cloud services."%}
-## 2023-37.x Release Notes
+## 2023-38.x Release Notes
+
+### Onboarded Subscriptions
+
+**New Admin Permission and Service Role**: With this release, we introduce the **Admin** [permission](csp_permissions_overview.html#operations-for-applications-permissions) and [service role](csp_users_roles.html#operations-for-applications-service-roles-built-in). **Admin** users can manage the Operations for Applications organization settings.
+
### Original and Onboarded Subscriptions
diff --git a/pages/doc/wavefront_support_feedback.md b/pages/doc/wavefront_support_feedback.md
index 47c1b6eff..d581817bf 100644
--- a/pages/doc/wavefront_support_feedback.md
+++ b/pages/doc/wavefront_support_feedback.md
@@ -12,11 +12,11 @@ summary: Get help with and give feedback.
VMware Aria Operations for Applications (formerly known as Tanzu Observability by Wavefront) support is available as follows:
* Get in touch with Technical Support and create a support ticket. See the [How to Engage Technical Support](https://help.wavefront.com/hc/en-us/articles/360057219171-How-to-Engage-Technical-Support) KB.
-* Get support from within the product:
- 1. Log in to your product instance.
+* Get support from within Operations for Applications:
+ 1. Log in to your service instance.
1. From the gear icon on the toolbar, select Support.
 - +* Get support from within the VMware Cloud Services Console. See [How do I get support](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-E4DC731F-C039-4FB2-949E-9A61584CD5BF.html). ## Documentation Feedback