moved heading

Author: gitName

articles/api-management/inject-vnet-v2.md

@@ -54,8 +54,6 @@ If you want to enable *public* inbound access to an API Management instance in t
 * Minimum: /27 (32 addresses)
 * Recommended: /24 (256 addresses) - to accommodate scaling of API Management instance
 
-## Network security group
-
 [!INCLUDE [api-management-virtual-network-v2-nsg-rules](../../includes/api-management-virtual-network-v2-nsg-rules.md)]
 * Configure inbound rules to meet your requirements for access to the API Management instance.
 

articles/api-management/integrate-vnet-outbound.md

@@ -46,8 +46,6 @@ If you want to inject a Premium v2 (preview) API Management instance into a virt
 * Minimum: /27 (32 addresses)
 * Recommended: /24 (256 addresses) - to accommodate scaling of API Management instance
 
-### Network security group
-
 [!INCLUDE [api-management-virtual-network-v2-nsg-rules](../../includes/api-management-virtual-network-v2-nsg-rules.md)]
 
 ### Subnet delegation

includes/api-management-virtual-network-v2-nsg-rules.md

@@ -6,6 +6,8 @@ ms.date: 06/16/2025
 ms.author: danlep
 ---
 
+### Network security group
+
 A network security group (NSG) must be associated with the subnet. To set up a network security group, see [Create a network security group](../articles/virtual-network/manage-network-security-group.md). 
 
 * Configure an outbound NSG rule to allow access to Azure Storage on port 443.