Merge pull request #311145 from MicrosoftDocs/main

Auto Publish – main to live - 2026-01-30 18:00 UTC

Author: learn-build-service-prod[bot]

articles/app-service/configure-gateway-required-vnet-integration.md

@@ -3,7 +3,7 @@ title: Configure gateway-required virtual network integration for your app
 description: Integrate your app in Azure App Service with Azure virtual networks using gateway-required virtual network integration.
 author: seligj95
 ms.topic: how-to
-ms.date: 06/19/2025
+ms.date: 01/30/2026
 ms.author: jordanselig
 ms.custom:
   - build-2025
@@ -12,7 +12,7 @@ ms.service: azure-app-service
 # Configure gateway-required virtual network integration
 
 > [!IMPORTANT]
-> For all virtual network integrations with App Service, the recommended method uses [regional virtual network integration](./overview-vnet-integration.md). Gateway-required virtual network integration is a legacy method with limitations that regional virtual network integration mitigates.
+> Gateway-required virtual network integration is being retired on March 31, 2027. For more information, see the [retirement announcement](https://azure.microsoft.com/updates/?id=499923) and [Migrate from SSTP to IKEv2 or OpenVPN](../vpn-gateway/ikev2-openvpn-from-sstp.md). We recommend migrating to [regional virtual network integration](./overview-vnet-integration.md), which mitigates the limitations of gateway-required virtual network integration.
 
 Gateway-required virtual network integration supports connecting to a virtual network in another region or to a classic virtual network. Gateway-required virtual network integration only works for Windows plans. We recommend using [regional virtual network integration](./overview-vnet-integration.md) to integrate with virtual networks.
 

articles/app-service/migrate-gateway-based-vnet-integration.md

@@ -3,13 +3,16 @@ title: Migrate from gateway-based to regional virtual network integration
 description: Learn how to migrate your App Service virtual network integration from legacy gateway-based integration to modern regional virtual network integration for improved performance and capabilities.
 author: seligj95
 ms.topic: how-to
-ms.date: 06/20/2025
+ms.date: 01/30/2026
 ms.author: jordanselig
 ms.custom: devx-track-azurecli, devx-track-azurepowershell
 ms.service: azure-app-service
 ---
 # Migrate from gateway-based to regional virtual network integration
 
+> [!IMPORTANT]
+> Gateway-required virtual network integration is being retired on March 31, 2027. For more information, see the [retirement announcement](https://azure.microsoft.com/updates/?id=499923) and [Migrate from SSTP to IKEv2 or OpenVPN](../vpn-gateway/ikev2-openvpn-from-sstp.md). We recommend migrating to [regional virtual network integration](./overview-vnet-integration.md), which mitigates the limitations of gateway-required virtual network integration.
+
 App Service supports two types of virtual network integration: **regional virtual network integration** (recommended) and **gateway-based virtual network integration** (legacy). This article guides you through migrating from the legacy gateway-based approach to the modern regional integration method.
 
 ## Overview

articles/application-gateway/media/rewrite-http-headers-url/remove-inline-proxy-xff.png

@@ -163,6 +163,15 @@ Application Gateway inserts an X-Forwarded-For header into all requests before i
 
 ![A screenshot showing a remove port action.](./media/rewrite-http-headers-url/remove-port.png)
 
+#### Remove an in-line Proxy's IP for use with a backend firewall's X-Forwarded-For source feature
+
+Some third-party firewalls, also referred to as Network Virtual Appliances (NVAs), determine the source IP address by using the incoming `X-Forwarded-For` header instead of the packet’s source IP address, which would otherwise reflect the Application Gateway’s IP address. In many cases, NVAs display only the most recent IP address in the header.
+
+When a request traverses multiple proxies (for example, Client -> Azure Front Door -> Application Gateway -> NVA), the most recent IP address in the `X-Forwarded-For` header may represent Azure Front Door rather than the original client IP address. To preserve the client IP address, you can configure an Application Gateway rewrite rule to set the `X-Forwarded-For` header to the `http_req_X-Forwarded-For` server variable. This configuration prevents Application Gateway from appending the IP address of Azure Front Door or other intermediate reverse proxies, as shown in the following screenshot:
+
+![A screenshot showing the removal of in-line proxy IP from XFF header.](./media/rewrite-http-headers-url/remove-inline-proxy-xff.png)
+
+This captures the incoming X-Forwarded-For header, which will be the client's original IP address, and forwards it as-is rather than adding the AFD or proxy's IP to the header, allowing the NVA to display and evaluate the original client IP.
 
