Merge branch 'main' into release-preview-sentinel-lake

Author: v-alje

articles/api-management/inject-vnet-v2.md

@@ -54,14 +54,7 @@ If you want to enable *public* inbound access to an API Management instance in t
 * Minimum: /27 (32 addresses)
 * Recommended: /24 (256 addresses) - to accommodate scaling of API Management instance
 
-### Network security group
-
-A network security group must be associated with the subnet. 
-
-* Configure an outbound NSG rule to allow access to Azure Storage on port 443. 
-* Configure other rules to meet your organization's network access requirements. 
-
-To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
+[!INCLUDE [api-management-virtual-network-v2-nsg-rules](../../includes/api-management-virtual-network-v2-nsg-rules.md)]
 
 ### Subnet delegation
 

articles/api-management/integrate-vnet-outbound.md

@@ -5,7 +5,7 @@ author: dlepow
 ms.author: danlep
 ms.service: azure-api-management
 ms.topic: how-to 
-ms.date: 04/03/2025
+ms.date: 06/16/2025
 ---
 
 # Integrate an Azure API Management instance with a private virtual network for outbound connections 
@@ -46,9 +46,7 @@ If you want to inject a Premium v2 (preview) API Management instance into a virt
 * Minimum: /27 (32 addresses)
 * Recommended: /24 (256 addresses) - to accommodate scaling of API Management instance
 
-### Network security group
-
-A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. Network security groups (NSG) can also be used to block outbound traffic to the internet and access only resources in your virtual network. To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
+[!INCLUDE [api-management-virtual-network-v2-nsg-rules](../../includes/api-management-virtual-network-v2-nsg-rules.md)]
 
 ### Subnet delegation
 

articles/app-service/quickstart-arm-template.md

@@ -25,8 +25,6 @@ To complete this quickstart, you need an Azure account with an active subscripti
 
 If you're familiar with using ARM templates, you can skip to the end by selecting this :::image type="content" source="~/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Button to deploy the Resource Manager template to Azure." border="false" link="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.web%2Fapp-service-docs-windows%2Fazuredeploy.json"::: button. This button opens the ARM template in the Azure portal. 
 
-:::image type="content" source="media/quickstart-arm/create-windows-code.png" alt-text="Screenshot of the ARM Template in the Azure portal.":::
-
 In the Azure portal, select **Create new** to create a new Resource Group and then select the **Review + create** button to deploy the app.
 
 ::: zone-end
@@ -39,8 +37,6 @@ To complete this quickstart, you need an Azure account with an active subscripti
 
 If you're familiar with using ARM templates, you can skip to the end by selecting this :::image type="content" source="~/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Button to deploy the Resource Manager template to Azure." border="false" link="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.web%2Fapp-service-docs-linux%2Fazuredeploy.json"::: button. This button opens the ARM template in the Azure portal. 
 
-:::image type="content" source="media/quickstart-arm/create-linux.png" alt-text="Screenshot of the ARM Template in the Azure portal.":::
-
 In the Azure portal, select **Create new** to create a new Resource Group and then select the **Review + create** button to deploy the app.
 ::: zone-end
 ::: zone pivot="platform-windows-container"
@@ -50,8 +46,6 @@ Get started with [Azure App Service](overview.md) by deploying an app to the clo
 
 If you're familiar with using ARM templates, you can skip to the end by selecting this :::image type="content" source="~/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Button to deploy the Resource Manager template to Azure." border="false" link="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.web%2Fapp-service-docs-windows-container%2Fazuredeploy.json"::: button. This button opens the ARM template in the Azure portal. 
 
