Merge branch 'main' of https://github.com/microsoftdocs/azure-docs-pr into thiago-linuxv3note-fixup

Author: ggailey777

articles/active-directory-b2c/add-api-connector.md

@@ -25,7 +25,7 @@ ms.custom:
 
 [!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
 
-As a developer or IT administrator, you can use API connectors to integrate your sign-up user flows with REST APIs to customize the sign-up experience and integrate with external systems. At the end of this walkthrough, you'll be able to create an Azure AD B2C user flow that interacts with [REST API services](api-connectors-overview.md) to modify your sign-up experiences. 
+As a developer or IT administrator, you can use API connectors to integrate sign-up user flows with REST APIs, enabling customization of the sign-up experience and integration with external systems. At the end of this walkthrough, you'll be able to create an Azure AD B2C user flow that interacts with [REST API services](api-connectors-overview.md) to modify your sign-up experiences. 
 
 ::: zone pivot="b2c-user-flow"
 You can create an API endpoint using one of our [samples](api-connector-samples.md#api-connector-rest-api-samples).
@@ -515,7 +515,7 @@ Add the validation technical profile reference to the sign-up technical profile,
             <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true"/>
             <OutputClaim ClaimTypeReferenceId="displayName"/>
             <OutputClaim ClaimTypeReferenceId="givenName"/>
-            <OutputClaim ClaimTypeReferenceId="surName"/>
+            <OutputClaim ClaimTypeReferenceId="surname"/>
             <!-- Required to present the text box to collect the data from the user -->
             <OutputClaim ClaimTypeReferenceId="loyaltyId"/>
             <!-- Required to pass the promoCode returned from "REST-ValidateProfile" 

articles/api-center/TOC.yml

@@ -63,7 +63,7 @@
     - name: Agents
       items:
       - name: Overview
-        href: agent-to-agent-overview.md
+        href: agent-to-agent-overview.md 
       - name: Register and manage agents 
         href: register-manage-agents.md
     - name: MCP servers
@@ -100,6 +100,8 @@
     href: self-host-api-center-portal.md
   - name: Discover and consume APIs - VS Code extension
     href: discover-apis-vscode-extension.md
+  - name: Enable plugin marketplace
+    href: enable-api-center-plugin-marketplace.md
 - name: API center management and operations
   items:
   - name: Reliability

articles/api-center/enable-api-center-plugin-marketplace.md

@@ -0,0 +1,113 @@
+---
+title: Enable API Center Plugin Marketplace
+description: Enable a plugin marketplace endpoint (preview) for your Azure API center. Developers can configure it in GitHub Copilot or Claude Code to discover and install plugins from your inventory.
+
+ms.service: azure-api-center
+ms.topic: how-to
+ms.date: 04/15/2026
+ 
+ms.custom: 
+# Customer intent: As an API program manager, I want to create a plugin marketplace from my API center so AI developers can find and install plugins from my inventory.
+---
+
+# Enable discovery of API center plugins from a plugin marketplace (preview)
+
+
+This article shows how to enable a plugin marketplace endpoint in [Azure API Center](overview.md). The plugin marketplace endpoint uses the API Center data plane API to catalog the AI plugins such as MCP servers and skills available in the API center inventory. 
+
+After you enable the plugin marketplace, developers can add it to their GitHub Copilot CLI or Claude Code development environment to discover and install plugins from your API center.
+
+## Prerequisites
+
+- An API center in your Azure subscription. If you don't have one, see [Quickstart: Create your API center](set-up-api-center.md).
+
+- One or more plugins registered in your API center inventory, such as [MCP servers](register-discover-mcp-server.md) or [skills](register-discover-skills.md).
+
+- The API center portal enabled and set up for your API center. For details, see [Set up and customize your API Center portal](set-up-api-center-portal.md). The access method you choose for the portal determines how developers will authenticate when they access the plugin marketplace. 
+
+- [GitHub Copilot CLI](https://github.com/github/copilot-cli) or [Claude Code](https://www.anthropic.com/claude) installed in your development environment.
+
+
+## Confirm plugin marketplace endpoint is enabled for your API center
+
+After setting up the API Center portal, confirm that the plugin marketplace endpoint is enabled for your API center by cloning it locally. 
+
+> [!NOTE]
+> After setting up the API center portal, it can take several minutes for the plugin marketplace endpoint to be available. 
+
+The marketplace endpoint is of the following form:
+
+```
+https://<service name>.data.<region>.azure-apicenter.ms/workspaces/default/plugins/marketplace.git
+```
+
+To clone it, use a command similar to the following in your terminal, replacing the service name and region with the values from your API center:
+
+```bash
+git clone https://myapicenter.data.eastus.azure-apicenter.ms/workspaces/default/plugins/marketplace.git
+```
+
+The `marketplace` folder of the cloned repository contains folders for marketplace configuration in Claude Code and GitHub Copilot CLI, and folders for each plugin in your API center inventory. For example:
+
+```
+marketplace/
+    .claude-plugin/
+    .github/
+    plugins/
+        plugin1/
+        plugin2/
+        ...
+```
+
+Each plugin folder contains JSON files with the plugin metadata and configuration.
+
+## Add plugin marketplace to GitHub Copilot CLI 
+
+Developers can add the plugin marketplace from your API center's marketplace endpoint to GitHub Copilot CLI by using the `plugin marketplace add` command. For example, add it in a GitHub Copilot CLI session with a command similar to the following. Replace the service name and region with the values from your API center:
+
+```bash
+/plugin marketplace add https://myapicenter.data.eastus.azure-apicenter.ms/workspaces/default/plugins/marketplace.git
+```
+
+Follow the prompts to add the plugin marketplace to your GitHub Copilot CLI. 
+
+After adding the marketplace, use the `/plugin marketplace browse` command to see the plugins from your API center inventory. 
+
+```bash
+/plugin marketplace browse myapicenter
+```
+
+Add a plugin from the marketplace to a GitHub Copilot CLI session with the `/plugin install` command. For example:
+
+```bash
+/plugin install plugin-name@myapicenter
+```
+
+For more information about installing plugins from the marketplace in GitHub Copilot CLI, see [GitHub Copilot CLI documentation](https://docs.github.com/copilot/how-tos/copilot-cli/customize-copilot/plugins-finding-installing).
+
+## Add plugin marketplace to Claude Code
+
+Developers can add the plugin marketplace from their API center's marketplace endpoint by using the `/plugin marketplace add` command. For example, add it in a Claude Code session with a command similar to the following command. Replace the service name and region with the values from your API center:
+
+```bash
+/plugin marketplace add https://myapicenter.data.eastus.azure-apicenter.ms/workspaces/default/plugins/marketplace.git
+```
+
+Follow the prompts to add the plugin marketplace.
+
+After you add the marketplace, use the `/plugin` command to see the plugins from your API center inventory. 
+
+Add a plugin from the marketplace to a Claude Code session with the `/plugin install` command. For example:
+
+```bash
+/plugin install plugin-name@myapicenter
+```
+
+For more information about installing plugins from the marketplace in Claude Code, see [Claude Code documentation](https://code.claude.com/docs/en/discover-plugins).
+
+## Related content
+
+* [Set up and customize your API Center portal](set-up-api-center-portal.md)
+* [Discover and consume APIs - VS Code extension](discover-apis-vscode-extension.md)
+
+

