Feedback bug fix

Removed sequence diagram and enhancement suggestions for keyless authentication flow.

Author: Susmitha221

learn-pr/wwl-azure/manage-secure-ai-ready-infrastructure/includes/3-implement-keyless-authentication-microsoft.md

@@ -18,42 +18,10 @@ Now that you understand how managed identities provide keyless authentication th
 
 :::image type="content" source="../media/keyless-authentication-flow-system-assigned.png" alt-text="Diagram showing eight steps in the keyless authentication flow.":::
 
-```mermaid
-sequenceDiagram
-    participant Agent as AI Agent App Service
-    participant IMDS as Azure Instance Metadata Service
-    participant EntraID as Microsoft Entra ID
-    participant CosmosDB as Azure Cosmos DB
-    Agent->>IMDS: GET /metadata/identity/oauth2/token?resource=https://cosmos.azure.com
-    IMDS->>EntraID: Validate system-assigned identity for App Service
-    EntraID-->>IMDS: Identity confirmed, generate JWT access token
-    IMDS-->>Agent: Return JWT token (expires in 24 hours)
-    Agent->>CosmosDB: POST /dbs/conversations/colls/sessions/docs with Authorization: Bearer {token}
-    CosmosDB->>EntraID: Validate token signature and check claims
-    EntraID-->>CosmosDB: Token valid, principal has Cosmos DB Data Contributor role
-    CosmosDB->>CosmosDB: Verify RBAC permissions for write operation
-    CosmosDB-->>Agent: HTTP 201 Created with document ID
-```
-
 *Keyless authentication flow using system-assigned managed identity and Azure Instance Metadata Service to write conversation data*
 
-Alt text: Sequence diagram showing eight steps in the keyless authentication flow: 1) AI Agent App Service sends HTTP GET request to Azure Instance Metadata Service requesting an access token for Cosmos DB resource, including the resource parameter set to https://cosmos.azure.com. 2) IMDS sends validation request to Microsoft Entra ID to confirm the App Service has a system-assigned managed identity enabled. 3) Entra ID confirms identity is valid and generates a JWT access token with appropriate claims and 24-hour expiration. 4) IMDS returns the JWT token to the agent application. 5) Agent makes HTTP POST request to Cosmos DB to create a new conversation document, including the token in the Authorization header as Bearer authentication. 6) Cosmos DB sends token to Entra ID to validate the signature and extract claims including the principal identity. 7) Entra ID confirms token is valid and returns the principal's role assignments, showing Cosmos DB Data Contributor permissions. 8) Cosmos DB verifies the principal has write permissions through RBAC and returns HTTP 201 Created response with the new document ID.
-
 ## Additional resources
 
 - [How to use managed identities for App Service and Azure Functions](/azure/app-service/overview-managed-identity) - Detailed guide for enabling and using managed identities in App Service with code samples in multiple languages
 - [Authenticate and authorize with managed identities in Azure Cosmos DB](/azure/cosmos-db/how-to-setup-rbac) - Instructions for configuring role-based access control for Cosmos DB using managed identities instead of connection strings
 - [Azure Instance Metadata Service (IMDS)](/azure/virtual-machines/instance-metadata-service) - Technical reference for the IMDS endpoint including request formats, response schemas, and token acquisition examples
-
-## Enhancement suggestions
-
-- Screenshot of Azure portal showing the Identity blade of an App Service resource with the System assigned tab selected. The Status toggle should be set to On with a green indicator and checkmark. The Object (principal) ID field should display a sample GUID like 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' to show the managed identity's unique identifier. The Azure resource ID field should show the full resource path. Include callout number 1 pointing to the Status toggle and number 2 pointing to the Object ID field with a label explaining 'This ID is used when assigning RBAC roles.'
-- Screenshot showing sample application code or Azure CLI command demonstrating token acquisition from IMDS. For example, a Python code snippet using the requests library to call the IMDS endpoint with appropriate headers including 'Metadata: true' and the resource parameter. The response JSON should show the access_token, expires_on timestamp, and resource fields. Include syntax highlighting and a caption explaining that this code runs inside the Azure resource with managed identity enabled.
-- Four-minute demonstration video showing the complete process of enabling a system-assigned managed identity on an App Service, assigning the Cosmos DB Data Contributor role to that identity through the Access Control (IAM) blade, and then viewing the Activity Log to verify the role assignment event. Video should include voice-over explaining the automatic token acquisition process and how the application code uses the IMDS endpoint without storing any credentials.
-- Three-minute animated explainer video illustrating the token acquisition and validation flow with visual representations of the HTTP requests between agent, IMDS, Entra ID, and Cosmos DB. Animation should highlight the JWT token structure showing header, payload with claims, and signature components, with labels explaining how each part contributes to secure authentication.
-- Interactive managed identity configuration simulator where learners choose between system-assigned and user-assigned identity types, select target resources (Cosmos DB, Key Vault, Storage Account), assign appropriate RBAC roles, and observe a visual representation of the resulting authentication flow. Tool should provide feedback on configuration choices and highlight security best practices versus common mistakes.
-- Hands-on token inspection tool where learners paste a sample JWT access token and the tool decodes and displays the header, payload claims (including principal object ID, resource audience, expiration time), and signature. Tool should include explanatory tooltips for each claim and show how Cosmos DB validates these claims during authorization.
-
-## Accessibility notes
-
-Sequence diagram uses labeled participant boxes at the top with clear names (AI Agent App Service, Azure Instance Metadata Service, Microsoft Entra ID, Azure Cosmos DB). Numbered arrows show request and response flow with descriptive labels including HTTP methods, endpoints, and key parameters. Alt text describes each interaction step in detail including the purpose of the request, the validation performed, and the content of each response. Comparison table uses left-aligned text with clear column headers and row labels, avoiding merged cells or complex formatting that might confuse screen readers.