[APIM] VNet injection resources

Author: dlepow

articles/api-management/virtual-network-injection-resources.md

@@ -5,7 +5,7 @@ author: dlepow
 
 ms.service: api-management
 ms.topic: conceptual
-ms.date: 03/26/2024
+ms.date: 06/10/2024
 ms.author: danlep
 ---
 
@@ -18,11 +18,11 @@ The following are virtual network resource requirements for API Management injec
 #### [stv2](#tab/stv2)
 
 * An Azure Resource Manager virtual network is required.
-* You must provide a Standard SKU [public IPv4 address](../virtual-network/ip-services/public-ip-addresses.md#sku) in addition to specifying a virtual network and subnet.
 * The subnet used to connect to the API Management instance may contain other Azure resource types.
-* The subnet used to connect to the API Management instance should not have any delegations enabled. The "Delegate subnet to a service" setting for the subnet should be set to "None". 
+* The subnet used to connect to the API Management instance should not have any delegations enabled. The **Delegate subnet to a service** setting for the subnet should be set to *None*. 
 * A [network security group](../virtual-network/network-security-groups-overview.md) attached to the subnet above. A network security group (NSG) is required to explicitly allow inbound connectivity, because the load balancer used internally by API Management is secure by default and rejects all inbound traffic. 
-* The API Management service, virtual network and subnet, and public IP address resource must be in the same region and subscription.
+* Depending on whether you inject your API Management instance into a virtual network in external mode or internal mode, you may provide a Standard SKU [public IPv4 address](../virtual-network/ip-services/public-ip-addresses.md#sku) in addition to specifying a virtual network and subnet.
+* The API Management service, virtual network and subnet, and public IP address resource (if provided) must be in the same region and subscription.
 * For multi-region API Management deployments, configure virtual network resources separately for each location.
 
 #### [stv1](#tab/stv1)

includes/api-management-virtual-network-prerequisites.md

@@ -41,6 +41,8 @@ Some prerequisites differ depending on the version (`stv2` or `stv1`) of the [co
 
   * The value of the IP address is assigned as the virtual public IPv4 address of the API Management instance in that region. 
 
+* For multi-region API Management deployments, configure virtual network resources separately for each location.
+
 ### [stv1](#tab/stv1)
 
 + **An API Management instance.** For more information, see [Create an Azure API Management instance](../articles/api-management/get-started-create-service-instance.md).
@@ -50,4 +52,6 @@ Some prerequisites differ depending on the version (`stv2` or `stv1`) of the [co
   * The subnet used to connect to the API Management instance should not have any delegations enabled. The **Delegate subnet to a service** setting for the subnet should be set to *None*. 
 
 * For certain scenarios, enable **service endpoints** in the subnet to dependent services such as Azure Storage or Azure SQL. For more information, see [Force tunnel traffic to on-premises firewall using ExpressRoute or network virtual appliance](#force-tunnel-traffic-to-on-premises-firewall-using-expressroute-or-network-virtual-appliance), later in this article. 
+
+* For multi-region API Management deployments, configure virtual network resources separately for each location.
 ---