complete merge

Author: b-ahibbard

articles/api-center/register-discover-mcp-server.md

@@ -65,6 +65,8 @@ You can use the following lightweight OpenAPI 3.0 API definition for your MCP se
 
 Set up the [API Center portal](set-up-api-center-portal.md) so that developers and other stakeholders in your organization can discover MCP servers in your API inventory. Users can browse and filter MCP servers in the inventory and view details such as the URL endpoint of the MCP server, if available in the MCP server's API definition. 
 
+For a live example of how Azure API Center can power your private, enterprise-ready MCP registry, visit [https://mcp.azure.com](https://mcp.azure.com).
+
 :::image type="content" source="media/register-discover-mcp-server/mcp-server-portal-small.png" lightbox="media/register-discover-mcp-server/mcp-server-portal.png" alt-text="Screenshot of MCP server in API Center portal.":::
 
 > [!NOTE]

articles/api-management/TOC.yml

@@ -680,7 +680,7 @@
       href: breaking-changes/git-configuration-retirement-march-2025.md
     - name: Direct management API retirement (March 2025)
       href: breaking-changes/direct-management-api-retirement-march-2025.md
-    - name: Managed certificates suspension (August 2025)
+    - name: Managed certificates suspension (August 2025 - March 2026)
       href: breaking-changes/managed-certificates-suspension-august-2025.md
     - name: ADAL-based identity provider retirement (September 2025)
       href: breaking-changes/identity-provider-adal-retirement-sep-2025.md
@@ -695,4 +695,4 @@
   - name: Stack Overflow
     href: https://stackoverflow.com/questions/tagged/azure-api-management
   - name: aka.ms/apimlove
-    href: https://aka.ms/apimlove
+    href: https://aka.ms/apimlove

articles/api-management/api-management-features.md

@@ -28,7 +28,7 @@ Each API Management [pricing tier](api-management-key-concepts.md#api-management
 | -------------------------------------------------------------------------------------------- | ----------- | --------- | --------- | --------- | ----- | -------- | ------- | ------- | 
 | Microsoft Entra integration<sup>1</sup>                                                             | No          | Yes       | No    | Yes      | Yes      | Yes      | Yes     | Yes |
 | Virtual network injection support                                                               | No          | Yes       | No    | No       | No       | No       | Yes    | Yes |
-| Private endpoint support for inbound connections                                                               | No          | Yes       | Yes    | No       | Yes      | Yes (preview)       | Yes  | No   |
+| Private endpoint support for inbound connections                                                               | No          | Yes       | Yes    | No       | Yes      | Yes     | Yes  | No   |
 | Outbound virtual network integration support                                                             | No          | No       | No    | No       | No       | Yes       | No    | Yes |
 | Multi-region deployment                                                                      | No          | No        | No    | No       | No       | No       | Yes     | No |
 | Availability zones                                                                           | No          | No        | No    | No       | No       | No       | Yes     | No  |
@@ -64,4 +64,4 @@ Each API Management [pricing tier](api-management-key-concepts.md#api-management
 * [Overview of Azure API Management](api-management-key-concepts.md)
 * [API Management limits](/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/api-management/toc.json&bc=/azure/api-management/breadcrumb/toc.json#api-management-limits)
 * [V2 tiers overview](v2-service-tiers-overview.md)
-* [API Management pricing](https://azure.microsoft.com/pricing/details/api-management/)
+* [API Management pricing](https://azure.microsoft.com/pricing/details/api-management/)

articles/api-management/breaking-changes/managed-certificates-suspension-august-2025.md

@@ -10,13 +10,15 @@ ms.date: 07/18/2025
 ms.author: danlep
 ---
 
-# Creation of managed certificates temporarily suspended for custom domains (August 2025)
+# Creation of managed certificates temporarily suspended for custom domains (August 2025 - March 2026)
 
 [!INCLUDE [premium-dev-standard-basic.md](../../../includes/api-management-availability-premium-dev-standard-basic.md)]
 
 Creation of Azure-managed certificates for custom domains in API Management will be temporarily turned off from August 15, 2025 to March 15, 2026. Existing managed certificates will be autorenewed and remain unaffected.
 
