Keyboard focus

Author: cherylmc

articles/bastion/bastion-faq.md

@@ -4,7 +4,7 @@ description: Learn about frequently asked questions for Azure Bastion.
 author: cherylmc
 ms.service: bastion
 ms.topic: conceptual
-ms.date: 08/03/2023
+ms.date: 08/08/2023
 ms.author: cherylmc
 ---
 # Azure Bastion FAQ
@@ -98,7 +98,7 @@ Yes, [Azure AD guest accounts](../active-directory/external-identities/what-is-b
 
 ### <a name="shareable-links-domains"></a>Are custom domains supported with Bastion shareable links?
 
-No, custom domains are not supported with Bastion shareable links. Users will receive a certificate error upon trying to add specific domains in the CN/SAN of the Bastion host certificate.
+No, custom domains aren't supported with Bastion shareable links. Users receive a certificate error upon trying to add specific domains in the CN/SAN of the Bastion host certificate.
 
 ## <a name="vm"></a>VM features and connection FAQs
 
@@ -111,9 +111,11 @@ In order to make a connection, the following roles are required:
 * Reader role on the Azure Bastion resource.
 * Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).
 
+Additionally, the user must have the rights (if required) to connect to the VM. For example, if the user is connecting to a Windows VM via RDP and isn't a member of the local Administrators group, they must be a member of the Remote Desktop Users group.
+
 ### <a name="publicip"></a>Do I need a public IP on my virtual machine to connect via Azure Bastion?
 
-No. When you connect to a VM using Azure Bastion, you don't need a public IP on the Azure virtual machine that you're connecting to. The Bastion service will open the RDP/SSH session/connection to your virtual machine over the private IP of your virtual machine, within your virtual network.
+No. When you connect to a VM using Azure Bastion, you don't need a public IP on the Azure virtual machine that you're connecting to. The Bastion service opens the RDP/SSH session/connection to your virtual machine over the private IP of your virtual machine, within your virtual network.
 
 ### <a name="rdpssh"></a>Do I need an RDP or SSH client?
 
@@ -145,7 +147,7 @@ Azure Bastion offers support for file transfer between your target VM and local
 
 ### <a name="aadj"></a>Does Bastion hardening work with AADJ VM extension-joined VMs?
 
-This feature doesn't work with AADJ VM extension-joined machines using Azure AD users. For more information, see [Log in to a Windows virtual machine in Azure by using Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md#requirements).
+This feature doesn't work with AADJ VM extension-joined machines using Azure AD users. For more information, see [Sign in to a Windows virtual machine in Azure by using Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md#requirements).
 
 ### <a name="rdscal"></a>Does Azure Bastion require an RDS CAL for administrative purposes on Azure-hosted VMs?
 
@@ -177,7 +179,11 @@ To set your target language as your keyboard layout on a Windows workstation, na
 
 ### <a name="shortcut"></a>Is there a keyboard solution to toggle focus between a VM and browser?
 
-Users can use "Ctrl+Shift+Alt" to effectively switch focus between the VM and the browser. 
+Users can use "Ctrl+Shift+Alt" to effectively switch focus between the VM and the browser.
+
+### <a name="keyboard-focus"></a>How do I take keyboard or mouse focus back from an instance?
+
+Click the Windows key twice in a row to take back focus within the Bastion window.
 
 ### <a name="res"></a>What is the maximum screen resolution supported via Bastion?
 
@@ -223,12 +229,12 @@ Make sure the user has **read** access to both the VM, and the peered VNet. Addi
 |Microsoft.Network/virtualNetworks/subnets/virtualMachines/read|Gets references to all the virtual machines in a virtual network subnet|Action|
 |Microsoft.Network/virtualNetworks/virtualMachines/read|Gets references to all the virtual machines in a virtual network|Action|
 
-### My privatelink.azure.com cannot resolve to management.privatelink.azure.com
+### My privatelink.azure.com can't resolve to management.privatelink.azure.com
 
 This may be due to the Private DNS zone for privatelink.azure.com linked to the Bastion virtual network causing management.azure.com CNAMEs to resolve to management.privatelink.azure.com behind the scenes. Create a CNAME record in their privatelink.azure.com zone for management.privatelink.azure.com to arm-frontdoor-prod.trafficmanager.net to enable successful DNS resolution.
 
 
 
 ## Next steps
 
-For more information, see [What is Azure Bastion](bastion-overview.md).
+For more information, see [What is Azure Bastion](bastion-overview.md).