Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)

Author: Banani-Rath

articles/active-directory/governance/entitlement-management-access-package-approval-policy.md

@@ -114,6 +114,21 @@ If you selected a multi-stage approval, you'll need to add an approver for each
 
 1. Specify the number of days the second approver has to approve the request in the box under **Decision must be made in how many days?**. 
 
+1. Set the Require approver justification toggle to **Yes** or **No**.
+
+    You also have the option to add an additional stage for a three-stage approval process. For example, you might want an employee’s manager to be the first stage approver for an access package. But, one of the resources in the access package contains confidential information. In this case, you could designate the resource owner as a second approver and a security reviewer as the third approver (Preview). 
+
+1. Add the **Third Approver (Preview)**: 
+    
+    If the users are in your directory, add a specific user as the third approver by clicking **Add approvers** under Choose specific approvers.
+
+    If the users aren't in your directory, select **Internal sponsor** or **External sponsor** as the third approver. After selecting the approver, add the fallback approvers.
+
+    > [!NOTE]
+    > <ul>Like the second stage, if the users are in your directory and **Manager as approver** is selected in either the first or second stage of approval, you will only see an option to select specific approvers for the third stage of approval.</ul><ul>If you want to designate the manager as a third approver, you can adjust your selections in the previous approval stages to ensure that **Manager as approver** isn’t selected. Then, you should see **Manager as approver** as an option in the dropdown.</ul><ul>If the users aren’t in your directory and you have not selected **Internal sponsor** or **External sponsor** as approvers in previous stages, you will see them as options for **Third Approver**. Otherwise, you will only be able to select **Choose specific approvers**.</ul>
+
+1. Specify the number of days the third approver (Preview) has to approve the request in the box under **Decision must be made in how many days?**.
+
 1. Set the Require approver justification toggle to **Yes** or **No**.
 
 ### Alternate approvers

articles/active-directory/managed-identities-azure-resources/managed-identities-status.md

@@ -38,7 +38,7 @@ The following Azure services support managed identities for Azure resources:
 | Azure Container Registry        | [Use an Azure-managed identity in ACR Tasks](../../container-registry/container-registry-tasks-authentication-managed-identity.md)                                                                       |
 | Azure Cognitive Services        | [Configure customer-managed keys with Azure Key Vault for Cognitive Services](../../cognitive-services/encryption/cognitive-services-encryption-keys-portal.md)                                                                          |
 | Azure Data Box                  | [Use customer-managed keys in Azure Key Vault for Azure Data Box](../../databox/data-box-customer-managed-encryption-key-portal.md)                                                                                             |
-| Azure Data Explorer             | [Configure managed identities for your Azure Data Explorer cluster](https://docs.microsoft.com/azure/data-explorer/configure-managed-identities-cluster?tabs=portal)                                                                                                     |
+| Azure Data Explorer             | [Configure managed identities for your Azure Data Explorer cluster](/azure/data-explorer/configure-managed-identities-cluster?tabs=portal)                                                                                                     |
 | Azure Data Factory              | [Managed identity for Data Factory](../../data-factory/data-factory-service-identity.md)                                                                                                           |
 | Azure Data Lake Storage Gen1    | [Customer-managed keys for Azure Storage encryption](../../storage/common/customer-managed-keys-overview.md)                                                                                                  |
 | Azure Data Share                | [Roles and requirements for Azure Data Share](../../data-share/concepts-roles-permissions.md)                                                                                                             |
@@ -50,7 +50,7 @@ The following Azure services support managed identities for Azure resources:
 | Azure Kubernetes Service (AKS)  | [Use managed identities in Azure Kubernetes Service](../../aks/use-managed-identity.md)                                                                                                                           |
 | Azure Logic Apps                | [Authenticate access to Azure resources using managed identities in Azure Logic Apps](../../logic-apps/create-managed-service-identity.md)                                                                                                       |
 | Azure Log Analytics cluster     | [Azure Monitor customer-managed key](../../azure-monitor/logs/customer-managed-keys.md)
-| Azure Machine Learning Services | [Use Managed identities with Azure Machine Learning](/machine-learning/how-to-use-managed-identities.md?tabs=python)                                                                                         |
+| Azure Machine Learning Services | [Use Managed identities with Azure Machine Learning](/azure/machine-learning/how-to-use-managed-identities?tabs=python)                                                                                         |
 | Azure Managed Disk              | [Use the Azure portal to enable server-side encryption with customer-managed keys for managed disks](../../virtual-machines/disks-enable-customer-managed-keys-portal.md)                                                                                        |
 | Azure Media services            | [Managed identities](../../media-services/latest/concept-managed-identities.md) |
 | Azure Monitor                   | [Azure Monitor customer-managed key](../../azure-monitor/logs/customer-managed-keys.md?tabs=portal)                                                                                              |