 ### Modify a redirection URL
 

articles/application-gateway/rewrite-http-headers-url.md

@@ -193,7 +193,7 @@ Keep these other considerations in mind when using Flex Consumption plan:
 + **Regions**: While the Flex Consumption plan is available in many Azure regions, not all regions are currently supported. To learn more, see [View currently supported regions](flex-consumption-how-to.md#view-currently-supported-regions).
 + **Deployments**: Deployment slots aren't currently supported. For zero downtime deployments with Flex Consumption, see [Site update strategies in Flex Consumption](flex-consumption-site-updates.md).
 + **Azure Storage as a local share**: Network File System (NFS) file shares aren't available for Flex Consumption. Only Server Message Block (SMB) and Azure Blobs (read-only) are supported.
-+ **Scale**: The lowest maximum scale is currently `40`. The highest currently supported value is `1000`.
++ **Scale**: The lowest maximum scale is currently `1`. The highest currently supported value is `1000`.
 + **PowerShell Managed dependencies**: Flex Consumption doesn't support [managed dependencies in PowerShell](functions-reference-powershell.md#managed-dependencies-feature). You must instead [upload modules with app content](functions-reference-powershell.md#including-modules-in-app-content).
 + **Certificates**: Loading certificates with the WEBSITE_LOAD_CERTIFICATES app setting, managed certificates, app service certificates, and other platform certificate-based features like endToEndEncryptionEnabled are currently not supported.
 + **Timezones**: `WEBSITE_TIME_ZONE` and `TZ` app settings aren't currently supported when running on Flex Consumption plan.

articles/azure-functions/flex-consumption-plan.md

@@ -336,7 +336,7 @@ You can't use the [quick create](functions-develop-vs-code.md?tabs=quick-create#
    | **Select a location for new resources** | Select a location in a [region](https://azure.microsoft.com/regions/) near you or near other services that your functions access. If you chose an existing resource group, that location is used and you don't see this prompt. |
    | **Select a runtime stack**| Select the language version you currently run locally. |
    | **Select an instance size** | Select **512** or a larger size. You can always [change the instance size](./flex-consumption-how-to.md#configure-instance-memory) at a later time. |
-   | **Enter the maximum instance count** | Select the default value of **100**, which limits the total scale-out of your app. You can also choose a different value between 40 and 1,000.  |
+   | **Enter the maximum instance count** | Select the default value of **100**, which limits the total scale-out of your app. You can also choose a different value between 1 and 1,000.  |
    | **Select a resource group**  | Select **Create new resource group** and accept the default or enter another name for the new group that's unique in your subscription.| 
    | **Select resource authentication type** | Select **Managed identity** so that your app connects to remote resources by using Microsoft Entra ID authentication instead of using shared secrets (connection strings and keys), which are less secure. |
    | **Select a user assigned identity** | Select **Create new user-assigned identity**. | 

articles/azure-functions/functions-develop-vs-code.md

@@ -340,7 +340,7 @@ Use these steps to create a function app in the Flex Consumption plan. When you
         | **Select a location for new resources** | Select a location in a [region](https://azure.microsoft.com/regions/) near you or near other services that your functions access. |
     | **Select a runtime stack**| Select the language version you currently run locally. |
         | **Select an instance size** | Select **512**. You can always [change the instance size](./flex-consumption-how-to.md#configure-instance-memory) setting to a larger size later. |
-    | **Enter the maximum instance count** | Select the default value of **100**, which limits the total scale-out of your app. You can also choose a different value between 40 and 1,000.  |
+    | **Enter the maximum instance count** | Select the default value of **100**, which limits the total scale-out of your app. You can also choose a different value between 1 and 1,000.  |
     | **Select a resource group**  | Select **Create new resource group** and accept the default or enter another name for the new group that's unique in your subscription.| 
     | **Select resource authentication type** | Select **Managed identity** so that your app connects to remote resources by using Microsoft Entra ID authentication instead of using shared secrets (connection strings and keys), which are less secure. |
     | **Select a user assigned identity** | Select **Create new user-assigned identity**. | 