articles/api-center/media/register-discover-skills/linked-skills.png

@@ -315,6 +315,12 @@ You can use a system-assigned managed identity to access Key Vault to store and
 
 Use the system-assigned identity to authenticate to a backend service via the [authentication-managed-identity](authentication-managed-identity-policy.md) policy.
 
+> [!CAUTION]
+> **Security consideration:** Users with permissions to edit API Management policies (for example, users assigned the [API Management Service Contributor](/azure/role-based-access-control/built-in-roles#api-management-service-contributor) role) can use the [`authentication-managed-identity`](authentication-managed-identity-policy.md) policy to authenticate as the service's managed identity. When you assign roles or permissions to the API Management resouce, be aware that any user who can edit policies may be able to access those same resources through the managed identity. To mitigate risk:
+> - Follow the [principle of least privilege](/entra/identity-platform/secure-least-privileged-access) when assigning roles to managed identities.
+> - Only grant the API Management Contributor role or policy editing permissions to trusted users.
+> - Regularly review and audit managed identity role assignments and who has access to edit API Management policies.
+
 ### Connect to Azure resources behind an IP firewall by using a system-assigned managed identity
 
 API Management is a trusted Microsoft service to the following resources. This trusted status enables the service to connect to the following resources behind a firewall when the firewall enables the **Allow Trusted Microsoft Services to bypass this firewall** setting. After you explicitly assign the appropriate Azure role to the [system-assigned managed identity](../active-directory/managed-identities-azure-resources/overview.md) for a resource instance, the scope of access for the instance corresponds to the Azure role that's assigned to the managed identity.
@@ -481,6 +487,12 @@ You can use a user-assigned managed identity to access Key Vault to store and ma
 
 You can use the user-assigned identity to authenticate to a backend service via the [authentication-managed-identity](authentication-managed-identity-policy.md) policy.
 
+> [!CAUTION]
+> **Security consideration:** Users with permissions to edit API Management policies (for example, users assigned the [API Management Service Contributor](/azure/role-based-access-control/built-in-roles#api-management-service-contributor) role) can use the [`authentication-managed-identity`](authentication-managed-identity-policy.md) policy to authenticate as the service's managed identity. When you assign roles or permissions to the API Management resouce, be aware that any user who can edit policies may be able to access those same resources through the managed identity. To mitigate risk:
+> - Follow the [principle of least privilege](/entra/identity-platform/secure-least-privileged-access) when assigning roles to managed identities.
+> - Only grant the API Management Contributor role or policy editing permissions to trusted users.
+> - Regularly review and audit managed identity role assignments and who has access to edit API Management policies.
+
 ### Log events to an event hub
 