articles/active-directory/managed-identities-azure-resources/services-azure-active-directory-support.md

@@ -23,19 +23,19 @@ The following services support Azure AD authentication. New services are added t
 | Azure Batch                     | [Authenticate Batch service solutions with Active Directory](../../batch/batch-aad-auth.md)         |
 | Azure Container Registry        | [Authenticate with an Azure container registry](../../container-registry/container-registry-authentication.md)                                                                       |
 | Azure Cognitive Services        | [Authenticate requests to Azure Cognitive Services](../../cognitive-services/authentication.md?tabs=powershell#authenticate-with-azure-active-directory)                                                                          |
-| Azure Databricks                | [Authenticate using Azure Active Directory tokens](https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/)
-| Azure Data Explorer             | [How-To Authenticate with Azure Active Directory for Azure Data Explorer Access](https://docs.microsoft.com/azure/data-explorer/kusto/management/access-control/how-to-authenticate-with-aad)                                                                                                     |
+| Azure Databricks                | [Authenticate using Azure Active Directory tokens](/azure/databricks/dev-tools/api/latest/aad/)
+| Azure Data Explorer             | [How-To Authenticate with Azure Active Directory for Azure Data Explorer Access](/azure/data-explorer/kusto/management/access-control/how-to-authenticate-with-aad)                                                                                                     |
 | Azure Data Lake Storage Gen1    | [Authentication with Azure Data Lake Storage Gen1 using Azure Active Directory](../../data-lake-store/data-lakes-store-authentication-using-azure-active-directory.md)                                                                                                  |
 | Azure Digital Twins             | [Set up an Azure Digital Twins instance and authentication (portal)](../../digital-twins/how-to-set-up-instance-portal.md#set-up-user-access-permissions)                                                                                            |
 | Azure Event Hubs                | [Authenticate an application with Azure Active Directory to access Event Hubs resources](../../event-hubs/authenticate-application.md)
 | Azure IoT Hub                   | [Control access to IoT Hub](../../iot-hub/iot-hub-devguide-security.md)                                                                               |
 | Azure Key Vault                 | [Authentication in Azure Key Vault](../../key-vault/general/authentication.md)
 | Azure Kubernetes Service (AKS)  | [Control access to cluster resources using Kubernetes role-based access control and Azure Active Directory identities in Azure Kubernetes Service](../../aks/azure-ad-rbac.md)                                                                                                                           |
-| Azure Machine Learning Services | [Set up authentication for Azure Machine Learning resources and workflows](/machine-learning/how-to-setup-authentication.md)                                                                                         |
+| Azure Machine Learning Services | [Set up authentication for Azure Machine Learning resources and workflows](/azure/machine-learning/how-to-setup-authentication)                                                                                         |
 | Azure Maps                      | [Manage authentication in Azure Maps](../../azure-maps/how-to-manage-authentication.md) |
 | Azure Media services            | [Access the Azure Media Services API with Azure AD authentication](../../media-services/previous/media-services-use-aad-auth-to-access-ams-api.md) |
 | Azure Monitor                   | [Azure AD authentication for Application Insights (Preview)](../../azure-monitor/app/azure-ad-authentication.md?tabs=net)                                                                                              |
-| Azure Resource Manager          | [Azure security baseline for Azure Resource Manager](https://docs.microsoft.com/security/benchmark/azure/baselines/resource-manager-security-baseline?toc=/azure/azure-resource-manager/management/toc.json)
+| Azure Resource Manager          | [Azure security baseline for Azure Resource Manager](/security/benchmark/azure/baselines/resource-manager-security-baseline?toc=/azure/azure-resource-manager/management/toc.json)
 | Azure Service Fabric            | [Set up Azure Active Directory for client authentication](../../service-fabric/service-fabric-cluster-creation-setup-aad.md)                                                                                                        |
 | Azure Service Bus               | [Service Bus authentication and authorization](../../service-bus-messaging/service-bus-authentication-and-authorization.md)
 | Azure SignalR Service           | [Authorize access with Azure Active Directory for Azure SignalR Service](../../azure-signalr/signalr-concept-authorize-azure-active-directory.md)                                                                                                     |
@@ -47,6 +47,6 @@ The following services support Azure AD authentication. New services are added t
 
