toc-include-numbering

Author: shlipsey3

articles/active-directory/reports-monitoring/howto-archive-logs-to-storage-account.md

@@ -30,20 +30,20 @@ To use this feature, you need:
 
 [!INCLUDE [diagnostic-settings-include](../includes/diagnostic-settings-include.md)]
 
-1. Under **Destination Details** select the **Archive to a storage account** check box. 
+6. Under **Destination Details** select the **Archive to a storage account** check box. 
 
-1. Select the appropriate **Subscription** and **Storage account** from the menus.
+7. Select the appropriate **Subscription** and **Storage account** from the menus.
 
     ![Diagnostics settings](media/howto-archive-logs-to-storage-account/diagnostic-settings-storage.png)
 
-1. After the categories have been selected, in the **Retention days** field, type in the number of days of retention you need of your log data. By default, this value is *0*, which means that logs are retained in the storage account indefinitely. If you set a different value, events older than the number of days selected are automatically cleaned up.
+8. After the categories have been selected, in the **Retention days** field, type in the number of days of retention you need of your log data. By default, this value is *0*, which means that logs are retained in the storage account indefinitely. If you set a different value, events older than the number of days selected are automatically cleaned up.
 
     > [!NOTE]
     > The Diagnostic settings storage retention feature is being deprecated. For details on this change, see [**Migrate from diagnostic settings storage retention to Azure Storage lifecycle management**](../../azure-monitor/essentials/migrate-to-azure-storage-lifecycle-policy.md).
  
-1. Select **Save** to save the setting.
+9. Select **Save** to save the setting.
 
-1. Close the window to return to the Diagnostic settings pane.
+10. Close the window to return to the Diagnostic settings pane.
 
 ## Next steps
 

articles/active-directory/reports-monitoring/howto-integrate-activity-logs-with-azure-monitor-logs.md

@@ -51,11 +51,11 @@ Follow the steps below to send logs from Azure Active Directory to Azure Monitor
 
 [!INCLUDE [diagnostic-settings-include](../includes/diagnostic-settings-include.md)]
 
-1. Under **Destination Details** select the **Send to Log Analytics workspace** check box. 
+6. Under **Destination Details** select the **Send to Log Analytics workspace** check box. 
 
-1. Select the appropriate **Subscription** and **Log Analytics workspace** from the menus.
+7. Select the appropriate **Subscription** and **Log Analytics workspace** from the menus.
 
-1. Select the **Save** button.
+8. Select the **Save** button.
 
     ![Screenshot of the Diagnostics settings with some destination details shown.](./media/howto-integrate-activity-logs-with-azure-monitor-logs/diagnostic-settings-log-analytics-workspace.png)
 

articles/active-directory/reports-monitoring/howto-stream-logs-to-event-hub.md

@@ -28,9 +28,9 @@ Once you have an event hub that contains Azure AD activity logs, you can set up
 
 [!INCLUDE [diagnostic-settings-include](../includes/diagnostic-settings-include.md)]
 
-1. Select the **Stream to an event hub** check box.
+6. Select the **Stream to an event hub** check box.
 
-1. Select the Azure subscription, Event Hubs namespace, and optional event hub where you want to route the logs.
+7. Select the Azure subscription, Event Hubs namespace, and optional event hub where you want to route the logs.
 
 The subscription and Event Hubs namespace must both be associated with the Azure AD tenant from where you're streaming the logs.
 

articles/active-directory/reports-monitoring/toc.yml

@@ -14,6 +14,19 @@ items:
 - name: Identity logs
   expanded: true
   items:
+  - name: Concepts
+    expanded: false
+    items:
+    - name: Audit logs
+      href: concept-audit-logs.md
+    - name: Sign-in logs
+      href: concept-sign-ins.md
+    - name: Sign-in logs (preview)
+      href: concept-all-sign-ins.md
+    - name: Basic info in the sign-in logs
+      href: reference-basic-info-sign-in-logs.md
+    - name: Provisioning logs
+      href: concept-provisioning-logs.md
   - name: How-to guides 
     expanded: true
     items:
@@ -31,12 +44,18 @@ items:
 - name: Identity reports 
   expanded: true
   items:
-  - name: Usage and Insights report
-    href: concept-usage-insights-report.md
-  - name: How to use Identity Recommendations
-    href: howto-use-recommendations.md
-  - name: How to use Identity Workbooks
-    href: howto-use-azure-monitor-workbooks.md
+  - name: Concepts
+    expanded: false
+    items:
+    - name: Usage and Insights report
+      href: concept-usage-insights-report.md
+  - name: How-to guides 
+    expanded: true
+    items:
+    - name: How to use Identity Recommendations
+      href: howto-use-recommendations.md
+    - name: How to use Identity Workbooks
+      href: howto-use-azure-monitor-workbooks.md
   - name: Recommendations
     expanded: false
     items: