Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into llmf

Author: dlepow

articles/api-management/api-management-gateways-overview.md

@@ -8,7 +8,7 @@ ms.service: azure-api-management
 ms.custom:
   - build-2024
 ms.topic: concept-article
-ms.date: 02/11/2026
+ms.date: 02/17/2026
 ms.author: danlep
 ---
 
@@ -110,7 +110,7 @@ The following tables compare features available in the following API Management
 | [Pass-through GraphQL](graphql-apis-overview.md) |  ✔️ | ✔️ |✔️ | ✔️ | ✔️ |
 | [Synthetic GraphQL](graphql-apis-overview.md)|  ✔️ |  ✔️ | ✔️<sup>1</sup> | ✔️<sup>1</sup> | ❌ |
 | [Pass-through WebSocket](websocket-api.md) |  ✔️ |  ✔️ | ❌ | ✔️ | ✔️ |
-| [Pass-through gRPC](grpc-api.md)  |  ❌ | ❌ | ❌ | ✔️ | ❌ |
+| [Pass-through gRPC](grpc-api.md)  |  ✔️ | ❌ | ❌ | ✔️ | ❌ |
 | [OData](import-api-from-odata.md)  |  ✔️ |  ✔️ | ✔️ | ✔️ | ✔️ |
 | [Azure OpenAI in Microsoft Foundry models and LLMs](azure-ai-foundry-api.md) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
 | [Pass-through MCP server](expose-existing-mcp-server.md) | ✔️  | ✔️ | ❌ | ✔️ | ❌ |

articles/api-management/grpc-api.md

@@ -6,7 +6,7 @@ author: dlepow
 
 ms.service: azure-api-management
 ms.topic: how-to
-ms.date: 10/06/2025
+ms.date: 02/18/2026
 ms.author: danlep
 ms.custom:
   - devx-track-arm-template
@@ -17,7 +17,7 @@ ms.custom:
 ---
 # Import a gRPC API
 
-[!INCLUDE [api-management-availability-premium-dev](../../includes/api-management-availability-premium-dev.md)]
+[!INCLUDE [api-management-availability-premium-dev-standard-basic](../../includes/api-management-availability-premium-dev-standard-basic.md)]
 
 This article shows how to import a gRPC service definition as an API in API Management. You can then manage the API in API Management, secure access and apply other policies, and pass gRPC API requests through the gateway to the gRPC backend. 
 
@@ -30,21 +30,21 @@ To add a gRPC API to API Management, you need to:
 API Management supports pass-through with the following types of gRPC service methods: unary, server streaming, client streaming, and bidirectional streaming. To learn more about gRPC, see [Introduction to gRPC](https://grpc.io/docs/what-is-grpc/introduction/).
 
 > [!NOTE]
-> * Currently, gRPC APIs are only supported in the self-hosted gateway, not the managed gateway for your API Management instance.
+> * gRPC APIs are supported in the [self-hosted gateway](self-hosted-gateway-overview.md) and in the managed gateway for classic tier instances created starting January 2026 (preview). Contact support to enable gRPC API support in classic tier instances created before this date. gRPC APIs currently aren't supported in the v2 tiers.
 > * Currently, testing gRPC APIs isn't supported in the test console of the Azure portal or in the API Management developer portal.
-> * Import is limited to a single protobuf (*.proto*) file. 
+> * Import is limited to a single protobuf (*.proto*) file.  
 
 ## Prerequisites
 
 * An API Management instance. If you don't already have one, complete the following quickstart: [Create an Azure API Management instance](get-started-create-service-instance.md).
 
-* A gateway resource provisioned in your instance. If you don't already have one, see [Provision a self-hosted gateway in Azure API Management](api-management-howto-provision-self-hosted-gateway.md).
-
 * A gRPC protobuf (*.proto*) file available locally, and gRPC service that's accessible over HTTPS.
 
+* HTTP/2 protocol support enabled for client traffic. For more information, see [Manage protocols and ciphers in Azure API Management](api-management-howto-manage-protocols-ciphers.md).
+
 ## Add a gRPC API
 
-1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.
+1. In the [Azure portal](https://portal.azure.com), go to your API Management instance.
 
 1. Under **APIs** in the sidebar menu, select **APIs**.
 
@@ -54,7 +54,7 @@ API Management supports pass-through with the following types of gRPC service me
 
 1. In the **Create a gRPC API window**, select **Full**.
 
-1. For a gRPC API, you must specify the following settings:
+1. For a gRPC API, specify the following settings:
 
     1. Enter a display name.
 
@@ -64,18 +64,15 @@ API Management supports pass-through with the following types of gRPC service me
 
     1. For **Gateways**, select the gateway resource that you want to use to expose the API. 
 
-        > [!IMPORTANT]
-        > In public preview, you can only select a self-hosted gateway. The **Managed** gateway isn't supported.
-
-1. Enter any remaining settings to configure your API. These settings are explained in the [Import and publish your first API](import-and-publish.md#import-and-publish-a-backend-api) tutorial.
+1. Enter any remaining settings to configure your API. The [Import and publish your first API](import-and-publish.md#import-and-publish-a-backend-api) tutorial explains these settings.
 