 ## Next steps
 
-- [Azure China developer guide](https://docs.microsoft.com/azure/china/resources-developer-guide)
+- [Azure China developer guide](/azure/china/resources-developer-guide)
 - [Compare Azure Government and global Azure](../../azure-government/compare-azure-government-global-azure.md)
 - [Azure services that can use Managed identities to access other services](managed-identities-status.md)

articles/application-gateway/configuration-infrastructure.md

@@ -35,6 +35,9 @@ Application Gateway (Standard_v2 or WAF_v2 SKU) can support up to 125 instances
 > [!IMPORTANT]
 > Although a /24 subnet is not required per Application Gateway v2 SKU deployment, it is highly recommended. This is to ensure that Application Gateway v2 has sufficient space for autoscaling expansion and maintenance upgrades. You should ensure that the Application Gateway v2 subnet has sufficient address space to accommodate the number of instances required to serve your maximum expected traffic. If you specify the maximum instance count, then the subnet should have capacity for at least that many addresses. For capacity planning around instance count, see [instance count details](understanding-pricing.md#instance-count).
 
+> [!TIP]
+> IP addresses are allocated from the beginning of the defined subnet space for gateway instances. As instances are created and removed due to creation of gateways or scaling events, it can become difficult to understand what the next available address is in the subnet. To be able to determine the next address to use for a future gateway and have a contiguous addressing theme for frontend IPs, consider assigning frontend IP addresses from the upper half of the defined subset space. For example, if my subnet address space is 10.5.5.0/24, consider setting the frontend IP of your gateways starting with 10.5.5.254 and then following with 10.5.5.253, 10.5.5.252, 10.5.5.251, and so forth for future gateways.
+
 > [!TIP]
 > It is possible to change the subnet of an existing Application Gateway within the same virtual network. You can do this using Azure PowerShell or Azure CLI. For more information, see [Frequently asked questions about Application Gateway](application-gateway-faq.yml#can-i-change-the-virtual-network-or-subnet-for-an-existing-application-gateway)
 

articles/automation/TOC.yml

@@ -38,7 +38,7 @@
     - name: Automation runbook types
       href: automation-runbook-types.md
     - name: PowerShell DSC
-      href: /powershell/dsc/overview/overview
+      href: /powershell/dsc/overview
     - name: Automation network configuration details
       href: automation-network-configuration.md
     - name: Security

articles/azure-functions/functions-how-to-azure-devops.md

@@ -18,11 +18,11 @@ YAML pipelines aren't available for Azure DevOps 2019 and earlier.
 
 * A GitHub account, where you can create a repository. If you don't have one, you can [create one for free](https://github.com).
 