articles/azure-functions/functions-event-grid-blob-trigger.md

@@ -188,7 +188,7 @@ The following tables compare AWS Lambda concepts, resources, and properties with
  | AWS Lambda  | Azure Functions   |
 |---|---|
 | Provisioned concurrency reduces latency and ensures predictable function performance by pre-initializing a requested number of function instances. Provisioned concurrency suits latency-sensitive applications and is priced separately from standard concurrency.    | Function apps allow you to configure concurrency for each instance, which drives its scale. Multiple jobs can run in parallel in the same instance of the app, and subsequent jobs in the instance don't incur the initial cold start. Function apps also have *always ready* instances. Customers can specify a number of prewarmed instances to eliminate cold-start latency and ensure consistent performance. Function apps also scale out to more instances based on demand, while maintaining the always ready instances.     |
-| Reserved concurrency specifies the maximum number of concurrent instances that a function can have. This limit ensures that a portion of your account's concurrency quota is set aside exclusively for that function. AWS Lambda dynamically scales out to handle incoming requests even when reserved concurrency is set, as long as the requests don't exceed the specified reserved concurrency limit. The lower limit for reserved concurrency in AWS Lambda is 1. The upper limit for reserved concurrency in AWS Lambda is determined by the account's regional concurrency quota. By default, this limit is 1,000 concurrent operations for each region. | Azure Functions doesn't have an equivalent feature to reserved concurrency. To achieve similar functionality, isolate specific functions into separate function apps and set the maximum scale-out limit for each app. Azure Functions dynamically scales out, or adds more instances, and scales in, or removes instances, within the scale-out limit set. By default, apps that run in a Flex Consumption plan start with a configurable limit of 100 overall instances. The lowest maximum instance count value is 40, and the highest supported maximum instance count value is 1,000.  [Regional subscription memory quotas](/azure/azure-functions/flex-consumption-plan#regional-subscription-memory-quotas) can also limit how much function apps can scale out, but you can increase this quota by calling support. |
+| Reserved concurrency specifies the maximum number of concurrent instances that a function can have. This limit ensures that a portion of your account's concurrency quota is set aside exclusively for that function. AWS Lambda dynamically scales out to handle incoming requests even when reserved concurrency is set, as long as the requests don't exceed the specified reserved concurrency limit. The lower limit for reserved concurrency in AWS Lambda is 1. The upper limit for reserved concurrency in AWS Lambda is determined by the account's regional concurrency quota. By default, this limit is 1,000 concurrent operations for each region. | Azure Functions doesn't have an equivalent feature to reserved concurrency. To achieve similar functionality, isolate specific functions into separate function apps and set the maximum scale-out limit for each app. Azure Functions dynamically scales out, or adds more instances, and scales in, or removes instances, within the scale-out limit set. By default, apps that run in a Flex Consumption plan start with a configurable limit of 100 overall instances. The lowest maximum instance count value is 1, and the highest supported maximum instance count value is 1,000.  [Regional subscription memory quotas](/azure/azure-functions/flex-consumption-plan#regional-subscription-memory-quotas) can also limit how much function apps can scale out, but you can increase this quota by calling support. |
 
 ### Pricing
 

articles/azure-functions/migration/migrate-aws-lambda-to-azure-functions.md

@@ -1215,7 +1215,10 @@ Consider concurrency settings first if you want your new app to scale similarly
 
 If you had a custom scale-out limit set in your original app, you can also apply it to your new app. Otherwise, you can skip to the next section.
 
-The default maximum instance count is 100, and it must be set to a value of 40 or higher.
+The default maximum instance count is 100, and it must be set to a value between 1 and 1,000.
+
+> [!NOTE]
+> Reducing maximum instance count below 40 for HTTP function apps can cause frequent request failures and prolonged throttling windows when traffic exceeds capacity. This setting is intended only for advanced scenarios where limited scale-out is acceptable and has been fully tested.
 
 #### [Azure CLI](#tab/azure-cli)
 

articles/azure-functions/migration/migrate-plan-consumption-to-flex.md

@@ -5,7 +5,7 @@ services: azure-netapp-files
 author: b-hchen
 ms.service: azure-netapp-files
 ms.topic: how-to
-ms.date: 01/23/2026
+ms.date: 01/30/2026
 ms.author: anfdocs
 # Customer intent: As a storage administrator, I want to configure manual backups for Azure NetApp Files volumes, so that I can create point-in-time snapshots to ensure data protection and recovery for my applications.
 ---
@@ -15,6 +15,8 @@ Azure NetApp Files backup supports *policy-based* (scheduled) backups and *manua
 
 This article shows you how to configure manual backups. For policy-based backup configuration, see [Configure policy-based backups](backup-configure-policy-based.md).  
 
+[!INCLUDE [Elastic backup preview](includes/elastic-backup-preview.md)]
+
 ## About manual backups  
 
 Every Azure NetApp Files volume must have a backup vault assigned before any backups (policy-based or manual) can be taken. After you assign a backup vault, you can choose to manually back up a volume.