add includes

Author: craigshoemaker

articles/azure-signalr/concept-connection-string.md

@@ -12,6 +12,8 @@ ms.author: kenchen
 
 A connection string contains information about how to connect to Azure SignalR Service. In this article, you learn the basics of connection strings and how to configure one in your application.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## What a connection string is
 
 When an application needs to connect to Azure SignalR Service, it needs the following information:
@@ -192,6 +194,8 @@ Endpoint=https://<resource_name>.service.signalr.net;AccessKey=<access_key>;Serv
 
 ## Configure a connection string in your application
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 There are two ways to configure a connection string in your application.
 
 You can set the connection string when calling the `AddAzureSignalR()` API:

articles/azure-signalr/includes/signalr-connection-string-security-comment.md

@@ -0,0 +1,12 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+Raw connection strings appear in this article for demonstration purposes only. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).

articles/azure-signalr/includes/signalr-connection-string-security.md

@@ -0,0 +1,17 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+> [!IMPORTANT]
+> Raw connection strings appear in this article for demonstration purposes only.
+>
+> A connection string includes the authorization information required for your application to access Azure Web PubSub service. The access key inside the connection string is similar to a root password for your service. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).
+>
+> Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.