Merge pull request #266660 from dcurwin/wi-212966-recommendations-alerts-h3-feb19-2024

Replace recommendation and alerts tables with H3

Author: v-ccolin

articles/container-registry/allow-access-trusted-services.md

@@ -16,8 +16,8 @@ Use the Azure Cloud Shell or a local installation of the Azure CLI to run the co
 
 ## Limitations
 
-* Certain registry access scenarios with trusted services require a [managed identity for Azure resources](../active-directory/managed-identities-azure-resources/overview.md). Except where noted that a user-assigned managed identity is supported, only a system-assigned identity may be used. 
-* Allowing trusted services doesn't apply to a container registry configured with a [service endpoint](container-registry-vnet.md). The feature only affects registries that are restricted with a [private endpoint](container-registry-private-link.md) or that have [public IP access rules](container-registry-access-selected-networks.md) applied. 
+* Certain registry access scenarios with trusted services require a [managed identity for Azure resources](../active-directory/managed-identities-azure-resources/overview.md). Except where noted that a user-assigned managed identity is supported, only a system-assigned identity may be used.
+* Allowing trusted services doesn't apply to a container registry configured with a [service endpoint](container-registry-vnet.md). The feature only affects registries that are restricted with a [private endpoint](container-registry-private-link.md) or that have [public IP access rules](container-registry-access-selected-networks.md) applied.
 
 ## About trusted services
 
@@ -26,17 +26,17 @@ Azure Container Registry has a layered security model, supporting multiple netwo
 * [Private endpoint with Azure Private Link](container-registry-private-link.md). When configured, a registry's private endpoint is accessible only to resources within the virtual network, using private IP addresses.  
 * [Registry firewall rules](container-registry-access-selected-networks.md), which allow access to the registry's public endpoint only from specific public IP addresses or address ranges. You can also configure the firewall to block all access to the public endpoint when using private endpoints.
 
-When deployed in a virtual network or configured with firewall rules, a registry denies access to users or services from outside those sources. 
+When deployed in a virtual network or configured with firewall rules, a registry denies access to users or services from outside those sources.
 
-Several multi-tenant Azure services operate from networks that can't be included in these registry network settings, preventing them from performing operations such as pull or push images to the registry. By designating certain service instances as "trusted", a registry owner can allow select Azure resources to securely bypass the registry's network settings to perform registry operations. 
+Several multi-tenant Azure services operate from networks that can't be included in these registry network settings, preventing them from performing operations such as pull or push images to the registry. By designating certain service instances as "trusted", a registry owner can allow select Azure resources to securely bypass the registry's network settings to perform registry operations.
 
 ### Trusted services
 
 Instances of the following services can access a network-restricted container registry if the registry's **allow trusted services** setting is enabled (the default). More services will be added over time.
 
 Where indicated, access by the trusted service requires additional configuration of a managed identity in a service instance, assignment of an [RBAC role](container-registry-roles.md), and authentication with the registry. For example steps, see [Trusted services workflow](#trusted-services-workflow), later in this article.
 
-|Trusted service  |Supported usage scenarios  | Configure managed identity with RBAC role
+|Trusted service  |Supported usage scenarios  | Configure managed identity with RBAC role |
 |---------|---------|------|
 | Azure Container Instances | [Deploy to Azure Container Instances from Azure Container Registry using a managed identity](../container-instances/using-azure-container-registry-mi.md) | Yes, either system-assigned or user-assigned identity |
 | Microsoft Defender for Cloud | Vulnerability scanning by [Microsoft Defender for container registries](scan-images-defender.md) | No |
@@ -45,7 +45,7 @@ Where indicated, access by the trusted service requires additional configuration
 |Azure Container Registry | [Import images](container-registry-import-images.md) to or from a network-restricted Azure container registry | No |
 
 > [!NOTE]
-> Curently, enabling the allow trusted services setting doesn't apply to App Service.
+> Currently, enabling the allow trusted services setting doesn't apply to App Service.
 
 ## Allow trusted services - CLI
 
@@ -65,15 +65,15 @@ az acr update --name myregistry --allow-trusted-services true
 
 ## Allow trusted services - portal
 
-By default, the allow trusted services setting is enabled in a new Azure container registry. 
+By default, the allow trusted services setting is enabled in a new Azure container registry.
 
 To disable or re-enable the setting in the portal:
 
 1. In the portal, navigate to your container registry.
-1. Under **Settings**, select **Networking**. 
+1. Under **Settings**, select **Networking**.
 1. In **Allow public network access**, select **Selected networks** or **Disabled**.
 1. Do one of the following:
-    * To disable access by trusted services, under **Firewall exception**, uncheck **Allow trusted Microsoft services to access this container registry**. 
+    * To disable access by trusted services, under **Firewall exception**, uncheck **Allow trusted Microsoft services to access this container registry**.
     * To allow trusted services, under **Firewall exception**, check **Allow trusted Microsoft services to access this container registry**.
 1. Select **Save**.
 
@@ -84,21 +84,21 @@ Here's a typical workflow to enable an instance of a trusted service to access a
 1. Enable a managed identity in an instance of one of the [trusted services](#trusted-services) for Azure Container Registry.
 1. Assign the identity an [Azure role](container-registry-roles.md) to your registry. For example, assign the ACRPull role to pull container images.
 1. In the network-restricted registry, configure the setting to allow access by trusted services.
-1. Use the identity's credentials to authenticate with the network-restricted registry. 
+1. Use the identity's credentials to authenticate with the network-restricted registry.
 1. Pull images from the registry, or perform other operations allowed by the role.
 
 ### Example: ACR Tasks
 
 The following example demonstrates using ACR Tasks as a trusted service. See [Cross-registry authentication in an ACR task using an Azure-managed identity](container-registry-tasks-cross-registry-authentication.md) for task details.
 
 1. Create or update an Azure container registry.
-[Create](container-registry-tasks-cross-registry-authentication.md#option-2-create-task-with-system-assigned-identity) an ACR task. 
+[Create](container-registry-tasks-cross-registry-authentication.md#option-2-create-task-with-system-assigned-identity) an ACR task.
     * Enable a system-assigned managed identity when creating the task.
     * Disable default auth mode (`--auth-mode None`) of the task.
 1. Assign the task identity [an Azure role to access the registry](container-registry-tasks-authentication-managed-identity.md#3-grant-the-identity-permissions-to-access-other-azure-resources). For example, assign the AcrPush role, which has permissions to pull and push images.
-2. [Add managed identity credentials for the registry](container-registry-tasks-authentication-managed-identity.md#4-optional-add-credentials-to-the-task) to the task.
-3. To confirm that the task bypasses network restrictions, [disable public access](container-registry-access-selected-networks.md#disable-public-network-access) in the registry.
-4. Run the task. If the registry and task are configured properly, the task runs successfully, because the registry allows access.
+1. [Add managed identity credentials for the registry](container-registry-tasks-authentication-managed-identity.md#4-optional-add-credentials-to-the-task) to the task.
+1. To confirm that the task bypasses network restrictions, [disable public access](container-registry-access-selected-networks.md#disable-public-network-access) in the registry.
+1. Run the task. If the registry and task are configured properly, the task runs successfully, because the registry allows access.
 
 To test disabling access by trusted services: