Merge branch 'main' into chrisda

chrisda · chrisda · commit 35fa348378b6 · 2025-06-16T11:00:10.000-07:00
diff --git a/ATADocs/ata-capacity-planning.md b/ATADocs/ata-capacity-planning.md
@@ -4,7 +4,7 @@
 title: Planning your Advanced Threat Analytics deployment
 description: Helps you plan your deployment and decide how many ATA servers will be needed to support your network
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: concept-article
 ms.service: advanced-threat-analytics
 ms.assetid: 1b5b24ff-0df8-4660-b4f8-64d68cc72f65
 
diff --git a/ATADocs/ata-configuration-file.md b/ATADocs/ata-configuration-file.md
@@ -4,7 +4,7 @@
 title: Export and Import Advanced Threat Analytics Configuration
 description: How to export and import the ATA configuration.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 1d27dba8-fb30-4cce-a68a-f0b1df02b977
 
diff --git a/ATADocs/ata-prerequisites.md b/ATADocs/ata-prerequisites.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics prerequisites
 description: Describes the requirements for a successful deployment of ATA in your environment
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: a5f90544-1c70-4aff-8bf3-c59dd7abd687
 
diff --git a/ATADocs/ata-silent-installation.md b/ATADocs/ata-silent-installation.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics silently
 description: This article describes how to silently install ATA.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: b3cceb18-0f3c-42ac-8630-bdc6b310f1d6
 
diff --git a/ATADocs/ata-threats.md b/ATADocs/ata-threats.md
@@ -4,7 +4,7 @@
 title: What threats does Advanced Threat Analytics detect?
 description: Lists the threats that Advanced Threat Analytics detects 
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: concept-article
 ms.service: advanced-threat-analytics
 ms.assetid: 283e7b4e-996a-4491-b7f6-ff06e73790d2
 
diff --git a/ATADocs/install-ata-step1.md b/ATADocs/install-ata-step1.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 1
 description: First step to install ATA involves downloading and installing the ATA Center onto your chosen server.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: b3cceb18-0f3c-42ac-8630-bdc6b310f1d6
 
diff --git a/ATADocs/install-ata-step2.md b/ATADocs/install-ata-step2.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 2
 description: Step 2 of installing ATA helps you configure the domain connectivity settings on your ATA Center server
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: e1c5ff41-d989-46cb-aa38-5a3938f03c0f
 
diff --git a/ATADocs/install-ata-step3.md b/ATADocs/install-ata-step3.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 3
 description: Step 3 of installing ATA helps you download the ATA Gateway setup package.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 7fb024e6-297a-4ad9-b962-481bb75a0ba3
 
diff --git a/ATADocs/install-ata-step4.md b/ATADocs/install-ata-step4.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 4
 description: Step 4 of installing ATA helps you to install the ATA Gateway.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 6bbc50c3-bfa8-41db-a2f9-56eed68ef5d2
 
diff --git a/ATADocs/install-ata-step5.md b/ATADocs/install-ata-step5.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 5
 description: Step 5 of installing ATA helps you configure settings for your ATA Gateway.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 2a5b6652-2aef-464c-ac17-c7e5f12f920f
 
diff --git a/ATADocs/install-ata-step6.md b/ATADocs/install-ata-step6.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 6
 description: In this step of installing ATA, you configure data sources.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 8980e724-06a6-40b0-8477-27d4cc29fd2b
 
diff --git a/ATADocs/install-ata-step7.md b/ATADocs/install-ata-step7.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 8
 description: In the final step of installing ATA, you configure the Honeytoken user.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: 8980e724-06a6-40b0-8477-27d4cc29fd2b
 
diff --git a/ATADocs/monitoring-alerts.md b/ATADocs/monitoring-alerts.md
@@ -4,7 +4,7 @@
 title: Understanding ATA health alerts
 description: Describes all the health alerts for each component, listing the cause and the steps needed to resolve the problem
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: concept-article
 ms.collection: M365-security-compliance
 ms.service: advanced-threat-analytics
 ms.assetid: b04fb8a4-b366-4b55-9d4c-6f054fa58a90
diff --git a/ATADocs/troubleshoot-audit.md b/ATADocs/troubleshoot-audit.md
@@ -4,7 +4,7 @@
 title: Working with ATA audit logs
 description: This article describes how to work with ATA audit logs in the Windows Event Log.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: concept-article
 ms.service: advanced-threat-analytics
 ms.assetid: 1d186a96-ef70-4787-aa64-c03d1db94ce0
 
diff --git a/ATADocs/vpn-integration-install-step.md b/ATADocs/vpn-integration-install-step.md
@@ -4,7 +4,7 @@
 title: Install Advanced Threat Analytics - Step 7
 description: In this step of installing ATA, you integrate your VPN.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.service: advanced-threat-analytics
 ms.assetid: e0aed853-ba52-46e1-9c55-b336271a68e7
 
diff --git a/ATPDocs/deploy/activate-capabilities.md b/ATPDocs/deploy/activate-capabilities.md
@@ -1,5 +1,5 @@
 ---
-title: Activate Microsoft Defender for Identity capabilities directly on a domain controller 
+title: Activate Microsoft Defender for Identity capabilities directly on a domain controller (Preview)
 description: Learn about the Microsoft Defender for Identity capabilities on domain controllers and how to activate them.
 ms.date: 08/13/2024
 ms.topic: how-to
@@ -14,7 +14,7 @@ This article describes how to activate and test Microsoft Defender for Identity
 > The capabilities described in this article are currently available as Preview features. Preview features are features that aren't complete, but are made available on a "preview" basis so customers can get early access and provide feedback.
 > 
 > Preview features are still in development, have limited or restricted functionality and may be available only in selected geographic areas.
-> For more information, see the [Microsoft Defender XDR preview features](/defender-xdr/preview)
+> For more information, see the [Microsoft Defender XDR preview features](/defender-xdr/preview).
 
 > [!IMPORTANT]
 > The new Defender for Identity sensor (version 3.x) is recommended for customers looking to deploy core identity protections to new domain controllers running Windows Server 2019 or newer. For all other identity infrastructure, or for customers looking to deploy the most robust identity protections available from Microsoft Defender for Identity today, we recommend deploying the classic sensor [here](quick-installation-guide.md).
@@ -90,8 +90,8 @@ Activate the Defender for Identity from the [Microsoft Defender portal](https://
    [![Screenshot that shows how to activate the new sensor.](media/activate-capabilities/1.jpg)](media/activate-capabilities/1.jpg#lightbox)
 
    
-> [!NOTE]
-> You can choose to activate eligible domain controllers either automatically, where Defender for Identity activates them as soon as they're discovered, or manually, where you select specific domain controllers from the list of eligible servers.
+   > [!NOTE]
+   > You can choose to activate eligible domain controllers either automatically, where Defender for Identity activates them as soon as they're discovered, or manually, where you select specific domain controllers from the list of eligible servers.
 
 1. When the activation is complete, a green success banner shows. In the banner, select **Click here to see the onboarded servers** to jump to the **Settings > Identities > Sensors** page, where you can check your sensor health.  
 
@@ -207,9 +207,9 @@ We recommend simulating risky behavior in a test environment to trigger supporte
     Get-ADObject -Identity ((Get-ADDomain).distinguishedname) -Properties ms-DS-MachineAccountQuota
     ```
 
-1. In Microsoft Secure Score, select **Recommended Actions** to check for a new **Resolve unsecure domain configurations** recommendation. You might want to filter recommendations by the **Defender for Identity** product.
+1. In the Microsoft Secure Score, select **Recommended Actions** to check for a new **Resolve unsecure domain configurations** recommendation. You might want to filter recommendations by the **Defender for Identity** product.
 
-For more information, see [Microsoft Defender for Identity's security posture assessments](../security-assessment.md)
+For more information, see [Microsoft Defender for Identity's security posture assessments](../security-assessment.md).
 
 ### Test alert functionality
 
@@ -253,7 +253,7 @@ Deactivating Defender for Identity capabilities from your domain controller does
 ### Offboard Defender for Identity capabilities on your domain controller 
 Download the Defender for Identity offboarding package from the [Microsoft Defender portal](https://security.microsoft.com).
 
-1. Navigate to **Settings** > **Identities** > **Activation**
+1. Navigate to **Settings** > **Identities** > **Activation**.
 
