Merge pull request #97546 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to master to sync with https://github.com/Microsoft/azure-docs (branch master)

Author: huypub

articles/azure-government/compliance/secure-azure-computing-architecture.md

@@ -152,7 +152,7 @@ We recommend this architecture because it meets SCCA requirements. It’s highly
 
 ## Automated SACA deployment options
 
- As previously mentioned, Microsoft has partnered with two vendors to create an automated SACA infrastructure template. Both templates deploy the following Azure components: 
+ As previously mentioned, Microsoft has partnered with two vendors to create an automated SACA infrastructure template. Both templates deploy the following Azure components:
 
 - SACA virtual network
     - Management subnet

articles/bastion/bastion-nsg.md

@@ -53,8 +53,8 @@ If you create and apply an NSG to ***AzureBastionSubnet***, make sure you have a
 * **Diagnostics logging and others:** Outbound on 443 to AzureCloud. Regional tags within this service tag are not supported yet.
 * **Target VM:** Outbound for 3389 and 22 to VirtualNetwork
 
-An NSG rule example is available for reference in this [quickstart template](https://github.com/Azure/azure-quickstart-templates/tree/master/101-azure-bastion).
+An NSG rule example is available for reference in this [quickstart template](https://github.com/Azure/azure-quickstart-templates/tree/master/101-azure-bastion-nsg).
 
 ## Next steps
 
-For more information about Azure Bastion, see the [FAQ](bastion-faq.md).
+For more information about Azure Bastion, see the [FAQ](bastion-faq.md).

includes/bastion-faq-include.md

@@ -51,3 +51,7 @@ A session should be initiated only from the Azure portal. Sign in to the Azure p
 
 Azure Bastion currently supports en-us-qwerty keyboard layout inside the VM.  Support for other locales for keyboard layout is work in progress.
 
+### <a name="udr"></a>Is user-defined routing (UDR) supported on an Azure Bastion subnet?
+
+No. UDR is not supported on an Azure Bastion subnet.
+For scenarios that include both Azure Bastion and Azure Firewall/Network Virtual Appliance (NVA) in the same virtual network, you don’t need to force traffic from an Azure Bastion subnet to Azure Firewall because the communication between Azure Bastion and your VMs is private. For more details, see [Accessing VMs behind Azure Firewall with Bastion](https://azure.microsoft.com/blog/accessing-virtual-machines-behind-azure-firewall-with-azure-bastion/).