 1. Select **Create**.
 
-    The API is added to the **APIs** list. You can view update your settings by going to the **Settings** tab of the API.
+    The portal adds the API to the **APIs** list. You can view and update your settings by going to the **Settings** tab of the API.
 
-## Call gRPC services with .NET
+## Call gRPC services by using .NET
 
-For information about calling gRPC services with .NET, see the following articles:
+For information about calling gRPC services by using .NET, see the following articles:
 
 * [Tutorial: Create a gRPC client and server in ASP.NET Core](/aspnet/core/tutorials/grpc/grpc-start)
 * [Troubleshoot gRPC on .NET](/aspnet/core/grpc/troubleshoot#calling-grpc-services-hosted-in-a-sub-directory)

articles/api-management/migrate-amazon-api-gateway-to-api-management.md

@@ -142,7 +142,7 @@ As part of the assessment, consider whether to retain or replace existing servic
 - *OpenAPI specifications* exported from an Amazon API Gateway REST API contain details specific to the frontend implementation in Amazon API Gateway, not the backend service. You need to remove AWS-specific tags and configure details in the specification (such as the backend service URL) before import to Azure API Management or during the migration process. 
 - *Kubernetes microservices* backends, such as gRPC APIs, are handled differently:
   - Amazon API Gateway connects to the application load balancer in VPC, which in turn provides ingress to AWS EKS.
-  - Azure API Management supports gRPC APIs on Kubernetes clusters accessed only through the self-hosted gateway.
+  - Azure API Management typically supports gRPC and other microservice APIs on Kubernetes clusters through the self-hosted gateway.
   - Use of gRPC prevents the use of Application Gateway as a WAF.
 
 ### Compare API configurations

articles/application-gateway/configure-application-gateway-with-private-frontend-ip.md

@@ -6,7 +6,7 @@ services: application-gateway
 author: mbender-ms
 ms.service: azure-application-gateway
 ms.topic: how-to
-ms.date: 08/09/2024
+ms.date: 02/26/2026
 ms.author: mbender
 ms.custom: sfi-image-nochange
 # Customer intent: "As a network administrator, I want to configure an internal load balancer with a private frontend IP for my application gateway, so that I can manage and optimize traffic for internal applications without exposing them to the Internet."
@@ -106,14 +106,19 @@ To do this:
    - Select **Windows Server 2019 Datacenter** for **Image**.
    - Type a valid **Username**.
    - Type a valid **Password**.
+   - For **Public inbound ports**, select **None**.
 1. Accept the remaining defaults and select **Next: Disks**.
 1. Accept the defaults and select **Next : Networking**.
 1. Ensure that **myVNet** is selected for the virtual network and the subnet is **myBackendSubnet**.
+1. For **Public IP**, select **None**.
 1. Accept the remaining defaults, and select **Next : Management**.
 1. Select **Disable** to disable boot diagnostics.
 1. Select **Review + create**.
 1. Review the settings on the summary page, and then select **Create**. It may take several minutes to create the VM. Wait until the deployment finishes successfully before moving on to the next section.
 
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 ### Install IIS
 
 1. Open the Cloud Shell and ensure that it's set to **PowerShell**.

articles/application-gateway/create-multiple-sites-portal.md

@@ -6,7 +6,7 @@ services: application-gateway
 author: mbender-ms
 ms.service: azure-application-gateway
 ms.topic: tutorial
-ms.date: 06/13/2023
+ms.date: 02/26/2026
 ms.author: mbender
 ms.custom: sfi-image-nochange
 #Customer intent: As an IT administrator, I want to use the Azure portal to set up an application gateway so I can host multiple sites.
@@ -170,13 +170,17 @@ To add backend targets, you'll:
     - **Region**: Select the same region that you used before.
     - **Username**: Enter a name for the administrator user name.
     - **Password**: Enter a password for the administrator.
-1. Accept the other defaults and then select **Next: Disks**.  
+    - **Public inbound ports**: Select **None**.
+1. Accept the other defaults and then select **Next: Disks**.
 2. Accept the **Disks** tab defaults and then select **Next: Networking**.
-3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
+3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Set **Public IP** to **None**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
 4. On the **Management** tab, set **Boot diagnostics** to **Disable**. Accept the other defaults and then select **Review + create**.
 5. On the **Review + create** tab, review the settings, correct any validation errors, and then select **Create**.
 6. Wait for the virtual machine creation to complete before continuing.
 
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 ### Install IIS for testing
 
 In this example, you install IIS on the virtual machines only to verify Azure created the application gateway successfully.

articles/application-gateway/create-ssl-portal.md

@@ -5,7 +5,7 @@ services: application-gateway
 author: mbender-ms
 ms.service: azure-application-gateway
 ms.topic: tutorial
-ms.date: 06/30/2022
+ms.date: 02/26/2026
 ms.author: mbender
 ms.custom: sfi-image-nochange
 #Customer intent: As an IT administrator, I want to use the Azure portal to configure Application Gateway with TLS termination so I can secure my application traffic.
@@ -197,9 +197,14 @@ To do this, you'll:
     - **Virtual machine name**: Enter *myVM* for the name of the virtual machine.
     - **Username**: Enter a name for the administrator user name.
     - **Password**: Enter a password for the administrator account.
+    - **Public inbound ports**: Select **None**.
+
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 1. Accept the other defaults and then select **Next: Disks**.  
 2. Accept the **Disks** tab defaults and then select **Next: Networking**.
-3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Accept the other defaults and then select **Next: Management**.
+3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. For **Public IP**, select **None**. Accept the other defaults and then select **Next: Management**.
 
    Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
 1. On the **Management** tab, set **Boot diagnostics** to **Disable**. Accept the other defaults and then select **Review + create**.
@@ -228,7 +233,7 @@ In this example, you install IIS on the virtual machines only to verify Azure cr
             -Location <location>
    ```
 
-3. Create a second virtual machine and install IIS by using the steps that you previously completed. Use *myVM2* for the virtual machine name and for the **VMName** setting of the **Set-AzVMExtension** cmdlet.
+3. Create a second virtual machine and install IIS by using the steps that you previously completed. Use *myVM2* for the virtual machine name and for the **VMName** setting of the **Set-AzVMExtension** cmdlet. Set **Public inbound ports** to **None** and **Public IP** to **None** as you did for *myVM*.
 
 ### Add backend servers to backend pool
 

articles/application-gateway/deploy-basic-portal.md

@@ -5,7 +5,7 @@ description: Learn how to deploy Application Gateway Basic.
 services: application-gateway
 author: mbender-ms
 ms.topic: how-to
-ms.date: 05/06/2024
+ms.date: 02/26/2026
 ms.author: mbender
 ms.service: azure-application-gateway
 ms.custom:
@@ -173,9 +173,13 @@ To do this:
     - **Username**: Type a name for the administrator user name.
     - **Password**: Type a password.
     - **Public inbound ports**: None.
+
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 4. Accept the other defaults and then select **Next: Disks**.  
 5. Accept the **Disks** tab defaults and then select **Next: Networking**.
-6. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it's in, but you need to ensure there's IP connectivity.
+6. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Verify that **Public IP** is set to **None**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it's in, but you need to ensure there's IP connectivity.
 7. Select **Next: Monitoring** and set **Boot diagnostics** to **Disable**. Accept the other defaults and then select **Review + create**.
 8. On the **Review + create** tab, review the settings, correct any validation errors, and then select **Create**.
 9. Wait for the virtual machine creation to complete before continuing.

articles/application-gateway/tutorial-protect-application-gateway-ddos.md

@@ -5,7 +5,7 @@ description: Learn how to set up an application gateway and protect it with Azur
 services: application-gateway
 author: duongau
 ms.author: duau
-ms.date: 09/20/2023
+ms.date: 02/26/2026
 ms.topic: quickstart
 ms.service: azure-application-gateway
 ms.custom: sfi-image-nochange
@@ -199,9 +199,13 @@ To do this, you'll:
     - **Username**: Type a name for the administrator user name.
     - **Password**: Type a password.
     - **Public inbound ports**: None.
+
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 4. Accept the other defaults and then select **Next: Disks**.  
 5. Accept the **Disks** tab defaults and then select **Next: Networking**.
-6. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
+6. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Set **Public IP** to **None**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
 7. On the **Management** tab, set **Boot diagnostics** to **Disable**. Accept the other defaults and then select **Review + create**.
 8. On the **Review + create** tab, review the settings, correct any validation errors, and then select **Create**.
 9. Wait for the virtual machine creation to complete before continuing.

articles/azure-resource-manager/management/async-operations.md

@@ -1,8 +1,8 @@
----
+---
 title: Status of asynchronous operations
 description: Describes how to track asynchronous operations in Azure. It shows the values you use to get the status of a long-running operation.
 ms.topic: article
-ms.date: 01/22/2025
+ms.date: 02/27/2026
 ---
 
 # Track asynchronous Azure operations

articles/azure-resource-manager/management/authenticate-multi-tenant.md

@@ -1,9 +1,9 @@
----
+---
 title: Authenticate across tenants
 description: Describes how Azure Resource Manager handles authentication requests across tenants.
 ms.topic: article
 ms.custom: devx-track-arm-template
-ms.date: 01/22/2025
+ms.date: 02/27/2026
 ---
 
 # Authenticate requests across tenants