-* An Azure DevOps organization. If you don't have one, you can [create one for free](//azure/devops/get-started/pipelines-sign-up.md). (An Azure DevOps organization is different from your GitHub organization. You can give your DevOps organization and your GitHub organization the same name if you want alignment between them.)
+* An Azure DevOps organization. If you don't have one, you can [create one for free](/azure/devops/pipelines/get-started/pipelines-sign-up). (An Azure DevOps organization is different from your GitHub organization. You can give your DevOps organization and your GitHub organization the same name if you want alignment between them.)
 
   If your team already has one, then make sure you're an administrator of the Azure DevOps project that you want to use.
 
-* An ability to run pipelines on Microsoft-hosted agents. You can either purchase a [parallel job](/azure/devops/licensing/concurrent-jobs.md) or you can request a free tier. To request a free tier, follow the instructions in [this article](/azure/devops/licensing/concurrent-jobs.md). Note that it may take us 2-3 business days to grant access to the free tier.
+* An ability to run pipelines on Microsoft-hosted agents. You can either purchase a [parallel job](/azure/devops/pipelines/licensing/concurrent-jobs) or you can request a free tier. To request a free tier, follow the instructions in [this article](/azure/devops/pipelines/licensing/concurrent-jobs). Note that it may take us 2-3 business days to grant access to the free tier.
 
 ## Create your function app
 
@@ -235,7 +235,7 @@ steps:
 
 ## Deploy your app
 
-You'll deploy with the [Azure Function App Deploy](/azure/devops/pipelines/tasks/deploy/azure-function-app.md) task. This task requires an [Azure service connection](/azure/devops/pipelines/library/service-endpoints) as an input. An Azure service connection stores the credentials to connect from Azure Pipelines to Azure.
+You'll deploy with the [Azure Function App Deploy](/azure/devops/pipelines/tasks/deploy/azure-function-app) task. This task requires an [Azure service connection](/azure/devops/pipelines/library/service-endpoints) as an input. An Azure service connection stores the credentials to connect from Azure Pipelines to Azure.
 
 # [YAML](#tab/yaml)
 
@@ -282,7 +282,7 @@ You can automatically deploy your code to Azure Functions as a custom container
 
 # [YAML](#tab/yaml/)
 
-The simplest way to deploy to a container is to use the [Azure Function App on Container Deploy task](/azure/devops/pipelines/tasks/deploy/azure-rm-functionapp-containers.md).
+The simplest way to deploy to a container is to use the [Azure Function App on Container Deploy task](/azure/devops/pipelines/tasks/deploy/azure-rm-functionapp-containers).
 
 To deploy, add the following snippet at the end of your YAML file:
 
@@ -312,7 +312,7 @@ The snippet pushes the Docker image to your Azure Container Registry. The **Azur
 
 # [Classic](#tab/classic/)
 
-The best way to deploy your function app as a container is to use the [Azure Function App on Container Deploy task](/azure/devops/pipelines/tasks/deploy/azure-rm-functionapp-containers.md) in your release pipeline.
+The best way to deploy your function app as a container is to use the [Azure Function App on Container Deploy task](/azure/devops/pipelines/tasks/deploy/azure-rm-functionapp-containers) in your release pipeline.
 
 
 How you deploy your app depends on your app's programming language. Each language has a template with specific deploy steps. If you can't find a template for your language, select the generic **Azure App Service Deployment** template.

articles/azure-netapp-files/cross-region-replication-introduction.md

@@ -40,6 +40,7 @@ Azure NetApp Files volume replication is supported between various [Azure region
 | North America | East US | West US |
 | North America | East US 2 | Central US |
 | North America | North Central US | South Central US|
+| North America | West US 3 | East US |
 | Norway | Norway East | Norway West |
 | Switzerland | Switzerland North | Switzerland West |
 | UK | UK South | UK West |