Merge branch 'main' into release-asr-h2a-deprecation

Author: v-alje

articles/application-gateway/application-gateway-faq.yml

@@ -137,7 +137,7 @@ sections:
           Yes. The Application Gateway v1 SKU continues to be supported. We strongly recommend moving to v2 to take advantage of the feature updates in that SKU. For more information on the differences between v1 and v2 features, see [Autoscaling and zone-redundant Application Gateway v2](application-gateway-autoscaling-zone-redundant.md). You can manually migrate Application Gateway v1 SKU deployments to v2 by following our [v1-v2 migration document](migrate-v1-v2.md).
           
       - question: Does Application Gateway v2 support proxying requests with NTLM or Kerberos authentication?
-        answer: No. Application Gateway v2 doesn't support proxying requests with NTLM or Kerberos authentication.
+        answer: Yes. Application Gateway v2 now supports proxying requests with NTLM or Kerberos authentication.For more information, see [Dedicated backend connection](configuration-http-settings.md#dedicated-backend-connection).
 
       - question: Why are some header values not present when requests are forwarded to my application?
         answer: Request header names can contain alphanumeric characters and hyphens. Request header names that contain other characters are discarded when a request is sent to the backend target. Response header names can contain any alphanumeric characters and specific symbols as defined in [RFC 7230](https://tools.ietf.org/html/rfc7230#page-27).

articles/application-gateway/overview-v2.md

@@ -104,7 +104,7 @@ The following table compares the features available with each SKU.
 | WebSocket support                                 | ✓ | ✓ |
 | HTTP/2 support                                    | ✓ | ✓ |
 | Connection draining                               | ✓ | ✓ |
-| Proxy NTLM authentication                         | ✓ |          |
+| Proxy NTLM authentication                         | ✓ | ✓ |
 | Path based rule encoding                          | ✓ |          |
 | DHE Ciphers                                       | ✓ |          |
 > [!NOTE]

articles/azure-app-configuration/quickstart-container-apps.md

@@ -6,7 +6,7 @@ author: maud-lv
 ms.service: azure-app-configuration
 ms.custom: service-connector
 ms.topic: quickstart
-ms.date: 12/11/2024
+ms.date: 09/19/2025
 ms.author: malev
 
 ---
@@ -18,6 +18,9 @@ In this quickstart, you use Azure App Configuration in an app running in Azure C
 > [!TIP]
 > While following this quickstart, preferably register all new resources within a single resource group, so that you can regroup them all in a single place and delete them faster later on if you don't need them anymore.
 
+> [!IMPORTANT]
+> Support for Service Connector (preview) on Azure Container Apps ends on March 30, 2026. After that date, new service connections using Service Connector (preview) aren't available through any interface. For more information, see [RETIREMENT: Service Connector (Preview) on Azure Container Apps](https://aka.ms/serviceconnectoraca).
+
 ## Prerequisites
 
 - An application using an App Configuration store. If you don't have one, create an instance using the [Quickstart: Create an ASP.NET Core app with App Configuration](./quickstart-aspnet-core-app.md).
@@ -187,4 +190,4 @@ The managed identity enables one Azure resource to access another without you ma
 To learn how to configure your ASP.NET Core web app to dynamically refresh configuration settings, continue to the next tutorial.
 
 > [!div class="nextstepaction"]
-> [Enable dynamic configuration](./enable-dynamic-configuration-aspnet-core.md)
+> [Enable dynamic configuration](./enable-dynamic-configuration-aspnet-core.md)

articles/azure-netapp-files/azure-netapp-files-service-levels.md

@@ -5,7 +5,7 @@ services: azure-netapp-files
 author: b-hchen
 ms.service: azure-netapp-files
 ms.topic: concept-article
-ms.date: 08/22/2025
+ms.date: 09/16/2025
 ms.author: anfdocs
 # Customer intent: "As a cloud storage administrator, I want to understand the throughput capabilities of different service levels in Azure NetApp Files, so that I can choose the right configuration to meet my application's performance requirements."
 ---
@@ -17,7 +17,7 @@ Service levels are an attribute of a capacity pool. Service levels are defined a
 
 Azure NetApp Files supports four service levels: *Flexible*, *Standard*, *Premium*, and *Ultra*.   
 
