Merge pull request #110567 from spelluru/sbusfirewall0407

moved note up

Author: PRMerger19

articles/service-bus-messaging/service-bus-ip-filtering.md

@@ -20,11 +20,14 @@ By default, Service Bus namespaces are accessible from internet as long as the r
 
 This feature is helpful in scenarios in which Azure Service Bus should be only accessible from certain well-known sites. Firewall rules enable you to configure rules to accept traffic originating from specific IPv4 addresses. For example, if you use Service Bus with [Azure Express Route][express-route], you can create a **firewall rule** to allow traffic from only your on-premises infrastructure IP addresses or addresses of a corporate NAT gateway. 
 
+> [!IMPORTANT]
+> Firewalls and Virtual Networks are supported only in the **premium** tier of Service Bus. If upgrading to the **premier** tier isn't an option, we recommend that you keep the Shared Access Signature (SAS) token secure and share with only authorized users. For information about SAS authentication, see [Authentication and authorization](service-bus-authentication-and-authorization.md#shared-access-signature).
+
 ## IP firewall rules
 The IP firewall rules are applied at the Service Bus namespace level. Therefore, the rules apply to all connections from clients using any supported protocol. Any connection attempt from an IP address that does not match an allowed IP rule on the Service Bus namespace is rejected as unauthorized. The response does not mention the IP rule. IP filter rules are applied in order, and the first rule that matches the IP address determines the accept or reject action.
 
 ## Use Azure portal
-This section shows you how to use the Azure portal to create IP firewall rules for an Service Bus namespace. 
+This section shows you how to use the Azure portal to create IP firewall rules for a Service Bus namespace. 
 
 1. Navigate to your **Service Bus namespace** in the [Azure portal](https://portal.azure.com).
 2. On the left menu, select **Networking** option. By default, the **All networks** option is selected. Your Service Bus namespace accepts connections from any IP address. This default setting is equivalent to a rule that accepts the 0.0.0.0/0 IP address range. 
@@ -41,8 +44,6 @@ This section shows you how to use the Azure portal to create IP firewall rules f
 ## Use Resource Manager template
 This section has a sample Azure Resource Manager template that creates a virtual network and a firewall rule.
 
-> [!IMPORTANT]
-> Firewalls and Virtual Networks are supported only in the **premium** tier of Service Bus.
 
 The following Resource Manager template enables adding a virtual network rule to an existing Service Bus namespace.