Merge branch 'main' into reliability-include-update

Author: anaharris-ms

.openpublishing.redirection.json

@@ -3714,6 +3714,21 @@
       "source_path_from_root": "/articles/reliability/resiliency-recommendations/recommend-cosmos-db-nosql.md",
       "redirect_url": "/azure/reliability/reliability-cosmos-db-nosql",
       "redirect_document_id": false
+    },
+    {
+      "source_path_from_root": "/articles/virtual-network/tutorial-create-route-table-portal.md",
+      "redirect_url": "/azure/virtual-network/tutorial-create-route-table",
+      "redirect_document_id": false
+    },
+    {
+      "source_path_from_root": "/articles/virtual-network/tutorial-create-route-table-powershell.md",
+      "redirect_url": "/azure/virtual-network/tutorial-create-route-table",
+      "redirect_document_id": false
+    },
+    {
+      "source_path_from_root": "/articles/virtual-network/tutorial-create-route-table-cli.md",
+      "redirect_url": "/azure/virtual-network/tutorial-create-route-table",
+      "redirect_document_id": false
     }
   ]
 }

articles/api-center/build-register-apis-vscode-extension.md

@@ -28,7 +28,7 @@ The following Visual Studio Code extensions are needed for the specified scenari
 * [GitHub Actions](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-github-actions) - to register APIs using a CI/CD pipeline with GitHub Actions
 * [Azure Pipelines](https://marketplace.visualstudio.com/items?itemName=ms-azure-devops.azure-pipelines) - to register APIs using a CI/CD pipeline with Azure Pipelines
 * [GitHub Copilot](https://marketplace.visualstudio.com/items?itemName=GitHub.copilot) - to generate OpenAPI specification files from API code
-* [GitHub Copilot for Azure](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azure-github-copilot) - to generate OpenAPI specification files using the Azure API Center Plugin for GitHub Copilot for Azure
+* [GitHub Copilot for Azure](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azure-github-copilot) - to generate OpenAPI specification files using the Azure API Center Plugin for [GitHub Copilot for Azure](/azure/developer/github-copilot-azure/introduction) (preview)
 
 [!INCLUDE [vscode-extension-setup](includes/vscode-extension-setup.md)]  
 
@@ -66,7 +66,7 @@ After generating the OpenAPI specification file and checking for accuracy, you c
 
 ## Generate OpenAPI spec using natural language prompts
 
-The API Center plugin for [GitHub Copilot for Azure](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azure-github-copilot) helps you design new APIs starting from natural language prompts. With AI assistance, quickly generate an OpenAPI spec for API development that complies with your organization's standards.
+The API Center plugin for [GitHub Copilot for Azure](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azure-github-copilot) (preview) helps you design new APIs starting from natural language prompts. With AI assistance, quickly generate an OpenAPI spec for API development that complies with your organization's standards.
 
 > [!NOTE]
 > This feature is available in the pre-release version of the API Center extension.
@@ -98,4 +98,5 @@ The API Center plugin for [GitHub Copilot for Azure](https://marketplace.visuals
 * [Discover and consume APIs with the Azure API Center extension for Visual Studio Code](discover-apis-vscode-extension.md)
 * [Govern APIs with the Azure API Center extension for Visual Studio Code](govern-apis-vscode-extension.md)
 * [Enable and view platform API catalog in Visual Studio Code](enable-platform-api-catalog-vscode-extension.md)
+* [Overview of GitHub Copilot for Azure](/azure/developer/github-copilot-azure/introduction)
 

articles/api-center/includes/vscode-extension-basic-prerequisites.md

@@ -15,8 +15,8 @@ ms.custom: Include file
 
 * One or more API centers in your Azure subscription. 
 
-    * Currently, you need to be assigned the Contributor role or higher permissions to manage APIs with the extension.
+    * Currently, you need to be assigned the Azure API Center Service Contributor role or higher permissions on an API center to manage APIs with the extension.
 
