Merge pull request #2608 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-security-docs (branch main)

Author: Taojunshen

articles/key-vault/managed-hsm/multi-region-replication.md

@@ -6,7 +6,7 @@ author: msmbaldwin
 ms.service: azure-key-vault
 ms.subservice: managed-hsm
 ms.topic: tutorial
-ms.date: 06/19/2025
+ms.date: 03/10/2026
 
 ms.author: nkondamudi
 ms.custom: references_regions
@@ -108,6 +108,17 @@ az keyvault region add --hsm-name "ContosoMHSM" --region "australiaeast"
 > [!NOTE]
 > "ContosoMHSM" in this example is the primary HSM pool name; "australiaeast" is the extended region into which you are extending it.
 
+> [!IMPORTANT]
+> After initiating the extension to a new region, do not perform any operations on the primary HSM until the extension region pool is fully provisioned. This is especially critical for networking changes such as configuring private endpoints or updating firewall rules. Performing these operations before the extension pool is ready can result in configuration inconsistencies between regions.
+>
+> To verify that the extension region pool is fully provisioned, run:
+>
+> ```azurecli-interactive
+> az keyvault region list --hsm-name ContosoMHSM
+> ```
+>
+> Confirm that the extended region appears in the output and that its provisioning state shows as **Succeeded** before proceeding with any other HSM operations.
+
 ### Remove an extended region from the primary HSM
 
 Once you remove an extended HSM, the HSM partitions in the other region will be purged. All secondaries must be deleted before a primary managed HSM can be soft-deleted or purged. Only secondaries can be deleted using this command. The primary can only be deleted using the [soft-delete](soft-delete-overview.md#soft-delete-behavior) and [purge](soft-delete-overview.md#purge-protection) commands