Merge pull request #1784 from MicrosoftDocs/batamig-patch-1

XDR - region updates nov 2024

Author: padmagit77

defender-xdr/data-privacy.md

@@ -19,7 +19,7 @@ ms.topic: conceptual
 search.appverid: 
   - MOE150
   - MET150
-ms.date: 08/19/2024
+ms.date: 11/03/2024
 appliesto: 
 - Microsoft Defender XDR 
 ---
@@ -28,22 +28,66 @@ appliesto:
 
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
 
-Microsoft Defender XDR operates in Microsoft Azure data centers in the European Union, the United Kingdom, the United States, Australia, and Switzerland. Customer data collected by the service is stored at rest in (a) the geo-location of the tenant as identified during provisioning or, (b) the geo-location as defined by the data storage rules of an online service if this online service is used by Microsoft Defender XDR to process such data.
+Microsoft Defender XDR integrates with several different Microsoft security services, which collect data using various technologies. Integrated services allow Microsoft Defender XDR to access their data for the purpose of identifying cross-product correlations.
 
-Customer data in pseudonymized form might also be stored in central storage and processing systems in the United States.
+## Collected data
 
-The table below shows the general information on the data retention of specific service sources in Defender XDR:
+Customer data collected from integrated services includes *processed data*, such as incidents and alerts, and *configuration data*, such as connector settings, rules and so on.
 
-|Product|Default data retention period|More information|
-|:---|:---|:---|
-|Microsoft Defender for Endpoint|180 days|[Defender for Endpoint data storage and privacy](/defender-endpoint/data-storage-privacy)|
-|Microsoft Defender for Office 365|Varies according to feature and license|[Defender for Office 365 data retention information](/defender-office-365/mdo-data-retention)|
-|Microsoft Defender for Identity|180 days|[Defender for Identity data storage and privacy](/defender-for-identity/privacy-compliance)|
-|Microsoft Defender for Cloud Apps|180 days|[Defender for Cloud Apps data storage and privacy](/defender-cloud-apps/cas-compliance-trust)|
-|Microsoft Entra|Varies according to feature and license|[Microsoft Entra data storage and privacy](/entra/identity/monitoring-health/reference-reports-data-retention)|
-|Microsoft Sentinel|90 days for Basic logs, varies depending on pricing|[Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)|
+## Data storage location
 
-> [!NOTE]
-> [Advanced hunting](advanced-hunting-overview.md) lets you query up to 30 days of raw data.
+Microsoft Defender XDR operations in Microsoft Azure data centers in the following geographical regions:
+
+- **European Union**: North Europe and West Europe
+- **United Kingdom**: UK South and UK West
+- **United States**: East US 2 and Central US
+- **Australia**: Australia East and Australia Southeast
+- **Switzerland**: Switzerland North and Switzerland West
+- **India**: Central India and South India
+
+Once created, the Microsoft Defender XDR tenant isn't movable to a different region. Your geographical region is shown in the Microsoft Defender portal, under **Settings > Microsoft Defender XDR > Account**.
+
+Customer data stored by integrated services might also be stored in the following locations:
+
+- The original location for the relevant service.
+- A region defined by data storage rules of an integrated service, if Microsoft Defender XDR shares data with that service.
+
+## Data retention
+
+Microsoft Defender XDR data is retained for 180 days, and is visible across the Microsoft Defender portal during that time, except for in **Advanced hunting** queries. 
+
+In the Microsoft Defender portal's **Advanced hunting** page, data is accessible via queries for only 30 days, unless it's streamed through [Microsoft's unified security operations platform with Microsoft Sentinel](/azure/sentinel/microsoft-365-defender-sentinel-integration?toc=%2Fdefender-xdr%2Ftoc.json&bc=%2Fdefender-xdr%2Fbreadcrumb%2Ftoc.json&tabs=defender-portal), where retention periods may be longer.
+
+Data continues to be retained and visible, even when a license is under a grace period or in suspended mode. At the end of any grace period or suspension, and no later than 180 days from a contract termination or expiration, data is deleted from Microsoft's systems and is unrecoverable.
+
+Most Defender services also have a default data retention period of 180 days. More information on data retention period per product is found in [relevant service docs](#related-content).
+
+## Data sharing
+
+Microsoft Defender XDR shares data among the following Microsoft products, also licensed by the customer:
+
+- Microsoft Defender for Cloud
+- Microsoft Defender for Identity
+- Microsoft Defender for Endpoint
+- Microsoft Defender for Cloud Apps
+- Microsoft Defender for Office 365
+- Microsoft Defender for IoT
+- Microsoft Sentinel
+- Microsoft Intune
+- Microsoft Purview
+- Microsoft Entra
+- Microsoft Defender Vulnerability Management
+- Microsoft Copilot for Security
+
+## Related content
+
+For more information, see:
+
+- [Defender for Endpoint data storage and privacy](/defender-endpoint/data-storage-privacy)
+- [Defender for Office 365 data retention information](/defender-office-365/mdo-data-retention)
+- [Defender for Identity data storage and privacy](/defender-for-identity/privacy-compliance)
+- [Defender for Cloud Apps data storage and privacy](/defender-cloud-apps/cas-compliance-trust)
+- [Microsoft Entra data storage and privacy](/entra/identity/monitoring-health/reference-reports-data-retention)
+- [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)
 
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]