@@ -50,7 +50,7 @@ The following data is stored on the managed resources.
 A new architecture for customer-managed key encryption with hubs is available in preview, which resolves the dependency on the managed resource group. In this new model, encrypted data is stored service-side on Microsoft-managed resources instead of in managed resources in your subscription. Metadata is stored in multitenant resources using document-level CMK encryption. An Azure AI Search instance is hosted on the Microsoft-side per customer, and for each hub. Due to its dedicated resource model, its Azure cost is charged in your subscription via the hub resource.
 
 > [!NOTE]
-> During this preview key rotation and user-assigned identity capabilities are not supported. Server-side encryption is currently not supported in reference to an Azure Key Vault for storing your encryption key that has public network access disabled.
+> During this preview key rotation and user-assigned identity capabilities are not supported. Service-side encryption is currently not supported in reference to an Azure Key Vault for storing your encryption key that has public network access disabled.
 
 ## Use customer-managed keys with Azure Key Vault
 
@@ -83,7 +83,7 @@ Customer-managed key encryption is configured via Azure portal in a similar way
 1. Create a new Azure resource in Azure portal.
 1. Under the encryption tab, select your encryption key.
 
-:::image type="content" source="../../machine-learning/media/concept-customer-managed-keys/cmk-service-side-encryption.png" alt-text="Screenshot of the encryption tab with the option for server side encryption selected." lightbox="../../machine-learning/media/concept-customer-managed-keys/cmk-service-side-encryption.png":::
+:::image type="content" source="../../machine-learning/media/concept-customer-managed-keys/cmk-service-side-encryption.png" alt-text="Screenshot of the encryption tab with the option for service side encryption selected." lightbox="../../machine-learning/media/concept-customer-managed-keys/cmk-service-side-encryption.png":::
 
 Alternatively, use infrastructure-as-code options for automation. Example Bicep templates for Azure AI Studio are available on the Azure Quickstart repo:
 1. [CMK encryption for hub](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.machinelearningservices/aistudio-cmk).

@@ -67,7 +67,7 @@ export AZURE_INFERENCE_ENDPOINT="<your-model-endpoint-goes-here>"
 export AZURE_INFERENCE_CREDENTIAL="<your-key-goes-here>"
 ```
 
-Once configured, create a client to connect to the endpoint:
+Once configured, create a client to connect to the endpoint. The parameter `model_name` in the constructor is not required for endpoints serving a single model, like serverless endpoints.
 
 ```python
 import os
@@ -80,7 +80,7 @@ llm = AzureAICompletionsModel(
 ```
 
 > [!TIP]
-> The parameter `model_name` in the constructor is not required for endpoints serving a single model, like serverless endpoints).
+> If your model is an OpenAI model deployed to Azure OpenAI service or AI services resource, configure the client as indicated at [Azure OpenAI models](#azure-openai-models).
 
 Alternatively, if your endpoint support Microsoft Entra ID, you can use the following code to create the client:
 
@@ -112,6 +112,23 @@ llm = AzureAICompletionsModel(
 )
 ```
 
+### Azure OpenAI models
+
+If you are using Azure OpenAI models with key-based authentication, you need to pass the authentication key in the header `api-key`, which is the one expected in the Azure OpenAI service and in Azure AI Services. This configuration is not required if you are using Microsoft Entra ID (formerly known as Azure AD). The following example shows how to configure the client:
+
+```python
+import os
+from llama_index.llms.azure_inference import AzureAICompletionsModel
+
+llm = AzureAICompletionsModel(
+    endpoint=os.environ["AZURE_INFERENCE_ENDPOINT"],
+    credential="",
+    client_kwargs={"headers" : { "api-key": os.environ["AZURE_INFERENCE_CREDENTIAL"] } }
+)
+```
+
+Notice that `credentials` is still being passed with an empty value since it's a required parameter.
+
 ### Inference parameters
 
 You can configure how inference in performed for all the operations that are using this client by setting extra parameters. This helps avoid indicating them on each call you make to the model.

@@ -53,6 +53,8 @@ For more information on Azure OpenAI models, see [What is Azure OpenAI Service?]
 The model catalog offers two distinct ways to deploy models for your use: managed compute and serverless APIs.
 
 The deployment options and features available for each model vary, as described in the following tables. [Learn more about data processing with the deployment options]( concept-data-privacy.md).
+
+### Capabilities of model deployment options
 <!-- docutune:disable -->
 
 Features | Managed compute | Serverless API (pay-as-you-go)
@@ -62,6 +64,8 @@ API authentication | Keys and Microsoft Entra authentication. | Keys only.
 Content safety | Use Azure AI Content Safety service APIs. | Azure AI Content Safety filters are available integrated with inference APIs. Azure AI Content Safety filters are billed separately.
 Network isolation | [Configure managed networks for Azure AI Studio hubs](configure-managed-network.md).  | Managed compute follow your hub's public network access (PNA) flag setting. For more information, see the [Network isolation for models deployed via Serverless APIs](#network-isolation-for-models-deployed-via-serverless-apis) section later in this article.
 
+### Available models for supported deployment options
+
 Model | Managed compute | Serverless API (pay-as-you-go)
 --|--|--
 Llama family models | Llama-2-7b <br> Llama-2-7b-chat <br> Llama-2-13b <br> Llama-2-13b-chat <br> Llama-2-70b <br> Llama-2-70b-chat <br> Llama-3-8B-Instruct <br> Llama-3-70B-Instruct <br> Llama-3-8B <br> Llama-3-70B | Llama-3-70B-Instruct <br> Llama-3-8B-Instruct <br> Llama-2-7b <br> Llama-2-7b-chat <br> Llama-2-13b <br> Llama-2-13b-chat <br> Llama-2-70b <br> Llama-2-70b-chat

@@ -304,36 +304,36 @@ items:
       href: how-to/quota.md
     - name: Increase rate limit
       href: how-to/autoscale.md
-  - name: Infrastructure & security
+- name: Security & Governance
+  items:
+  - name: Identity & access management
     items:
-    - name: Identity & access management
-      items:
-      - name: Role-based access control in Azure AI Studio
-        href: concepts/rbac-ai-studio.md
-    - name: Network security
-      items:
-      - name: Configure managed network
-        href: how-to/configure-managed-network.md
-      - name: Configure private link
-        href: how-to/configure-private-link.md
-      - name: Configure custom DNS
-        href: /azure/machine-learning/how-to-custom-dns?context=/azure/ai-studio/context/context
-      - name: Secure playground chat
-        href: how-to/secure-data-playground.md
-      - name: Troubleshoot secure project connectivity
-        href: how-to/troubleshoot-secure-connection-project.md
-    - name: Data protection & encryption
-      items:
-      - name: Configure customer-managed keys
-        href: concepts/encryption-keys-portal.md
-      - name: Rotate keys
-        href: ../ai-services/rotate-keys.md?context=/azure/ai-studio/context/context
-    - name: Vulnerability management
-      href: concepts/vulnerability-management.md
-    - name: Disaster recovery
-      href: how-to/disaster-recovery.md
-    - name: Security baseline
-      href: /security/benchmark/azure/baselines/azure-ai-studio-security-baseline
+    - name: Role-based access control in Azure AI Studio
+      href: concepts/rbac-ai-studio.md
+  - name: Network security
+    items:
+    - name: Configure managed network
+      href: how-to/configure-managed-network.md
+    - name: Configure private link
+      href: how-to/configure-private-link.md
+    - name: Configure custom DNS
+      href: /azure/machine-learning/how-to-custom-dns?context=/azure/ai-studio/context/context
+    - name: Secure playground chat
+      href: how-to/secure-data-playground.md
+    - name: Troubleshoot secure project connectivity
+      href: how-to/troubleshoot-secure-connection-project.md
+  - name: Data protection & encryption
+    items:
+    - name: Configure customer-managed keys
+      href: concepts/encryption-keys-portal.md
+    - name: Rotate keys
+      href: ../ai-services/rotate-keys.md?context=/azure/ai-studio/context/context
+  - name: Vulnerability management
+    href: concepts/vulnerability-management.md
+  - name: Disaster recovery
+    href: how-to/disaster-recovery.md
+  - name: Security baseline
+    href: /security/benchmark/azure/baselines/azure-ai-studio-security-baseline
 - name: Responsible AI
   items:
   - name: Overview