 You can configure and use a user-assigned managed identity to access an event hub to log events from an API Management instance. For more information, see [How to log events to Azure Event Hubs in Azure API Management](api-management-howto-log-event-hubs.md).

articles/api-management/api-management-howto-use-managed-service-identity.md

@@ -20,6 +20,8 @@ Both system-assigned identity and any of the multiple user-assigned identities c
 
 [!INCLUDE [api-management-policy-generic-alert](../../includes/api-management-policy-generic-alert.md)]
 
+> [!CAUTION]
+> **Security consideration:** Any user with permissions to edit API Management policies (for example, users assigned the [API Management Service Contributor](/azure/role-based-access-control/built-in-roles#api-management-service-contributor) role) can use this policy to authenticate as the service's managed identity. This effectively grants that user access to any resource for which the managed identity has permissions. Ensure that you follow the [principle of least privilege](/entra/identity-platform/secure-least-privileged-access) when assigning permissions to API Management resource. For more information, see [How to use managed identities in Azure API Management](api-management-howto-use-managed-service-identity.md).
   
 ## Policy statement  
 

articles/api-management/authentication-managed-identity-policy.md

@@ -128,7 +128,7 @@ In a Linux app, all containers (main and sidecars) share environment variables.
 
 ## Add the Redis sidecar extension
 
-From the Azure portal, you can add a Redis sidecar extension to your app for caching. The Redis sidecar is for lightweight caching only, not a replacement for Azure Cache for Redis.
+From the Azure portal, you can add a Redis sidecar extension to your app for caching. The Redis sidecar is for lightweight caching only, not a replacement for Azure Managed Redis.
 
 To use the Redis sidecar:
 

articles/app-service/configure-sidecar.md

@@ -122,9 +122,14 @@ To see whether an existing App Service Environment supports zone redundancy:
 
 ## Configure Isolated v2 App Service plans with zone redundancy
 
-All App Service plans created in an App Service Environment must use the Isolated v2 pricing tier.
+After you enable your App Service Environment to be zone redundant, you can also make each Isolated v2 App Service plan as zone redundant.
+
+> [!NOTE]
+> Each plan has its own independent zone redundancy setting, so you can manually enable or disable zone redundancy on specific plans in an App Service Environment.
+>
+> If a specific plan doesn't need to be zone-redundant, you can disable zone redundancy and then optionally scale it to a single instance.
 
-If you enable your App Service Environment to be zone redundant, you can also set the Isolated v2 App Service plans as zone redundant. Each plan has its own independent zone redundancy setting, so you can manually enable or disable zone redundancy on specific plans in an App Service Environment, as long as the environment is configured to be zone redundant.
+All App Service plans created in an App Service Environment must use the Isolated v2 pricing tier.
 
 - **To create a new Isolated v2 App Service plan with zone redundancy**, use the Azure portal, the Azure CLI, or Bicep.
     

articles/app-service/environment/configure-zone-redundancy-environment.md

@@ -4,7 +4,7 @@ description: Learn how to scale automatically in Azure App Service with no confi
 author: msangapu-msft
 ms.author: msangapu
 ms.topic: how-to
-ms.date: 01/09/2026
+ms.date: 04/16/2026
 ms.custom: devx-track-azurecli
 ms.service: azure-app-service
 ---
@@ -41,7 +41,7 @@ Only one scaling method should be active for an App Service plan.
 
 |   | **Manual** | **Autoscale** | **Automatic scaling** |
 |--------|------------|---------------|------------------------|
-| Available tiers | Basic and up | Standard and up | Premium v2 and Premium v3 |
+| Available tiers | Basic and up | Standard and up | Premium v2 - v4 |
 | Rule-based scaling | No | Yes | No (traffic-based) |
 | Schedule-based scaling | No | Yes | No |
 | Always-ready instances | No | No | Yes (minimum 1) |
@@ -61,7 +61,7 @@ Here are a few scenarios where you should scale out automatically:
 
 ## Enable automatic scaling
 
-The **Maximum burst** setting represents the highest number of instances that your App Service plan can increase to based on incoming HTTP requests. For Premium v2 & v3 plans, you can specify up to 30 instances. The maximum burst number must be equal to or greater than the number of workers specified for the App Service plan.
+The **Maximum burst** setting represents the highest number of instances that your App Service plan can increase to based on incoming HTTP requests. For Premium v2, v3, and v4 plans, you can specify up to 30 instances. The maximum burst number must be equal to or greater than the number of workers specified for the App Service plan.
 
 #### [Azure portal](#tab/azure-portal)
 

articles/app-service/manage-automatic-scaling.md

@@ -56,6 +56,8 @@
     - name: Process real-time events
       displayName: Event Hubs, streaming, events
       href: scenario-real-time-events-processing.md
+    - name: Migrate Linux apps to Flex Consumption using Copilot
+      href: migration/scenario-migrate-linux-consumption-to-flex.md
   - name: Developer tools
     items:
     - name: Azure Developer CLI