Merge pull request #199152 from Blackmist/moe-updates

incorporating feedback

Author: 19BMG00

articles/machine-learning/how-to-secure-online-endpoint.md

@@ -31,10 +31,14 @@ The following diagram shows how communications flow through private endpoints to
 
 * You must install and configure the Azure CLI and ML extension. For more information, see [Install, set up, and use the CLI (v2)](how-to-configure-cli.md). 
 
-* You must have an Azure Resource group, in which you (or the service principal you use) need to have `Contributor` access. You'll have such a resource group if you configured your ML extension per the above article. 
+* You must have an Azure Resource Group, in which you (or the service principal you use) need to have `Contributor` access. You'll have such a resource group if you configured your ML extension per the above article. 
 
 * You must have an Azure Machine Learning workspace, and the workspace must use a private endpoint. If you don't have one, the steps in this article create an example workspace, VNet, and VM. For more information, see [Configure a private endpoint for Azure Machine Learning workspace](how-to-configure-private-link.md).
 
+* The Azure Container Registry for your workspace must be configured for __Premium__ tier. For more information, see [Azure Container Registry service tiers](/azure/container-registry/container-registry-skus).
+
+* The Azure Container Registry and Azure Storage Account must be in the same Azure Resource Group as the workspace.
+
 > [!IMPORTANT]
 > The end-to-end example in this article comes from the files in the __azureml-examples__ GitHub repository. To clone the samples repository and switch to the repository's `cli/` directory, use the following commands: 
 >
@@ -74,7 +78,7 @@ The following are the resources that the deployment communicates with over the p
 * The Azure Storage blob that is the default storage for the workspace.
 * The Azure Container Registry for the workspace.
 
-When you configure the `egress_public_network_access` to `disabled`, a new private endpoint is created per deployment, per service. For example, if you set the flag to `true` for three deployments to an online endpoint, nine private endpoints are created. Each deployment would have three private endpoints that are used to communicate with the workspace, blob, and container registry.
+When you configure the `egress_public_network_access` to `disabled`, a new private endpoint is created per deployment, per service. For example, if you set the flag to `disabled` for three deployments to an online endpoint, nine private endpoints are created. Each deployment would have three private endpoints that are used to communicate with the workspace, blob, and container registry.
 
 ```azurecli
 az ml online-deployment create -f deployment.yml --set egress_public_network_access=disabled

articles/machine-learning/toc.yml

@@ -491,21 +491,8 @@
           items: 
             - name: Deploy an ML model with an online endpoint
               href: how-to-deploy-managed-online-endpoints.md
-            - name: Security
-              items:
-                - name: Authenticate to endpoints
-                  href: how-to-authenticate-online-endpoint.md
-                - name: Network isolation with managed online endpoints
-                  displayName: network, vnet, secure
-                  href: how-to-secure-online-endpoint.md
-                - name: Managed online endpoints VM SKU list
-                  href: reference-managed-online-endpoints-vm-sku-list.md
             - name: Safe rollout for online endpoints
               href: how-to-safely-rollout-managed-endpoints.md
-            - name: Autoscale managed online endpoints
-              href: how-to-autoscale-endpoints.md
-            - name: Access Azure resources from online endpoints
-              href: how-to-access-resources-from-endpoints-managed-identities.md
             - name: Deployment scenarios
               items: 
                 - name: Deploy a MLflow model with an online endpoint
@@ -521,6 +508,19 @@
                   href: how-to-deploy-with-rest.md
                 - name: Deploy an AutoML model with an online endpoint
                   href: how-to-deploy-automl-endpoint.md
+            - name: Security
+              items:
+                - name: Authenticate to endpoints
+                  href: how-to-authenticate-online-endpoint.md
+                - name: Network isolation with managed online endpoints
+                  displayName: network, vnet, secure
+                  href: how-to-secure-online-endpoint.md
+                - name: Access Azure resources from online endpoints
+                  href: how-to-access-resources-from-endpoints-managed-identities.md
+            - name: Autoscale managed online endpoints
+              href: how-to-autoscale-endpoints.md
+            - name: Managed online endpoints VM SKU list
+              href: reference-managed-online-endpoints-vm-sku-list.md
             - name: Viewing managed online endpoint costs
               href: how-to-view-online-endpoints-costs.md
             - name: Monitoring managed online endpoints