Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into release-microsoft-discovery

Author: Mukesh Dua

articles/api-management/api-management-howto-api-inspector.md

@@ -85,7 +85,8 @@ Detailed steps follow.
 
 > [!NOTE]
 >
-> - These steps require API Management REST API version 2023-05-01-preview or later. You must be assigned the Contributor or higher role on the API Management instance to call the REST API.
+> - These steps require API Management REST API version 2023-05-01-preview or later.
+> - You must be assigned the Contributor or higher role on the API Management instance or have equivalent write permissions on the API to obtain a debug token.
 > - For information about authenticating to the REST API, see [Azure REST API reference](/rest/api/azure). 
 
 1. **Obtain a debug token**. Call the API Management gateway's [List debug credentials](/rest/api/apimanagement/gateway/list-debug-credentials) API. In the URI, enter *managed* for the instance's managed gateway in the cloud, or the gateway ID for a self-hosted gateway. For example, to obtain trace credentials for the instance's managed gateway, use a request similar to the following example:

articles/api-management/configure-service-update-settings.md

@@ -4,13 +4,13 @@ description: Learn how to configure settings for applying service updates to you
 author: dlepow
 ms.service: azure-api-management
 ms.topic: how-to
-ms.date: 11/25/2025
+ms.date: 04/13/2026
 ms.author: danlep
 ---
 
 # Configure service update settings for your API Management instances 
 
-[!INCLUDE [api-management-availability-premium-standard-basic](../../includes/api-management-availability-premium-standard-basic.md)]
+[!INCLUDE [api-management-availability-premium-dev-standard-basic](../../includes/api-management-availability-premium-dev-standard-basic.md)]
 
 
 This article shows you how to configure *service update* settings (preview) in your API Management instance. Azure periodically applies service updates automatically to API Management instances by using a phased rollout approach. These updates include new features, security enhancements, and reliability improvements. 
@@ -25,8 +25,8 @@ An update group (also called a *release channel*) is a set of instances that rec
 |--------------|-------------|
 | **AI Gateway Early** (GenAI release channel) | Gets early access to the latest [AI gateway features and updates](genai-gateway-capabilities.md) before they reach other update groups.<br/><br/>Combines the most stable mainline service updates with the newest AI-specific features. Receives other service updates as part of the **Late** update group, enabling faster deployment of AI-related capabilities. |
 | **Early** | Receives updates early in the rollout, for testing and early access to new features. This option isn't recommended for production deployments. |
-| **Default** | Receives updates as part of the regular release rollout. This option is recommended for most services, including production deployments. |
-| **Late** | Receives updates later than the previous groups, typically weeks after the initial rollout. This option is recommended for mission-critical deployments only. |
+| **Default** | Receives updates as part of the regular release rollout. This option is recommended for most services, including production deployments. *Not available in Developer tier*.|
+| **Late** | Receives updates later than the previous groups, typically weeks after the initial rollout. This option is recommended for mission-critical deployments only. *Not available in Developer tier*.|
 
 
 > [!NOTE]

articles/azure-resource-manager/bicep/bicep-functions-resource.md

@@ -5,7 +5,7 @@ ms.topic: reference
 ms.custom:
   - devx-track-bicep
   - build-2025
-ms.date: 12/22/2025
+ms.date: 04/17/2026
 ---
 
 # Resource functions for Bicep
@@ -661,6 +661,48 @@ output storageID string = storageAccount.id
 
 For more information, see the [JSON template resourceId function](../templates/template-functions-resource.md#resourceid).
 
+## roleDefinitions
+
+`roleDefinisions(roleName)`
+
+Returns information about the specified role definition, including `id` and `roleDefinitionId`. It's a name-based helper for Azure RBAC role assignments. Instead of requiring you to hardcode the GUID of a built-in role definition (like Contributor, Reader, and others), it lets you provide the built-in role’s display name, and the function resolves the corresponding role definition information at deployment time.
+
+Namespace: [az](bicep-functions.md#namespaces-for-functions).
+
+### Parameters
+
+| Parameter | Required | Type | Description |
+|:--- |:--- |:--- |:--- |
+| roleName | Yes | string | The display name of the role definition. |
+
+### Return value
+
+An object representing the role definition, including `id` and `roleDefinitionId`.
+
+### Examples
+
+The following Bicep code creates a deterministic Azure RBAC role assignment that grants a specified principal the **Storage Blob Data Reader** built‑in role at the deployment scope by resolving the role definition by name at deployment time.
+
+```bicep
+@description('Specifies the role definition ID used in the role assignment.')
+param roleDefinitionName string = 'Storage Blob Data Reader'
+
+@description('Specifies the principal ID assigned to the role.')
+param principalId string
+
+var roleAssignmentName= guid(principalId, roleDefinitionName, resourceGroup().id)
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: roleAssignmentName
+  properties: {
+    roleDefinitionId: roleDefinitions(roleDefinitionName).id
+    principalId: principalId
+  }
+}
+
+```
+
+For more information, see the [JSON template resourceId function](../templates/template-functions-resource.md#roledefinitions).
+
 ## subscriptionResourceId
 
