Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into waf-jsc

Author: halkazwini

articles/active-directory-b2c/string-transformations.md

@@ -446,7 +446,7 @@ The following example generates an error message when an account is already in t
 </Localization>
 ```
 
-The claims transformation creates a response message based on the localized string. The message contains the user's email address embedded into the localized sting *ResponseMessage_EmailExists*.
+The claims transformation creates a response message based on the localized string. The message contains the user's email address embedded into the localized string *ResponseMessage_EmailExists*.
 
 ```xml
 <ClaimsTransformation Id="SetResponseMessageForEmailAlreadyExists" TransformationMethod="FormatLocalizedString">

articles/api-management/applications.md

@@ -1,5 +1,5 @@
 ---
-title: Protect Access to Product APIs with Microsoft Entra Application - Azure API Management
+title: Securely Access Products and APIs - Microsoft Entra Applications - Azure API Management
 titleSuffix: Azure API Management
 description: Configure OAuth 2.0 access to product APIs in Azure API Management with Microsoft Entra ID applications.
 services: api-management
@@ -11,7 +11,7 @@ ms.date: 05/19/2025
 ms.author: danlep
 ms.custom: 
 ---
-# Secure product API access with Microsoft Entra applications
+# Securely access products and APIs with Microsoft Entra applications
 
 [!INCLUDE [api-management-availability-premium-dev-standard-basic](../../includes/api-management-availability-premium-dev-standard-basic.md)]
 
@@ -64,14 +64,14 @@ The following example uses the **Starter** product, but choose any published pro
 1. In the left menu, under **APIs**, select **Products**.
 1. Choose the product that you want to configure, such as the **Starter** product.
 1. In the left menu, under **Product**, select **Properties**.
-1. Enable the **Application based access** setting.
-1. Optionally, enable the **Requires subscription** setting. If you enable both application based access and a subscription requirement, the API Management gateway can accept either OAuth 2.0 authorization or a subscription key for access to the product's APIs.
+1. In the **Application based access** section, enable the **OAuth 2.0 token (most secure)** setting.
+1. Optionally, enable the **Subscription key** setting. If you enable both application based access and a subscription requirement, the API Management gateway can accept either an OAuth 2.0 token or a subscription key for access to the product's APIs.
 1. Select **Save**.
 
 :::image type="content" source="media/applications/enable-application-based-access.png" alt-text="Screenshot of enabling application based access in the portal.":::
 
 > [!TIP]
-> You can also enable the **Application based access** setting when creating a new product.
+> You can also enable the **OAuth 2.0 token** setting when creating a new product.
 
  Enabling application based access creates a backend enterprise application in Microsoft Entra ID to represent the product. The backend application ID is displayed in the product's **Properties** page.
 

articles/api-management/media/applications/enable-application-based-access.png

@@ -116,7 +116,7 @@ Choose one of the following methods to import your API to API Management:
     |---------|---------| 
     |`HEAD /`     | Enables the client to exchange cross-site request forgery (CSRF) tokens with the SAP server when required.<br/><br/>SAP also allows CSRF token exchange via the GET verb.<br/><br/> CSRF token exchange isn’t covered in this article. See an [example API Management policy snippet](https://github.com/Azure/api-management-policy-snippets/blob/master/examples/Get%20X-CSRF%20token%20from%20SAP%20gateway%20using%20send%20request.policy.xml) to broker token exchange.     |
 
-    :::image type="content" source="media/sap-api/head-root-operation.png" alt-text="Sceenshot that shows the operation for fetching tokens.":::
+    :::image type="content" source="media/sap-api/head-root-operation.png" alt-text="Screenshot that shows the operation for fetching tokens.":::
 
 - `GET /`
 

articles/api-management/media/applications/product-application-settings.png

@@ -95,6 +95,8 @@ If the secret version isn't specified in the reference, the app uses the latest
 
 The delay is because App Service caches the values of the Key Vault references and refetches them every 24 hours. Any configuration change to the app causes an app restart and an immediate refetch of all referenced secrets.
 
+To force resolution of your app's Key Vault references, make an authenticated POST request to the API endpoint `https://management.azure.com/[Resource ID]/config/configreferences/appsettings/refresh?api-version=2022-03-01`.
+
 ## <a name = "source-app-settings-from-key-vault"></a> Understand source app settings from Key Vault
 
 To use a Key Vault reference, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required.

articles/api-management/sap-api.md

@@ -15,7 +15,7 @@ For more information about containerized applications in a serverless environmen
 ## Prerequisites
 
 - An [Azure account](https://azure.microsoft.com/free/?utm_source=campaign&utm_campaign=vscode-tutorial-docker-extension&mktingSource=vscode-tutorial-docker-extension)
-- An [Azure container registry](/azure/container-registry/container-registry-get-started-portal)
+- An [Azure Container Registry](/azure/container-registry/container-registry-get-started-portal)
 - [Azure CLI](/cli/azure/install-azure-cli)
 - [Docker](https://www.docker.com/community-edition)
 
@@ -91,7 +91,7 @@ Sign in to the [Azure portal](https://portal.azure.com).
 
 1. At the top of the page, select the **Container** tab.
 
-1. In the **Container** tab, for **Image Source**, select **Azure Container Registry**. Under **Azure container registry options**, set the following values:
+1. In the **Container** tab, for **Image Source**, select **Azure Container Registry**. Under **Azure Container Registry options**, set the following values:
 
    - **Registry**: Select your Azure Container Registry.
    - **Image**: Select **dotnetcore-docs-hello-world-linux**.

articles/app-service/app-service-key-vault-references.md

@@ -27,7 +27,7 @@ This quickstart uses Azure Container Registry as the registry. You can use other
 Create a container registry by following the instructions in [Quickstart: Create a private container registry using the Azure portal](/azure/container-registry/container-registry-get-started-portal).
 
