Updates

Author: msmbaldwin

articles/attestation/policy-version-1-0.md

@@ -19,8 +19,6 @@ This article introduces the workings of the attestation service and the policy e
 
 The minimum version of the policy supported by the service is version 1.0.
 
-:::image type="content" source="./media/maa-policy-version-10.png" alt-text="A diagram showing Azure attestation using policy version 1.0":::
-
 The attestation service flow is as follows:
 - The platform sends the attestation evidence in the attest call to the attestation service.
 - The attestation service parses the evidence and creates a list of claims that is then used in the attestation evaluation. These claims are logically categorized as incoming claims sets.
@@ -30,12 +28,9 @@ For Policy version 1.0:
 
 The policy has three segments, as seen above:
 
-**version**: The version is the version number of the grammar that is followed.
-version=1.0
-
-**authorizationrules**: A collection of claim rules that will be checked first, to determine if attestation should proceed to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail  attestation.
-
-**issuancerules**: A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. These rules can be used to add to the outgoing claim set and the response token, these rules cannot be used to fail attestation.
+- **version**: The version is the version number of the grammar that is followed.
+- **authorizationrules**: A collection of claim rules that will be checked first, to determine if attestation should proceed to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail  attestation.
+- **issuancerules**: A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. These rules can be used to add to the outgoing claim set and the response token, these rules cannot be used to fail attestation.
 
 List of claims supported by policy version 1.0 as part of the incoming claims.
 

articles/attestation/policy-version-1-1.md

@@ -17,8 +17,6 @@ This article introduces the workings of the attestation service and the policy e
 
 ## Policy version 1.1
 
-:::image type="content" source="./media/maa-policy-version-11.png" alt-text="A diagram showing Azure attestation using policy version 1.1":::
-
 The attestation flow is as follows:
 - The platform sends the attestation evidence in the attest call to the attestation service.
 - The attestation service parses the evidence and creates a list of claims that is then used during rule evaluation. The claims are logically categorized as incoming claims sets.
@@ -28,11 +26,10 @@ The attestation flow is as follows:
 For Policy version 1.1:
 The policy has four segments, as seen above:
 
-**version**: The version is the version number of the grammar that is followed.
-version=1.1
-**configurationrules**: During policy evaluation, sometimes it may be required to control the behavior of the policy engine itself. This is where configuration rules can be used to indicate to the policy evaluation engine how to handle some claims in the evaluation.
-**authorizationrules**: A collection of claim rules that will be checked first, to determine if attestation should proceed to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail attestation.
-**issuancerules**: A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the defined order and are also optional. These rules can also be used to add to the outgoing claim set and the response token, however these rules cannot be used to fail attestation.
+- **version**: The version is the version number of the grammar that is followed.
+- **configurationrules**: During policy evaluation, sometimes it may be required to control the behavior of the policy engine itself. This is where configuration rules can be used to indicate to the policy evaluation engine how to handle some claims in the evaluation.
+- **authorizationrules**: A collection of claim rules that will be checked first, to determine if attestation should proceed to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail attestation.
+- **issuancerules**: A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the defined order and are also optional. These rules can also be used to add to the outgoing claim set and the response token, however these rules cannot be used to fail attestation.
 
 The following **configurationrules** are available to the policy author.
 

articles/attestation/policy-version-1-2.md

@@ -17,19 +17,17 @@ This article introduces the workings of the attestation service and the policy e
 
 ## Policy Version 1.2
 
-:::image type="content" source="./media/maa-policy-version-12.png" alt-text="A diagram showing Azure attestation using policy version 1.2":::
-
 The attestation flow is as follows:
 - The platform sends the attestation evidence in the attest call to the attestation service.
 - The attestation service parses the evidence and creates a list of claims that is then used in the attestation evaluation. The evidence is also parsed and maintained as a JSON format, which is used to provide a broader set of measurements to the policy writer. These claims are logically categorized as incoming claims sets.
 - The attestation policy uploaded by the owner of the attestation service instance is then used to evaluate and issue claims to the response. The policy writer can now use JmesPath based queries to search in the evidence to create their own claims and subsequent claim rules. During the evaluation, configuration rules can also be used to indicate to the policy evaluation engine how to handle certain claims.
 
 Policy version 1.2 has four segments:
 
-**version:** The version is the version number of the grammar.
-**configurationrules:** During policy evaluation, sometimes it may be required to control the behavior of the policy engine itself. Configuration rules can be used to indicate to the policy evaluation engine how to handle some claims in the evaluation.
-**authorizationrules:** A collection of claim rules that will be checked first, to determine if attestation should continue to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail attestation.
-**issuancerules:** A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they're defined and are also optional. A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. These rules can be used to add to the outgoing claim set and the response token, these rules can't be used to fail attestation.
+- **version:** The version is the version number of the grammar.
+- **configurationrules:** During policy evaluation, sometimes it may be required to control the behavior of the policy engine itself. Configuration rules can be used to indicate to the policy evaluation engine how to handle some claims in the evaluation.
+- **authorizationrules:** A collection of claim rules that will be checked first, to determine if attestation should continue to issuancerules. This section should be used to filter out calls that don’t require the issuancerules to be applied. No claims can be issued from this section to the response token. These rules can be used to fail attestation.
+- **issuancerules:** A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they're defined and are also optional. A collection of claim rules that will be evaluated to add information to the attestation result as defined in the policy. The claim rules apply in the order they are defined and are also optional. These rules can be used to add to the outgoing claim set and the response token, these rules can't be used to fail attestation.
 
 The following **configurationrules** are available to the policy author.
 

articles/attestation/toc.yml

@@ -40,7 +40,7 @@
   - name: Basic concepts
     href: basic-concepts.md
     items:
-      - name: Trusted Platform Module(TPM) Attestation
+      - name: Trusted Platform Module (TPM) Attestation
         href: tpm-attestation-concepts.md
   - name: Attestation policy
     items:

articles/attestation/tpm-attestation-concepts.md

@@ -1,5 +1,5 @@
 ---
-title: TPM Attestation overview
+title: Azure Attestation TPM attestation overview
 description: TPM Attestation overview
 services: attestation
 author: prsriva
@@ -10,7 +10,7 @@ ms.author: prsriva
 ms.custom: TPM Attestation overview complete 
 ---
 
-# Trusted Platform Module(TPM) Attestation
+# Trusted Platform Module (TPM) Attestation
 
 Devices with a TPM, can rely on attestation to prove that boot integrity isn't compromised along with using the measured boot to detect early boot feature states. A growing number of device types, bootloaders and boot stack attacks require an attestation solution to evolve accordingly. An attested state of a device is driven by the attestation policy used to verify the contents on the platform evidence. This document provides an overview of TPM attestation and capabilities supported by MAA.
 
@@ -38,8 +38,6 @@ Validate the measurements made during the boot using the Azure Attestation servi
 - Relying parties can perform an attestation against the Azure Attestation service, which can be used to validate measurements made during the boot process.
 - A relying party can then rely on the attestation statement to gate access to resources or other actions.
 
-![Conceptual device attestation flow](./media/device-tpm-attestation-flow.png)
-
 Conceptually, TPM attestation can be visualized as above, where the relying party applies Azure Attestation service to verify the platform(s) integrity and any violation of promises, providing the confidence to run workloads or provide access to resources.
 
 ## Protection from malicious boot attacks