Merge branch 'main' into release-preview-sre-agent

Author: v-alje

articles/app-service/app-service-undelete.md

@@ -12,6 +12,9 @@ ms.custom: devx-track-azurepowershell
 
 If you accidentally deleted an app in Azure App Service, you can now restore it by using the Azure portal or PowerShell.
 
+> [!IMPORTANT]
+> This feature isn't supported for apps hosted on App Service plans using the Free and Shared tiers.
+
 ## Restore a deleted App Service app by using the Azure portal
 
 If you deleted your app in Azure App Service, you can restore it from the portal by following these steps:

articles/azure-functions/functions-reference-python.md

@@ -842,7 +842,7 @@ The *host.json* file must also be updated to include an HTTP `routePrefix`, as s
   "extensionBundle": 
   {
     "id": "Microsoft.Azure.Functions.ExtensionBundle",
-    "version": "[3.*, 4.0.0)"
+    "version": "[4.*, 5.0.0)"
   },
   "extensions": 
   {
@@ -910,7 +910,7 @@ You can use Asynchronous Server Gateway Interface (ASGI)-compatible and Web Serv
   "extensionBundle": 
   {
     "id": "Microsoft.Azure.Functions.ExtensionBundle",
-    "version": "[2.*, 3.0.0)"
+    "version": "[4.*, 5.0.0)"
   },
   "extensions": 
   {

articles/backup/backup-azure-backup-faq.yml

@@ -4,7 +4,7 @@ metadata:
   description: 'Answers to common questions about'
   ms.topic: faq
   ms.service: azure-backup
-  ms.date: 08/09/2024
+  ms.date: 06/23/2025
   author: jyothisuri
   ms.author: jsuri
   ms.custom: engagement-fy24
@@ -109,6 +109,11 @@ sections:
         answer: |
           No. Currently, Azure Backup supports only copying restore points from one vault to another. You can [move snapshots to a different region using the VM restore point APIs](/azure/virtual-machines/manage-restore-points#copy-a-vm-restore-point-between-regions), but this isn't supported for Vault-tier recovery points.
 
+      - question: |
+          Why is Cross Region Restore not supported when Public Network access is set to Deny?
+        answer: |
+          Cross Region Restore (CRR) replicates data from the primary to the secondary region using Geo-redundant storage (GRS) with CRR enabled. When you deny public access and use a private endpoint, the system expects data sync to occur over a private network. However, the secondary region currently doesn’t support private endpoint configuration, which is essential for replication. Without a private connection in the secondary region, CRR can't perform the required replication.
+
   - name: Azure Backup agent
     questions:
       - question: |

articles/container-apps/networking.md

@@ -147,13 +147,13 @@ Different environment types have different subnet requirements:
 
     | Subnet Size | Available IP Addresses<sup>1</sup> | Max nodes (Dedicated workload profile)<sup>2</sup>| Max replicas (Consumption workload profile)<sup>2</sup> |
     |--|--|--|--|
-    | /23 | 495 | 247 | 2,470 |
-    | /24 | 239 | 119 | 1,190 |
-    | /25 | 111 | 55 | 550 |
-    | /26 | 47 | 23 | 230 |
-    | /27 | 15 | 7 | 70 |
+    | /23 | 498 | 249 | 2,490 |
+    | /24 | 242 | 121 | 1,210 |
+    | /25 | 114 | 57 | 570 |
+    | /26 | 50 | 25 | 250 |
+    | /27 | 18 | 9 | 90 |
 
-    <sup>1</sup> The available IP addresses is the size of the subnet minus the 12 IP addresses required for Azure Container Apps infrastructure and 5 IP addresses reserved by the subnet.  
+    <sup>1</sup> The available IP addresses is the size of the subnet minus the 14 IP addresses required for Azure Container Apps infrastructure which includes 5 IP addresses reserved by the subnet.  
     <sup>2</sup> This is accounting for apps in single revision mode.  
 
 # [Consumption only environment](#tab/consumption-only-env)

articles/frontdoor/end-to-end-tls.md

@@ -45,7 +45,7 @@ For Azure Front Door classic and Microsoft CDN classic, you can configure the mi
 
 ## Supported certificates
 
-When you create your TLS/SSL certificate, you must create a complete certificate chain with an allowed Certificate Authority (CA) that is part of the [Microsoft Trusted CA List](https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFT). If you use a non-allowed CA, your request will be rejected.
+When you create your TLS/SSL certificate, you must create a complete certificate chain with an allowed Certificate Authority (CA) that is part of the [Microsoft Trusted CA List](https://ccadb.my.salesforce-sites.com/microsoft/IncludedCACertificateReportForMSFT). If you use a non-allowed CA, your request will be rejected.
 
