Updates based on feedback and clarity for manual aggregation

Author: Michael Bender

articles/virtual-network-manager/concept-security-admin-rules-network-group.md

@@ -18,43 +18,29 @@ In this article, you learn how to use network groups with security admin rules i
 
 ## Why use network groups with security admin rules?
 
-Using network groups with security admin rules allows you to define the source and destination of the traffic for the security admin rule. This feature streamlines the process of securing your traffic across workloads and environments, as it removes the manual step of specifying individual CIDR ranges or resource IDs.
+Using network groups with security admin rules allows you to define the source and destination of the traffic for the security admin rule. This feature streamlines the process of securing your traffic across workloads and environments by aggregating the CIDR ranges of the network groups to your virtual network manager instance. Aggregation to a virtual network manager removes the manual step of specifying individual CIDR ranges or resource IDs. 
 
-For example, you need to ensure traffic is denied between your production and nonproduction environments represented by two separate network groups. Create a security admin rule with an action type of **Deny**. Specify one of your network groups as the source. Specify the other network group as the destination. Select the direction of the traffic you want to deny. You can enforce the traffic between your grouped network resources without the need to specify individual CIDR ranges or resource IDs.
+For example, you need to ensure traffic is denied between your production and nonproduction environments represented by two separate network groups. Create a security admin rule with an action type of
+**Deny**.
+Specify one network group as the target for your rule collection, these virtual networks will receive the configured rules. Then select the direction of the traffic you want to deny and use the other network group as the corresponding source / destination. You can enforce the traffic between your grouped network resources without the need to specify individual CIDR ranges or resource IDs.
 
 ## How do I deploy a security admin rule using network groups?
 
-From the Azure portal, you can [deploy a security admin rule using network groups](./how-to-create-security-admin-rule-network-groups.md) in the Azure portal. To create a security admin rule, create a security admin configuration and add a security admin rule that utilizes network groups as source and destination. Finally, deploy the security admin configuration and the rules apply to the network group resources.
+From the Azure portal, you can [deploy a security admin rule using network groups](./how-to-create-security-admin-rule-network-groups.md) in the Azure portal. To create a security admin rule, create a security admin configuration and add a security admin rule that utilizes network groups as source and destination. This is done by electing to use *Manual* for the **Network group address space aggregation option** setting in the configuration. Once elected, the virtual network manager instance will aggregate the CIDR ranges of the network groups referenced as the source and destination of the security admin rules in the configuration.
+
+Finally, deploy the security admin configuration and the rules apply to the network group resources. With the *Manual* aggregation option, the CIDR ranges in the network group are aggregated only when you deploy the security admin configuration. This allows you to commit the CIDR ranges on your schedule.
 
 If you change the resources in your network group or a network group's CIDR range changes, you need to redeploy the security configuration after the changes are made. After deployment, the new CIDR ranges will be applied across your network to all new and existing network group resources.
 
 ## Supported regions
 
-During the public preview, network groups with security admin rules are supported in the following regions:
-
-- Supported Regions:
-    
-    - Central US EUAP
-    
-    - East US
-    
-    - East US 2
-    
-    - East US 2 EUAP
-    
-    - South Central US
-    
-    - West US
-    
-    - West US 2
-    
-    - West US Central
+During the public preview, network groups with security admin rules are supported in all regions where Azure Virtual Network Manager is available.
 
 ## Limitations of network groups with security admin rules
 
 The following limitations apply when using network groups with security admin rules:
 
-- Only supports manual aggregation of CIDRs in a network group. The CIDR range in a rule only changes upon the customer commit.
+- Only supports manual aggregation of CIDRs in a network group. The CIDR range in a rule only changes upon the customer commit. This means The CIDR range within a rule remains unchanged until the customer commits.
 
 - Supports 100 networking resources (virtual networks or subnets) in any one network group referenced in the security admin rule.
 

articles/virtual-network-manager/how-to-create-security-admin-rule-network-group.md

@@ -12,10 +12,10 @@ ms.custom: template-how-to
 ---
 # Create a security admin rule using network groups in Azure Virtual Network Manager
 
-In Azure Virtual Network Manager, you can deploy [security admin rules](./concept-security-admins.md) using [network groups](./concept-network-groups.md). Security admin rules and network groups allow you to define the source and destination of the traffic for the security admin rule.    
-
 In this article, you learn how to create a security admin rule using network groups in Azure Virtual Network Manager. You use the Azure portal to create a security admin configuration, add a security admin rule, and deploy the security admin configuration.
 
+In Azure Virtual Network Manager, you can deploy [security admin rules](./concept-security-admins.md) using [network groups](./concept-network-groups.md). Security admin rules and network groups allow you to define the source and destination of the traffic for the security admin rule.    
+
 [!INCLUDE [virtual-network-manager-preview](../../includes/virtual-network-manager-network-groups-source-destination-preview.md)]
 
 ## Prerequisites
@@ -63,16 +63,19 @@ To create a security admin configuration, follow these steps:
 
     :::image type="content" source="media/how-to-create-security-admin-rules-network-groups/create-configuration-with-aggregation-options.png" alt-text="Screenshot of create a security admin configuration deployment options selecting manual aggregation option.":::
 
-1. Select **Rule collections** or **Next: Rule collections >**.
-2. In the Rule collections tab, select **Add**.
-3. In the **Add a rule collection** window, enter the following settings:
+    > [!NOTE]
+    > The **Network group address space aggregation option** setting allows you to reference network groups in your security admin rules. Once elected, the virtual network manager instance will aggregate the CIDR ranges of the network groups referenced as the source and destination of the security admin rules in the configuration. With the manual aggregation option, the CIDR ranges in the network group are aggregated only when you deploy the security admin configuration. This allows you to commit the CIDR ranges on your schedule.
+
+2. Select **Rule collections** or **Next: Rule collections >**.
+3. In the Rule collections tab, select **Add**.
+4. In the **Add a rule collection** window, enter the following settings:
 
     | **Setting** | **Value** |
     | --- | --- |
     | Name | Enter a name for the rule collection. |
     | Target network groups | Select the network group that contains the source and destination of the traffic for the security admin rule. |
 
-1. Select **Add** and enter the following settings in the **Add a rule** window:
+5. Select **Add** and enter the following settings in the **Add a rule** window:
 
     | **Setting** | **Value** |
     | --- | --- |
@@ -92,9 +95,9 @@ To create a security admin configuration, follow these steps:
 
     :::image type="content" source="media/how-to-create-security-admin-rules-network-groups/create-network-group-as-source-destination-rule.png" alt-text="Screenshot of add a rule window using network groups as source and destination in rule creation.":::
 
-2. Select **Add** and **Add** again to add the security admin rule to the rule collection.
+6. Select **Add** and **Add** again to add the security admin rule to the rule collection.
 
-3. Select **Review + create** and then select **Create**.
+7. Select **Review + create** and then select **Create**.
 
 ## Deploy the security admin configuration