-* <a name="Flexible"></a>Flexible storage (preview):
+* <a name="Flexible"></a>Flexible storage:
 
     The Flexible service level enables you to adjust throughput and size limits independently. You can use the Flexible service level to create high-capacity volumes with low throughput requirements or the reverse: low-capacity volumes with high throughput requirements. The Flexible service level is designed for demanding applications such as Oracle or SAP HANA.
 

articles/azure-netapp-files/azure-netapp-files-set-up-capacity-pool.md

@@ -5,7 +5,7 @@ services: azure-netapp-files
 author: b-hchen
 ms.service: azure-netapp-files
 ms.topic: how-to
-ms.date: 08/14/2025
+ms.date: 09/16/2025
 ms.author: anfdocs
 ms.custom:
   - build-2025
@@ -25,21 +25,6 @@ Creating a capacity pool enables you to create volumes within it.
     >[!IMPORTANT]
     >To create a 1-TiB capacity pool with a tag, you must use API versions `2023-07-01_preview` to `2024-01-01_preview` or stable releases from `2024-01-01`.
 * The Standard, Premium, and Ultra service levels are generally available (GA). No registration is required. 
-* <a name="flexible"></a> The **Flexible** service level is currently in preview and supported in all Azure NetApp Files regions. You must register the feature before using it for the first time:
-
-    1. Register the feature: 
-
-    ```azurepowershell-interactive
-    Register-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFFlexibleServiceLevel
-    ```
-
-    2. Check the status of feature registration with the command:
-
-    ```azurepowershell-interactive
-    Get-AzProviderFeature -ProviderNamespace Microsoft.NetApp -FeatureName ANFFlexibleServiceLevel
-    ```
-    
-    You can also use [Azure CLI commands](/cli/azure/feature) `az feature show` to register the feature and display the registration status. 
 
 ## Considerations
 

articles/azure-netapp-files/manage-cool-access.md

@@ -5,7 +5,7 @@ services: azure-netapp-files
 author: b-ahibbard
 ms.service: azure-netapp-files
 ms.topic: how-to
-ms.date: 08/14/2025
+ms.date: 09/16/2025
 ms.author: anfdocs
 ms.custom:
   - build-2025
@@ -138,7 +138,7 @@ No registration is required to use cool access at the Standard service level.
 
 # [Flexible](#tab/flexible)
 
-Cool access with the Flexible service level is currently in preview. You must be registered to use the [Flexible service](azure-netapp-files-set-up-capacity-pool.md#flexible) before requesting cool access with the Flexible service level. Once you confirm your registration in the Flexible service level preview, register to use cool access with the Flexible service level. 
+Cool access with the Flexible service level is currently in preview. You must register the feature before using it. 
 
 1. Register the feature: 
 

articles/azure-netapp-files/whats-new.md

@@ -8,7 +8,7 @@ ms.custom:
   - linux-related-content
   - build-2025
 ms.topic: overview
-ms.date: 09/04/2025
+ms.date: 09/16/2025
 ms.author: anfdocs
 # Customer intent: As a cloud administrator, I want to learn about the latest enhancements in Azure NetApp Files, so that I can effectively utilize new features for improved data security, resilience, and operational efficiency in my organization's cloud storage solutions.
 ---
@@ -19,6 +19,12 @@ Azure NetApp Files is updated regularly. This article provides a summary about t
 
 ## September 2025
 
+* [Flexible service level](azure-netapp-files-set-up-capacity-pool.md) is now generally available (GA)
+ 
+    The [Flexible service level](azure-netapp-files-service-levels.md#Flexible) allows you to independently configure storage capacity and throughput, optimizing costs by right-sizing according to storage and performance requirements. With separate pricing for capacity and throughput, the Flexible service level prevents overprovisioning and supports up to 640 MiB/second per TiB. This throughput is five times the performance of the Ultra service level, making it ideal for demanding workloads and offering higher throughput for smaller capacity pools and adapting to changing requirements without the need for volume moves. 
+    
+    The Flexible service level is only supported with _new_ manual QoS capacity pools. The Flexible service level offers a minimum throughput of 128 MiB/s and a maximum of 640 MiB/s per TiB [per pool](azure-netapp-files-service-levels.md#flexible-service-level-throughput-examples). This new service level is suitable for applications such as Oracle or SAP HANA and for creating high-capacity volumes with low throughput needs. You can adjust throughput and size limits independently, ensuring flexibility and precise scaling to meet your price-performance requirements. 
+
 * [Azure NetApp Files datastore support in Azure VMware Solution Generation 2](../azure-vmware/attach-azure-netapp-files-to-azure-vmware-solution-hosts.md)
 
   [Azure NetApp Files datastore](../azure-vmware/attach-azure-netapp-files-to-azure-vmware-solution-hosts.md) is now supported in [Azure VMware Solution (AVS) Generation 2](../azure-vmware/native-introduction.md). AVS Generation 2 private clouds are deployed inside an Azure virtual network. This means that ExpressRoute is no longer needed to connect the Azure VMware Solution to Azure NetApp Files datastores. This deployment simplifies networking architecture, enhances data transfer speeds, reduces latency for workloads, and improves performance when accessing other Azure services. This capability is supported in all regions where Azure VMware Solution Generation 2 and Azure NetApp Files are available.