-:::image type="content" source="media/quickstart-arm/create-windows-container.png" alt-text="Screenshot of the ARM Template in the Azure portal.":::
-
 In the Azure portal, select **Create new** to create a new Resource Group and then select the **Review + create** button to deploy the app.
 ::: zone-end
 
@@ -97,7 +91,7 @@ This template contains several parameters that are predefined for your convenien
 | appServicePlanName | string  | `webAppPlan-<uniqueString>` | App Service Plan name based on a [unique string value](../azure-resource-manager/templates/template-functions-string.md#uniquestring) |
 | location   | string  | `[resourceGroup().location]` | [App region](../azure-resource-manager/templates/template-functions-resource.md#resourcegroup)
 | sku        | string  | `F1`                         | Instance size (F1 = Free Tier) |
-| linuxFxVersion   | string  | `DOTNETCORE|3.0`        | "Programming language stack &#124; Version" |
+| linuxFxVersion   | string  | `DOTNETCORE|9.0`        | "Programming language stack &#124; Version" |
 | repoUrl    | string  | ` `                          | External Git repo (optional) |
 
 ---
@@ -162,11 +156,11 @@ az webapp config show --resource-group myResourceGroup --name <app-name> --query
 
 | Language    | Example                                                                            |
 |-------------|------------------------------------------------------------------------------------|
-| **.NET**    | linuxFxVersion="DOTNETCORE&#124;3.0"                                               |
-| **Java**    | linuxFxVersion="JAVA&#124;21-java21 TOMCAT&#124;10.1-java21 JBOSSEAP&#124;8-java17"|
-| **Node.js** | linuxFxVersion="NODE&#124;10.15"                                                   |
-| **Python**  | linuxFxVersion="PYTHON&#124;3.7"                                                   |
-| **PHP**     | linuxFxVersion="PHP&#124;7.4"                                                      |
+| **.NET**    | linuxFxVersion="DOTNETCORE&#124;9.0"                                               |
+| **Java**    | linuxFxVersion="JAVA&#124;21-java21 TOMCAT&#124;11.0-java21 JBOSSEAP&#124;8-java17"|
+| **Node.js** | linuxFxVersion="NODE&#124;22-lts                                                   |
+| **Python**  | linuxFxVersion="PYTHON&#124;3.13"                                                   |
+| **PHP**     | linuxFxVersion="PHP&#124;8.4"                                                      |
 
 ---
 ::: zone-end
@@ -220,3 +214,4 @@ When no longer needed, [delete the resource group](../azure-resource-manager/man
 
 > [!div class="nextstepaction"]
 > [Secure with custom domain and certificate](tutorial-secure-domain-certificate.md)
+

articles/app-service/tutorial-php-mysql-app.md

@@ -239,7 +239,7 @@ The creation wizard generated the connectivity variables for you already as [app
         A **Create connection** dialog is opened on top of the edit dialog.
     :::column-end:::
     :::column:::
-        :::image type="content" source="./media/tutorial-php-mysql-app/azure-portal-secure-connection-secrets-5.png" alt-text="A screenshot showing how to edit a service connector with a key vault connection." lightbox="./media/tutorial-php-mysql-app/azure-portal-secure-connection-secrets-5.png":::
+        :::image type="content" source="./media/tutorial-php-mysql-app/azure-portal-secure-connection-secrets-5.png" alt-text="A screenshot that shows how to edit a service connector with a key vault connection." lightbox="./media/tutorial-php-mysql-app/azure-portal-secure-connection-secrets-5.png":::
     :::column-end:::
 :::row-end:::
 :::row:::

articles/azure-resource-manager/managed-applications/publish-bicep-definition.md

@@ -33,7 +33,7 @@ To complete the tasks in this article, you need the following items:
 ## Create a Bicep file
 
 > [!Note]
-> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
+> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
 
 Every managed application definition includes a file named _mainTemplate.json_. The template defines the Azure resources to deploy and is no different than a regular ARM template. You can develop the template using Bicep and then convert the Bicep file to JSON.
 

articles/azure-resource-manager/managed-applications/publish-service-catalog-app.md

@@ -34,7 +34,7 @@ To complete this quickstart, you need the following items:
 ## Create the ARM template
 
 > [!Note]
-> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
+> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
 
 Every managed application definition includes a file named _mainTemplate.json_. The template defines the Azure resources to deploy and is no different than a regular ARM template.
 

