Merge pull request #191869 from yelevin/patch-5

Update removal procedure

Author: v-regandowner

articles/sentinel/media/offboard/delete-solution.png

@@ -18,13 +18,21 @@ If you no longer want to use Microsoft Sentinel, this article explains how to re
 
 Follow this process to remove Microsoft Sentinel from your workspace:
 
-1. Go to **Microsoft Sentinel**, followed by **Settings**, and select the tab **Remove Microsoft Sentinel**.
+1. From the Microsoft Sentinel navigation menu, under **Configuration**, select **Settings**.
 
-1. Before you remove Microsoft Sentinel, please use the checkboxes to let us know why you're removing it.
+1. In the **Settings** pane, select the **Settings** tab.
+
+1. Locate and expand the **Remove Microsoft Sentinel** expander (at the bottom of the list of expanders).
+
+    :::image type="content" source="media/offboard/locate-remove-sentinel.png" alt-text="Screenshot to find the setting to remove Microsoft Sentinel from your workspace.":::
+
+1. Read the **Know before you go...** section and the rest of this document carefully, making sure that you understand the implications of removing Microsoft Sentinel, and that you take all the necessary actions before proceeding.
+
+1. Before you remove Microsoft Sentinel, please mark the relevant checkboxes to let us know why you're removing it. Enter any additional details in the space provided, and indicate whether you want Microsoft to email you in response to your feedback.
 
 1. Select **Remove Microsoft Sentinel from your workspace**.
 
-    ![Delete the SecurityInsights solution](media/offboard/delete-solution.png)
+    :::image type="content" source="media/offboard/remove-sentinel-reasons.png" alt-text="Screenshot to remove the Microsoft Sentinel solution from your workspace and specify reasons.":::
 
 ## What happens behind the scenes?
 
@@ -37,27 +45,27 @@ After the disconnection is identified, the offboarding process begins.
 
 -   AWS
 
--   Microsoft services security alerts: Microsoft Defender for Identity (*formerly Azure ATP*), Microsoft Defender for Cloud Apps including Cloud Discovery Shadow IT reporting, Azure AD Identity Protection, Microsoft Defender for Endpoint (*formerly Microsoft Defender ATP*), security alerts from Microsoft Defender for Cloud
+-   Microsoft services security alerts: Microsoft Defender for Identity, Microsoft Defender for Cloud Apps (*formerly Microsoft Cloud App Security*) including Cloud Discovery Shadow IT reporting, Azure AD Identity Protection, Microsoft Defender for Endpoint, security alerts from Microsoft Defender for Cloud (*formerly Azure Defender*)
 
 -   Threat Intelligence
 
 -   Common security logs (including CEF-based logs, Barracuda, and Syslog) (If you get security alerts from Microsoft Defender for Cloud, these logs will continue to be collected.)
 
 -   Windows Security Events (If you get security alerts from Microsoft Defender for Cloud, these logs will continue to be collected.)
 
-Within the first 48 hours, the data and analytic rules (including real-time automation configuration) will no longer be accessible or queryable in Microsoft Sentinel.
+Within the first 48 hours, the data and analytics rules (including real-time automation configuration) will no longer be accessible or queryable in Microsoft Sentinel.
 
 **After 30 days these resources are removed:**
 
 -   Incidents (including investigation metadata)
 
--   Analytic rules
+-   Analytics rules
 
 -   Bookmarks
 
 Your playbooks, saved workbooks, saved hunting queries, and notebooks are not removed. **Some may break due to the removed data. You can remove those manually.**
 
-After you remove the service, there is a grace period of 30 days during which you can re-enable the solution and your data and analytic rules will be restored but the configured connectors that were disconnected must be reconnected.
+After you remove the service, there is a grace period of 30 days during which you can re-enable the solution. Your data and analytics rules will be restored, but the configured connectors that were disconnected must be reconnected.
 
 > [!NOTE]
 > If you remove the solution, your subscription will continue to be registered with the Microsoft Sentinel resource provider. **You can remove it manually.**