 1. Select Download offboarding package and save the file in a location you can access from your domain controller.  
 ![Screenshot that shows how to offboard the new sensor.](media/activate-capabilities/screenshot-that-shows-how-to-offboard-the-new-sensor.png)
diff --git a/ATPDocs/deploy/prerequisites-standalone.md b/ATPDocs/deploy/prerequisites-standalone.md
@@ -2,7 +2,7 @@
 title: Standalone sensor prerequisites | Microsoft Defender for Identity
 description: This article describes the prerequisites required for a successful Microsoft Defender for Identity deployment using a standalone sensor.
 ms.date: 11/26/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 #CustomerIntent: As a Defender for Identity admin, I want to understand extra prerequisites for deploying a Defender for Identity standalone sensor so that I can be prepared for a successful deployment.
 ms.reviewer: rlitinsky
 ---
diff --git a/ATPDocs/deploy/prerequisites.md b/ATPDocs/deploy/prerequisites.md
@@ -2,7 +2,7 @@
 title: Prerequisites | Microsoft Defender for Identity
 description: This article describes the prerequisites required for a successful Microsoft Defender for Identity deployment.
 ms.date: 08/28/2023
-ms.topic: conceptual
+ms.topic: install-set-up-deploy
 ms.reviewer: rlitinsky
 ---
 
diff --git a/CloudAppSecurityDocs/app-governance-manage-app-governance.md b/CloudAppSecurityDocs/app-governance-manage-app-governance.md
@@ -1,7 +1,7 @@
 ---
 title: App governance in Microsoft Defender for Cloud Apps and Microsoft Defender XDR
 ms.date: 05/23/2025
-ms.topic: conceptual
+ms.topic: concept-article
 description: Implement Microsoft app governance capabilities over Microsoft Defender for Cloud Apps and Microsoft Defender XDR to govern your apps.
 ---
 
diff --git a/CloudAppSecurityDocs/app-governance-monitor-apps-unusual-data-usage.md b/CloudAppSecurityDocs/app-governance-monitor-apps-unusual-data-usage.md
@@ -1,7 +1,7 @@
 ---
 title: Monitor and respond to apps with unusual data usage with app governance | Microsoft Defender for Cloud Apps
 ms.date: 05/23/2025
-ms.topic: conceptual
+ms.topic: concept-article
 description: Monitor and respond to apps with unusual data usage using app governance in Microsoft Defender XDR with Microsoft Defender for Cloud Apps.
 ---
 
diff --git a/CloudAppSecurityDocs/app-governance-visibility-insights-compliance-posture.md b/CloudAppSecurityDocs/app-governance-visibility-insights-compliance-posture.md
@@ -1,7 +1,7 @@
 ---
 title: Determine your app compliance posture with app governance | Microsoft Defender for Cloud Apps
 ms.date: 05/23/2025
-ms.topic: conceptual
+ms.topic: concept-article
 description: Determine your app compliance posture with app governance in Microsoft Defender XDR with Microsoft Defender for Cloud Apps.
 ---
 
diff --git a/CloudAppSecurityDocs/app-governance-visibility-insights-overview.md b/CloudAppSecurityDocs/app-governance-visibility-insights-overview.md
@@ -1,7 +1,7 @@
 ---
 title: App governance visibility and insights | Microsoft Defender for Cloud Apps
 ms.date: 05/23/2025
-ms.topic: conceptual
+ms.topic: concept-article
 description: Learn about visibility and insights available for app governance with Microsoft Defender for Cloud Apps in Microsoft Defender XDR.
 ---
 
diff --git a/CloudAppSecurityDocs/proxy-intro-aad.md b/CloudAppSecurityDocs/proxy-intro-aad.md
@@ -2,7 +2,7 @@
 title: Conditional Access app control | Microsoft Defender for Cloud Apps
 description: Learn how Microsoft Defender for Cloud Apps provides Conditional Access app control.
 ms.date: 02/29/2024
-ms.topic: conceptual
+ms.topic: concept-article
 ---
 # Conditional Access app control in Microsoft Defender for Cloud Apps
 
@@ -73,7 +73,7 @@ Apply session and access controls to any interactive single sign-on that uses th
 Additionally, if you're using Microsoft Entra ID apps, apply session and access controls to:
 
 - Any interactive single sign-on that uses the OpenID Connect authentication protocol.
-- Apps hosted on-premises and configured with the [Microsoft Entra application proxy](/entra/identity/app-proxy/application-proxy).
+- Apps hosted on-premises and configured with the [Microsoft Entra application proxy](/entra/identity/app-proxy/).
 
