Feedback

Author: limwainstein

articles/sentinel/sap/cross-workspace.md

@@ -48,7 +48,7 @@ A common practice is to provide some or all of the SOC team members with the **S
 
 Creating separate workspaces for the SAP and SOC data has these benefits:
 
-- Microsoft Sentinel can create alerts that include both SOC and SAP data, and to run those alerts on the SOC workspace. 
+- Microsoft Sentinel can trigger alerts that include both SOC and SAP data, and run those alerts on the SOC workspace. 
 
    > [!NOTE]
    > For larger SAP landscapes, running queries made by the SOC on data from the SAP workspace can impact performance, because the SAP data must travel to the SOC workspace when being queried. For improved performance and cost optimizations, consider having both the SOC and SAP workspaces on the same [dedicated cluster](../../azure-monitor/logs/logs-dedicated-clusters.md?tabs=cli#cluster-pricing-model).
@@ -62,13 +62,13 @@ This table maps out the access of data and features for the SAP and SOC teams in
 
 |Function  |SOC team  |SAP team  |
 |---------|---------|---------|
-|SOC workspace access     | ❌         | ✅         |
+|SOC workspace access     | ✅         | ❌     |
 |SAP workspace data, analytics rules, functions, watchlists, and workbooks access     | ✅         | ✅         |
 |SAP incident access and collaboration     | ✅          | ✅          |
 
 ## Scenario 2: SAP data is kept in the SOC workspace 
 
-In this scenario, you want to keep all of the data in one workspace. You can do this using Log Analytics to [manage access to data by resource](../resource-context-rbac.md). You can also associate SAP resources with an Azure resource ID by specifying the required `azure_resource_id` field in the connector configuration section on the data collector used to ingest data from the SAP system into Microsoft Sentinel. 
+In this scenario, you want to keep all of the data in one workspace and to apply access controls. You can do this using Log Analytics to [manage access to data by resource](../resource-context-rbac.md). You can also associate SAP resources with an Azure resource ID by specifying the required `azure_resource_id` field in the [connector configuration section](reference-systemconfig.md#connector-configuration-section) on the data collector used to ingest data from the SAP system into Microsoft Sentinel. 
 
 :::image type="content" source="media/cross-workspace/sap-cross-workspace-combined.png" alt-text="Diagram of working with the Microsoft Sentinel solution for SAP® applications using the same workspace for the SAP and SOC data." border="false":::
 

articles/sentinel/sap/deploy-sap-security-content.md

@@ -60,11 +60,12 @@ To deploy SAP solution security content, do the following:
     1. Under **Configure the workspace where the SOC data resides in**, select the SOC subscription and workspace. 
     1. Under **Configure the workspace where the SAP data resides in**, select the SAP subscription and workspace.
 
-        For example:
+    For example:
 
-        :::image type="content" source="./media/deploy-sap-security-content/sap-multi-workspace.png" alt-text="Screenshot of how to configure the Microsoft Sentinel solution for SAP® applications to work across multiple workspaces.":::
+    :::image type="content" source="./media/deploy-sap-security-content/sap-multi-workspace.png" alt-text="Screenshot of how to configure the Microsoft Sentinel solution for SAP® applications to work across multiple workspaces.":::
 
-    If you want the SOC and SAP data to be kept on the same workspace, review [this scenario](cross-workspace.md#scenario-2-sap-data-is-kept-in-the-soc-workspace).      
+    > [!Note]
+    > If you want the SAP and SOC data to be kept on the same workspace with no additional access controls, do not select **Some of the data is on a different workspace**. If you want the SOC and SAP data to be kept on the same workspace, but to apply additional access controls, review [this scenario](cross-workspace.md#scenario-2-sap-data-is-kept-in-the-soc-workspace).      
 
 1. Select **Next** to cycle through the **Data Connectors**, **Analytics**, and **Workbooks** tabs, where you can learn about the components that will be deployed with this solution.