articles/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage.md

@@ -35,7 +35,7 @@ To complete this quickstart, you need the following items:
 ## Create the ARM template
 
 > [!Note]
-> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
+> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
 
 Every managed application definition includes a file named _mainTemplate.json_. The template defines the Azure resources to deploy and is no different than a regular ARM template.
 

articles/azure-resource-manager/managed-applications/reference-main-template-artifact.md

@@ -12,7 +12,7 @@ This article is a reference for a _mainTemplate.json_ artifact in Azure Managed
 ## Deployment template
 
 > [!Note]
-> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
+> Azure Managed Applications only supports ARM templates using languageVersion 1.0 and **does not** support languageVersion 2.0. Refer to the [ARM Template documentation](/azure/azure-resource-manager/templates/syntax#languageversion-20) to see what features will automatically enable version 2.0.
 
 The following JSON shows an example of _mainTemplate.json_ file for Azure Managed Applications:
 

articles/backup/backup-create-recovery-services-vault.md

@@ -2,7 +2,7 @@
 title: Create and configure Recovery Services vaults
 description: Learn how to create and configure Recovery Services vaults, and how to restore in a secondary region by using Cross Region Restore.
 ms.topic: how-to
-ms.date: 06/23/2025
+ms.date: 06/30/2025
 ms.custom: references_regions, engagement-fy23
 author: jyothisuri
 ms.author: jsuri
@@ -83,6 +83,23 @@ For more information about backup and restore with Cross Region Restore, see the
 - [Cross Region Restore for SAP HANA databases](sap-hana-db-restore.md#cross-region-restore)
 - [Cross Region Restore for MARS (Preview)](about-restore-microsoft-azure-recovery-services.md#cross-region-restore)
 
+## Set Cross Subscription Restore
+
+Cross Subscription Restore allows you to restore data to a different subscription within the same tenant as the source subscription (as per the Azure RBAC capabilities) from restore points. 
+
+>[!Note]
+>Cross Subscription Restore is currently supported for Azure VM, SQL Server in Azure VM, SAP ASE and SAP HANA in Azure VM, and Azure Files.
+
+To configure Cross Subscription Restore for the vault, follow these steps:
+
+1. In the Azure portal, go to your **Recovery Services vault**.
+1. On the **Recovery Services vault** pane, select **Settings** > **Properties**.
+1. On the **Properties** pane, under **Cross Subscription Restore**, select **Update**.
+
+   :::image type="content" source="./media/backup-create-rs-vault/configure-cross-region-restore.png" alt-text="Screenshot shows how to enable Cross subscription restore for a vault." lightbox="./media/backup-create-rs-vault/configure-cross-region-restore.png" :::
+
+1. On the **Cross Subscription Restore** pane, select **Enable Cross Subscription Restore** > **Update**.
+
 ## Set encryption settings
 
 By default, the data in the Recovery Services vault is encrypted through platform-managed keys. You don't need to take any explicit actions to enable this encryption. It applies to all workloads that are backed up to your Recovery Services vault. 
@@ -136,7 +153,7 @@ If you need to keep the current protected data in the GRS vault and continue the
 
 - For an Azure VM, you can [stop protection with retained data](backup-azure-manage-vms.md#stop-protecting-a-vm) for the VM in the GRS vault, move the VM to another resource group, and then help protect the VM in the LRS vault. For information about moving a VM to another resource group, see the [guidance and limitations](../azure-resource-manager/management/move-limitations/virtual-machines-move-limitations.md).
 
-  You can add a VM to only one vault at a time. However, the VM in the new resource group can be added to the LRS vault because it's considered a different VM. Be aware that:
+  You can add a VM to only one vault at a time. However, the VM in the new resource group can be added to the LRS vault because it's considered as a different VM. Be aware that:
 
   - The Azure Backup service will retain the recovery points that have been backed up on the GRS vault.
   - You'll need to pay to keep the recovery points in the GRS vault. See [Azure Backup pricing](azure-backup-pricing.md) for details.