Merge branch 'main' into WI499749-remove-include-files-56-pr2

Author: DeCohen

defender-for-cloud-apps/create-snapshot-cloud-discovery-reports.md

@@ -1,7 +1,7 @@
 ---
 title: Create snapshot cloud discovery reports
 description: This article provides information about how to upload logs manually to create a snapshot report of your cloud discovery apps.
-ms.date: 01/29/2023
+ms.date: 10/20/2025
 ms.topic: how-to
 ms.reviewer: Mravela
 ---
@@ -61,6 +61,7 @@ To create a snapshot report:
 
 Cloud discovery uses the data in your traffic logs. The more detailed your log, the better visibility you get. Cloud discovery requires web-traffic data with the following attributes:
 
+
 - Date of the transaction
 - Source IP
 - Source user - highly recommended
@@ -77,9 +78,10 @@ Therefore, these attributes won't be shown in cloud discovery data for these log
 To successfully generate a cloud discovery report, your traffic logs must meet the following conditions:
 
 1. [Data source is supported](set-up-cloud-discovery.md#supported-firewalls-and-proxies).
-2. Log format matches the expected standard format (format checked upon upload by the Log tool).
-3. Events aren't more than 90 days old.
-4. The log file is valid and includes outbound traffic information.
+1. Log format matches the expected standard format (format checked upon upload by the Log tool).
+1. Events aren't more than 90 days old.
+1. The log file is valid and includes outbound traffic information.
+1. Configure the appliance to forward only traffic logs. Including unrelated logs in the configuration can inflate the ingested traffic volume.
 
 ## Next steps
 

defender-for-cloud-apps/real-time-agent-protection-during-runtime.md

@@ -63,17 +63,15 @@ The following steps describe the Security Administrator’s required actions to
     > [!IMPORTANT]
     > If the Microsoft 365 connector isn’t properly connected, real-time agent protection during runtime continues to block suspicious activity on the AI agent. Alerts and incidents related to these actions won't show in the Microsoft Defender portal.
 
-1. Make sure to collaborate with the following administrators:
+1. Enter the App ID provided by your Power Platform administrator and select **Save**.
+      :::image type="content" source="media/protect-agents-real-time/turn-on-real-time-agent-protection.png" alt-text="Screenshot that shows how to turn on Real time agent protection during runtime in the Defender portal." lightbox="media/protect-agents-real-time/turn-on-real-time-agent-protection.png":::
 
-   - The **Microsoft Entra Administrator** needs to create [a Microsoft Entra ID application](/microsoft-copilot-studio/external-security-provider#step-1-configure-microsoft-entra-application) and configure a Federated Identity Credential (FIC) using the URL provided in the Microsoft Defender portal. For more information, see: [Authorize the Microsoft Entra application with your provider of choice](/microsoft-copilot-studio/external-security-provider#authorize-the-microsoft-entra-application-with-your-provider-of-choice).
-
-   - The **Power Platform Administrator** needs to  enter the Application ID and URL in the Power Platform settings page. For more information, see: [Enable external threat detection and protection for Copilot Studio custom agents](/microsoft-copilot-studio/external-security-provider#step-2-configure-the-threat-detection-system).
-1. Enter the App ID provided by your Power Platform administrator. The Application (client) ID, uniquely identifies your application and is used in your application's code as part of validating the security tokens it receives from the Microsoft identity platform.
-1. Select **Save**.
-1. Copy the URL provided.
-1. Share the URL with the Power Platform administrator. 
-
-   :::image type="content" source="media/protect-agents-real-time/turn-on-real-time-agent-protection.png" alt-text="Screenshot that shows how to turn on Real time agent protection during runtime in the Defender portal." lightbox="media/protect-agents-real-time/turn-on-real-time-agent-protection.png":::
+    > [!IMPORTANT]
+    > - Completing the onboarding process requires collaboration with a Power Platform administrator. The onboarding instructions on the Power Platform side are specified here: [Enable external threat detection and protection for Copilot Studio custom agents](/microsoft-copilot-studio/external-security-provider#step-2-configure-the-threat-detection-system).
+    > - The application ID that the Power Platform administrator needs to provide is this [Microsoft Entra ID application](/microsoft-copilot-studio/external-security-provider#step-1-configure-microsoft-entra-application).
+    > - To allow the Power Platform administrator to complete the onboarding steps, share the URL provided in the Defender portal with them.
+    
+1. No further action is needed on your part. Once the Power Platform administrator completes the onboarding steps on their side, you’ll see a green **Connected** status.
 
 
 ## Related articles

defender-for-identity/deploy/activate-sensor.md

@@ -18,9 +18,8 @@ See [Microsoft Defender for Identity sensor v3.x prerequisites](prerequisites-se
 The **Activation** page displays all servers from your device inventory. Defender for Identity detects all of your servers and their configuration. The server's activation state lets you know what you need to do to onboard the domain controller to Defender for Identity.
 
 You can choose to activate eligible domain controllers either automatically, where Defender for Identity activates them as soon as they're discovered, or manually, by selecting specific domain controllers from the list of eligible servers.
-
-   
-[![Screenshot that shows how to auto and manual activation.](media/activate-sensor/1.png)](media/activate-sensor/1.png#lightbox)
+ 
+[![Screenshot that shows how to activate a new sensor.](media/activate-sensor/blog.png)](media/activate-sensor/blog.png#lightbox)
 
 |Activation State  |Next steps  |
 |---------|---------|
@@ -44,8 +43,8 @@ The process for activating the sensor depends on your configuration.
 
 
 1. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers**. This takes you to the **Sensors** page, where you can check your sensor health.
-   
-   [![Screenshot that shows successful activation.](media/activate-sensor/image1.png)](media/activate-sensor/image1.png#lightbox)
+
+   [![Screenshot that shows sucesseful activation.](media/activate-sensor/activated-sensor.png)](media/activate-sensor/activated-sensor.png#lightbox)
 
 <!--## Onboard the domain controller