Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into wi-285688-mma-retirement-july18-2024

Author: David Curwin

articles/azure-monitor/logs/api/cross-workspace-queries.md

@@ -1,7 +1,7 @@
 ---
 title: Cross workspace queries
 description: The API supports the ability to query across multiple workspaces.
-ms.date: 08/06/2022
+ms.date: 07/21/2024
 author: guywi-ms
 ms.author: guywild
 ms.topic: article
@@ -68,7 +68,7 @@ Example:
     Authorization: Bearer <user token>
     
     {
-    "query": "union (AzureActivity | where timestamp > ago(1d), (workspaces('AIFabrikamDemo').AzureActivity | where timestamp> ago(1d))"
+    "query": "union (AzureActivity | where timestamp > ago(1d)), (workspaces('00000000-0000-0000-0000-000000000000').AzureActivity | where timestamp> ago(1d))"
     }
 ```
 

articles/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent.md

@@ -36,14 +36,27 @@ The following table summarizes how Defender for Servers features will be provide
 | OS misconfigurations (Microsoft Cloud Security Benchmark) | Recommendations that are  available through the Foundational CSPM and Defender for Servers plans using the Log Analytics agent, Guest Configuration extension (Preview). | Guest Configuration extension, as part of Defender for Servers Plan 2.| - Functionality based on Guest Configuration extension will be released to GA in September 2024<br/>- Functionality with the Log Analytics agent will be deprecated in November 2024.<br/>- Support of this feature for Docker-hub and Azure Virtual Machine Scale Sets will be deprecated in Aug 2024.|
 | File integrity monitoring | Log Analytics agent, AMA (Preview) | Defender for Endpoint agent integration | Functionality with the Defender for Endpoint agent will be available in August 2024.<br/>- Functionality with the Log Analytics agent will be deprecated in November 2024.<br/>- Functionality with AMA will deprecate when the Defender for Endpoint integration is released.|
 
-The [500-MB benefit](faq-defender-for-servers.yml#is-the-500-mb-of-free-data-ingestion-allowance-applied-per-workspace-or-per-machine-) for data ingestion over the defined tables remains supported via the AMA agent for machines under subscriptions covered by Defender for Servers Plan 2. Every machine is eligible for the benefit only once, even if both Log Analytics agent and Azure Monitor agent are installed on it. For the data allowance to be granted, Defender for Servers Plan 2 needs to be enabled on the Log Analytics workspace AMA is connected to and on the machine's subscription.
-Learn more about how to [deploy AMA](../azure-monitor/vm/monitor-virtual-machine-agent.md#agent-deployment-options).
+### The 500-MB benefit for data ingestion
+
+To preserve the 500 MB of free data ingestion allowance for the [supported data types](faq-defender-for-servers.yml#is-the-500-mb-of-free-data-ingestion-allowance-applied-per-workspace-or-per-machine-), you need to migrate from MMA to AMA.
+
+> [!NOTE]
+>
+> - The benefit is granted to every AMA machine that is part of a subscription with Defender for Servers plan 2 enabled.
+>
+> - The benefit is granted to the workspace the machine is reporting to.
+>
+> - The security solution should be installed on the related Workspace. Learn more about how to perform it [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-to-configure-security-events-collection-with-azure-monitor/ba-p/3770719).
+>
+> - If the machine is reporting to more than one workspace, the benefit will be granted to only one of them.
+
+Learn more about how to [deploy AMA](/azure/azure-monitor/vm/monitor-virtual-machine-agent).
 
 For SQL servers on machines, we recommend to [migrate to SQL server-targeted Azure Monitoring Agent's (AMA) autoprovisioning process](defender-for-sql-autoprovisioning.md).
 
 ### Endpoint protection recommendations experience - changes and migration guidance
 
-Endpoint discovery and recommendations are currently provided by the Defender for Cloud Foundational CSPM and the Defender for Servers plans using the Log Analytics agent in GA, or in preview via the AMA. This experience will be replaced by security recommendations that are gathered using agentless machine scanning. 
+Endpoint discovery and recommendations are currently provided by the Defender for Cloud Foundational CSPM and the Defender for Servers plans using the Log Analytics agent in GA, or in preview via the AMA. This experience will be replaced by security recommendations that are gathered using agentless machine scanning.
 
 Endpoint protection recommendations are constructed in two stages. The first stage is [discovery](#endpoint-detection-and-response-solution---discovery) of an endpoint detection and response solution. The second is [assessment](#endpoint-detection-and-response-solution---configuration-assessment) of the solution’s configuration. The following tables provide details of the current and new experiences for each stage.