Merge pull request #98127 from DennisLee-DennisLee/v-dele-1645361-003

1645361 portal-nav: Updated two API management articles.

Author: PRMerger19

articles/api-management/api-management-howto-protect-backend-with-aad.md

@@ -43,12 +43,12 @@ Here is a quick overview of the steps:
 
 To protect an API with Azure AD, the first step is to register an application in Azure AD that represents the API. 
 
-1. Navigate to the [Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page. 
+1. Go to the [Azure portal](https://portal.azure.com) to register your application. Search for and select **API registrations**.
 
 1. Select **New registration**. 
 
 1. When the **Register an application page** appears, enter your application's registration information: 
-    - In the **Name** section, enter a meaningful application name that will be displayed to users of the app, for example `backend-app`. 
+    - In the **Name** section, enter a meaningful application name that will be displayed to users of the app, such as *backend-app*. 
     - In the **Supported account types** section, select an option that suits your scenario. 
 
 1. Leave the **Redirect URI** section empty.
@@ -59,51 +59,51 @@ To protect an API with Azure AD, the first step is to register an application in
 
 1. Select **Expose an API** and set the **Application ID URI** with the default value. Record this value for later.
 
-1. In the **Add a scope** page, create a new scope supported by the API. (e.g., Read) then click on *Add scope* to create the scope. Repeat this step to add all scopes supported by your API.
+1. Select the **Add a scope** button to display the **Add a scope** page. Then create a new scope that's supported by the API (for example, `Files.Read`). Finally, select the **Add scope** button to create the scope. Repeat this step to add all scopes supported by your API.
 
-1. When the scope is created, make a note of it, for use in a subsequent step. 
+1. When the scopes are created, make a note of them for use in a subsequent step. 
 
 ## Register another application in Azure AD to represent a client application
 
 Every client application that calls the API needs to be registered as an application in Azure AD as well. In this example, the client application is the Developer Console in the API Management developer portal. Here's how to register another application in Azure AD to represent the Developer Console.
 
-1. Navigate to the [Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page. 
+1. Go to the [Azure portal](https://portal.azure.com) to register your application. Search for and select **API registrations**.
 
 1. Select **New registration**.
 
 1. When the **Register an application page** appears, enter your application's registration information: 
-    - In the **Name** section, enter a meaningful application name that will be displayed to users of the app, for example `client-app`. 
-    - In the **Supported account types** section, select **Accounts in any organizational directory**. 
+    - In the **Name** section, enter a meaningful application name that will be displayed to users of the app, such as *client-app*. 
+    - In the **Supported account types** section, select **Accounts in any organizational directory (Any Azure AD directory - Multitenant)**. 
 
-1. In the **Redirect URI** section, select `Web` and enter the URL `https://contoso5.portal.azure-api.net/signin`
+1. In the **Redirect URI** section, select `Web` and enter the URL `https://contoso5.portal.azure-api.net/signin`.
 
 1. Select **Register** to create the application. 
 
 1. On the app **Overview** page, find the **Application (client) ID** value and record it for later.
 
-Now, create a client secret for this application, for use in a subsequent step.
+Now, create a client secret for this application to use in a subsequent step.
 
 1. From the list of pages for your client app, select **Certificates & secrets**, and select **New client secret**.
 
 1. Under **Add a client secret**, provide a **Description**. Choose when the key should expire, and select **Add**.
 
-When the secret is created, make a note of the key value, for use in a subsequent step. 
+When the secret is created, note the key value for use in a subsequent step. 
 
 ## Grant permissions in Azure AD
 
 Now that you have registered two applications to represent the API and the Developer Console, you need to grant permissions to allow the client-app to call the backend-app.  
 
-1. Navigate to **App registrations**. 
+1. Go to the [Azure portal](https://portal.azure.com) to grant permissions to your client application. Search for and select **API registrations**.
 
-1. Select `client-app`, and in the list of pages for the app go to **API permissions**.
+1. Choose your client app. Then in the list of pages for the app, select **API permissions**.
 
 1. Select **Add a Permission**.
 
-1. Under **Select an API**, find and select `backend-app`.
+1. Under **Select an API**, select **My APIs**, and then find and select your backend-app.
 
-1. Under **Delegated Permissions**, select the appropriate permissions to `backend-app` then click on **Add permissions**.
+1. Under **Delegated Permissions**, select the appropriate permissions to your backend-app, then select **Add permissions**.
 
-1. Optionally, on the **API permissions** page, click on **Grant admin consent for <your-tenant-name>** in the bottom of the page to grant consent on behalf of all users in this directory. 
+1. Optionally, on the **API permissions** page, select **Grant admin consent for \<your-tenant-name>** to grant consent on behalf of all users in this directory. 
 
