Acrolinx and validation fixes

Author: ShawnJackson

CloudAppSecurityDocs/caac-known-issues.md

@@ -21,7 +21,7 @@ In Microsoft Defender XDR, select **Settings** > **Conditional Access App Contro
 
 ## Maximum file size for session policies based on content inspection in Information Protection
 
-When you apply a session policy to block file uploads or downloads based on content inspection in Microsoft Purview Information Protection, inspection is performed on only files that are smaller than 30 MB and have fewer than 1 million characters.
+When you apply a session policy to block file uploads or downloads based on content inspection in Microsoft Purview Information Protection, inspection is performed on only files that are smaller than 30 MB and that have fewer than 1 million characters.
 
 For example, you might define one of the following session policies:
 
@@ -43,7 +43,7 @@ The following table lists more examples of files that are and aren't scanned:
 
 ## Files encrypted with sensitivity labels
 
-For tenants that enable co-authoring for files encrypted with sensitivity labels, a session policy to block file upload\download that relies on label filters or file content will operate based on the **Always apply the selected action even if data cannot be scanned** policy setting.
+For tenants that enable coauthoring for files encrypted with sensitivity labels, a session policy to block file upload\download that relies on label filters or file content will operate based on the **Always apply the selected action even if data cannot be scanned** policy setting.
 
 For example, assume that a session policy is configured to prevent downloading files that contain credit card numbers and is set to **Always apply the selected action even if data cannot be scanned**. Any file with an encrypted sensitivity label is blocked from downloading, regardless of its content.
 
@@ -55,13 +55,13 @@ Session policies don't protect external business-to-business (B2B) collaboration
 
 This section lists limitations that apply only on sessions that the reverse proxy serves. Users of Microsoft Edge can benefit from in-browser protection instead of using the reverse proxy, so these limitations don't affect them.
 
-### Built-in apps and browser plug-ins
+### Built-in app and browser plug-in limitations
 
 Conditional Access app control in Defender for Cloud Apps modifies underlying application code. It doesn't currently support built-in apps or browser extensions.
 
 As an administrator, you might want to define default system behavior for when a policy can't be enforced. You can choose to either allow access or totally block it.
 
-### Context loss
+### Context loss limitations
 
 In the following applications, we encountered scenarios where browsing to a link might result in loss of the full path of the link. Typically, the user lands on the home page of the app.
 
@@ -73,7 +73,7 @@ In the following applications, we encountered scenarios where browsing to a link
 - ServiceNow
 - Workday
 
-### File upload
+### File upload limitations
 
 If you apply a session policy to block or monitor the upload of sensitive files, the user's attempts to upload files or folders by using a drag-and-drop operation blocks the complete list of files and folders in the following scenarios:
 

CloudAppSecurityDocs/proxy-intro-aad.md

@@ -41,11 +41,11 @@ Access and session policies include the following types of activities:
 |**Prevent data exfiltration** |Block the download, cut, copy, and print of sensitive documents on (for example) unmanaged devices. |
 | **Require authentication context** |Reevaluate Microsoft Entra Conditional Access policies when a sensitive action occurs in the session, such as requiring multifactor authentication. |
 |**Protect on download** |Instead of blocking the download of sensitive documents, require documents to be labeled and encrypted when you integrate with Microsoft Purview Information Protection. This action helps protect the document and restrict user access in a potentially risky session. |
-|**Prevent upload of unlabeled files** |Ensure that unlabeled files with sensitive content are blocked from being uploaded until the user classifies the content. Before a sensitive file is uploaded, distributed, and used by others, it's important to make sure that the sensitive file has the label that your organization's policy defined. |
-|**Block potential malware** |Help protect your environment from malware by blocking the upload of potentially malicious files. Any file that's uploaded or downloaded can be scanned against Microsoft Threat Intelligence and blocked instantaneously. |
+|**Prevent upload of unlabeled files** |Ensure that the upload of unlabeled files that have sensitive content is blocked until the user classifies the content. Before a user uploads, distributes, or uses a sensitive file, the file must have the label that your organization's policy defined. |
+|**Block potential malware** |Help protect your environment from malware by blocking the upload of potentially malicious files. Any file that a user tries to upload or download can be scanned against Microsoft Threat Intelligence and blocked instantaneously. |
 |**Monitor user sessions for compliance** |Investigate and analyze user behavior to understand where, and under what conditions, session policies should be applied in the future. Risky users are monitored when they sign in to apps, and their actions are logged from within the session. |
 |**Block access** |Granularly block access for specific apps and users, depending on several risk factors. For example, you can block them if they're using client certificates as a form of device management. |
-|**Block custom activities** |Some apps have unique scenarios that carry risk. An example is sending messages with sensitive content in apps like Microsoft Teams or Slack. In these kinds of scenarios, scan messages for sensitive content and block them in real time. |
+|**Block custom activities** |Some apps have unique scenarios that carry risk. An example is sending messages that have sensitive content in apps like Microsoft Teams or Slack. In these kinds of scenarios, scan messages for sensitive content and block them in real time. |
 
 For more information, see: