Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into patricka-freshness

Author: PatAltimore

articles/api-management/integrate-vnet-outbound.md

@@ -48,7 +48,7 @@ If you want to inject a Premium v2 (preview) API Management instance into a virt
 
 ### Network security group
 
-A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
+A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. Network security groups (NSG) can also be used to block outbound traffic to the internet and access only resources in your virtual network. To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
 
 ### Subnet delegation
 

articles/application-gateway/configuration-http-settings.md

@@ -16,8 +16,8 @@ The Backend Settings enable you to manage the configurations for backend connect
 ## Types of Backend Settings in Application Gateway
 While Portal users will only see the "Backend Settings" option, API users will have access to two types of settings. You must utilize the correct configuration, according to the protocol.
 
-1. Backend HTTP settings - It is for Layer 7 proxy configurations that support HTTP, HTTPS, and WebSockets protocols.
-2. Backend settings - It is for Layer 4 proxy (Preview) configurations that support TLS and TCP protocols.
+* Backend HTTP settings - It is for Layer 7 proxy configurations that support HTTP, HTTPS, and WebSockets protocols.
+* Backend settings - It is for Layer 4 proxy (Preview) configurations that support TLS and TCP protocols.
 
 ---
 ## [Backend HTTP Settings](#tab/backendhttpsettings)

articles/azure-maps/media/power-bi-visual/country-borders-off.png

@@ -85,12 +85,18 @@ Take the following steps to load the Azure Maps visual:
 
     :::image type="content" source="media/power-bi-visual/bubble-layer-styled.png" alt-text="A screenshot of the Azure Maps visual displaying points as bubbles on the map with a custom style." lightbox="media/power-bi-visual/bubble-layer-styled.png":::
 
-1. You can also show or hide labels in the **Format** pane. The following two images show maps with the **Show labels** setting turned on and off:  
+1. You can also show or hide labels in the **Format** pane. The following two images show maps with the **Labels** setting turned on and off:  
 
     :::image type="content" source="media/power-bi-visual/show-labels-on.png" alt-text="A screenshot of the Azure Maps visual displaying a map with the show labels setting turned on in the style section of the format pane in Power BI." lightbox="media/power-bi-visual/show-labels-on.png":::
 
     :::image type="content" source="media/power-bi-visual/show-labels-off.png" alt-text="A screenshot of the Azure Maps visual displaying a map with the show labels setting turned off in the style section of the format pane in Power BI." lightbox="media/power-bi-visual/show-labels-off.png":::
 
+1. You can also show or hide country borders, state or province borders, county borders, building, and road details in the **Format** pane. The following two images show maps with the **Country borders** settings turned on and off:
+
+    :::image type="content" source="media/power-bi-visual/country-borders-on.png" alt-text="A screenshot of the Azure Maps visual displaying a map with the country borders setting turned on in the style section of the format pane in Power BI." lightbox="media/power-bi-visual/country-borders-on.png":::
+
+    :::image type="content" source="media/power-bi-visual/country-borders-off.png" alt-text="A screenshot of the Azure Maps visual displaying a map with the country borders setting turned off in the style section of the format pane in Power BI." lightbox="media/power-bi-visual/country-borders-off.png":::
+
 ## Fields pane buckets
 
 The following data buckets are available in the **Fields** pane of the Azure Maps visual.
@@ -117,7 +123,30 @@ The following settings are available in the **Style** section:
 | Setting     | Description  |
 |-------------|--------------|
 | Style       | The style of the map. The dropdown list contains [blank and blank accessible], [grayscale dark], [grayscale light], [high contrast dark], [high contrast light], [night], [road], [road shaded relief], [satellite] and [satellite road labels]. |
-| Show labels | A toggle switch that enables you to either show or hide map labels. For more information, see list item number five in the previous section. |
+| Labels | A toggle switch that allows you to show or hide map labels. For more information, see item number five in the previous section titled [Use the Azure Maps Power BI visual](#use-the-azure-maps-power-bi-visual). |
+| Country borders | A toggle switch that controls the visibility of country borders. |
+| State or province borders | A toggle switch that controls the visibility of the borders for the first-level administrative divisions, such as state or province borders. |
+| County borders | A toggle switch that controls the visibility of the borders for the second-level administrative divisions, such as county borders. |
+| Buildings | A toggle switch that controls the visibility of building footprints |
+| Road details | A toggle switch that adjusts the level of detail for visible roads. Turning this off will reduce the number of roads shown on the map. |
+
+The availability of the above toggles depends on the selected style. Below is a table showing the supported options for different styles:
+
+| Map styles | Labels | Country borders | State or province borders | County borders | Buildings | Road details |
+|-|-|-|-|-|-|-|
+| [blank and blank accessible] | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+| [grayscale dark] | ✅ | ✅ | ✅ | ❌ | ✅ | ✅ |
+| [grayscale light] | ✅ | ✅ | ✅ | ❌ | ✅ | ✅ |
+| [high contrast dark] | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| [high contrast light] | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| [night] | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| [road] | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| [road shaded relief] | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+| [satellite] | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+| [satellite road labels] | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
+
+If an option is not supported by the currently selected style, it will have no effect until you choose a style that supports it.
+
 
