Security guidance clarity edits

Author: ecfan

articles/connectors/connectors-create-api-mq.md

@@ -38,9 +38,11 @@ Based on whether you use the MQ managed connector (Consumption or Standard workf
 
 | Authentication | Supported logic app type and MQ connector | Process |
 |----------------|-------------------------------------------|---------|
-| Server only <br>(one-way) | - Consumption: Managed only <br><br>- Standard: Managed or built-in | For server authentication, your MQ server sends a private key certificate, either publicly trusted or non-publicly trusted, to your logic app client for validation. The MQ connector validates the incoming server certificate for authenticity against public key certificates, known also as a "signer" certificates, by using standard .NET SSL stream validation. <br><br>The logic app doesn't send a client certificate. |
+| Server only <br>(one-way) | - Consumption: Managed only <br><br>- Standard: Managed or built-in | For server authentication, your MQ server sends a private key certificate, either publicly trusted or non-publicly trusted, to your logic app client for validation. The MQ connector validates the incoming server certificate for authenticity against public key certificates, also known as *signer certificates*, by using standard .NET SSL stream validation. <br><br>The logic app workflow doesn't send a client certificate. |
 | Server-client <br>(two-way) | - Consumption: Not supported <br><br>- Standard: Built-in only | For server authentication, see the previous row. <br><br>For client authentication, the logic app client sends a private key certificate to your MQ server for validation. The MQ server validates the incoming client certificate for authenticity also by using a public key certificate. |
 
+[!INCLUDE [secrets-guidance](../logic-apps/includes/secrets-guidance.md)]
+
 ### Notes about private key and public key certificates
 
 - The certificate that requires validation is always a private key certificate. The certificate used to perform the validation is always a public key certificate. 
@@ -266,8 +268,6 @@ To check that the thumbprints for the required public key certificates exist on
 
 Follow these steps to add a public key certificate to the Trusted Root CA Store on the virtual machine host where your Standard logic app runs.
 
-[!INCLUDE [secrets-guidance](../logic-apps/includes/secrets-guidance.md)]
-
 1. In the [Azure portal](https://portal.azure.com), open your Standard logic app resource. On the logic app resource menu, under **Settings**, select **Certificates**.
 
 1. Select the **Public key certificates (.cer)** tab, and then select **Add certificate**.
@@ -298,8 +298,6 @@ Follow these steps to add a public key certificate to the Trusted Root CA Store
 
 Follow these steps to add a private key certificate to the Trusted Root CA Store on virtual machine host where your Standard logic app runs.
 
-[!INCLUDE [secrets-guidance](../logic-apps/includes/secrets-guidance.md)]
-
 1. In the [Azure portal](https://portal.azure.com), open your logic app resource. On the logic app resource menu, under **Settings**, select **Certificates**.
 
 1. Select the **Bring your own certificates (.pfx)** tab, and then select **Add certificate**.

articles/logic-apps/includes/secrets-guidance.md

@@ -8,17 +8,9 @@ ms.date: 01/07/2025
 
 > [!IMPORTANT]
 >
-> In production environments, always protect sensitive information and secrets, such as credentials, 
-> certificates, thumbprints, access keys, and connection strings. Make sure that you securely store such information 
-> by using Microsoft Entra ID and [Azure Key Vault](https://go.microsoft.com/fwlink/?linkid=2300117). 
-> Avoid hardcoding this information, sharing with other users, or saving in plain text anywhere others 
-> can access. Rotate your secrets as soon as possible if you think this information might be compromised. 
-> For more information, see [About Azure Key Vault](/azure/key-vault/general/overview).
->
-> For authentication, use [Microsoft Entra ID](/entra/identity/authentication/overview-authentication) with 
-> [managed identities](/entra/identity/managed-identities-azure-resources/overview) whenever possible. 
-> This method provides optimal and superior security without having to provide credentials. Azure manages 
-> this identity for you and helps keep authentication information secure so that you don't have to manage 
-> this sensitive information. To set up a managed identity for Azure Logic Apps, see 
-> [Authenticate access and connections to Azure resources with managed identities in Azure Logic Apps](/azure/logic-apps/authenticate-with-managed-identity).
->
+> In production environments, always protect sensitive information and secrets, such as credentials, certificates, 
+> thumbprints, access keys, and connection strings. Make sure that you securely store such information by using 
+> Microsoft Entra ID and [Azure Key Vault](https://go.microsoft.com/fwlink/?linkid=2300117). Avoid hardcoding 
+> this information, sharing with other users, or saving in plain text anywhere that others can access. Rotate your 
+> secrets as soon as possible if you think this information might be compromised. For more information, see 
+> [About Azure Key Vault](/azure/key-vault/general/overview).