Merge pull request #1173 from MicrosoftDocs/main

Publish main to live, Friday 10:30AM PDT, 08/19

Author: padmagit77

defender-for-iot/TOC.yml

@@ -43,4 +43,10 @@
     - name: Manage
       items:
       - name: Manage sites
-        href: manage-sites.md           
+        href: manage-sites.md  
+      - name: Manage licenses
+        items:
+          - name: Overview
+            href: license-overview.md
+          - name: Manage your license
+            href: manage-license.md           

defender-for-iot/get-started.md

@@ -46,3 +46,7 @@ Once you have a trial license, [set up a new site](set-up-sites.md) so that Micr
 ## Turn on Public preview features
 
 Turn on the public preview features in the Microsoft Defender XDR settings to enable the site security features. Directions to change the settings are available in [Defender portal preview features](/defender-xdr/preview#turn-on-preview-features).
+
+## Upgrade to a permanent license
+
+After assessing the trial version, you can [upgrade to a full license](manage-license.md). For more information, see [license overview](license-overview.md).

defender-for-iot/license-overview.md

@@ -0,0 +1,41 @@
+---
+title: Overview of the permanent site license and how to choose one for Microsoft Defender for IoT in the Defender portal 
+description: Learn about a permanent site license, how to upgrade and the different options available for Microsoft Defender for IoT in the Defender portal.
+ms.service: defender-for-iot
+author: limwainstein
+ms.author: lwainstein
+ms.localizationpriority: medium
+ms.date: 08/01/2024
+ms.topic: overview
+---
+
+# How the site-based license model works
+
+The site-based license model offers a simplified approach to licensing by providing coverage for entire sites rather than individual devices. Customers can purchase annual licenses for their operational sites where Operational Technology (OT) devices are deployed, and receive security coverage for all devices within the site.  
+
+[!INCLUDE [defender-iot-preview](../includes//defender-for-iot-defender-public-preview.md)]
+
+## What defines a site?
+
+A site refers to a logical grouping of devices within your organization. It represents a specific physical location, such as a manufacturing facility, campus, office building, hospital, rig, or any other relevant site.
+
+## What are the different OT site-based licenses?
+
+Licenses come in five different sizes, based on the number of devices at the site. The licenses range from the smallest tier that covers up to 100 devices per site, to the largest tier, which secures up to 5000 devices per site. For more information, see [license sizing details](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-iot-pricing#xfb84a030eec341cb84a6165f393e928a).
+
+The size of a site is determined by the maximum number of devices per site. Billing is based on the license tier, regardless of the number of devices actually discovered.
+
+## What if I need to change the number of devices for a site after making a purchase?  
+
+Once a license is purchased, the number of devices cannot be adjusted until the renewal period. During the annual license renewal, you change to a different license tier for a site based on your updated discovered device count.
+
+## How to choose a license and assess the number of devices on-site?
+
+There are two methods for assessing the number of devices at your site. You could either utilize your OT network monitoring tools to detect and count the devices per site, or use previous knowledge of the number of devices at the site and update the license during the annual license renewal if needed.
+
+> [!Note]
+> All types of devices, both OT and IT, identified on your site should be included in the license. This includes endpoints managed by Microsoft Defender for Endpoint and devices detected by the Microsoft Defender for IoT sensors.
+
+## Next steps
+
+[Manage your license](manage-license.md)

