Merge pull request #109405 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to master to sync with https://github.com/Microsoft/azure-docs (branch master)

Author: huypub

articles/active-directory/saas-apps/netskope-cloud-security-tutorial.md

@@ -80,7 +80,7 @@ Follow these steps to enable Azure AD SSO in the Azure portal.
 1. On the **Basic SAML Configuration** section, if you wish to configure the application in **IDP** initiated mode, enter the values for the following fields:
 
     a. In the **Identifier** text box, type a URL using the following pattern:
-    `Netskope_<OrgKey>`
+    `<OrgKey>`
 
     b. In the **Reply URL** text box, type a URL using the following pattern:
     `https://<tenant_host_name>/saml/acs`
@@ -231,4 +231,4 @@ When you click the Netskope Administrator Console tile in the Access Panel, you
 
 - [What is conditional access in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
 
-- [Try Netskope Administrator Console with Azure AD](https://aad.portal.azure.com/)
+- [Try Netskope Administrator Console with Azure AD](https://aad.portal.azure.com/)

articles/aks/media/private-clusters/aks-private-hub-spoke.png

@@ -77,6 +77,18 @@ As mentioned, VNet peering is one way to access your private cluster. To use VNe
 8. Select **Add**, add the virtual network of the VM, and then create the peering.  
 9. Go to the virtual network where you have the VM, select **Peerings**, select the AKS virtual network, and then create the peering. If the address ranges on the AKS virtual network and the VM's virtual network clash, peering fails. For more information, see  [Virtual network peering][virtual-network-peering].
 
+## Hub and spoke with custom DNS
+
+[Hub and spoke architectures](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) are commonly used to deploy networks in Azure. In many of these deployments, DNS settings in the spoke VNets are configured to reference a central DNS forwarder to allow for on-premises and Azure-based DNS resolution. When deploying an AKS cluster into such a networking environment, there are some special considerations that must be taken into account.
+
+![Private cluster hub and spoke](media/private-clusters/aks-private-hub-spoke.png)
+
+1. By default, when a private cluster is provisioned, a private endpoint (1) and a private DNS zone (2) are created in the cluster managed resource group. The cluster uses an A record in the private zone to resolve the IP of the private endpoint for communication to the API server.
+
+2. The private DNS zone is linked only to the VNet that the cluster nodes are attached to (3). This means that the private endpoint can only be resolved by hosts in that linked VNet. In scenarios where no custom DNS is configured on the VNet (default), this works without issue as hosts point at 168.63.129.16 for DNS which can resolve records in the private DNS zone due to the link.
+
+3. In scenarios where the VNet containing your cluster has custom DNS settings (4), cluster deployment fails unless the private DNS zone is linked to the VNet that contains the custom DNS resolvers (5). This link can be created manually after the private zone is created during cluster provisioning or via automation upon detection of creation of the zone using Azure Policy or other event-based deployment mechanisms (for example, Azure Event Grid and Azure Functions).
+
 ## Dependencies  
 
 * The Private Link service is supported on Standard Azure Load Balancer only. Basic Azure Load Balancer isn't supported.  

articles/aks/private-clusters.md

@@ -9,7 +9,7 @@ ms.author: jobreen
 
 # Azure Custom Resource Providers Overview
 
-Azure Custom Resource Providers is an extensibility platform to Azure. It allows you define to custom APIs that can be used to enrich the default Azure experience. This documentation describes:
+Azure Custom Resource Providers is an extensibility platform to Azure. It allows you to define custom APIs that can be used to enrich the default Azure experience. This documentation describes:
 
 - How to build and deploy an Azure Custom Resource Provider.
 - How to utilize Azure Custom Resource Providers to extend existing workflows.

articles/azure-resource-manager/custom-providers/overview.md

@@ -46,7 +46,7 @@ You'll use the Docker engine to run the sample labeling tool. Follow these steps
    Install Docker on your machine by following the appropriate instructions for your operating system: 
    * [Windows](https://docs.docker.com/docker-for-windows/)
    * [macOS](https://docs.docker.com/docker-for-mac/)
-   * [Linux](https://docs.docker.com/install/).
+   * [Linux](https://docs.docker.com/install/)
 
 1. Get the sample labeling tool container with the `docker pull` command.
     ```

articles/cognitive-services/form-recognizer/quickstarts/label-tool.md

@@ -321,6 +321,6 @@ There are no differences specific to Queue storage in the emulator.
 
 ## Next steps
 
-* Evaluate the cross-platform, community-maintained open-source storage emulator [Azurite](https://github.com/arafato/azurite). 
+* Evaluate the cross-platform, community-maintained open-source storage emulator [Azurite](https://github.com/azure/azurite). 
 * [Azure Storage samples using .NET](../storage-samples-dotnet.md) contains links to several code samples you can use when developing your application.
 * You can use the [Microsoft Azure Storage Explorer](https://storageexplorer.com) to work with resources in your cloud Storage account, and in the storage emulator.