Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into mdb-troubleshooting-articles

Author: RoseHJM

articles/communication-services/how-tos/ui-library-sdk/callkit.md

@@ -19,6 +19,7 @@ In this article, you learn how to set up CallKit correctly by using the UI Libra
 
 ## Prerequisites
 
+- A physical iOS device. An iOS Simulator does not support CallKit functionality.
 - An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
 - A deployed Communication Services resource. [Create a Communication Services resource](../../quickstarts/create-communication-resource.md).
 - A user access token to enable the call client. [Get a user access token](../../quickstarts/identity/access-tokens.md).

articles/communication-services/how-tos/ui-library-sdk/includes/pip/ios.md

@@ -10,6 +10,9 @@ ms.service: azure-communication-services
 
 For more information, see the [open-source iOS UI Library](https://github.com/Azure/communication-ui-library-ios) and the [sample application code](https://github.com/Azure-Samples/communication-services-ios-quickstarts/tree/main/ui-calling).
 
+### Prerequisites
+A physical iOS device to run the App. An iOS Simulator does not support Picture-in-picture functionality.
+
 ### Picture-in-picture setup
 
 To enable multitasking and picture-in-picture, use the `CallCompositeOptions` constructor parameters `enableMultitasking` and `enableSystemPiPWhenMultitasking`.

articles/cost-management-billing/reservations/exchange-and-refund-azure-reservations.md

@@ -39,6 +39,8 @@ Not all reservations are eligible for exchange. For example, you can't exchange
 - Synapse Analytics Pre-purchase plan
 - Red Hat plans
 - SUSE Linux plans
+- Microsoft Defender for Cloud Pre-Purchase Plan
+- Microsoft Sentinel Pre-Purchase Plan
 
 You can also refund reservations, but the sum total of all canceled reservation commitment in your billing scope (such as EA, Microsoft Customer Agreement, and Microsoft Partner Agreement) can't exceed USD 50,000 in a 12 month rolling window.
 
@@ -51,6 +53,8 @@ The following reservations aren't eligible for refunds:
 - Azure VMware solution by CloudSimple
 - Red Hat plans
 - SUSE Linux plans
+- Microsoft Defender for Cloud Pre-Purchase Plan
+- Microsoft Sentinel Pre-Purchase Plan
 
 ## Prerequisites
 

articles/event-grid/mqtt-automotive-connectivity-and-data-solution.md

@@ -1,6 +1,6 @@
 ---
 title: 'Automotive messaging, data & analytics reference architecture'
-description: 'Describes the use case of automotive messaging'
+description: 'Describes the use case of a sample Internet of Things (IoT) solutions - automotive messaging'
 ms.topic: conceptual
 ms.custom:
   - ignite-2023

articles/event-grid/mqtt-overview.md

@@ -1,6 +1,6 @@
 ---
 title: 'Overview of MQTT broker feature in Azure Event Grid'
-description: 'Describes the main concepts for the MQTT broker feature in Azure Event Grid.'
+description: Describes how Azure Event Grid enables MQTT clients to communicate with each other and with Azure services, to support your Internet of Things (IoT) solutions.
 ms.topic: conceptual
 ms.custom:
   - ignite-2023

articles/firewall/media/premium-deploy-certificates-enterprise-ca/certificate-template-key-usage-extension.png

@@ -28,12 +28,28 @@ To use an Enterprise CA to generate a certificate to use with Azure Firewall Pre
 - an [Azure Key Vault](premium-certificates.md#azure-key-vault) 
 - a Managed Identity with Read permissions to **Certificates and Secrets** defined in the Key Vault Access Policy 
 
+## Create a new Subordinate Certificate Template
+
+1. Run `certtmpl.msc` to open the Certificate Template Console.
+2. Find the **Subordinate Certification Authority** template in the console.
+3. Right-click on the **Subordinate Certification Authority** template and select **Duplicate Template**.
+4. In the **Properties of New Template** window, go to the **Compatibility** tab and set the appropriate compatibility settings or leave them as default.
+5. Go to the **General** tab, set the **Template Display Name** (for example: `My Subordinate CA`), and adjust the validity period if necessary. Optionally, select the **Publish certificate in Active Directory** checkbox.
+6. In the **Settings** tab, ensure the required users and groups have read and `enroll` permissions.
+7. Navigate to the **Extensions** tab, select **Key Usage**, and select **Edit**.
+   - Ensure that the **Digital signature**, **Certificate signing**, and **CRL signing** checkboxes are selected.
+   - Select the **Make this extension critical** checkbox and select **OK**.
+   
+   :::image type="content" source="media/premium-deploy-certificates-enterprise-ca/certificate-template-key-usage-extension.png" alt-text="Screenshot of certificate template key usage extensions.":::
+8. Select **OK** to save the new certificate template.
+9. Ensure the new template is enabled so it can be used to issue certificates.
+
 ## Request and export a certificate
 
