Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)

Author: Banani-Rath

articles/active-directory/develop/v2-oauth2-auth-code-flow.md

@@ -54,6 +54,8 @@ The authorization code flow begins with the client directing the user to the `/a
 
 Some permissions are admin-restricted, for example, writing data to an organization's directory by using `Directory.ReadWrite.All`. If your application requests access to one of these permissions from an organizational user, the user receives an error message that says they're not authorized to consent to your app's permissions. To request access to admin-restricted scopes, you should request them directly from a Global Administrator. For more information, see [Admin-restricted permissions](v2-permissions-and-consent.md#admin-restricted-permissions).
 
+Unless specified otherwise, there are no default values for optional parameters. There is, however, default behavior for a request omitting optional parameters. The default behavior is to either sign in the sole current user, show the account picker if there are multiple users, or show the login page if there are no users signed in. 
+
 ```http
 // Line breaks for legibility only
 

articles/active-directory/hybrid/choose-ad-authn.md

@@ -7,8 +7,8 @@ author: billmath
 ms.author: billmath
 ms.date: 01/05/2022
 ms.topic: article
-ms.service: security
-ms.subservice: security-fundamentals
+ms.service: active-directory
+ms.subservice: hybrid
 ms.workload: identity
 ---
 # Choose the right authentication method for your Azure Active Directory hybrid identity solution

articles/aks/open-service-mesh-troubleshoot.md

@@ -319,4 +319,4 @@ Information on how OSM issues and manages certificates to Envoy proxies running
 
 ### Upgrading Envoy
 
-When a new pod is created in a namespace monitored by the add-on, OSM will inject an [envoy proxy sidecar](https://docs.openservicemesh.io/docs/guides/app_onboarding/sidecar_injection/) in that pod. Information regarding how to update the envoy version can be found in the [Upgrade Guide](https://docs.openservicemesh.io/docs/getting_started/upgrade/#envoy) on the OpenServiceMesh docs site.
+When a new pod is created in a namespace monitored by the add-on, OSM will inject an [envoy proxy sidecar](https://docs.openservicemesh.io/docs/guides/app_onboarding/sidecar_injection/) in that pod. Information regarding how to update the envoy version can be found in the [Upgrade Guide](https://docs.openservicemesh.io/docs/getting_started/) on the OpenServiceMesh docs site.

articles/aks/security-hardened-vm-host-image.md

@@ -2,10 +2,8 @@
 title: Security hardening in AKS virtual machine hosts 
 description: Learn about the security hardening in AKS VM host OS
 services: container-service
-author: georgewallace
 ms.topic: article
 ms.date: 03/29/2021
-ms.author: gwallace
 ms.custom: mvc
 ---
 

articles/aks/use-system-pools.md

@@ -2,10 +2,8 @@
 title: Use system node pools in Azure Kubernetes Service (AKS)
 description: Learn how to create and manage system node pools in Azure Kubernetes Service (AKS)
 services: container-service
-author: georgewallace
 ms.topic: article
 ms.date: 06/18/2020
-ms.author: gwallace
 ms.custom: fasttrack-edit, devx-track-azurecli
 ---
 

articles/api-management/self-hosted-gateway-overview.md

@@ -49,6 +49,41 @@ The following functionality found in the managed gateways is **not available** i
 - Client certificate renegotiation. This means that for [client certificate authentication](api-management-howto-mutual-certificates-for-clients.md) to work, API consumers must present their certificates as part of the initial TLS handshake. To ensure this behavior, enable the Negotiate Client Certificate setting when configuring a self-hosted gateway custom hostname.
 - Built-in cache. Learn about using an [external Redis-compatible cache](api-management-howto-cache-external.md) in self-hosted gateways.
 
+### Container images
+
+We provide a variety of container images for self-hosted gateways to meet your needs:
+
+| Tag convention | Recommendation | Example  | Rolling tag  | Recommended for production |
+| ------------- | -------- | ------- | ------- | ------- |
+| `{major}.{minor}.{patch}` | Use this tag to always to run the same version of the gateway |`2.0.0` | ❌ |  ✔️ |
+| `v{major}` | Use this tag to always run a major version of the gateway with every new feature and patch. |`v2` | ✔️ |  ❌ |
+| `v{major}-preview` | Use this tag if you always want to run our latest preview container image. | `v2-preview` | ✔️ |  ❌ |
+| `latest` | Use this tag if you want to evaluate the self-hosted gateway. | `latest` | ✔️ |  ❌ |
+
+You can find a full list of available tags [here](https://mcr.microsoft.com/v2/azure-api-management/gateway/tags/list).
+
+#### Use of tags in our official deployment options
+
+Our deployment options in the Azure portal use the `v2` tag which allows customers to use the most recent version of the self-hosted gateway v2 container image with all feature updates and patches.
+
+> [!NOTE]
+> We provide the command and YAML snippets as reference, feel free to use a more specific tag if you wish to.
+
+When installing with our Helm chart, image tagging is optimized for you. The Helm chart's application version pins the gateway to a given version and does not rely on `latest`.
+
+Learn more on how to [install an API Management self-hosted gateway on Kubernetes with Helm](how-to-deploy-self-hosted-gateway-kubernetes-helm.md).
+
+#### Risk of using rolling tags
+
+Rolling tags are tags that are potentially updated when a new version of the container image is released. This allows container users to receive updates to the container image without having to update their deployments.