articles/azure-resource-manager/bicep/modules.md

@@ -254,7 +254,7 @@ module storage 'br/public:avm/res/storage/storage-account:0.18.0' = {
 }
 ```
 
-You can override the public alias in the _bicepconfig.json_ file.
+You can override the public alias in the *bicepconfig.json* file.
 
 ### File in template spec
 
@@ -549,6 +549,28 @@ output storageEndpoint object = stgModule.outputs.storageEndpoint
 
 With Bicep version 0.35.1 and later, the `@secure()` decorator can be applied to module outputs to mark them as sensitive, ensuring that their values are not exposed in logs or deployment history. This is useful when a module needs to return sensitive data, such as a generated key or connection string, to the parent Bicep file without risking exposure. For more information, see [Secure outputs](./outputs.md#secure-outputs).
 
+## Module identity
+
+Starting with Bicep version 0.36.1, you can assign a user-assigned managed identity to a module. This makes the identity available within the module—for example, to access a Key Vault. However, this capability is intended for future use and is not yet supported by backend services.
+
+```bicep
+param identityId string
+
+module mod './module.bicep' = {
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${identityId}': {}
+    }
+  }
+  name: 'mod'
+  params: {
+    keyVaultUri: 'keyVaultUri'
+    identityId: identityId
+  }
+}
+```
+
 ## Related content
 
 - For a tutorial, see [Build your first Bicep file](/training/modules/deploy-azure-resources-by-using-bicep-templates/).

articles/backup/azure-file-share-support-matrix.md

@@ -33,7 +33,7 @@ Vaulted backup for Azure Files is available in the following regions: UK South,
 
 Cross Region Restore is supported in all preceding regions, except Italy North.
 
-Migration of  File Shares protected with snapshot backup to vaulted backup is supported in the following regions: UK South, UK West, Southeast Asia, East Asia, West Central US, India Central, Spain Central, Jio India West, Israel Central, Australia Central 2 and Germany North. 
+Migration of  File Shares protected with snapshot backup to vaulted backup is supported in the following regions: UK South, UK West, Southeast Asia, East Asia, West Central US, India Central, Spain Central, Jio India West, Israel Central, Australia Central 2 and Germany North, Brazil South, Switzerland North, South Africa North, Australia Southeast, Sweden Central, Norway East, UAE North, West US 3, Japan West, Korea Central, Canada East, South India, Italy North, Poland Central, Australia Central. 
 
 >[!Note]
 >Cross Subscription Backup and Restore are supported for vaulted backup.

articles/backup/backup-azure-restore-files-from-vm.md

@@ -2,7 +2,7 @@
 title: Recover files and folders from Azure VM backup
 description: In this article, learn how to recover files and folders from an Azure virtual machine recovery point.
 ms.topic: how-to
-ms.date: 06/18/2025
+ms.date: 09/18/2025
 ms.custom: references_regions
 ms.service: azure-backup
 author: AbhishekMallick-MS
@@ -32,25 +32,23 @@ To restore files or folders from the recovery point, go to the virtual machine a
 
 2. In the virtual machine's menu, select **Backup** to open the Backup dashboard.
 
-    ![Open Recovery Services vault backup item](./media/backup-azure-restore-files-from-vm/open-vault-for-vm.png)
+    :::image type="content" source="./media/backup-azure-restore-files-from-vm/open-vault-for-vm.png" alt-text="Screenshot shows how to open Recovery Services vault backup item." lightbox="./media/backup-azure-restore-files-from-vm/open-vault-for-vm.png":::
 
 3. In the Backup dashboard menu, select **File Recovery**.
 
-    ![Select File Recovery](./media/backup-azure-restore-files-from-vm/vm-backup-menu-file-recovery-button.png)32
+    ![Select File Recovery](./media/backup-azure-restore-files-from-vm/vm-backup-menu-file-recovery-button.png)
 
     The **File Recovery** menu opens.
 
-    ![File recovery menu](./media/backup-azure-restore-files-from-vm/file-recovery-blade.png)
+    ![File recovery menu](./media/backup-azure-restore-files-from-vm/file-recovery-pane.png)
 
 > [!IMPORTANT]
 > Users should note the performance limitations of this feature. As pointed out in the footnote section of the above blade, this feature should be used when the total size of recovery is 10 GB or less. The expected data transfer speeds are around 1 GB per hour.
 
-4. From the **Select recovery point** drop-down menu, select the recovery point that holds the files you want. By default, the latest recovery point is already selected.
+4. Under **Select restore point**, click **Select** to choose the restore point that contains the required files for restore.
 
 5. Select **Download Executable** (for Windows Azure VMs) or **Download Script** (for Linux Azure VMs, a Python script is generated) to download the software used to copy files from the recovery point.
 
-    ![Download Executable](./media/backup-azure-restore-files-from-vm/download-executable.png)
-
     Azure downloads the executable or script to the local computer.
 
     ![download message for the executable or script](./media/backup-azure-restore-files-from-vm/run-the-script.png)
@@ -59,12 +57,9 @@ To restore files or folders from the recovery point, go to the virtual machine a
 
 6. The executable or script is password protected and requires a password. In the **File Recovery** menu, select the copy button to load the password into memory.
 
-    ![Generated password](./media/backup-azure-restore-files-from-vm/generated-pswd.png)
-
-
 ## Step 2: Ensure the machine meets the requirements before executing the script
 
-After the script is successfully downloaded, make sure you have the right machine to execute this script. The VM where you are planning to execute the script, should not have any of the following unsupported configurations. **If it does, then choose an alternate machine that meets the requirements**.
+After the script is successfully downloaded, make sure you have the right machine to execute this script. The VM where you're planning to execute the script, shouldn't have any of the following unsupported configurations. **If it does, then choose an alternate machine that meets the requirements**.
 
 ### Dynamic disks
 
@@ -142,18 +137,18 @@ If you run the script on a computer with restricted access, ensure there's acces
   - `https://pod01-rec2.GEO-NAME.backup.windowsazure.us` (For Azure US Government) or `AzureBackup` service tag in NSG
   - `https://pod01-rec2.GEO-NAME.backup.windowsazure.de` (For Azure Germany) or `AzureBackup` service tag in NSG
 - Public DNS resolution on port 53 (outbound)
-- The access requirement of the Microsoft Entra ID are `*.microsoft.com`, `*.windowsazure.com`, and `*.windows.net` on port 443 (outbound).
+- The access requirement of the Microsoft Entra ID is `*.microsoft.com`, `*.windowsazure.com`, and `*.windows.net` on port 443 (outbound).
 
 > [!NOTE]
-> Proxies may not support iSCSI protocol or give access to port 3260. Hence it is strongly recommended to run this script on machines which have direct access as required above and not on the machines which will redirect to proxy.
+> Proxies may not support iSCSI protocol or give access to port 3260. Hence it's strongly recommended to run this script on machines which have direct access as required above and not on the machines which will redirect to proxy.
 
 > [!NOTE]
 >
-> In case, the backed up VM is Windows, then the geo-name will be mentioned in the password generated.<br><br>
+> In case, the backed-up VM is Windows, then the geo-name will be mentioned in the password generated.<br><br>
 > For example, if the generated password is *ContosoVM_wcus_GUID*, then geo-name is wcus and the URL would be: <`https://pod01-rec2.wcus.backup.windowsazure.com`><br><br>
 >
 >
-> If the backed up VM is Linux, then the script file you downloaded in step 1 [above](#step-1-generate-and-download-script-to-browse-and-recover-files) will have the **geo-name** in the name of the file. Use that **geo-name** to fill in the URL. The downloaded script name will begin with: \'VMname\'\_\'geoname\'_\'GUID\'.<br><br>
+> If the backed-up VM is Linux, then the script file you downloaded in step 1 [above](#step-1-generate-and-download-script-to-browse-and-recover-files) will have the **geo-name** in the name of the file. Use that **geo-name** to fill in the URL. The downloaded script name will begin with: \'VMname\'\_\'geoname\'_\'GUID\'.<br><br>
 > So for example, if the script filename is *ContosoVM_wcus_12345678*, the **geo-name** is *wcus* and the URL would be: <`https://pod01-rec2.wcus.backup.windowsazure.com`><br><br>
 >
 
@@ -168,7 +163,7 @@ Also, ensure that you have the [right machine to execute the ILR script](#step-2
 
 > [!NOTE]
 >
-> The script is generated in English language only and is not localized. Hence it might require that the system locale is in English for the script to execute properly
+> The script is generated in English language only and isn't localized. Hence it might require that the system locale is in English for the script to execute properly
 >
 
 
@@ -215,7 +210,7 @@ If the file recovery process hangs after you run the file-restore script (for ex
 
 1. In the file /etc/iscsi/iscsid.conf, change the setting from:
     - `node.conn[0].timeo.noop_out_timeout = 5`  to `node.conn[0].timeo.noop_out_timeout = 120`
-2. After making the above changes, rerun the script. If there are transient failures, ensure there is a gap of 20 to 30 minutes between reruns to avoid successive bursts of requests impacting the target preparation. This interval between re-runs will ensure the target is ready for connection from the script.
+2. After making the above changes, rerun the script. If there are transient failures, ensure there's a gap of 20 to 30 minutes between reruns to avoid successive bursts of requests impacting the target preparation. This interval between re-runs will ensure the target is ready for connection from the script.
 3. After file recovery, make sure you go back to the portal and select **Unmount disks** for recovery points where you weren't able to mount volumes. Essentially, this step will clean any existing processes/sessions and increase the chance of recovery.