 ## Enable OAuth 2.0 user authorization in the Developer Console
 

articles/api-management/api-management-using-with-vnet.md

@@ -41,44 +41,47 @@ To perform the steps described in this article, you must have:
 
 ### Enable VNET connectivity using the Azure portal
 
-1. Navigate to your APIM instance in the [Azure portal](https://portal.azure.com/).
-2. Select **Virtual Network**.
-3. Configure the API Management instance to be deployed inside a Virtual network.
+1. Go to the [Azure portal](https://portal.azure.com) to find your API management instance. Search for and select **API Management services**.
+
+2. Choose your API Management instance.
+
+3. Select **Virtual network**.
+4. Configure the API Management instance to be deployed inside a Virtual network.
 
     ![Virtual network menu of API Management][api-management-using-vnet-menu]
-4. Select the desired access type:
+5. Select the desired access type:
+
+    * **Off**: This is the default. API Management is not deployed into a virtual network.
 
-   * **Off**: this is the default. API Management is not deployed into a virtual network.
+    * **External**: The API Management gateway and developer portal are accessible from the public internet via an external load balancer. The gateway can access resources within the virtual network.
 
-   * **External**: the API Management gateway and developer portal are accessible from the public internet via an external load balancer. The gateway can access resources within the virtual network.
+        ![Public peering][api-management-vnet-public]
 
-     ![Public peering][api-management-vnet-public]
+    * **Internal**: The API Management gateway and developer portal are accessible only from within the virtual network via an internal load balancer. The gateway can access resources within the virtual network.
 
-   * **Internal**: the API Management gateway and developer portal are accessible only from within the virtual network via an internal load balancer. The gateway can access resources within the virtual network.
+        ![Private peering][api-management-vnet-private]
 
-     ![Private peering][api-management-vnet-private]
+6. If you selected **External** or **Internal**, you will see a list of all regions where your API Management service is provisioned. Choose a **Location**, and then pick its **Virtual network** and **Subnet**. The virtual network list is populated with both classic and Resource Manager virtual networks available in your Azure subscriptions that are set up in the region you are configuring.
 
-     You will now see a list of all regions where your API Management service is provisioned. Select a VNET and subnet for every region. The list is populated with both classic and Resource Manager virtual networks available in your Azure subscriptions that are setup in the region you are configuring.
+    > [!IMPORTANT]
+    > When deploying an Azure API Management instance to a Resource Manager VNET, the service must be in a dedicated subnet that contains no other resources except for Azure API Management instances. If an attempt is made to deploy an Azure API Management instance to a Resource Manager VNET subnet that contains other resources, the deployment will fail.
 
-     > [!IMPORTANT]
-     > When deploying an Azure API Management instance to a Resource Manager VNET, the service must be in a dedicated subnet that contains no other resources except for Azure API Management instances. If an attempt is made to deploy an Azure API Management instance to a Resource Manager VNET subnet that contains other resources, the deployment will fail.
-     >
+    Then select **Apply**. The **Virtual network** page of your API Management instance is updated with your new virtual network and subnet choices.
 
-     ![Select VPN][api-management-setup-vpn-select]
+    ![Select VPN][api-management-setup-vpn-select]
 
-5. Click **Save** in the top navigation bar.
-6. Click **Apply network configuration** in the top navigation bar.
+7. In the top navigation bar, select **Save**, and then select **Apply network configuration**.
 
 > [!NOTE]
 > The VIP address of the API Management instance will change each time VNET is enabled or disabled.
-> The VIP address will also change when API Management is moved from **External** to **Internal** or vice-versa
+> The VIP address will also change when API Management is moved from **External** to **Internal**, or vice-versa.
 >
 
 > [!IMPORTANT]
 > If you remove API Management from a VNET or change the one it is deployed in, the previously used VNET can remain locked for up to six hours. During this period it will not be possible to delete the VNET or deploy a new resource to it. This behavior is true for clients using api-version 2018-01-01 and earlier. Clients using api-version 2019-01-01 and later, the VNET is freed up as soon as the associated API Management service is deleted.
 
 ## <a name="enable-vnet-powershell"> </a>Enable VNET connection using PowerShell cmdlets
-You can also enable VNET connectivity using the PowerShell cmdlets
+You can also enable VNET connectivity using the PowerShell cmdlets.
 
 * **Create an API Management service inside a VNET**: Use the cmdlet [New-AzApiManagement](/powershell/module/az.apimanagement/new-azapimanagement) to create an Azure API Management service inside a VNET.