 * [Visual Studio Code](https://code.visualstudio.com/)
 
-* [Azure API Center extension for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=apidev.azure-api-center)
+* [Azure API Center extension for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=apidev.azure-api-center)

articles/api-center/register-apis-github-actions.md

@@ -55,7 +55,7 @@ In the following steps, create a Microsoft Entra ID service principal, which wil
 > [!NOTE]
 > Configuring a service principal is shown for demonstration purposes. The recommended way to authenticate with Azure for GitHub Actions is with OpenID Connect, an authentication method that uses short-lived tokens. Setting up OpenID Connect with GitHub Actions is more complex but offers hardened security. [Learn more](../app-service/deploy-github-actions.md?tabs=openid%2Caspnetcore#1-generate-deployment-credentials)
 
-Create a service principal using the [az ad sp create-for-rbac](/cli/azure/ad#az-ad-sp-create-for-rbac) command. The following example first uses the [az apic show](/cli/azure/apic#az-apic-show) command to retrieve the resource ID of the API center. The service principal is then created with the Contributor role for the API center.
+Create a service principal using the [az ad sp create-for-rbac](/cli/azure/ad#az-ad-sp-create-for-rbac) command. The following example first uses the [az apic show](/cli/azure/apic#az-apic-show) command to retrieve the resource ID of the API center. The service principal is then created with the Azure API Center Service Contributor role for the API center.
 
 #### [Bash](#tab/bash)
 
@@ -67,7 +67,7 @@ spName=<service-principal-name>
 
 apicResourceId=$(az apic show --name $apiCenter --resource-group $resourceGroup --query "id" --output tsv)
 
-az ad sp create-for-rbac --name $spName --role Contributor --scopes $apicResourceId --json-auth
+az ad sp create-for-rbac --name $spName --role "Azure API Center Service Contributor" --scopes $apicResourceId --json-auth
 ```
 
 #### [PowerShell](#tab/powershell)
@@ -80,7 +80,7 @@ $spName = "<service-principal-name>"
 
 $apicResourceId = $(az apic show --name $apiCenter --resource-group $resourceGroup --query "id" --output tsv)
 
-az ad sp create-for-rbac --name $spName --role Contributor --scopes $apicResourceId --json-auth
+az ad sp create-for-rbac --name $spName --role "Azure API Center Service Contributor" --scopes $apicResourceId --json-auth
 ```
 ---
 

articles/api-management/api-management-howto-disaster-recovery-backup-restore.md

@@ -7,7 +7,7 @@ author: dlepow
 
 ms.service: azure-api-management
 ms.topic: how-to
-ms.date: 01/31/2023
+ms.date: 09/06/2024
 ms.author: danlep 
 ms.custom: devx-track-azurepowershell
 ---
@@ -129,6 +129,38 @@ Backup-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $api
 
 Backup is a long-running operation that may take several minutes to complete. During this time the API gateway continues to handle requests, but the state of the service is Updating.
 
+### [CLI](#tab/cli)
+
+[Sign in](/cli/azure/authenticate-azure-cli) with Azure CLI.
+
+In the following examples:
+
+* An API Management instance named *myapim* is in resource group *apimresourcegroup*.
+* A storage account named *backupstorageaccount* is in resource group *storageresourcegroup*. The storage account has a container named *backups*.
+* A backup blob will be created with name *ContosoBackup.apimbackup*.
+
+Set variables in Bash:
+
+```azurecli-interactive
+apiManagementName="myapim";
+apiManagementResourceGroup="apimresourcegroup";
+storageAccountName="backupstorageaccount";
+storageResourceGroup="storageresourcegroup";
+containerName="backups";
+backupName="ContosoBackup.apimbackup";
+```
+
+### Access using storage access key
+
+```azurecli-interactive
+storageKey=$(az storage account keys list --resource-group $storageResourceGroup --account-name $storageAccountName --query [0].value --output tsv)
+
+az apim backup --resource-group $apiManagementResourceGroup --name $apiManagementName \
+    --storage-account-name $storageAccountName --storage-account-key $storageKey --storage-account-container $containerName --backup-name $backupName
+```
+
+Backup is a long-running operation that may take several minutes to complete. During this time the API gateway continues to handle requests, but the state of the service is Updating.
+
 ### [REST](#tab/rest)
 
 See [Azure REST API reference](/rest/api/azure/) for information about authenticating and calling Azure REST APIs.
@@ -261,6 +293,35 @@ Restore-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $ap
 
 Restore is a long-running operation that may take up to 45 minutes or more to complete. 
 
