Merge pull request #308723 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)

Author: Taojunshen

articles/frontdoor/front-door-wildcard-domain.md

@@ -43,7 +43,7 @@ For accepting HTTPS traffic on your wildcard domain, you must enable HTTPS on th
 
 > [!NOTE]
 > * You can choose to use the same wildcard certificate from Azure Key Vault or from Azure Front Door managed certificates for subdomains. 
-> * If you want to add a subdomain of the wildcard domain that’s already validated in the Azure Front Door Standard or Premium profile, the domain validation is automatically approved. This is applicable to Bring Your Own Certificate. Domain ownership is required for managed certficate for sub-domains.
+> * If you want to add a subdomain of the wildcard domain that’s already validated in the Azure Front Door Standard or Premium profile, the domain validation is automatically approved. This is applicable to Bring Your Own Certificate. Domain ownership is required for managed certificate for sub-domains.
 > * If a wildcard domain is validated and already added to one profile, a single-level subdomain can still be added to another profile as long as it is also validated. 
 
 ## Define a subdomain explicitly

articles/frontdoor/standard-premium/how-to-enable-private-link-internal-load-balancer.md

@@ -46,7 +46,7 @@ In this section, you map the Private Link service to a private endpoint created
     * **Name** - Enter a name to identify this origin.
     * **Origin type** - Select the **Custom** origin type.
     * **Host name** - The host name is used for SNI (SSL negotiation) and should match your server side certificate. |
-    * **Origin host header** | The origin host header can be the private link private IP for the internal load balancer or a valid domain name.
+    * **Origin host header** - The origin host header can be the private link private IP for the internal load balancer or a valid domain name. When a private link service is enabled, this field is used only for the HTTP request header.
     * **Certificate subject name validation** - Select the checkbox to enable certificate subject name validation. This validation checks the certificate subject name against the host name. If the certificate subject name doesn't match the host name, the connection is rejected. **This validation is required if private link is enabled.**
     * **HTTP port** - 80 (default)
     * **HTTPS port** 443 (default)
@@ -79,6 +79,7 @@ In this section, you map the Private Link service to a private endpoint created
 The following are common mistakes when configuring an origin with Azure Private Link enabled:
 
 * Adding the origin with Azure Private Link enabled to an existing origin group that contains public origins. Azure Front Door doesn't allow mixing public and private origins in the same origin group.
+* Private Link changes how the **Host name** and the **Origin host header** fields operate. It doesn't change the NAT behavior of the flow to the private link service origin.
 
 ## Related content
 

articles/vpn-gateway/whats-new.md

@@ -32,7 +32,7 @@ You can also find the latest VPN Gateway updates and subscribe to the RSS feed [
 