 ### View
 

articles/azure-maps/media/power-bi-visual/country-borders-on.png

@@ -36,7 +36,7 @@ If you're a billing administrator, use following steps to view and manage all re
 1. Sign in to the [Azure portal](https://portal.azure.com) and navigate to **Cost Management + Billing**.
     - If you're an EA admin, in the left menu, select **Billing scopes** and then in the list of billing scopes, select one.
     - If you're a Microsoft Customer Agreement billing profile owner, in the left menu, select **Billing profiles**. In the list of billing profiles, select one.
-1. In the left menu, select **Products + services** > **Reservations**.
+1. In the left menu, select **Products + services** > **Reservations + Hybrid Benefit**.
 1. The complete list of reservations for your EA enrollment or billing profile is shown.
 1. Billing administrators can take ownership of a reservation by selecting one or multiple reservations, selecting **Grant access** and selecting **Grant access** in the window that appears. For a Microsoft Customer Agreement, user should be in the same Microsoft Entra tenant (directory) as the reservation.
 

articles/azure-maps/media/power-bi-visual/show-labels-off.png

@@ -5,7 +5,7 @@ author: ahartoon
 ms.author: anboisve
 ms.service: azure-stream-analytics
 ms.topic: how-to
-ms.date: 02/05/2025
+ms.date: 05/09/2025
 ms.custom: references_regions, ignite-2024
 ---
 
@@ -19,11 +19,16 @@ Virtual network support enables you to lock down access to Azure Stream Analytic
 - [Service endpoints](../virtual-network/virtual-network-service-endpoints-overview.md), which connect your data sources to your virtual network injected ASA job. 
 - [Service tags](../virtual-network/service-tags-overview.md), which allow or deny traffic to Azure Stream Analytics. 
 
-## Availability 
-Currently, this capability is only available in select **regions**: East US, East US 2, West US, West US 2, Central US, North-Central US, Central Canada, West Europe, North Europe, Southeast Asia, Brazil South, Japan East, UK South, Central India, Australia East, France Central, Germany West Central, and UAE North.
-If you're interested in enabling virtual network integration in your region, **fill out this [form](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRzFwASREnlZFvs9gztPNuTdUMU5INk5VT05ETkRBTTdSMk9BQ0w3OEZDQi4u)**.  Regions are added based on demand and feasibility. We will notify you if we are able to accommodate your request.
+## Available Regions 
+Virtual network integration is currently supported in the following regions:
 
-## Requirements for virtual network integration support 
+**East US, East US 2, West US, West US 2, Central US, North Central US, Central Canada, West Europe, North Europe, Southeast Asia, Brazil South, Japan East, UK South, Central India, Australia East, France Central, Germany West Central, and UAE North.**
+
+If your region is not listed and you're interested in using this capability, please **fill out this [form](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbRzFwASREnlZFvs9gztPNuTdUMU5INk5VT05ETkRBTTdSMk9BQ0w3OEZDQi4u)**. 
+
+We evaluate requests based on demand and feasibility, and will notify you if we are able to support your region.
+
+## Prerequisites 
 
 - A **General purpose V2 (GPV2) Storage account** is required for virtual network injected ASA jobs.   
     - Virtual network injected ASA jobs require access to metadata such as checkpoints to be stored in Azure tables for operational purposes.   
@@ -49,33 +54,43 @@ If you're interested in enabling virtual network integration in your region, **f
 
     For more information about Azure NAT Gateway, see [Azure NAT Gateway](../nat-gateway/nat-overview.md). 
 
