Merge pull request #9792 from MicrosoftDocs/main

Auto Publish – main to live - 2025-09-29 18:00 UTC

Author: learn-build-service-prod[bot]

…shoot-domain-and-tls-ssl-certificates.md …shoot-domain-and-tls-ssl-certificates.mdsupport/azure/app-service/troubleshoot-domain-and-tls-ssl-certificates.md renamed to support/azure/app-service/connection-issues-with-ssl-or-tls/troubleshoot-domain-and-tls-ssl-certificates.md support/azure/app-service/troubleshoot-domain-and-tls-ssl-certificates.md renamed to support/azure/app-service/connection-issues-with-ssl-or-tls/troubleshoot-domain-and-tls-ssl-certificates.md

@@ -384,4 +384,4 @@ Also, if your CA gives you multiple certificates in the certificate chain, you h
 For an App Service certificate, you purchase through the Azure portal or by using a Powershell/CLI command. A certificate-signing request isn't needed. However, Azure Key Vault supports storing digital certificates issued by any CA. It supports creating a certificate-signing request with a private/public key pair. The certificate-signing request can be signed by any CA (an internal enterprise CA or an external public CA). For more information, see [Create a certificate-signing request](/azure/key-vault/certificates/create-certificate-signing-request).
 
 
-[!INCLUDE [Azure Help Support](../../includes/azure-help-support.md)]
+[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

support/azure/app-service/toc.yml

@@ -3,7 +3,7 @@
   - name: Connection issues with SSL or TLS
     items:
     - name: Troubleshoot domain and TLS/SSL certificates 
-      href: troubleshoot-domain-and-tls-ssl-certificates.md  
+      href: ./connection-issues-with-ssl-or-tls/troubleshoot-domain-and-tls-ssl-certificates.md  
     - name: Use Azure App Service Certificate with Azure Front Door
       href: ./connection-issues-with-ssl-or-tls/use-azure-app-service-certificate-with-azure-front-door.md
     - name: Use Azure App Service Certificate with Application Gateway

support/azure/azure-storage/files/file-sync/file-sync-troubleshoot-managed-identities.md

@@ -221,3 +221,14 @@ Set-AzStorageSyncServerEndpointPermission -ResourceGroupName <string> -StorageSy
 This issue occurs when the **Allow Azure services on the trusted services list to access this storage account** exception isn't enabled on a storage account. To resolve this issue, enable this exception by following instructions in [Grant access to trusted Azure services and restrict access to the storage account public endpoint to specific virtual networks](/azure/storage/file-sync/file-sync-networking-endpoints#grant-access-to-trusted-azure-services-and-restrict-access-to-the-storage-account-public-endpoint-to-specific-virtual-networks).
 
 [!INCLUDE [Azure Help Support](../../../../includes/azure-help-support.md)]
+
+
+## Unsupported cross-tenant configurations 
+
+Cross-tenant topologies where the server resource (Arc-enabled server or Azure VM) and the Storage Sync Service are in **different Microsoft Entra tenants** aren't supported. Managed identity and Azure RBAC require tokens issued by the same tenant; cross-tenant authorization fails in this scenario. Do not attempt cross-tenant setups. 
+
+**Mitigation:** Align the Storage Sync Service, server resource identity, storage account RBAC assignments, and managed identity to the **same tenant**, then retry.
+
+> [!NOTE]
+> This requirement applies to **both** Arc-enabled servers and Azure VMs.
+

support/windows-server/networking/disable-http-proxy-auth-features.md

@@ -1,7 +1,7 @@
 ---
 title: How to disable HTTP proxy features
 description: Describes how to disable specific features of Windows HTTP proxies.
-ms.date: 05/27/2025
+ms.date: 09/26/2025
 manager: dcscontentpm
 audience: itpro
 ms.topic: troubleshooting
@@ -60,3 +60,15 @@ After you disable WPAD, you must manually configure all proxies. The registry ke
 
 > [!IMPORTANT]
 > In addition to setting the registry key, WPAD should also be disabled in the Windows **Settings** UI, because third-party apps and Internet browsers may rely on these settings for Proxy Auto-Discovery.
+
+## How to disable proxy sorting
+
+In Windows Server and Windows client, when multiple proxies are configured, the system sorts them based on their response time. If you want to disable this feature, you can do so by setting a DWORD value for the following registry subkey to **1**:
+
+```console
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHTTP\DisableProxySort
+```
+
+After you disable proxy sorting, you'll need to restart the _WinHTTP Web Proxy Auto-Discovery Service_ (`WinHttpAutoProxySvc`) service for the change to take effect. Once restarted, the system uses the order in which the proxies were configured, without sorting them by response time.
+
+If first proxy in list is unavailable, there will be a delay while the service determines that proxy is unreachable and moves to next proxy. To avoid this delay, ensure that all configured proxies are reachable or enable proxy sorting again.