defender-for-iot/manage-license.md

@@ -0,0 +1,41 @@
+---
+title: Manage licenses for Microsoft Defender for IoT in the Microsoft Defender portal
+description: Read this article to learn about the managing of your license for Defender for IoT in the Microsoft Defender portal.
+ms.service: defender-for-iot
+author: limwainstein
+ms.author: lwainstein
+ms.localizationpriority: medium
+ms.date: 06/25/2024
+ms.topic: how-to
+---
+
+# Manage your license
+
+After using a trial license, and deciding to use Microsoft Defender for IoT permanently, you must purchase a full license. To purchase the correct license, you need to know the total number of devices within your network so that you can choose the correct sized license for your network.
+
+This article shows how to make changes to your license, including the steps to choose the best size license to purchase, and upgrading from a trial to permanent license.
+
+[!INCLUDE [defender-iot-preview](../includes//defender-for-iot-defender-public-preview.md)]
+
+## Calculate number of devices
+
+To calculate the number of devices in your network:
+
+1. In the [Microsoft Defender portal](https://security.microsoft.com/machines) menu, select **Assets > Devices**. The device inventory opens.
+1. Select the **IoT/OT devices** tab. Note down the total number of devices listed. In this example there are 816 IoT/OT devices detected.
+
+    :::image type="content" source="media/manage-licenses/calculate-ot-devices.png" alt-text="Screenshot showing the list of OT devices in the device inventory for caluculating the total number of devices at the site." lightbox="media/manage-licenses/calculate-ot-devices.png":::
+
+## Select license size in the admin center
+
+Purchase the license for your network from the [Microsoft 365 admin center](/microsoft-365/commerce/licenses/buy-licenses), ensuring it covers enough devices for your site needs.
+
+1. Go to the Microsoft 365 admin center **Billing > Purchase services**. If you don't have this option select **Marketplace** instead.
+
+1. Search for Defender for IoT.
+
+1. Choose the license appropriate for the size of your site. There are five different sized licenses ranging from Extra-large for up to 5,000 devices, to extra-small covering a maximum of 100 devices.
+
+    Make sure to select the number of licenses you want to purchase based on the number of sites you're monitoring. You might need to select licenses of different sizes if the number of devices at each site is different.
+
+1. Complete the purchasing instructions.

defender-for-iot/media/manage-licenses/calculate-ot-devices.png

@@ -27,6 +27,7 @@ ms.date: 02/16/2024
 
 
 **Applies to:**
+
 - Microsoft Defender XDR
 
 [!INCLUDE [Prerelease information](../includes/prerelease.md)]

defender-xdr/deploy-supported-services.md

@@ -26,6 +26,7 @@ ms.date: 04/20/2021
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
 
 **Applies to:**
+
 - Microsoft Defender XDR
 
 Microsoft Defender for Identity can help detect malicious attempts to compromise identities in your organization. Because Defender for Identity integrates with Microsoft Defender XDR, security analysts can have visibility on threats coming in from Defender for Identity, such as suspected Netlogon privilege elevation attempts.

defender-xdr/first-incident-path-identity.md

@@ -17,19 +17,16 @@ ms.topic: conceptual
 search.appverid: 
   - MOE150
   - MET150
-ms.date: 07/02/2024
+ms.date: 08/19/2024
+appliesto: 
+- Microsoft Defender XDR
+- Microsoft Sentinel in the Microsoft Defender portal
 ---
 
 # Manage incidents in Microsoft Defender
 
 [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
 
-
-**Applies to:**
-
-- Microsoft Defender XDR
-- Microsoft Defender unified security operations center (SOC) platform
-
 Incident management is critical to ensuring that incidents are named, assigned, and tagged to optimize time in your incident workflow and more quickly contain and address threats.
 
 You can manage incidents from **Incidents & alerts > Incidents** on the quick launch of the Microsoft Defender portal ([security.microsoft.com](https://security.microsoft.com)). Here's an example.

defender-xdr/manage-incidents.md

@@ -17,7 +17,7 @@ ms.collection:
 - tier1
 ms.topic: conceptual
 adobe-target: true
-ms.date: 07/18/2024
+ms.date: 08/19/2024
 appliesto:
 - ✅ <a href="https://learn.microsoft.com/defender-xdr/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a>
 manager: deniseb
@@ -59,8 +59,6 @@ Microsoft Defender XDR services protect:
 
 - **Applications with Defender for Cloud Apps** - Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps.
 
-- **Cloud workloads and applications** **with Defender for Cloud** - Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP) combining capabilities of a development security operations (DevSecOps), a cloud security posture (CPSM), and a cloud workload protection platform (CWPP) to protect cloud-based applications from threats and vulnerabilities.
-
 Microsoft Defender XDR's unique cross-product layer augments the individual service components to:
 
 - Help protect against attacks and coordinate defensive responses across the services through signal sharing and automated actions.