 1. Access the web enrollment site on the Root CA, usually `https://<servername>/certsrv` and select **Request a Certificate**.
 1. Select **Advanced Certificate Request**.
 1. Select **Create and Submit a Request to this CA**.
-1. Fill out the form using the Subordinate Certification Authority template.
+1. Fill out the form using the Subordinate Certification Authority template created in the previous section.
    :::image type="content" source="media/premium-deploy-certificates-enterprise-ca/advanced-certificate-request.png" alt-text="Screenshot of advanced certificate request":::
 1. Submit the request and install the certificate.
 1. Assuming this request is made from a Windows Server using Internet Explorer, open **Internet Options**.

articles/firewall/premium-deploy-certificates-enterprise-ca.md

@@ -133,7 +133,7 @@ sections:
       
       - question: Can public IP addresses with DDoS protection enabled be used with a NAT gateway? 
         answer: |
-          No, a NAT gateway doesn't support public IP addresses with DDoS protection enabled. For more information, see [DDoS limitations](../ddos-protection/ddos-protection-sku-comparison.md#limitations). 
+          No, a NAT gateway doesn't support public IP addresses with DDoS protection enabled. DDoS protected IPs are generally more critical for inbound traffic, since most DDoS attacks are designed to overwhelm the target's resources by flooding them with a large volume of incoming traffic. For more information on DDoS protected IPs, see [DDoS limitations](../ddos-protection/ddos-protection-sku-comparison.md#limitations).
       
       - question: Can public IPs of an existing NAT gateway be changed? 
         answer: |

articles/nat-gateway/faq.yml

@@ -1,6 +1,6 @@
 ---
-title: "Azure Operator Nexus: Accepted Cluster"
-description: Troubleshoot accepted Cluster resource.
+title: "Azure Operator Nexus: Accepted cluster"
+description: Learn how to troubleshoot accepted cluster resources.
 author: matternst7258
 ms.author: matthewernst
 ms.service: azure-operator-nexus
@@ -10,45 +10,45 @@ ms.date: 10/30/2024
 # ms.custom: template-include
 ---
 
-# Troubleshoot accepted Cluster resources
+# Troubleshoot accepted cluster resources
 
-Operator Nexus relies on mirroring, or hydrating, resources from the on-premises cluster to Azure. When this process is interrupted, the Cluster resource can move to `Accepted` state. 
+Azure Operator Nexus relies on mirroring, or hydrating, resources from the on-premises cluster to Azure. When this process is interrupted, the cluster resource can move to the `Accepted` state.
 
 ## Diagnosis
 
-The Cluster status is viewed via the Azure portal or via Azure CLI.
+The cluster status is viewed via the Azure portal or the Azure CLI.
 
 ```bash
 az networkcloud cluster show --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME>
 ```
 
 ## Mitigation steps
 
-### Triggering the resource sync
+Follow these steps for mitigation.
 
+### Trigger the resource sync
 
-1. From the Cluster resource page in the Azure portal, add a tag to the Cluster resource.
-2. The resource moves out of the `Accepted` state.
-
-```bash
-az login
-az account set --subscription <SUBSCRIPTION>
-az resource tag --tags exampleTag=exampleValue --name <CLUSTER> --resource-group <CLUSTER_RG> --resource-type "Microsoft.ContainerService/managedClusters"
-```
+1. From the cluster resource page in the Azure portal, add a tag to the cluster resource.
+1. The resource moves out of the `Accepted` state.
+    
+    ```bash
+    az login
+    az account set --subscription <SUBSCRIPTION>
+    az resource tag --tags exampleTag=exampleValue --name <CLUSTER> --resource-group <CLUSTER_RG> --resource-type "Microsoft.ContainerService/managedClusters"
+    ```
 
 ## Verification
 
-After the tag is applied, the Cluster moves to `Running` state.
+After the tag is applied, the cluster moves to the `Running` state.
 
 ```bash
 az networkcloud cluster show --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME>
 ```
 
-If the Cluster resource maintains the state after a period of time, more than 5 minutes, contact Microsoft support. 
-
-## Further information
+If the cluster resource maintains the state for more than five minutes, contact Microsoft support.
 
- Learn more about how resources are hydrated with [Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/overview).
+## Related content
 
-If you still have questions, [contact support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade).
-For more information about Support plans, see [Azure Support plans](https://azure.microsoft.com/support/plans/response/).
+- For more information about how resources are hydrated, see [Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/overview).
+- If you still have questions, contact [Azure support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade).
+- For more information about support plans, see [Azure support plans](https://azure.microsoft.com/support/plans/response/).