Clarified supportability with PE configured

Author: dimitri-furman

articles/azure-sql/database/active-geo-replication-overview.md

@@ -199,6 +199,8 @@ To create a geo-secondary in a subscription different from the subscription of t
 > [!NOTE]
 > Cross-subscription geo-replication operations including setup and geo-failover are only supported using T-SQL commands.
 > 
+> Adding a geo-secondary using T-SQL is not supported when the primary and/or secondary servers have a private endpoint configured, and public network access is disabled. If private endpoint is configured but public network access is enabled, adding a geo-secondary when connected to the primary server from a public IP address is supported. Once a geo-secondary is added, public access can be disabled.
+> 
 > Creating a geo-secondary on a logical server in a different Azure tenant is not supported when [Azure Active Directory only](https://techcommunity.microsoft.com/t5/azure-sql/azure-active-directory-only-authentication-for-azure-sql/ba-p/2417673) authentication for Azure SQL is active (enabled) on either primary or secondary logical server.
 
 ## <a name="keeping-credentials-and-firewall-rules-in-sync"></a> Keep credentials and firewall rules in sync

articles/azure-sql/database/database-copy.md

@@ -88,12 +88,9 @@ Start copying the source database with the [CREATE DATABASE ... AS COPY OF](/sql
 
 > [!NOTE]
 > Terminating the T-SQL statement does not terminate the database copy operation. To terminate the operation, drop the target database.
-> [!NOTE]
+>
 > Database copy is not supported when the source and/or destination servers have a private endpoint configured and public network access is disabled. 
-If private endpoint is configured but public network access is allowed, initiating database copy when connected to the destination server from a public IP address will succeed.
-To determine the source IP address of current connection, execute `SELECT client_net_address FROM sys.dm_exec_connections WHERE session_id = @@SPID;`
- 
-
+If private endpoint is configured but public network access is enabled, initiating database copy when connected to the destination server from a public IP address is supported. Once the copy operation completes, public access can be disabled.
 
 > [!IMPORTANT]
 > Selecting backup storage redundancy when using T-SQL CREATE DATABASE ... AS COPY OF command is not supported yet. 
@@ -136,7 +133,7 @@ CREATE DATABASE Database2 AS COPY OF server1.Database1;
 ```
 
 > [!IMPORTANT]
-> Both servers' firewalls must be configured to allow inbound connection from the IP of the client issuing the T-SQL CREATE DATABASE ... AS COPY OF command.
+> Both servers' firewalls must be configured to allow inbound connection from the IP of the client issuing the T-SQL CREATE DATABASE ... AS COPY OF command. To determine the source IP address of current connection, execute `SELECT client_net_address FROM sys.dm_exec_connections WHERE session_id = @@SPID;`
 
 ### Copy to a different subscription