+
+This means that you can potentially run different versions in parallel without noticing it, for example when you perform scaling actions once `v2` tag was updated.
+
+Example - `v2` tag was released with `2.0.0` container image, but when `2.1.0` will be released, the `v2` tag will be linked to the `2.1.0` image.
+
+> [!IMPORTANT]
+> Consider using a specific version tag in production to avoid unintentional upgrade to a newer version.
+
 ## Connectivity to Azure
 
 Self-hosted gateways require outbound TCP/IP connectivity to Azure on port 443. Each self-hosted gateway must be associated with a single API Management service and is configured via its management plane. A self-hosted gateway uses connectivity to Azure for:

articles/app-service/monitor-instances-health-check.md

@@ -25,8 +25,9 @@ This article uses Health check in the Azure portal to monitor App Service instan
 - Furthermore, when scaling up or out, App Service pings the Health check path to ensure new instances are ready.
 
 > [!NOTE]
->- Health check doesn't follow 302 redirects. At most one instance will be replaced per hour, with a maximum of three instances per day per App Service Plan.
->- Note, if your health check is giving the status `Waiting for health check response` then the check is likely failing due to an HTTP status code of 307, which can happen if you have HTTPS redirect enabled but have `HTTPS Only` disabled.
+>- Health check doesn't follow 302 redirects. 
+>- At most one instance will be replaced per hour, with a maximum of three instances per day per App Service Plan.
+>- If your health check is giving the status `Waiting for health check response` then the check is likely failing due to an HTTP status code of 307, which can happen if you have HTTPS redirect enabled but have `HTTPS Only` disabled.
 
 ## Enable Health Check
 

articles/app-service/quickstart-nodejs.md

@@ -3,7 +3,7 @@ title: 'Quickstart: Create a Node.js web app'
 description: Deploy your first Node.js Hello World to Azure App Service in minutes.
 ms.assetid: 582bb3c2-164b-42f5-b081-95bfcb7a502a
 ms.topic: quickstart
-ms.date: 09/14/2021
+ms.date: 03/10/2022
 ms.devlang: javascript
 ms.custom: mvc, devcenter, seodec18, mode-api
 #zone_pivot_groups: app-service-ide-oss
@@ -30,7 +30,7 @@ This quickstart configures an App Service app in the **Free** tier and incurs no
 :::zone target="docs" pivot="development-environment-cli"
 
 - Have an Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?utm_source=campaign&utm_campaign=vscode-tutorial-app-service-extension&mktingSource=vscode-tutorial-app-service-extension).
-- Install [Node.js and npm](https://nodejs.org). Run the command `node --version` to verify that Node.js is installed.
+- Install [Node.js LTS and npm](https://nodejs.org). Run the command `node --version` to verify that Node.js is installed.
 - Install <a href="/cli/azure/install-azure-cli" target="_blank">Azure CLI</a>, with which you run commands in any shell to provision and configure Azure resources.
 
 ::: zone-end
@@ -39,7 +39,7 @@ This quickstart configures an App Service app in the **Free** tier and incurs no
 :::zone target="docs" pivot="development-environment-azure-portal"
 
 - Have an Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?utm_source=campaign&utm_campaign=vscode-tutorial-app-service-extension&mktingSource=vscode-tutorial-app-service-extension).
-- Install [Node.js and npm](https://nodejs.org). Run the command `node --version` to verify that Node.js is installed.
+- Install [Node.js LTS and npm](https://nodejs.org). Run the command `node --version` to verify that Node.js is installed.
 - Have a FTP client (for example, [FileZilla](https://filezilla-project.org)), to connect to your app.
 
 ::: zone-end
@@ -53,20 +53,19 @@ In this step, you create a starter Node.js application and make sure it runs on
 1. Create a simple Node.js application using the [Express Generator](https://expressjs.com/starter/generator.html), which is installed by default with Node.js and NPM.
 
     ```bash
-    npx express-generator myExpressApp --view pug
+    npx express-generator myExpressApp --view ejs
     ```
 
 1. Change to the application's directory and install the NPM packages.
 
     ```bash
-    cd myExpressApp
-    npm install
+    cd myExpressApp && npm install
     ```
 
-1. Start the development server.
+1. Start the development server with debug information.
 
     ```bash
-    npm start
+    DEBUG=myexpressapp:* npm start
     ```
 
 1. In a browser, navigate to `http://localhost:3000`. You should see something like this:
@@ -165,7 +164,7 @@ Before you continue, ensure that you have all the prerequisites installed and co
 
 :::zone target="docs" pivot="development-environment-cli"
 
-In the terminal, make sure you're in the *myExpressApp* directory, and deploy the code in your local folder (*myExpressApp*) using the `az webapp up` command:
+In the terminal, make sure you're in the *myExpressApp* directory, and deploy the code in your local folder (*myExpressApp*) using the [az webapp up](/cli/azure/webapp#az-webapp-up) command:
 
 # [Deploy to Linux](#tab/linux)
 
@@ -283,16 +282,16 @@ Azure App Service supports [**two types of credentials**](deploy-configure-crede
 
 You can deploy changes to this app by making edits in Visual Studio Code, saving your files, and then redeploy to your Azure app. For example:
 
-1. From the sample project, open *views/index.pug* and change
+1. From the sample project, open *views/index.ejs* and change
 