 `subscriptionResourceId([subscriptionId], resourceType, resourceName1, [resourceName2], ...)`

articles/azure-resource-manager/bicep/bicep-functions.md

@@ -2,7 +2,7 @@
 title: Bicep functions overview
 description: Learn about the functions that can be used in a Bicep file to retrieve values, work with strings and numerics, and retrieve deployment information.
 ms.topic: reference
-ms.date: 09/11/2025
+ms.date: 04/17/2026
 ms.custom:
   - devx-track-bicep
   - build-2025
@@ -158,6 +158,7 @@ The following functions are available for getting resource values. Most of these
 * [providers (deprecated)](./bicep-functions-resource.md#providers)
 * [reference](./bicep-functions-resource.md#reference)
 * [resourceId](./bicep-functions-resource.md#resourceid) - This can be used at any scope, but the valid parameters change depending on the scope.
+* [roleDefinitions](./bicep-functions-resource.md#roledefinitions)
 * [subscriptionResourceId](./bicep-functions-resource.md#subscriptionresourceid)
 * [tenantResourceId](./bicep-functions-resource.md#tenantresourceid)
 * [toLogicalZone](./bicep-functions-resource.md#tologicalzone)

articles/azure-resource-manager/bicep/toc.yml

@@ -355,7 +355,7 @@ items:
       displayName: externalInput,getSecret,readEnvironmentVariable
       href: bicep-functions-parameters-file.md
     - name: Resource functions
-      displayName: extensionResourceId,getSecret,listAccountSas,ListKeys,listSecrets,list,managementGroupResourceId,pickZones,providers,reference,resourceId,subscriptionResourceId,tenantResourceId,toLogicalZone,toLogicalZones,toPhysicalZone,toPhysicalZones
+      displayName: extensionResourceId,getSecret,listAccountSas,ListKeys,listSecrets,list,managementGroupResourceId,pickZones,providers,reference,resourceId,roleDefinitions,subscriptionResourceId,tenantResourceId,toLogicalZone,toLogicalZones,toPhysicalZone,toPhysicalZones
       href: bicep-functions-resource.md
     - name: Scope functions
       displayName: managementGroup,resourceGroup,subscription,tenant

articles/azure-resource-manager/templates/template-functions-resource.md

@@ -1258,6 +1258,66 @@ The output of default values from the preceding example is:
 | differentSubOutput | String | /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/otherResourceGroup/providers/Microsoft.Storage/storageAccounts/examplestorage |
 | nestedResourceOutput | String | /subscriptions/{current-sub-id}/resourceGroups/examplegroup/providers/Microsoft.SQL/servers/serverName/databases/databaseName |
 
