Merge pull request #215579 from tomkerkhove/tomkerkhove-patch-1

docs: Provide notice that customers must use NSGs in stv2

Author: prmerger-automator[bot]

articles/api-management/virtual-network-reference.md

@@ -30,6 +30,9 @@ When an API Management service instance is hosted in a VNet, the ports in the fo
 
 ### [stv2](#tab/stv2)
 
+>[!IMPORTANT]
+> When using `stv2`, it is required to assign a Network Security Group to your VNet in order for the Azure Load Balancer to work. Learn more in the [Azure Load Balancer documentation](/security/benchmark/azure/baselines/azure-load-balancer-security-baseline#network-security-group-support).
+
 | Source / Destination Port(s) | Direction          | Transport protocol |   Service tags <br> Source / Destination   | Purpose                                            | VNet type |
 |------------------------------|--------------------|--------------------|---------------------------------------|-------------------------------------------------------------|----------------------|
 | * / [80], 443                  | Inbound            | TCP                | Internet / VirtualNetwork           | **Client communication to API Management**                     | External only            |