 | Event | Customer impact| Anticipated timelines | Customer action/ prerequisites | Documentation | Announcement Links |
 |---|---|---|---|---|---|
-|Basic SKU public IP address migration - For all VPN SKU's except Basic SKU Gateway |- New [pricing changes](https://azure.microsoft.com/pricing/details/ip-addresses/).<br>- To qualify for successful migration, ensure you have the right IP address space and subnet size.<br>- Up to 10 minutes of downtime is expected during customer-controlled migration.<br>- Customers will have atleast ~3 months to migrate after the release of the migration tool.|- **Starting Aug 4, 2025**: Basic SKU public IP address-to-Standard SKU public IP address migration tool is in **public preview** for **active-passive** gateways in Public cloud. <br> - Tentative **GA** timeline for Public and National cloud support **End of Nov 2025** <br>- **Jan 2026**: Basic SKU public IP address-to-Standard SKU public IP address migration tool tentative **GA** timeline for **active-active** gateways.<br>- **From Aug 4, 2025 to End of Mar 2026**: Customer-controlled migration can be initiated after tool availability.<br>- **April 2026**: Basic SKU public IP addresses are deprecated. <br> - **Deprecation timeline of Basic IP for all VPN Gateways is moved to End of Mar 2026**|- Ensure you have the right IP address space and subnet size, check here.<br>- If your VPN gateway is using a Basic SKU public IP address, migrate it to a Standard SKU public IP address.<br> - If your VPN gateway is already using a Standard SKU public IP address, no action is required.|- [About Basic SKU Public IP address migration](basic-public-ip-migrate-about.md) <br>  - [How to migrate Basic SKU public IP address to Standard](basic-public-ip-migrate-howto.md?tabs=portal)|[Basic SKU public IP address retirement](https://azure.microsoft.com/updates?id=upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired) |
+|Basic SKU public IP address migration - For all VPN SKU's except Basic SKU Gateway |- New [pricing changes](https://azure.microsoft.com/pricing/details/ip-addresses/).<br>- To qualify for successful migration, ensure you have the right IP address space and subnet size.<br>- Up to 10 minutes of downtime is expected during customer-controlled migration.<br>- Customers will have at least ~3 months to migrate after the release of the migration tool.|- **Starting Aug 4, 2025**: Basic SKU public IP address-to-Standard SKU public IP address migration tool is in **public preview** for **active-passive** gateways in Public cloud. <br> - Tentative **GA** timeline for Public and National cloud support **End of Nov 2025** <br>- **Jan 2026**: Basic SKU public IP address-to-Standard SKU public IP address migration tool tentative **GA** timeline for **active-active** gateways.<br>- **From Aug 4, 2025 to End of Mar 2026**: Customer-controlled migration can be initiated after tool availability.<br>- **April 2026**: Basic SKU public IP addresses are deprecated. <br> - **Deprecation timeline of Basic IP for all VPN Gateways is moved to End of Mar 2026**|- Ensure you have the right IP address space and subnet size, check here.<br>- If your VPN gateway is using a Basic SKU public IP address, migrate it to a Standard SKU public IP address.<br> - If your VPN gateway is already using a Standard SKU public IP address, no action is required.|- [About Basic SKU Public IP address migration](basic-public-ip-migrate-about.md) <br>  - [How to migrate Basic SKU public IP address to Standard](basic-public-ip-migrate-howto.md?tabs=portal)|[Basic SKU public IP address retirement](https://azure.microsoft.com/updates?id=upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired) |
 |Basic SKU public IP address migration - For Basic SKU Gateway | - Your actual IP address will not change, and connectivity will not be interrupted. | An automated capability to remove the Basic public IP from your gateway will be available **Mid-February'2026** <br> - **Deprecation timeline of Basic IP for all VPN Gateways is moved to end of Mar 2026** | - Because Microsoft is retiring Basic public IP resources, we’re updating the Basic VPN Gateway construct. You’ll see the Basic public IP reference as an attribute on your virtual network gateway. <br> - Your actual IP address will not change, and connectivity will not be interrupted. <br> - If you have scripts, ARM templates, or monitoring solutions that reference the Basic public IP resource, update them to use the IP address property of the virtual network gateway instead. | Available when the migration details are released | [Basic SKU public IP address retirement](https://azure.microsoft.com/updates?id=upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired) |
 |Non-AZ gateway SKU retirement |- New pricing for AZ gateway SKUs applied since Jan 2025.<br>- Non-AZ gateway SKUs will be migrated to AZ gateway SKUs with no downtime expected.<br>- Non-AZ gateway SKU creates to be blocked by May 2025. |- **Jan 2025**: New pricing for AZ gateway SKUs activated.<br> - **May 2025 to Sep 2026**: Non-AZ gateway SKU-to-AZ gateway SKU migration available.<br> - **Sep 2026**: Non-AZ gateway SKU retirement.|- If the VPN gateway is using a Basic public IP address SKU, migrate it to a Standard public IP address SKU. In case of Standard IP, you can upgrade the gateway SKU from portal |[VPN Gateway SKU consolidation and migration](gateway-sku-consolidation.md)| [Non-AZ gateway SKU retirement](https://azure.microsoft.com/updates?id=vpngw1-5-non-az-skus-will-be-retired-on-30-september-2026)|
 |Gateway SKU retirement: Standard and High Performance SKUs.|- New Standard/High Perf SKU gateway creations blocked Nov 2023.<br> - Standard/High Perf SKU gateways will be migrated to VpnGw1/VpnGw2 on non-AZ regions and to VpnGw1AZ/VpnAz2 on AZ regions.<br> - Up to 10 minutes of downtime is expected during customer-controlled migration.|- **May 2025 to Mar 2026**: Standard/HighPerf SKU migration.<br>- **Mar 2026**: Standard/HighPerf SKU retirement (extended from Sep 2025).| - Migrate your Basic IP address from portal when the experience is available by Nov 2025 |[Working with VPN Gateway legacy SKUs](vpn-gateway-about-skus-legacy.md)|[Standard and HighPerf gateway SKU retirement](https://azure.microsoft.com/updates?id=standard-and-highperformance-vpn-gateway-skus-will-be-retired-on-30-september-2025)|