Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into oauthnew

Author: Harikrishnan-M-B

.openpublishing.redirection.json

@@ -227,7 +227,7 @@
     },
     {
       "source_path": "articles/databox-online/azure-stack-edge-2301-release-notes.md",
-      "redirect_url": "/previous-versions/azure/databox-online/azure-stack-edge-2301-release-notes",
+      "redirect_url": "/previous-versions/azure/databox-online/azure-stack-edge-2301-release-notes"
     },
     {
       "source_path": "articles/network-watcher/nsg-flow-logs-rest.md",
@@ -2393,7 +2393,7 @@
       "source_path_from_root": "/articles/app-service/manage-disaster-recovery.md",
       "redirect_url": "/azure/architecture/web-apps/guides/multi-region-app-service/multi-region-app-service",
       "redirect_document_id": false
-    },       
+    },
     {
       "source_path_from_root": "/articles/public-multi-access-edge-compute-mec/tutorial-create-vm-using-python-sdk.md",
       "redirect_url": "/previous-versions/azure/public-multi-access-edge-compute-mec/tutorial-create-vm-using-python-sdk",
@@ -6875,49 +6875,49 @@
       "redirect_document_id": false
     },
     {
-         "source_path": "articles/storage/files/storage-files-enable-soft-delete.md",
+      "source_path": "articles/storage/files/storage-files-enable-soft-delete.md",
       "redirect_url": "/azure/storage/files/storage-files-prevent-file-share-deletion",
       "redirect_document_id": false
-     },
-     {
+    },
+    {
       "source_path": "articles/defender-for-iot/organizations/release-notes-archive.md",
       "redirect_url": "/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-portal.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-powershell.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-cli.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-template.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-terraform.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/nat-gateway/quickstart-create-nat-gateway-bicep.md",
       "redirect_url": "/azure/nat-gateway/quickstart-create-nat-gateway",
-       "redirect_document_id": false
-     },
-     {
+      "redirect_document_id": false
+    },
+    {
       "source_path": "articles/defender-for-iot/organizations/eiot-sensor.md",
       "redirect_url": "/azure/defender-for-iot/organizations/concept-enterprise",
       "redirect_document_id": false
     }
   ]
-}
+}

articles/api-management/integrate-vnet-outbound.md

@@ -48,7 +48,7 @@ If you want to inject a Premium v2 (preview) API Management instance into a virt
 
 ### Network security group
 
-A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
+A network security group must be associated with the subnet. Configure any network security group rules that you need for the gateway to access your API backends. Network security groups (NSG) can also be used to block outbound traffic to the internet and access only resources in your virtual network. To set up a network security group, see [Create a network security group](../virtual-network/manage-network-security-group.md).
 
 ### Subnet delegation
 

articles/app-service/deploy-authentication-types.md

@@ -22,7 +22,7 @@ With Azure App Service, you have multiple options for deploying your web applica
 | SCM/Kudu/OneDeploy REST endpoint | Basic authentication<br/><br/>Microsoft Entra | [Deploy files to App Service](deploy-zip.md) |
 | Kudu UI | Basic authentication<br/><br/>Microsoft Entra | [Deploy files to App Service](deploy-zip.md) |
 | FTP/FTPS | Basic authentication | [Deploy your app to Azure App Service by using FTP/S](deploy-ftp.md) |
-| Visual Studio | Basic authentication  | [Quickstart: Deploy an ASP.NET web app](quickstart-dotnetcore.md)<br/><br/>[Develop and deploy WebJobs by using Visual Studio](webjobs-dotnet-deploy-vs.md)<br/><br/>[Troubleshoot an app in Azure App Service by using Visual Studio](troubleshoot-dotnet-visual-studio.md)<br/><br/>[GitHub Actions integration in Visual Studio](/visualstudio/azure/overview-github-actions)<br/><br/>[Deploy your application to Azure by using GitHub Actions workflows created by Visual Studio](/visualstudio/deployment/azure-deployment-using-github-actions) |
+| Visual Studio | Basic authentication<br/><br/>Microsoft Entra  | [Quickstart: Deploy an ASP.NET web app](quickstart-dotnetcore.md)<br/><br/>[Develop and deploy WebJobs by using Visual Studio](webjobs-dotnet-deploy-vs.md)<br/><br/>[Troubleshoot an app in Azure App Service by using Visual Studio](troubleshoot-dotnet-visual-studio.md)<br/><br/>[GitHub Actions integration in Visual Studio](/visualstudio/azure/overview-github-actions)<br/><br/>[Deploy your application to Azure by using GitHub Actions workflows created by Visual Studio](/visualstudio/deployment/azure-deployment-using-github-actions) |
 | Visual Studio Code | Microsoft Entra | [Quickstart: Deploy an ASP.NET web app](quickstart-dotnetcore.md)<br/><br/>[Working with GitHub in VS Code](https://code.visualstudio.com/docs/sourcecontrol/github) |
 | GitHub with GitHub Actions | Publish profile (basic authentication)<br/><br/>Service principal (Microsoft Entra)<br/><br/>OpenID Connect (Microsoft Entra) | [Deploy to App Service by using GitHub Actions](deploy-github-actions.md) |
 | GitHub with the App Service build service as a build engine | Basic authentication | [Continuous deployment to Azure App Service](deploy-continuous-deployment.md) |

articles/app-service/includes/tutorial-ai-slm/advantages.md

@@ -0,0 +1,15 @@
+---
+author: cephalin
+ms.service: azure-app-service
+ms.topic: include
+ms.date: 05/07/2025
+ms.author: cephalin
+---
+
+Hosting your own small language model (SLM) offers several advantages:
+
+- Full control over your data. Sensitive information isn't exposed to external services, which is critical for industries with strict compliance requirements.
+- Self-hosted models can be fine-tuned to meet specific use cases or domain-specific requirements. 
+- Minimized network latency and faster response times for a better user experience.
+- Full control over resource allocation, ensuring optimal performance for your application.
+

articles/app-service/includes/tutorial-ai-slm/faq.md

@@ -0,0 +1,56 @@
+---
+author: cephalin
+ms.service: azure-app-service
+ms.topic: include
+ms.date: 05/07/2025
+ms.author: cephalin
+---
+
+## Frequently asked questions
+
+### How does pricing tier affect the performance of the SLM sidecar?
+
+Since AI models consume considerable resources, choose the pricing tier that gives you sufficient vCPUs and memory to run your specific model. For this reason, the built-in AI sidecar extensions only appear when the app is in a suitable pricing tier. If you build your own SLM sidecar container, you should also use a CPU-optimized model, since the App Service pricing tiers are CPU-only tiers.
+
+For example, the [Phi-3 mini model with a 4K context length from Hugging Face](https://huggingface.co/microsoft/Phi-3-mini-4k-instruct-onnx) is designed to run with limited resources and provides strong math and logical reasoning for many common scenarios. It also comes with a CPU-optimized version. In App Service, we tested the model on all premium tiers and found it to perform well in the [P2mv3](https://azure.microsoft.com/pricing/details/app-service/linux/) tier or higher. If your requirements allow, you can run it on a lower tier.
+
+### How to use my own SLM sidecar?
+
+The sample repository contains a sample SLM container that you can use as a sidecar. It runs a FastAPI application that listens on port 8000, as specified in its [Dockerfile](https://github.com/Azure-Samples/ai-slm-in-app-service-sidecar/blob/main/bring_your_own_slm/src/phi-3-sidecar/Dockerfile). The application uses [ONNX Runtime](https://onnxruntime.ai/docs/) to load the Phi-3 model, then forwards the HTTP POST data to the model and streams the response from the model back to the client. For more information, see [model_api.py](https://github.com/Azure-Samples/ai-slm-in-app-service-sidecar/blob/main/src/phi-3-sidecar/model_api.py).
+
+To build the sidecar image yourself, you need to install Docker Desktop locally on your machine.
+
+1. Clone the repository locally.
+
+    ```bash
+    git clone https://github.com/Azure-Samples/ai-slm-in-app-service-sidecar
+    cd ai-slm-in-app-service-sidecar
+    ```
+
+1. Change into the Phi-3 image's source directory and download the model locally using the [Huggingface CLI](https://huggingface.co/docs/huggingface_hub/guides/cli).
+
+    ```bash
+    cd bring_your_own_slm/src/phi-3-sidecar
+    huggingface-cli download microsoft/Phi-3-mini-4k-instruct-onnx --local-dir ./Phi-3-mini-4k-instruct-onnx
+    ```
+    
+    The [Dockerfile](https://github.com/Azure-Samples/ai-slm-in-app-service-sidecar/blob/main/src/phi-3-sidecar/Dockerfile) is configured to copy the model from *./Phi-3-mini-4k-instruct-onnx*.
+    
+1. Build the Docker image. For example:
+
+    ```bash
+    docker build --tag phi-3 .
+    ```
+
+1. Upload the built image to Azure Container Registry with [Push your first image to your Azure container registry using the Docker CLI](/azure/container-registry/container-registry-get-started-docker-cli).
+
+1. In the **Deployment Center** > **Containers (new)** tab, select **Add** > **Custom container** and configure the new container as follows:
+    - **Name**: *phi-3*
+    - **Image source**: **Azure Container Registry**
+    - **Registry**: your registry
+    - **Image**: the uploaded image
+    - **Tag**: the image tag you want
+    - **Port**: *8000*
+1. Select **Apply**.
+
+See [bring_your_own_slm/src/webapp](https://github.com/Azure-Samples/ai-slm-in-app-service-sidecar/blob/main/bring_your_own_slm/src/webapp) for a sample application that interacts with this custom sidecar container.

articles/app-service/includes/tutorial-ai-slm/phi-3-extension-create-test.md

@@ -0,0 +1,33 @@
+---
+author: cephalin
+ms.service: azure-app-service
+ms.topic: include
+ms.date: 05/07/2025
+ms.author: cephalin
+---
+
+## Add the Phi-3 sidecar extension
+
+In this section, you add the Phi-3 sidecar extension to your ASP.NET Core application hosted on Azure App Service.
+
+1. Navigate to the Azure portal and go to your app's management page.
+2. In the left-hand menu, select **Deployment** > **Deployment Center**.
+3. On the **Containers** tab, select **Add** > **Sidecar extension**.
+4. In the sidecar extension options, select **AI: phi-3-mini-4k-instruct-q4-gguf (Experimental)**.
+5. Provide a name for the sidecar extension.
+6. Select **Save** to apply the changes.
+7. Wait a few minutes for the sidecar extension to deploy. Keep selecting **Refresh** until the **Status** column shows **Running**.
+
+This Phi-3 sidecar extension uses a [chat completion API like OpenAI](https://platform.openai.com/docs/api-reference/chat/create) that can respond to chat completion response at `http://localhost:11434/v1/chat/completions`. For more information on how to interact with the API, see:
+
+- [OpenAI documentation: Create chat completion](https://platform.openai.com/docs/api-reference/chat/create)
+- [OpenAI documentation: Streaming](https://platform.openai.com/docs/api-reference/chat-streaming)
+
+## Test the chatbot
+
+1. In your app's management page, in the left-hand menu, select **Overview**.
+1. Under **Default domain**, select the URL to open your web app in a browser.
+1. Verify that the chatbot application is running and responding to user inputs.
+
+    :::image type="content" source="../../media/tutorial-ai-slm-dotnet/fashion-store-assistant-live.png" alt-text="Screenshot showing the fashion assistant app running in the browser.":::
+

articles/app-service/includes/tutorial-sidecar/common-faqs.md

@@ -0,0 +1,20 @@
+---
+author: cephalin
+ms.service: azure-app-service
+ms.topic: include
+ms.date: 05/08/2025
+ms.author: cephalin
+---
+
+### How do sidecar containers handle internal communication?
+
+Sidecar containers share the same network host as the main container, so the main container (and other sidecar containers) can reach any port on the sidecar with `localhost:<port>`. The example *startup.sh* uses `localhost:4318` to access port 4318 on the **otel-collector** sidecar.
+
+In the **Edit container** dialog, the **Port** box isn't currently used by App Service. You can use it as part of the sidecar metadata, such as to indicate which port the sidecar is listening to.
+
+### Can a sidecar container receive internet requests?
+
+No. App Service routes internet requests only to the main container. For code-based Linux apps, the built-in Linux container is the main container, and any sidecar container ([sitecontainers](/azure/templates/microsoft.web/sites/sitecontainers)) should be added with `IsMain=false`. For custom containers, all but one of the [sitecontainers](/azure/templates/microsoft.web/sites/sitecontainers) should have `IsMain=false`.
+
+For more information on configuring `IsMain`, see [Microsoft.Web sites/sitecontainers](/azure/templates/microsoft.web/sites/sitecontainers).
+

articles/app-service/includes/tutorial-sidecar/sidecar-overview.md

@@ -0,0 +1,13 @@
+---
+author: cephalin
+ms.service: azure-app-service
+ms.topic: include
+ms.date: 05/08/2025
+ms.author: cephalin
+---
+
+## What's a sidecar container?
+
+In Azure App Service, you can add up to nine sidecar containers for each Linux app. Sidecar containers let you deploy extra services and features to your Linux apps without making them tightly coupled to the main container (built-in or custom). For example, you can add monitoring, logging, configuration, and networking services as sidecar containers. An OpenTelemetry collector sidecar is one such monitoring example. 
+
+The sidecar containers run alongside the main application container in the same App Service plan.

articles/app-service/media/tutorial-ai-slm-dotnet/fashion-store-assistant-live.png

@@ -15,7 +15,7 @@ This article explains how to troubleshoot issues with your app in Azure App Serv
 
 Azure App Service diagnostics is an interactive experience to help you troubleshoot your app with no configuration required. App Service diagnostics points out what's wrong and guides you to the right information to more easily and quickly troubleshoot and resolve the problem.
 
-Although this experience is most helpful for problems that occured within the last 24 hours, all the diagnostic graphs are always available for you to analyze.
+Although this experience is most helpful for problems that occurred within the last 24 hours, all the diagnostic graphs are always available for you to analyze.
 
 App Service diagnostics works for not only apps on Windows, but also for apps on built-in or custom containers, [App Service Environments](./environment/intro.md), and [Azure Functions](../azure-functions/functions-overview.md).