Merge pull request #235753 from ntrogh/als-nsg-guidance

[Azure Lab Services] Revisit NSG guidance

Author: v-ccolin

articles/lab-services/TOC.yml

@@ -140,6 +140,7 @@
     - name: Configure auto-shutdown settings
       href: how-to-configure-auto-shutdown-lab-plans.md
     - name: Connect to a virtual network
+      displayName: VNET, injection, advanced, networking, hybrid, on-premise
       href: how-to-connect-vnet-injection.md
     - name: Create a lab with a shared resource
       href: how-to-create-a-lab-with-shared-resource.md

articles/lab-services/classroom-labs-concepts.md

@@ -100,6 +100,16 @@ The quota applies to a lab for each lab user individually, for the entire durati
 
 A lab can use either quota time, [scheduled time](#schedule), or a combination of both.
 
+## Advanced networking
+
+With lab plans, you have more control over the virtual network for labs by using advanced networking. With advanced networking, you can connect to a virtual network.
+
+Use advanced networking to connect to on premise resources such as licensing servers and use user defined routes (UDRs). Some organizations also have advanced network requirements and configurations that they want to apply to labs. For example, network requirements can include a network traffic control, ports management, access to resources in an internal network, and more.
+
+Azure Lab Services advanced networking uses virtual network (VNET) injection to connect a lab plan to your virtual network. VNET injection replaces the [Azure Lab Services virtual network peering](how-to-connect-peer-virtual-network.md) that was used with lab accounts.
+
+Learn more about how to [connect a lab plan to a virtual network](./how-to-connect-vnet-injection.md).
+
 ## Next steps
 
 - [Create the resources to get started](./quick-create-resources.md)

articles/lab-services/classroom-labs-fundamentals.md

@@ -43,7 +43,7 @@ Lab users connect to their lab virtual machine through a load balancer.  Lab vir
 
 Inbound rules on the load balancer forward the connection, depending on the operating system, to either port 22 (SSH) or port 3389 (RDP) of the lab virtual machine. A network security group (NSG) blocks external traffic to any other port.
 
-If you configured the lab to use [advanced networking](how-to-connect-vnet-injection.md), then each lab uses the subnet that was connected to the lab plan and delegated to Azure Lab Services. In this case, you're responsible for creating a [network security group with an inbound security rule to allow RDP and SSH traffic](how-to-connect-vnet-injection.md#associate-delegated-subnet-with-nsg) to the lab virtual machines.
+If the lab is using [advanced networking](how-to-connect-vnet-injection.md), then each lab is using the same subnet that was delegated to Azure Lab Services and connected to the lab plan. You're also responsible for creating an [NSG with an inbound security rule to allow RDP and SSH traffic](how-to-connect-vnet-injection.md#associate-the-subnet-with-the-network-security-group) so lab users can connect to their VMs.
 
 ## Access control to the lab virtual machines