 Certificates from internal CAs or self-signed certificates aren't allowed.
 

articles/iot-operations/deploy-iot-ops/overview-deploy.md

@@ -29,6 +29,9 @@ To install Azure IoT Operations, have the following hardware requirements availa
 | Available memory for Azure IoT Operations (RAM) | 10-GB | Depends on usage |
 | CPU  | 4 vCPUs | 8 vCPUs     |
 
+>[!NOTE]
+>The minimum configuration is appropriate when running AIO only.
+
 ## Choose your features
 
 Azure IoT Operations offers two deployment modes. You can choose to deploy with *test settings*, a basic subset of features that are simpler to get started with for evaluation scenarios. Or, you can choose to deploy with *secure settings*, the full feature set.

articles/role-based-access-control/permissions/hybrid-multicloud.md

@@ -228,7 +228,7 @@ Azure service: [Azure Arc](/azure/azure-arc/)
 > | Microsoft.HybridCompute/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
 > | Microsoft.HybridCompute/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |
 > | Microsoft.HybridCompute/machines/installPatches/action | Installs patches on any Azure Arc machines |
-> | Microsoft.HybridCompute/machines/listAccessDetails/action | Retreives the access details for a machines resource |
+> | Microsoft.HybridCompute/machines/listAccessDetails/action | Retrieves the access details for a machines resource |
 > | Microsoft.HybridCompute/machines/addExtensions/action | Setup Extensions on Azure Arc machines |
 > | Microsoft.HybridCompute/machines/extensions/read | Reads any Azure Arc extensions |
 > | Microsoft.HybridCompute/machines/extensions/write | Installs or Updates an Azure Arc extensions |

articles/sentinel/sap/deploy-data-connector-agent-container.md

@@ -348,7 +348,7 @@ At this stage, the system's **Health** status is **Pending**. If the agent is up
     - If you have the **Entra ID Application Developer** role or higher, continue to the next step.
     - If you don't have the **Entra ID Application Developer** role or higher:
         - Share the DCR ID with your Entra ID administrator or colleague with the required permissions. 
-        - Ensure that the **Monitoring Metrics Publishing** role is assigned on the DCR, with the service principal assignment, using the client ID from the Entra ID app registration.                      
+        - Ensure that the **Monitoring Metrics Publisher** role is assigned on the DCR, with the service principal assignment, using the client ID from the Entra ID app registration.                      
         - Retrieve the client ID and client secret from the Entra ID app registration to use for authorization on the DCR. 
         
         The SAP admin uses the client ID and client secret information to post to the DCR.              

articles/service-bus-messaging/includes/get-namespace-connection-string.md

@@ -4,19 +4,20 @@
  author: spelluru
  ms.service: azure-service-bus
  ms.topic: include
- ms.date: 02/02/2022
+ ms.date: 06/18/2025
  ms.author: spelluru
  ms.custom: include file
 ---
 
 ## Get connection string to the namespace (Azure portal)
-Creating a new namespace automatically generates an initial Shared Access Signature (SAS) policy with primary and secondary keys, and primary and secondary connection strings that each grant full control over all aspects of the namespace. See [Service Bus authentication and authorization](../service-bus-authentication-and-authorization.md) for information about how to create rules with more constrained rights for regular senders and receivers. 
+
+Creating a new namespace automatically generates an initial Shared Access Signature (SAS) policy. The policy includes primary and secondary keys, and primary and secondary connection strings that each grant full control over all aspects of the namespace. For more information about how to create rules with more constrained rights for regular senders and receivers, see [Service Bus authentication and authorization](../service-bus-authentication-and-authorization.md). 
 
 A client can use the connection string to connect to the Service Bus namespace. To copy the primary connection string for your namespace, follow these steps: 
 
-1. On the **Service Bus Namespace** page, select **Shared access policies** on the left menu.
-3. On the **Shared access policies** page, select **RootManageSharedAccessKey**.
-4. In the **Policy: RootManageSharedAccessKey** window, select the copy button next to **Primary Connection String**, to copy the connection string to your clipboard for later use. Paste this value into Notepad or some other temporary location.
+1. On the **Service Bus Namespace** page, expand **Settings**, then select **Shared access policies**.
+1. On the **Shared access policies** page, select **RootManageSharedAccessKey**.
+1. In the **SAS Policy: RootManageSharedAccessKey** window, select the copy button next to **Primary Connection String**. This action copies the connection string to your clipboard for later use. Paste this value into Notepad or some other temporary location.
 
     :::image type="content" source="./media/service-bus-create-namespace-portal/connection-string.png" lightbox="./media/service-bus-create-namespace-portal/connection-string.png" alt-text="Screenshot shows an S A S policy called RootManageSharedAccessKey, which includes keys and connection strings.":::