Merge pull request #304185 from MicrosoftDocs/main

Auto Publish – main to live - 2025-08-13 22:00 UTC

Author: learn-build-service-prod[bot]

articles/application-gateway/ipv6-application-gateway-portal.md

@@ -102,7 +102,7 @@ Create the application gateway using the tabs on the **Create application gatewa
 1. On the **Frontends** tab, verify **Frontend IP address type** is set to **Public**.
 
    > [!IMPORTANT]
-   > For the Application Gateway v2 SKU, there must be a **Public** frontend IP configuration. A private IPv6 frontend IP configuration (Only ILB mode) is currently not supported for the IPv6 Application Gateway. 
+   > For a [private only Application Gateway](./application-gateway-private-deployment.md), you can configure private IPv6 frontend IPs, but you must also configure a private IPv4 address. In other words, a private-only Application Gateway requires both private IPv4 and private IPv6 addresses.
 
 2. Select **Add new** for the **Public IP address**, enter a name for the public IP address, and select **OK**. For example, **myAGPublicIPAddress**. 
 

articles/azure-resource-manager/bicep/deploy-what-if.md

@@ -24,6 +24,7 @@ If you don't have Azure CLI installed, you can use Azure Cloud Shell. For more i
 > [!TIP]
 > We recommend [Bicep](../bicep/overview.md) because it offers the same capabilities as ARM templates and the syntax is easier to use. To learn more, see [How to deploy resources with Bicep and Azure CLI](../bicep/deploy-cli.md).
 
+## Prerequisites
 
 [!INCLUDE [permissions](../../../includes/template-deploy-permissions.md)]
 

articles/azure-resource-manager/bicep/media/deploy-what-if/resource-manager-deployment-whatif-change-types.png

@@ -12,6 +12,8 @@ You can use [Azure Cloud Shell](../../cloud-shell/overview.md) to deploy an Azur
 
 You can deploy to any scope. This article shows deploying to a resource group.
 
+## Prerequisites
+
 [!INCLUDE [permissions](../../../includes/template-deploy-permissions.md)]
 
 ## Deploy remote template

articles/azure-resource-manager/bicep/media/deploy-what-if/resource-manager-deployment-whatif-output-confirm.png

@@ -12,6 +12,8 @@ This article explains how to use the Azure Resource Manager REST API with Azure
 
 You can either include your template in the request body or link to a file. When using a file, it can be a local file or an external file that is available through a URI. When your template is in a storage account, you can restrict access to the template and provide a shared access signature (SAS) token during deployment.
 
+## Prerequisites
+
 [!INCLUDE [permissions](../../../includes/template-deploy-permissions.md)]
 
 ## Deployment scope

articles/azure-resource-manager/templates/deploy-cli.md

@@ -17,6 +17,8 @@ The deployment scope is determined by the template schema. For more information,
 - [management groups](deploy-to-management-group.md)
 - [tenants](deploy-to-tenant.md)
 
+## Prerequisites
+
 [!INCLUDE [permissions](../../../includes/template-deploy-permissions.md)]
 
 ## Use common image

articles/azure-resource-manager/templates/deploy-cloud-shell.md

@@ -17,6 +17,8 @@ You can use the what-if operation with Azure PowerShell, Azure CLI, or REST API
 
 To learn more about what-if, and for hands-on guidance, see [Preview Azure deployment changes by using what-if](/training/modules/arm-template-whatif).
 
+## Prerequisites
+
 [!INCLUDE [permissions](../../../includes/template-deploy-permissions.md)]
 
 ## What-if limits

articles/azure-resource-manager/templates/deploy-rest.md

@@ -25,6 +25,8 @@ Azure Communication Services relies on Azure Event Grid subscriptions to deliver
 
 ## Call Automation webhook events
 
+### OpenID Configuration Verification
+
 [Call Automation events](../../concepts/call-automation/call-automation.md#call-automation-webhook-events) are sent to the webhook callback URI specified when you answer a call or place a new outbound call. Your callback URI must be a public endpoint with a valid HTTPS certificate, Domain Name System name, and IP address with the correct firewall ports open to enable Call Automation to reach it. This anonymous public web server could create a security risk if you don't take the necessary steps to secure it from unauthorized access.
 
 ::: zone pivot="programming-language-csharp"
@@ -44,7 +46,17 @@ Azure Communication Services relies on Azure Event Grid subscriptions to deliver
 ::: zone-end
 
 > [!IMPORTANT]
-> Our service uses the default token standard described above. We do not support custom tokens or modified token formats.
+> Our service uses standard JSON Web Token in the authentication header, and only support OpenID Connect (OIDC) JWT validation.
+
+### Query Parameter Token Authentication
+
+Query Parameter Token Authentication is a simple method of securing webhook callbacks by appending a pre-shared secret token to the webhook endpoint URL as a query string parameter. This token acts as a lightweight authentication key, allowing your system to verify that webhook callback events originate from the Call Automation Service.
+
+```
+https://api.example.com/webhook?token=8f2d9c63a7b14d32b53c9e12a1f47fcb
+```
+
+When webhook callback events are received, the Call Automation Service includes the token exactly as you configured (see example above). Upon receiving the request, your system compares the token in the query parameter against a stored, trusted value. Requests without the token, or with an incorrect value, should be rejected.
 
 ## Call Automation WebSocket events