-    ```PUG
-    p Welcome to #{title}
+    ```html
+    <p>Welcome to <%= title %></p>
     ```
 
     to
 
-    ```PUG
-    p Welcome to Azure!
+    ```html
+    <p>Welcome to Azure</p>
     ```
 
 :::zone target="docs" pivot="development-environment-vscode"
@@ -305,7 +304,7 @@ You can deploy changes to this app by making edits in Visual Studio Code, saving
 
 :::zone target="docs" pivot="development-environment-cli"
 
-2. Save your changes, then redeploy the app using the `az webapp up` command again with no arguments:
+2. Save your changes, then redeploy the app using the [az webapp up](/cli/azure/webapp#az-webapp-up) command again with no arguments:
 
     ```azurecli
     az webapp up
@@ -362,7 +361,7 @@ az webapp log tail
 
 The command uses the resource group name cached in the *.azure/config* file.
 
-You can also include the `--logs` parameter with then `az webapp up` command to automatically open the log stream on deployment.
+You can also include the `--logs` parameter with then [az webapp up](/cli/azure/webapp#az-webapp-up) command to automatically open the log stream on deployment.
 
 Refresh the app in the browser to generate console logs, which include messages describing HTTP requests to the app. If no output appears immediately, try again in 30 seconds.
 

articles/application-gateway/toc.yml

@@ -18,6 +18,8 @@
   - name: Create Application Gateway - ARM template
     displayName: Resource Manager
     href: quick-create-template.md
+  - name: Create Application Gateway - Terraform
+    href: /azure/developer/terraform/application-gateway-quickstart?toc=/azure/application-gateway/toc.json&bc=/azure/application-gateway/breadcrumb/toc.json
 - name: Tutorials
   items:
   - name: Secure with SSL

articles/applied-ai-services/form-recognizer/concept-custom.md

@@ -7,7 +7,7 @@ manager: nitinme
 ms.service: applied-ai-services
 ms.subservice: forms-recognizer
 ms.topic: conceptual
-ms.date: 02/23/2022
+ms.date: 03/10/2022
 ms.author: lajanuar
 recommendations: false
 ---
@@ -35,7 +35,7 @@ Custom models can be one of two types, [**custom template**](concept-custom-temp
 
 The custom neural (custom document) model is a deep learning model type that relies on a base model trained on a large collection of documents. This model is then fine-tuned or adapted to your data when you train the model with a labeled dataset. Custom neural models support structured, semi-structured, and unstructured documents to extract fields. Custom neural models currently support English-language documents. When you're choosing between the two model types, start with a neural model if it meets your functional needs. See [neural models](concept-custom-neural.md) to learn more about custom document models.
 
-### Build mode
+## Build mode
 
 The build custom model operation has added support for the *template* and *neural* custom models. Previous versions of the REST API and SDKs only supported a single build mode that is now known as the *template* mode.
 
@@ -52,10 +52,18 @@ This table provides links to the build mode programming language SDK references
 |JavaScript | [DocumentBuildMode type](/javascript/api/@azure/ai-form-recognizer/documentbuildmode?view=azure-node-preview&preserve-view=true)| [buildModel.js](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/formrecognizer/ai-form-recognizer/samples/v4-beta/javascript/buildModel.js)|
 |Python | [DocumentBuildMode Enum](/python/api/azure-ai-formrecognizer/azure.ai.formrecognizer.documentbuildmode?view=azure-python-preview&preserve-view=true#fields)| [sample_build_model.py](https://github.com/Azure/azure-sdk-for-python/blob/azure-ai-formrecognizer_3.2.0b3/sdk/formrecognizer/azure-ai-formrecognizer/samples/v3.2-beta/sample_build_model.py)|
 
-## Model features
+## Compare model features
 
 The table below compares custom template and custom neural features:
 
+|Feature|Custom template (form) | Custom neural (document) |
+|---|---|---|
+|Document structure|Template, form, and structured | Structured, semi-structured, and unstructured|
+|Training time | 1 to 5 minutes | 20 minutes to 1 hour |
+|Data extraction | Key-value pairs, tables, selection marks, coordinates, and signatures | Key-value pairs and selection marks |
+|Document variations | Requires a model per each variation | Uses a single model for all variations |
+|Language support | Multiple [language support](language-support.md#read-layout-and-custom-form-template-model)  | United States English (en-US) [language support](language-support.md#custom-neural-model) |
+
 ## Custom model tools
 
 The following tools are supported by Form Recognizer v2.1: