Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into avesanRefresh

Author: roygara

articles/api-management/applications.md

@@ -1,5 +1,5 @@
 ---
-title: Protect Access to Product APIs with Microsoft Entra Application - Azure API Management
+title: Securely Access Products and APIs - Microsoft Entra Applications - Azure API Management
 titleSuffix: Azure API Management
 description: Configure OAuth 2.0 access to product APIs in Azure API Management with Microsoft Entra ID applications.
 services: api-management
@@ -11,7 +11,7 @@ ms.date: 05/19/2025
 ms.author: danlep
 ms.custom: 
 ---
-# Secure product API access with Microsoft Entra applications
+# Securely access products and APIs with Microsoft Entra applications
 
 [!INCLUDE [api-management-availability-premium-dev-standard-basic](../../includes/api-management-availability-premium-dev-standard-basic.md)]
 
@@ -64,14 +64,14 @@ The following example uses the **Starter** product, but choose any published pro
 1. In the left menu, under **APIs**, select **Products**.
 1. Choose the product that you want to configure, such as the **Starter** product.
 1. In the left menu, under **Product**, select **Properties**.
-1. Enable the **Application based access** setting.
-1. Optionally, enable the **Requires subscription** setting. If you enable both application based access and a subscription requirement, the API Management gateway can accept either OAuth 2.0 authorization or a subscription key for access to the product's APIs.
+1. In the **Application based access** section, enable the **OAuth 2.0 token (most secure)** setting.
+1. Optionally, enable the **Subscription key** setting. If you enable both application based access and a subscription requirement, the API Management gateway can accept either an OAuth 2.0 token or a subscription key for access to the product's APIs.
 1. Select **Save**.
 
 :::image type="content" source="media/applications/enable-application-based-access.png" alt-text="Screenshot of enabling application based access in the portal.":::
 
 > [!TIP]
-> You can also enable the **Application based access** setting when creating a new product.
+> You can also enable the **OAuth 2.0 token** setting when creating a new product.
 
  Enabling application based access creates a backend enterprise application in Microsoft Entra ID to represent the product. The backend application ID is displayed in the product's **Properties** page.
 

articles/api-management/media/applications/enable-application-based-access.png

@@ -95,6 +95,8 @@ If the secret version isn't specified in the reference, the app uses the latest
 
 The delay is because App Service caches the values of the Key Vault references and refetches them every 24 hours. Any configuration change to the app causes an app restart and an immediate refetch of all referenced secrets.
 
+To force resolution of your app's Key Vault references, make an authenticated POST request to the API endpoint `https://management.azure.com/[Resource ID]/config/configreferences/appsettings/refresh?api-version=2022-03-01`.
+
 ## <a name = "source-app-settings-from-key-vault"></a> Understand source app settings from Key Vault
 
 To use a Key Vault reference, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required.

articles/api-management/media/applications/product-application-settings.png

@@ -18,3 +18,29 @@ No. App Service routes internet requests only to the main container. For code-ba
 
 For more information on configuring `IsMain`, see [Microsoft.Web sites/sitecontainers](/azure/templates/microsoft.web/sites/sitecontainers).
 
+### How do I use volume mounts?
+
+The Volume mounts feature enables you to share non-persistent files and directories between containers within your Web App.
+
+:::image type="content" source="../../media/tutorial-custom-container-sidecar/configure-volume-mounts.png" alt-text="Screenshot showing a volume mount configuration for a sidecar container.":::
+
+**Volume sub path:** This is a logical directory path that is automatically created, and is not referenced within the container. Containers that are configured with the same volume sub path can share files and directories with each other.
+
+**Container mount path:** This corresponds to a directory path that you reference within the container. The container mount path is mapped to the volume sub path.
+
+For example, suppose the following volume mounts are configured:
+
+| Sidecar name | Volume sub path | Container mount path | Read-only |
+| ------------ | --------------- | -------------------- | --------- |
+| Container1 | /directory1/directory2 | /container1Vol | False |
+| Container2 | /directory1/directory2 | /container2Vol | True |
+| Container3 | /directory1/directory2/directory3 | /container3Vol | False |
+| Container4 | /directory4 | /container1Vol | False |
+
+Based on these settings, the following conditions apply:
+-	If Container1 creates **/container1Vol/myfile.txt**, Container2 can read the file via **/container2Vol/myfile.txt**.
+-	If Container1 creates **/container1Vol/directory3/myfile.txt**, Container2 can read the file via **/container2Vol/directory3/myfile.txt**, and Container3 can read and write to the file via **/container3Vol/myfile.txt**.
+-	Container4 does not share a volume mount in common with any of the other containers.
+
+> [!Note]
+> For code-based Linux apps, the built-in Linux container cannot use volume mounts.

articles/app-service/app-service-key-vault-references.md

@@ -4,7 +4,7 @@ description: Configure Application Gateway for Containers metrics to be sent to
 services: application-gateway
 author: greg-lindsay
 ms.service: azure-appgw-for-containers
-ms.topic: article
+ms.topic: how-to
 ms.date: 10/21/2024
 ms.author: greglin
 ---

articles/app-service/includes/tutorial-sidecar/common-faqs.md

@@ -4,7 +4,7 @@ description: Configure Application Gateway for Containers for SIEM integration w
 services: application-gateway
 author: greg-lindsay
 ms.service: azure-appgw-for-containers
-ms.topic: article
+ms.topic: how-to
 ms.date: 07/11/2024
 ms.author: greglin
 ---

articles/app-service/media/tutorial-custom-container-sidecar/configure-volume-mounts.png

@@ -4,7 +4,7 @@ description: This article is an overview of the resource health feature for Azur
 services: application-gateway
 author: greg-lindsay
 ms.service: azure-application-gateway
-ms.topic: article
+ms.topic: overview
 ms.date: 7/9/2019
 ms.author: greglin
 ---
@@ -56,4 +56,4 @@ The **Degraded** health status indicates your gateway has detected a loss in per
 
 ## Next steps
 
-To learn about troubleshooting Application Gateway Web Application Firewall (WAF), see [Troubleshoot Web Application Firewall (WAF) for Azure Application Gateway](../web-application-firewall/ag/web-application-firewall-troubleshoot.md).
+To learn about troubleshooting Application Gateway Web Application Firewall (WAF), see [Troubleshoot Web Application Firewall (WAF) for Azure Application Gateway](../web-application-firewall/ag/web-application-firewall-troubleshoot.md).

articles/application-gateway/for-containers/prometheus-grafana.md

@@ -166,6 +166,10 @@
       href: concept-soft-delete.md
     - name: Recover or purge deleted stores
       href: howto-recover-deleted-stores-in-azure-app-configuration.md
+- name: AI configuration
+  items:
+  - name: Overview
+    href: concept-ai-configuration.md
 - name: Feature management
   items:
   - name: Overview