Changed position & fixed broken link.

Author: RoseHJM

articles/deployment-environments/how-to-configure-catalog.md

@@ -163,6 +163,12 @@ Use the following steps to create an RBAC key vault:
 
 1. On the **Review + create** tab, select **Create**.
 
+If your organization's policies require you to keep your Key Vault private from the internet, you can set your Key Vault to allow trusted Microsoft services to bypass your firewall rule. 
+
+:::image type="content" source="media/how-to-configure-catalog/key-vault-configure-firewall.png" alt-text="Screenshot showing Azure firewall configuration with Allow trusted Microsoft services to bypass this firewall selected." lightbox="media/how-to-configure-catalog/key-vault-configure-firewall.png":::
+
+To learn how to allow trusted Microsoft services to bypass the firewall, see [Configure Azure Key Vault networking settings](../key-vault/general/how-to-azure-key-vault-network-security.md).
+
 ### Store the personal access token in the key vault
 
 1. In the Key Vault, on the left menu, select **Secrets**.
@@ -213,12 +219,6 @@ Get the path to the secret you created in the key vault.
 
 1. In **Catalogs** for the dev center, verify that your catalog appears. If the connection is successful, the **Status** is **Connected**.
 
-If your organization's policies require you to keep your Key Vault private from the internet, you can set your Key Vault to allow trusted Microsoft services to bypass your firewall rule. 
-
-:::image type="content" source="media/how-to-configure-catalog/key-vault-configure-firewall.png" alt-text="Screenshot showing Azure firewall configuration with Allow trusted Microsoft services to bypass this firewall selected." lightbox="media/how-to-configure-catalog/key-vault-configure-firewall.png":::
-
-To learn how to allow trusted Microsoft services to bypass the firewall, see [Configure Azure Key Vault networking settings](/azure/firewall/tutorial-firewall-portal).
-
 ## [GitHub repo DevCenter App](#tab/GitHubRepoApp/)
 
 To add a catalog, complete the following tasks:
@@ -368,6 +368,12 @@ Use the following steps to create an RBAC key vault:
 1. On the **Access policy** tab, select **Azure role-based access control**, and then select **Review + create**.
 
 1. On the **Review + create** tab, select **Create**.
+ 
+If your organization's policies require you to keep your Key Vault private from the internet, you can set your Key Vault to allow trusted Microsoft services to bypass your firewall rule. 
+
+:::image type="content" source="media/how-to-configure-catalog/key-vault-configure-firewall.png" alt-text="Screenshot showing Azure firewall configuration with Allow trusted Microsoft services to bypass this firewall selected." lightbox="media/how-to-configure-catalog/key-vault-configure-firewall.png":::
+
+To learn how to allow trusted Microsoft services to bypass the firewall, see [Configure Azure Key Vault networking settings](../key-vault/general/how-to-azure-key-vault-network-security.md).
 
 ### Store the personal access token in the key vault
 
@@ -417,12 +423,6 @@ Get the path to the secret you created in the key vault.
 
 1. In **Catalogs** for the dev center, verify that your catalog appears. When the connection is successful, the **Status** reads **Sync successful**.
 
-If your organization's policies require you to keep your Key Vault private from the internet, you can set your Key Vault to allow trusted Microsoft services to bypass your firewall rule. 
-
-:::image type="content" source="media/how-to-configure-catalog/key-vault-configure-firewall.png" alt-text="Screenshot showing Azure firewall configuration with Allow trusted Microsoft services to bypass this firewall selected." lightbox="media/how-to-configure-catalog/key-vault-configure-firewall.png":::
-
-To learn how to allow trusted Microsoft services to bypass the firewall, see [Configure Azure Key Vault networking settings](/azure/firewall/tutorial-firewall-portal).
-
 ---
 
 ## Update a catalog