-In the classic service tiers, Azure API Management offers [free, managed TLS certificates for custom domains](../configure-custom-domain.md#domain-certificate-options) (preview), allowing customers to secure their endpoints without purchasing and managing their own certificates. Because of an industry-wide deprecation of CNAME-based Domain Control Validation (DCV), our Certificate Authority (CA), DigiCert, will migrate to a new validation platform to meet Multi-Perspective Issuance Corroboration (MPIC) requirements for issuing certificates. This migration requires us to temporarily suspend the creation of managed certificates for custom domains.
+In the classic service tiers, Azure API Management offers [free, managed TLS certificates for custom domains](../configure-custom-domain.md#domain-certificate-options) (preview), allowing customers to secure their endpoints without purchasing and managing their own certificates. Because of an industry-wide deprecation of CNAME-based Domain Control Validation (DCV), our Certificate Authority (CA), DigiCert, is moving to a new open-source software (OSS) domain control validation (DCV) platform that provides transparency and accountability increasing the trustworthiness of domain validation. As part of this transition, DigiCert will deprecate support for the legacy CNAME Delegation DCV workflow. This migration requires us to temporarily suspend the creation of managed certificates for custom domains.
+
+Note that this does not impact the standard CNAME DCV workflow (where DigiCert validates a random value in the CNAME record) which is still supported in the OSS validation system. This change affects several Azure services that currently rely on the soon-to-be deprecated CNAME for automated certificate issuance and renewal.
 
 ## Is my service affected by this?
 

articles/api-management/breaking-changes/overview.md

@@ -30,7 +30,7 @@ The following table lists all the upcoming breaking changes and feature retireme
 | [Git repository retirement][git2025] | March 15, 2025 |
 | [Direct management API retirement][mgmtapi2025] | March 15, 2025 |
 | [Workspaces preview breaking changes, part 2][workspaces2025march] | March 31, 2025 |
-| [Managed certificates suspension][managed-certificates-suspension-august-2025] | August 15, 2025 |
+| [Managed certificates suspension][managed-certificates-suspension-august-2025] | August 15, 2025 - March 15, 2026|
 | [ADAL-based Microsoft Entra ID identity provider retirement][msal2025] | September 30, 2025 |
 | [CAPTCHA endpoint update][captcha2025] | September 30, 2025 |
 | [Built-in analytics dashboard retirement][analytics2027] | March 15, 2027 |

articles/api-management/export-rest-mcp-server.md

@@ -37,6 +37,7 @@ In this article, you learn how to:
 + Make sure that your instance manages a REST API that you'd like to expose as an MCP server. To import a sample API, see [Import and publish your first API](import-and-publish.md).
     > [!NOTE]
     > Only HTTP APIs from API Management can be exposed as MCP servers.
++ If you’ve enabled diagnostic logging via Application Insights or Azure Monitor at the global scope (All APIs) for your API Management service instance, ensure that the “Number of payload bytes to log” setting for Frontend Response is set to 0. This prevents unintended logging of response bodies across all APIs and helps ensure proper functioning of MCP servers. To log payloads selectively for specific APIs, configure the setting individually at the API scope, allowing targeted control over response logging.
 + To test the MCP server, you can use Visual Studio Code with access to [GitHub Copilot](https://code.visualstudio.com/docs/copilot/setup).
 
 
@@ -62,6 +63,8 @@ The MCP server is created and the API operations are exposed as tools. The MCP s
 :::image type="content" source="media/export-rest-mcp-server/mcp-server-list.png" alt-text="Screenshot of the MCP server list in the portal.":::
 
 ## Configure policies for the MCP server
+> [!IMPORTANT]
+> Do not access the response body using `context.Response.Body` within MCP server policies. Doing so triggers response buffering, which interferes with the streaming behavior required by MCP servers and may cause them to malfunction.
 
 Configure one or more API Management [policies](api-management-howto-policies.md) to help manage the MCP server. The policies are applied to all API operations exposed as tools in the MCP server and can be used to control access, authentication, and other aspects of the tools.
 

articles/app-service/tutorial-ai-openai-chatbot-python.md

@@ -15,7 +15,7 @@ ms.collection: ce-skilling-ai-copilot
 
 # Tutorial: Build a chatbot with Azure App Service and Azure OpenAI (Flask)
 
-In this tutorial, you'll build an intelligent AI application by integrating Azure OpenAI with a Python web application and deploying it to Azure App Service. You'll create a Flask app that sends chat completion requests to a model in Azure OpneAI.
+In this tutorial, you'll build an intelligent AI application by integrating Azure OpenAI with a Python web application and deploying it to Azure App Service. You'll create a Flask app that sends chat completion requests to a model in Azure OpenAI.
 
 :::image type="content" source="media/tutorial-ai-openai-chatbot-python/chat-in-browser.png" alt-text="Screenshot showing chatbot running in Azure App Service.":::
 

articles/application-gateway/application-gateway-private-deployment.md

@@ -187,6 +187,10 @@ The resource tag is cosmetic, and serves to confirm that the gateway has been pr
 
 Application Gateway Subnet is the subnet within the Virtual Network where the Application Gateway Resources will be deployed. In the Frontend Private Ip configuration, is important that this subnet can reach privately the resources that want to connect to your exposed app or site.
 
+> [!NOTE]
+> As of May 5, 2025, new and existing deployments of Private Application Gateway require Subnet Delegation to `Microsoft.Network/applicationGateways`.
+> Please follow [these steps](/azure/virtual-network/manage-subnet-delegation?tabs=manage-subnet-delegation-portal) for configuring Subnet Delegation.
+
 ## Outbound Internet connectivity
 
 Application Gateway deployments that contain only a private frontend IP configuration (do not have a public IP frontend configuration associated to a request routing rule) aren't able to egress traffic destined to the Internet. This configuration affects communication to backend targets that are publicly accessible via the Internet.

articles/application-gateway/application-gateway-tls-version-retirement.md

@@ -5,7 +5,7 @@ services: application gateway
 author: jaesoni
 ms.service: azure-application-gateway
 ms.topic: concept-article
-ms.date: 07/18/2025
+ms.date: 07/29/2025
 ms.author: mbender
 ms.custom:
   - build-2025
@@ -101,6 +101,9 @@ To determine whether clients connecting to your Application Gateway resource are
 ### Logs
 You can also check the [Application Gateway Access logs](monitor-application-gateway-reference.md#access-log-category) to view this information in log format.
 
+> [!NOTE]
+> The metrics and logs for the V1 SKUs do not provide client TLS protocol information.
+
 ### Error information
 Once support for TLS versions 1.0 and 1.1 is discontinued, clients may encounter errors such as `curl: (35) error:0A000410:SSL routines::sslv3 alert handshake failure`. Depending on the browser being used, various messages indicating TLS handshake failures may be displayed.
 

articles/application-gateway/for-containers/understanding-pricing.md

@@ -182,14 +182,15 @@ Pricing calculation:
 
 ### Example 6 - Web Application Firewall
 
-This example assumes Application Gateway for Containers has load raising the number of capacity units and has a Web Application Firewall (WAF) policy reference to an Application Gateway for Containers' security policy. The WAF policy is configured with both DRS 2.1 and bot manager rulesets.
+This example assumes Application Gateway for Containers has load raising the number of capacity units and has a Web Application Firewall (WAF) policy reference to an Application Gateway for Containers' security policy. The WAF policy is configured with both DRS 2.1 and bot manager rulesets. This WAF policy also has four custom rules enabled which do not incur any additional charges
 
 *	1 Application Gateway for Containers resource
 *	1 frontend resource
 *	1 association resource
 *	1 security policy resources (non-billable)
 *	8 capacity units
 *	1 WAF policy running a default ruleset and a bot manager ruleset
+*	4 WAF custom rules
 *	10 million requests processed by WAF
 
 Pricing calculation:
@@ -204,14 +205,14 @@ Pricing calculation:
 
 ### Example 7 - Web Application Firewall - Multiple Policies
 
-This example assumes Application Gateway for Containers has load raising the number of capacity units and has three Web Application Firewall (WAF) policy reference to three corresponding Application Gateway for Containers' security policies. One policy is configured with both DRS 2.1 and bot manager rulesets, the other two policies only have DRS 2.1 ruleset.
+This example assumes Application Gateway for Containers has load raising the number of capacity units and has three Web Application Firewall (WAF) policy reference to three corresponding Application Gateway for Containers' security policies. One policy is configured with both DRS 2.1, bot manager rulesets and 3 custom rules, the other two policies only have DRS 2.1 ruleset and no custom rules.
 
 *	1 Application Gateway for Containers resource
 *	1 frontend resource
 *	1 association resource
 *	3 security policy resources (non-billable)
 *	8 Capacity Units
-*	1 WAF policy running a default ruleset and a bot manager ruleset
+*	1 WAF policy running a default ruleset, a bot manager ruleset and three custom rules
 *	10 million requests processed by WAF
 
 Pricing calculation: