update

Author: msmbaldwin

articles/payment-hsm/create-payment-hsm.md

@@ -58,6 +58,9 @@ In this tutorial, you learn how to:
 
 - You must register the "Microsoft.HardwareSecurityModules" and "Microsoft.Network" resource providers, as well as the Azure Payment HSM features. Steps for doing so are at [Register the Azure Payment HSM resource provider and resource provider features](register-payment-hsm-resource-providers.md).
 
+  > [!WARNING]
+  > You must apply the "FastPathEnabled" feature flag to **every** subscription ID, and add the "fastpathenabled" tag to **every** virtual network. For more details, see [Fastpathenabled](fastpathenabled.md).
+
   To quickly ascertain if the resource providers and features are already registered, use the Azure PowerShell [Get-AzProviderFeature](/powershell/module/az.resources/get-azproviderfeature) cmdlet:
 
 ```azurepowershell-interactive

articles/payment-hsm/fastpathenabled.md

@@ -17,23 +17,25 @@ ms.author: mbaldwin
 
 Azure Payment HSM uses the term "Fastpathenabled" in two related but distinct ways:
 
-- "FastPathEnabled" (capitalized) is an Azure Feature Exposure Control (AFEC) flag. It must be applied to **every** subscription ID that wants to connect to a payment HSM.
-- "fastpathenabled" (lowercased) is a virtual network tag. It must be added to **every** virtual network (and NAT gateway, when applicable) that interacts with a payment HSM.
+- "FastPathEnabled" is an Azure Feature Exposure Control (AFEC) flag. It must be applied to **every** subscription ID that wants to connect to a payment HSM.
+- "fastpathenabled" (always lowercased) is a virtual network tag. . It must be added to the virtual network hosting the payment HSM's delegated subnet, as well as to **every** peered VNet requiring connectivity to the payment HSM.
 
-### Subscriptions
+Adding the “FastPathEnabled” feature flag and enabling the “fastpathenabled” tag don't cause any downtime.
 
-The "FastPathEnabled" feature flag must be added/registered to all subscriptions IDs that connect to a payment HSM.  Applying the "FastPathEnabled" feature flag to a subscription that already has resources has **no** effect on existing resources--existing resources must be subsequently registered. 
+### Subscriptions
 
-To apply the "FastPathEnabled" feature flag, see [Register the resource providers and features](register-payment-hsm-resource-providers.md).
+The "FastPathEnabled" feature flag must be added/registered to all subscriptions IDs that need access to Azure Payment HSM.  To apply the "FastPathEnabled" feature flag, see [Register the resource providers and features](register-payment-hsm-resource-providers.md).
 
 > [!IMPORTANT]
-> After registering the "FastPathEnabled" feature flag, you **must** contact the [Azure Payment HSM support team](support-guide.md#microsoft-support) team to have your registration approved.  In your message to Microsoft support, include the subscription IDs of **every** subscription you want to connect to the payment HSM.
+> After registering the "FastPathEnabled" feature flag, you **must** contact the [Azure Payment HSM support team](support-guide.md#microsoft-support) team to have your registration approved. In your message to Microsoft support, include the subscription IDs of **every** subscription that needs access to Azure Payment HSM.
 
 ### Virtual networks
 
-The "fastpathenabled" tag must be added to every virtual networks that the payment HSM uses, peered or otherwise. For instance, to peer a virtual network of a payment HSM with a virtual network of a VM, you must first add the "fastpathenabled" tag to the latter.
+The "fastpathenabled" tag must be added to every virtual networks connecting to Azure Payment HSM usesIn a Hub and Spoke topology, the "fastpathenabled" tag must be added to both the central Hub VNet and the peered Spoke VNet containing Payment HSM. In a Hub and Spoke topology, the "fastpathenabled" tag must be added to both the central Hub VNet and the peered Spoke VNet containing Azure Payment HSM.
+
+The "fastpathenabled" tag is not required on non-directly peered VNets reaching the Payment HSM's VNet via a Central hub.
 
-Unfortunately, adding the "fastpathenabled" tag through the Azure portal is insufficient—it must be done from the commandline. To do so, follow the steps outlined in [How to peer Azure Payment HSM virtual networks](peer-vnets.md?tabs=azure-cli).
+Adding the "fastpathenabled" tag through the Azure portal is insufficient—it must be done from the commandline. To do so, follow the steps outlined in [How to peer Azure Payment HSM virtual networks](peer-vnets.md?tabs=azure-cli).
 
 ### Virtual Network NAT scenario