+## roleDefinitions
+
+`roleDefinisions(roleName)`
+
+Returns information about the specified role definition, including `id` and `roleDefinitionId`. It's a name-based helper for Azure RBAC role assignments. Instead of requiring you to hardcode the GUID of a built-in role definition (like Contributor, Reader, and others), it lets you provide the built-in role’s display name, and the function resolves the corresponding role definition information at deployment time.
+
+In Bicep, use the [roleDefinitions](../bicep/bicep-functions-resource.md#roledefinitions) function.
+
+### Parameters
+
+| Parameter | Required | Type | Description |
+|:--- |:--- |:--- |:--- |
+| roleName | Yes | string | The display name of the role definition. |
+
+### Return value
+
+An object representing the role definition, including `id` and `roleDefinitionId`.
+
+### Examples
+
+The following ARM template creates a deterministic Azure RBAC role assignment that grants a specified principal the **Storage Blob Data Reader** built‑in role at the deployment scope by resolving the role definition by name at deployment time.
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "roleDefinitionName": {
+      "type": "string",
+      "defaultValue": "Storage Blob Data Reader",
+      "metadata": {
+        "description": "Specifies the role definition ID used in the role assignment."
+      }
+    },
+    "principalId": {
+      "type": "string",
+      "metadata": {
+        "description": "Specifies the principal ID assigned to the role."
+      }
+    }
+  },
+  "variables": {
+    "roleAssignmentName": "[guid(parameters('principalId'), parameters('roleDefinitionName'), resourceGroup().id)]"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "name": "[variables('roleAssignmentName')]",
+      "properties": {
+        "roleDefinitionId": "[roleDefinitions(parameters('roleDefinitionName')).id]",
+        "principalId": "[parameters('principalId')]"
+      }
+    }
+  ]
+}
+```
+
+For more information, see the [Bicep roleDefinition function](../bicep/bicep-functions-resource.md#roledefinitions).
+
 ## subscription
 
 See the [`subscription` scope](template-functions-scope.md#subscription) function for more information.

articles/azure-resource-manager/templates/template-functions.md

@@ -3,7 +3,7 @@ title: Template functions
 description: Describes the functions to use in an Azure Resource Manager template (ARM template) to retrieve values, work with strings and numerics, and retrieve deployment information.
 ms.topic: reference
 ms.custom: devx-track-arm-template
-ms.date: 07/10/2025
+ms.date: 04/17/2026
 ---
 
 # ARM template functions
@@ -262,6 +262,7 @@ Resource Manager provides the following functions for getting resource values:
 * [reference](template-functions-resource.md#reference)
 * [references](template-functions-resource.md#references)
 * [resourceId](template-functions-resource.md#resourceid) - can be used at any scope, but the valid parameters change depending on the scope.
+* [roleDefinitions](template-functions-resource.md#roledefinitions)
 * [subscriptionResourceId](template-functions-resource.md#subscriptionresourceid)
 * [tenantResourceId](template-functions-resource.md#tenantresourceid)
 

articles/private-link/private-endpoint-dns.md

@@ -7,7 +7,7 @@ ms.service: azure-private-link
 ms.custom:
   - ignite-2024
 ms.topic: concept-article
-ms.date: 08/04/2025
+ms.date: 04/17/2026
 # Customer intent: As a network administrator, I want to configure private DNS zone values for Azure services with private endpoints, so that I can ensure proper DNS resolution for secure connections within my network.
 ---
 
@@ -167,6 +167,7 @@ For Azure services, use the recommended zone names as described in the following
 > | Private link resource type | Subresource | Private DNS zone name | Public DNS zone forwarders |
 > |---|---|---|---|
 > | Azure Media Services (Microsoft.Media/mediaservices) | keydelivery </br> liveevent </br> streamingendpoint | privatelink.media.azure.net | media.azure.net |
+> | Azure AI Video Indexer (Microsoft.VideoIndexer/accounts) | account | privatelink.api.videoindexer.ai | api.videoindexer.ai |
 
 ### Management and Governance
 
@@ -223,6 +224,7 @@ For Azure services, use the recommended zone names as described in the following
 > | Azure Web Apps / Azure Function Apps (Microsoft.Web/sites) | sites | privatelink.azurewebsites.net </br> scm.privatelink.azurewebsites.net<sup>3</sup> | azurewebsites.net </br> scm.azurewebsites.net |
 > | SignalR (Microsoft.SignalRService/SignalR) | signalr | privatelink.service.signalr.net | service.signalr.net |
 > | Azure Static Web Apps (Microsoft.Web/staticSites) | staticSites | privatelink.azurestaticapps.net </br> privatelink.{partitionId}.azurestaticapps.net | azurestaticapps.net </br> {partitionId}.azurestaticapps.net |
+> | Azure Maps (Microsoft.Maps/accounts) | account | privatelink.account.maps.azure.com | account.maps.azure.com |
 > | Azure Web PubSub service (Microsoft.SignalRService/WebPubSub) | webpubsub | privatelink.webpubsub.azure.com | webpubsub.azure.com |
 
 <sup>1</sup>If you are using Azure Private DNS Zones, do not deploy this as an additional zone. DNS entries will be automatically added to the existing DNS Zone `privatelink.azurecr.io`.