 > [!IMPORTANT]
-> Be sure to set the **Admin User** option to **Enable** when you create the Azure container registry. You can also set it from the **Access keys** section of your registry page in the Azure portal. This setting is required for App Service access. For managed identity, see [Deploy from ACR tutorial](../../tutorial-custom-container.md?pivots=container-linux#vi-configure-the-web-app).
+> Be sure to set the **Admin User** option to **Enable** when you create the Azure Container Registry. You can also set it from the **Access keys** section of your registry page in the Azure portal. This setting is required for App Service access. For managed identity, see [Deploy from ACR tutorial](../../tutorial-custom-container.md?pivots=container-linux#vi-configure-the-web-app).
 
 ## Sign in
 
@@ -132,7 +132,7 @@ docker --version
 1. Make sure the image tag begins with `<acr-name>.azurecr.io` and press **Enter**.
 1. When Visual Studio Code finishes pushing the image to your container registry, select **Refresh** at the top of the **REGISTRIES** explorer and verify that the image is pushed successfully.
 
-    :::image type="content" source="../../media/quickstart-docker/image-in-registry.png" alt-text="Screenshot shows the image deployed to Azure container registry.":::
+    :::image type="content" source="../../media/quickstart-docker/image-in-registry.png" alt-text="Screenshot shows the image deployed to Azure Container Registry.":::
 
 ## Deploy to App Service
 

articles/app-service/includes/quickstart-custom-container/quickstart-custom-container-linux-azure-portal-pivot.md

@@ -14,7 +14,7 @@ This quickstart shows you how to deploy an ASP.NET app in a Windows image from A
 ## Prerequisites
 
 - An [Azure account](https://azure.microsoft.com/free/?utm_source=campaign&utm_campaign=vscode-tutorial-docker-extension&mktingSource=vscode-tutorial-docker-extension)
-- An [Azure container registry](/azure/container-registry/container-registry-get-started-portal)
+- An [Azure Container Registry](/azure/container-registry/container-registry-get-started-portal)
 - [Azure CLI](/cli/azure/install-azure-cli)
 - [Install Docker for Windows](https://docs.docker.com/docker-for-windows/install/)
 - [Switch Docker to run Windows containers](/virtualization/windowscontainers/quick-start/quick-start-windows-10)
@@ -94,7 +94,7 @@ Sign in to the [Azure portal](https://portal.azure.com).
 
 1. At the top of the page, select the **Container** tab.
 
-1. In the **Container** tab, for **Image Source**, select **Azure Container Registry** . Under **Azure container registry options**, set the following values:
+1. In the **Container** tab, for **Image Source**, select **Azure Container Registry** . Under **Azure Container Registry options**, set the following values:
 
    - **Registry**: Select your Azure Container Registry.
    - **Image**: Select **dotnetcore-docs-hello-world-linux**.
@@ -137,7 +137,7 @@ The App Service app pulls from the container registry each time it starts. If yo
 - [Secure with custom domain and certificate](../../tutorial-secure-domain-certificate.md)
 - [Integrate your app with an Azure virtual network](../../overview-vnet-integration.md)
 - [Use Private Endpoints for App Service apps](../../networking/private-endpoint.md)
-- [Use Azure container registry with Private Link](/azure/container-registry/container-registry-private-link)
+- [Use Azure Container Registry with Private Link](/azure/container-registry/container-registry-private-link)
 - [Migrate to Windows container in Azure](../../tutorial-custom-container.md)
 - [Deploy a container with Azure Pipelines](../../deploy-container-azure-pipelines.md)
 - [Deploy a container with GitHub Actions](../../deploy-container-github-action.md)

articles/app-service/includes/quickstart-custom-container/quickstart-custom-container-linux-visual-studio-code-pivot.md

@@ -18,3 +18,29 @@ No. App Service routes internet requests only to the main container. For code-ba
 
 For more information on configuring `IsMain`, see [Microsoft.Web sites/sitecontainers](/azure/templates/microsoft.web/sites/sitecontainers).
 
+### How do I use volume mounts?
+
+The Volume mounts feature enables you to share non-persistent files and directories between containers within your Web App.
+
+:::image type="content" source="../../media/tutorial-custom-container-sidecar/configure-volume-mounts.png" alt-text="Screenshot showing a volume mount configuration for a sidecar container.":::
+
+**Volume sub path:** This is a logical directory path that is automatically created, and is not referenced within the container. Containers that are configured with the same volume sub path can share files and directories with each other.
+
+**Container mount path:** This corresponds to a directory path that you reference within the container. The container mount path is mapped to the volume sub path.
+
+For example, suppose the following volume mounts are configured:
+
+| Sidecar name | Volume sub path | Container mount path | Read-only |
+| ------------ | --------------- | -------------------- | --------- |
+| Container1 | /directory1/directory2 | /container1Vol | False |
+| Container2 | /directory1/directory2 | /container2Vol | True |
+| Container3 | /directory1/directory2/directory3 | /container3Vol | False |
+| Container4 | /directory4 | /container1Vol | False |
+
+Based on these settings, the following conditions apply:
+-	If Container1 creates **/container1Vol/myfile.txt**, Container2 can read the file via **/container2Vol/myfile.txt**.
+-	If Container1 creates **/container1Vol/directory3/myfile.txt**, Container2 can read the file via **/container2Vol/directory3/myfile.txt**, and Container3 can read and write to the file via **/container3Vol/myfile.txt**.
+-	Container4 does not share a volume mount in common with any of the other containers.
+
+> [!Note]
+> For code-based Linux apps, the built-in Linux container cannot use volume mounts.