+### [CLI](#tab/cli)
+
+In the following examples, 
+
+* An API Management instance named *myapim* is restored from the backup blob named *ContosoBackup.apimbackup* in storage account *backupstorageaccount*.
+* The backup blob is in a container named *backups*.
+
+Set variables in Bash:
+
+```azurecli-interactive
+apiManagementName="myapim";
+apiManagementResourceGroup="apimresourcegroup";
+storageAccountName="backupstorageaccount";
+storageResourceGroup="storageresourcegroup";
+containerName="backups";
+backupName="ContosoBackup.apimbackup"
+```
+
+### Access using storage access key
+
+```azurecli-interactive
+storageKey=$(az storage account keys list --resource-group $storageResourceGroup --account-name $storageAccountName --query [0].value --output tsv)
+
+az apim restore --resource-group $apiManagementResourceGroup --name $apiManagementName \
+    --storage-account-name $storageAccountName --storage-account-key $storageKey --storage-account-container $containerName --backup-name $backupName
+```
+
+Restore is a long-running operation that may take up to 45 minutes or more to complete. 
+
 ### [REST](#tab/rest)
 
 To restore an API Management service from a previously created backup, make the following HTTP request:

articles/api-management/breaking-changes/workspaces-breaking-changes-march-2025.md

@@ -65,7 +65,7 @@ The following are abbreviated steps to add a workspace gateway to a workspace. F
 
 > [!NOTE]
 > * The workspace gateway incurs additional charges. For more information, see [API Management pricing](https://aka.ms/apimpricing).
-> * API Management currently supports a dedicated gateway per workspace only. If this is impacting your migration plans, see the workspaces roadmap in the [workspaces GA announcement](https://aka.ms/apim/workspaces/ga-announcement).
+> * We're introducing the ability to associate multiple workspaces with a workspace gateway, helping organizations manage APIs with workspaces at a lower cost. This feature is being rolled out starting in December 2024 and it may not be available to all eligible services before January. [Learn more](https://aka.ms/apim/workspaces/sharedgateway)
 
 1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.
 1. In the left menu, under **APIs**, select **Workspaces**.

articles/api-management/how-to-create-workspace.md

@@ -5,7 +5,7 @@ author: dlepow
 ms.topic: how-to
 ms.service: azure-api-management
 ms.author: danlep
-ms.date: 07/10/2024
+ms.date: 11/12/2024
 ms.custom:
 ---
 
@@ -24,7 +24,8 @@ Follow the steps in this article to:
 * Assign permissions to the workspace
 
 > [!NOTE]
-> Currently, creating a workspace gateway is a long-running operation that can take up to 3 hours or more to complete. 
+> * Currently, creating a workspace gateway is a long-running operation that can take up to 3 hours or more to complete. 
+> * We're introducing the ability to associate multiple workspaces with a workspace gateway, helping organizations manage APIs with workspaces at a lower cost. This feature is being rolled out starting in December 2024 and it may not be available to all eligible services before January. [Learn more](https://aka.ms/apim/workspaces/sharedgateway)
 
 ## Prerequisites
 

articles/api-management/migrate-stv1-to-stv2-vnet.md

@@ -6,7 +6,7 @@ author: dlepow
 ms.service: azure-api-management
 ms.custom:
 ms.topic: how-to
-ms.date: 09/16/2024
+ms.date: 11/04/2024
 ms.author: danlep
 ---
 
@@ -25,6 +25,8 @@ For a VNet-inject instance, you have the following migration options:
 
 * [**Option 2: Change to a new subnet**](#option-2-migrate-and-change-to-new-subnet) - Migrate your instance by specifying a different subnet in the same or a different VNet. After migration, optionally migrate back to the instance's original subnet. The migration process changes the VIP address(es) of the instance. After migration, you need to update any network dependencies including DNS, firewall rules, and VNets to use the new VIP address(es). 
 
+Under certain, less frequent conditions, migration in the same subnet may not be possible or behaves differently. For more information, see [Special conditions and scenarios](#special-conditions-and-scenarios).
+
 If you need to migrate a *non-VNnet-injected* API Management hosted on the `stv1` platform, see [Migrate a non-VNet-injected API Management instance to the stv2 platform](migrate-stv1-to-stv2-no-vnet.md).
 
