docs(architect): weekly KB update — 106 files refreshed (2026-04)

Updates across all 5 skills: ms-ai-advisor, ms-ai-engineering,
ms-ai-governance, ms-ai-security, ms-ai-infrastructure.

Key changes:
- Language Services (Custom Text Classification, Text Analytics, QnA):
  retirement warning 2029-03-31, migration guides to Foundry/GPT-4o
- Agentic Retrieval: 50M free reasoning tokens/month (Public Preview)
- Computer Use: Claude Sonnet 4.5 (preview) + OpenAI CUA models
- Agent Registry: Risks column (M365 E7), user-shared/org-published types
- Declarative agents: schema v1.5 → v1.6, Store validation requirements
- MLflow 3: 13 built-in LLM judges, production monitoring, Genie Code
- AG-UI HITL: ApprovalRequiredAIFunction (C#) + @tool(approval_mode) (Python)
- Entra ID Ignite 2025: Agent ID Admin/Developer RBAC roles, Conditional Access
- Security Copilot: 400 SCU/month per 1000 M365 E5 licenses, auto-provisioned
- Fast Transcription API: phrase lists, 14-language multi-lingual transcription
- Azure Monitor Workbooks: Bicep support, RBAC specifics
- Power Platform Copilot: data residency (Norway/Europe → EU DB, Bing → USA)
- RAG security-rbac: 4-approach table (GA + 3 preview access control methods)
- IaC MLOps: Well-Architected OE:05 principles, Bicep/Terraform patterns
- Translator: image file batch translation Preview (JPEG/PNG/BMP/WebP)

All 106 files: Last updated 2026-04 | Verified: MCP 2026-04

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/ms-ai-security/references/performance-scalability/regional-deployment-latency.md

@@ -1,6 +1,6 @@
 # Regional Deployment for Latency Reduction
 
-**Last updated:** 2026-02
+**Last updated:** 2026-04 | Verified: MCP 2026-04
 **Status:** GA
 **Category:** Performance & Scalability
 
@@ -306,6 +306,73 @@ class MultiRegionHealthChecker:
 | Gradert informasjon | Nei | Nei | Avhenger av sertifisering |
 | Metadata i EU | Nei | Ja | Ja |
 
+
+## Azure Front Door — oppdatert (2026-04)
+
+### Edge-lokasjoner og kapabiliteter
+
+Azure Front Door har **118+ edge-lokasjoner** globalt (bekreftet 2026-04). Premium-tier støtter:
+- **Private Link til origins**: Front Door Premium kan rute trafikk til Azure OpenAI via Private Link — ingen offentlig eksponering av backend
+- **WAF-regler**: Innebygd Web Application Firewall med OpenAI-spesifikke regler
+
+```bash
+# Front Door Premium med Private Link til Azure OpenAI
+az afd origin create \
+  --resource-group rg-ai-networking \
+  --profile-name fd-ai-gateway \
+  --origin-group-name aoai-backends \
+  --origin-name aoai-norway \
+  --host-name aoai-norway.openai.azure.com \
+  --origin-host-header aoai-norway.openai.azure.com \
+  --priority 1 \
+  --weight 1000 \
+  --enabled-state Enabled \
+  --https-port 443 \
+  --enable-private-link true \
+  --private-link-location norwayeast \
+  --private-link-resource "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.CognitiveServices/accounts/aoai-norway" \
+  --private-link-sub-resource-type account
+```
+
+## Gateway Multi-Backend — 4 topologier (oppdatert 2026-04)
+
+Microsoft dokumenterer nå fire formelle topologier for Azure OpenAI gateway:
+
+| Topologi | Beskrivelse | Bruksscenario |
+|----------|-------------|---------------|
+| Single APIM instance | Én APIM mot én Azure OpenAI | Enkel arkitektur, lav kompleksitet |
+| Single region, multiple backends | Én region, flere Azure OpenAI-instanser | Load balancing og failover |
+| Single region, multiple subscriptions | Kvote-utvidelse via flere Azure-subscriptions | Høy TPM-kvote krav |
+| Multiple regions | APIM i flere regioner, globalt | Global distribusjon, data residency |
+
+### Topologi 3: Multiple subscriptions for kvote-utvidelse
+
+```xml
+<!-- APIM Policy: Distribuer last over subscriptions for kvote-utvidelse -->
+<policies>
+    <inbound>
+        <base />
+        <set-variable name="subscription-backends" value="@{
+            var backends = new JArray(
+                new JObject(
+                    new JProperty('url', 'https://aoai-sub1.openai.azure.com'),
+                    new JProperty('subscription', 'sub1')),
+                new JObject(
+                    new JProperty('url', 'https://aoai-sub2.openai.azure.com'),
+                    new JProperty('subscription', 'sub2')),
+                new JObject(
+                    new JProperty('url', 'https://aoai-sub3.openai.azure.com'),
+                    new JProperty('subscription', 'sub3'))
+            );
+            // Round-robin mellom subscriptions
+            var idx = (int)(DateTimeOffset.UtcNow.ToUnixTimeSeconds() / 60) % 3;
+            return backends[idx]['url'].ToString();
+        }" />
+        <set-backend-service base-url="@(context.Variables.GetValueOrDefault<string>("subscription-backends"))" />
+    </inbound>
+</policies>
+```
+
 ## Norsk offentlig sektor
 
 - **Primær region**: Norway East for alle workloads med personopplysninger. Sweden Central som failover.