 Microsoft Entra ID apps are also automatically onboarded for Conditional Access app control, whereas apps that use other IdPs must be [onboarded manually](conditional-access-app-control-how-to-overview.md).
 
diff --git a/CloudAppSecurityDocs/set-up-cloud-discovery.md b/CloudAppSecurityDocs/set-up-cloud-discovery.md
@@ -2,7 +2,7 @@
 title: Cloud app discovery overview | Microsoft Defender for Cloud Apps
 description: This article describes Microsoft Defender for Cloud Apps support for cloud app discovery.
 ms.date: 12/20/2023
-ms.topic: conceptual
+ms.topic: concept-article
 ---
 
 # Cloud app discovery overview
diff --git a/CloudAppSecurityDocs/working-with-app-page.md b/CloudAppSecurityDocs/working-with-app-page.md
@@ -2,7 +2,7 @@
 title: Working with the app page
 description: This article describes how the app page works in Defender for Cloud Apps.
 ms.date: 05/15/2024
-ms.topic: conceptual
+ms.topic: concept-article
 ---
 # Working with the app page
 
diff --git a/CloudAppSecurityDocs/zero-trust.md b/CloudAppSecurityDocs/zero-trust.md
@@ -2,7 +2,7 @@
 title: Zero Trust and Microsoft Defender for Cloud Apps
 description: This article describes how Microsoft Defender for Cloud Apps fits into an overall Zero Trust security strategy when deployed with Microsoft Defender XDR.
 ms.date: 05/12/2024
-ms.topic: conceptual
+ms.topic: concept-article
 ms.collection:
   - zerotrust-services
 ---
diff --git a/defender-office-365/submissions-admin.md b/defender-office-365/submissions-admin.md
@@ -16,7 +16,7 @@ ms.collection:
 ms.custom: seo-marvel-apr2020
 description: "Admins can learn how to use the Submissions page in the Microsoft Defender portal to submit messages, URLs, and email attachments to Microsoft for analysis. Reasons for submission include: legitimate messages that were blocked, suspicious messages that were allowed, suspected phishing email, spam, malware, and other potentially harmful messages."
 ms.service: defender-office-365
-ms.date: 02/24/2025
+ms.date: 06/13/2025
 appliesto:
   - ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Exchange Online Protection</a>
   - ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -828,6 +828,9 @@ The analysis results of the reported item are shown in the details flyout that o
 
 If an override or policy configuration was found, the result should be available in several minutes. If there wasn't a problem in email authentication or delivery wasn't affected by an override or policy, the detonation and feedback from graders could take up to a day.
 
+> [!NOTE]
+> AI-powered Submissions Response capability introduces generative AI explanations for admin email submissions to Microsoft. For more information, see [Submission result definitions](submissions-result-definitions.md).
+
 ### Actions for admin submissions in Defender for Office 365
 
 In organizations with Microsoft Defender for Office 365 (add-on licenses or included in subscriptions like Microsoft 365 E5 or Microsoft 365 Business Premium), the following actions are available for admin submissions in the details flyout that opens after you select an entry from the list by clicking anywhere in the row other than the check box:
diff --git a/exposure-management/value-data-connectors.md b/exposure-management/value-data-connectors.md
@@ -47,6 +47,9 @@ Benefits of using the external data connectors include:
 - Visualizing through the Attack Map tool
 - Exploring using advanced hunting queries via KQL
 
+> [!NOTE]
+> Currently vulnerabilities retrieved from data connectors only appear in the Exposure Graph, and can be explored in the Attack Surface Map or using Advanced Hunting.
+
 ### Connectors data in the Device Inventory
 
 In the Device Inventory, you'll see the discovery sources for each device, which are the products from which we got any report on this device. These might include Microsoft Security products like MDE, MDC, and MDI, and also external data sources like Qualys or ServiceNow CMDB. You can filter on one or more discovery sources within the inventory to view devices that were discovered specifically by those sources.