 [!INCLUDE [api-management-migration-alert](../../includes/api-management-migration-alert.md)]
@@ -217,6 +219,28 @@ After you update the VNet configuration, the status of your API Management insta
 
 [!INCLUDE [api-management-migration-rollback](../../includes/api-management-migration-rollback.md)]
 
+## Special conditions and scenarios
+
+Under certain conditions, [Option 1: Migrate and keep same subnet](#option-1-migrate-and-keep-same-subnet) may not be available or behaves differently. The portal detects these conditions and recommends the migration option(s). If you aren't able to use Option 1, or multiple conditions are present, use [Option 2: Change to a new subnet](#option-2-migrate-and-change-to-new-subnet).
+
+* **VNet with special internal conditions** - If your API Management instance is currently deployed in a VNet with special internal conditions (unrelated to customer configuration), you are notified in the portal that Option 1 for same-subnet migration in the portal includes additional downtime (approximately 1 hour). Using the portal for migration is recommended. You can also use the following modified Azure CLI script for same-subnet migration with approximately 1 hour of downtime:
+
+   ```azurecli
+   APIM_NAME={name of your API Management instance}
+   # In PowerShell, use the following syntax: $APIM_NAME={name of your API Management instance}
+   RG_NAME={name of your resource group} 
+   # Get resource ID of API Management instance
+   APIM_RESOURCE_ID=$(az apim show --name $APIM_NAME --resource-group $RG_NAME --query id --output tsv)
+   # Call REST API to migrate to stv2 and preserve VIP address for special condition
+   az rest --method post --uri "$APIM_RESOURCE_ID/migrateToStv2?api-version=2024-06-01-preview&migrateWithDowntime=true" --body '{"mode": "PreserveIP"}' 
+   ```
+
+* **Multiple stv1 instances in subnet** - Sufficient free IP addresses may not be available for a same-subnet migration if you attempt to migrate the instances simultaneously. You may be able to migrate instances sequentially using Option 1.
+
+* **Subnet delegation** - If the subnet where API Management is deployed is currently delegated to other Azure services, you must migrate using Option 2. 
+
+* **Azure Key Vault blocked** - If access to Azure Key Vault is currently blocked, you must migrate using Option 2, including setting up NSG rules in the new subnet for access to Azure Key Vault.
+
 [!INCLUDE [api-management-migration-support](../../includes/api-management-migration-support.md)]
 
 ## Frequently asked questions

articles/api-management/workspaces-overview.md

@@ -67,12 +67,13 @@ Workspace gateways are managed independently from the API Management service and
 * For information on the cost of workspace gateways, see [API Management pricing](https://aka.ms/apimpricing).
 * For a detailed comparison of API Management gateways, see [API Management gateways overview](api-management-gateways-overview.md).
 
+> [!NOTE]
+> We're introducing the ability to associate multiple workspaces with a workspace gateway, helping organizations manage APIs with workspaces at a lower cost. This feature is being rolled out starting in December 2024 and it may not be available to all eligible services before January. [Learn more](https://aka.ms/apim/workspaces/sharedgateway)
+
 ### Gateway hostname
 
 Each association of a workspace to a workspace gateway creates a unique hostname for APIs managed in that workspace. Default hostnames follow the pattern `<workspace-name>-<hash>.gateway.<region>.azure-api.net`. Currently, custom hostnames aren't supported for workspace gateways.
 
-> [!NOTE]
-> Through October 2024, APIs in workspaces can be accessed at runtime using the gateway hostname of your API Management instance in addition to the hostname of the workspace gateway.
 
 ### Network isolation
 
@@ -109,7 +110,6 @@ Workspace gateways are currently available in the following regions:
 The following constraints currently apply to workspace gateways:
 
 * A workspace gateway needs to be in the same region as the API Management instance's primary Azure region and in the same subscription. 
-* A gateway can be associated only with one workspace
 * A workspace can't be associated with a self-hosted gateway
 * Workspace gateways don't support inbound private endpoints
 * APIs in workspace gateways can't be assigned custom hostnames