Merge pull request #223437 from duongau/patch-9

Azure Front Door - update domain fronting

Author: prmerger-automator[bot]

articles/frontdoor/front-door-faq.yml

@@ -184,14 +184,16 @@ sections:
       - question: | 
           How does Front Door handle ‘domain fronting’ behavior? 
         answer: |
-          Beginning November 8, 2022, all the newly created Azure Front Door, Azure Front Door (classic)  or Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibits domain fronting behavior. Requests where Host header in HTTP/HTTPS requests doesn't match the original TLS SNI extension used during the TLS negotiation, will be blocked.
+          Beginning November 8, 2022, all newly created Azure Front Door (Standard, Premium and Classic tier) or Azure CDN Standard from Microsoft (classic) resources will block any HTTP requests that exhibits domain fronting behavior. Requests where the host header in HTTP/HTTPS requests that doesn't match the original TLS SNI extension used during the TLS negotiation, will be blocked.
           
-          If you wish to block domain fronting for any existing Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources or for new Azure Front Door Standard and Premium, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources, please create a support request and provide your subscription and 
-          resource information. Upon enabling of blocking domain fronting behavior, Azure Front Door and Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibit this behavior.
+          If you wish to block domain fronting for an existing Azure Front Door or Azure CDN Standard from Microsoft (classic) resources, create a support request and provide your subscription and 
+          resource information. Upon enabling the blocking of domain fronting, Azure Front Door and Azure CDN Standard from Microsoft (classic) resources will block any HTTP/HTTPS requests that exhibit this behavior.
          
-          When Front Door blocks a request due to this mismatch: 
-          The client will receive a HTTP “421 Misdirected Request” error code response 
-          Front Door will log the block in its diagnostic logs under the “Error Info” property with the value “SSLMismatchedSNI” 
+          When Front Door blocks a request due to a mismatch: 
+          - The client will receive a HTTP "421 Misdirected Request" error code response. 
+          - Azure Front Door will log the block in the diagnostic logs under the "Error Info" property with the value **SSLMismatchedSNI**.
+          
+          For more information about domain fronting, see [Securing our approach to domain fronting within Azure](https://www.microsoft.com/en-us/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure/).
  
       - question: |
           What TLS versions are supported by Azure Front Door?