-## Subnet Requirements 
+- When configuring Azure IoT Hub with private endpoints, ensure that you also configure a private endpoint and corresponding DNS settings for the built-in Event Hubs-compatible endpoint. IoT Hub utilizes this endpoint to route messages, and without proper DNS resolution, services like Azure Stream Analytics may fail to connect.
+- For guidance on setting up private endpoints and DNS for IoT Hub and Event Hubs, refer to the following resources:
+
+    - [IoT Hub support for virtual networks with Azure Private Link](../iot-hub/virtual-network-support.md)
+    - [Integrate Azure Event Hubs with Azure Private Link Service](../event-hubs/private-link-service.md)
+    - [Azure Private Endpoint DNS configuration](../private-link/private-endpoint-dns.md)
+
+## Subnet Considerations 
 Virtual network integration depends on a dedicated subnet. 
 
 When configuring your delegated subnet, it is crucial to consider the IP range to accommodate both current and future requirements for your ASA workload. Since the subnet size cannot be modified once established, it is recommended to select a subnet size that can support the potential scale of your job. Additionally, be aware that Azure Networking reserves the first five IP addresses within the subnet range for internal use.
 
 The scale operation affects the real, available supported instances for a given subnet size.  
 
-### Considerations for estimating IP ranges 
+**Considerations for estimating IP ranges**:
 
 - Make sure the subnet range doesn't collide with ASA’s subnet range. Avoid IP range 10.0.0.0 to 10.0.255.255 as it's used by ASA. 
 - Reserve: 
     - **Five** IP addresses for Azure Networking 
     - **One** IP address is required to facilitate features such as sample data, test connection, and metadata discovery for jobs associated with this subnet. 
     - **Two** IP addresses are required for every six streaming unit (SU) or one SU V2 (ASA’s V2 pricing structure is launching July 1, 2023, see [here](https://aka.ms/AzureStreamAnalyticsisLaunchingaNewCompetitivePricingModel) for details)  
 
-### Releasing the subnet
-When you indicate virtual network integration with your Azure Stream Analytics job, Azure portal automatically delegates the subnet to the ASA service. Azure undelegates the subnet in the following scenarios: 
+**Subnet Delegation and Release Behavior**:
+
+- When you enable virtual network integration for an Azure Stream Analytics (ASA) job, the Azure portal automatically delegates the specified subnet to the ASA service.
+
+- ASA will automatically undelegate the subnet in either of the following cases:
+    - You disable virtual network integration for the last ASA job using that subnet via the Azure portal.
+    - You delete the last ASA job associated with the subnet.
+
+Note: Multiple ASA jobs can share the same subnet. The "last job" refers to the point when no other ASA jobs are using that subnet. Once the last job is removed, ASA releases the delegated subnet. This may take a few minutes to complete.
 
-- You inform us that virtual network integration is no longer needed for the [last job](#last-job) associated with specified subnet via the ASA portal (see the how-to section). 
-- You delete the [last job](#last-job) associated with the specified subnet. 
+**Subnet Must Allow Intra-Subnet Traffic**:
 
-### Intra-Subnet traffic
-The subnet configuration must enable intra-subnet network traffic. This means that it must allow inbound and outbound traffic where both the source and destination IP addresses reside within the same subnet.
-Learn more [here](../virtual-network/network-security-group-how-it-works.md#intra-subnet-traffic).
+- The subnet configuration must enable intra-subnet network traffic.
+- This means that it must allow inbound and outbound traffic where both the source and destination IP addresses reside within the same subnet. Learn more [here](../virtual-network/network-security-group-how-it-works.md#intra-subnet-traffic).
 
-### Last job 
-Several Stream Analytics jobs can utilize the same subnet. The last job here refers to no other jobs utilizing the specified subnet. When the last job has been deleted or removed by associated, Azure Stream Analytics releases the subnet as a resource, which was delegated to ASA as a service. Allow several minutes for this action to be completed. 
 
 ## Set up virtual network integration