Merge branch 'main' of https://github.com/MicrosoftDocs/defender-docs-pr into WI484153-manage-app-policies-remove-audit-mode

Author: DeCohen

CloudAppSecurityDocs/app-governance-app-policies-get-started.md

@@ -1,8 +1,9 @@
 ---
 title: Get started with app governance policies | Microsoft Defender for Cloud Apps
-ms.date: 05/28/2023
+ms.date: 08/31/2025
 ms.topic: how-to
 description: Get started learning about app governance policies with Microsoft Defender for Cloud Apps in Microsoft Defender XDR
+ms.reviewer: shragar456
 ---
 
 # Get started with app policies
@@ -23,22 +24,21 @@ To see your list of current app policies, go to the **Microsoft Defender XDR > A
 
 For example:
 
-![Screenshot of the app governance policies summary page in Microsoft Defender XDR.](media/app-governance-app-policies-get-started/azure-ad-policies.jpg)
+:::image type="content" source="media/app-governance-app-policies-get-started/app-governance-app-policies.png" alt-text="Screenshot that shows the app governance app polcies." lightbox="media/app-governance-app-policies-get-started/app-governance-app-policies.png":::
 
 > [!NOTE]
 > Built-in threat detection policies aren't listed on the **Policies** tab. For more information, see [Investigate threat detection alerts](app-governance-anomaly-detection-alerts.md).
 > 
 
 ## What’s available on the app policies dashboard
 
-The **App governance** > **Policies** tab shows the number of active, inactive, and audit mode policies, and the following information for each policy:
+The **App governance** > **Policies** tab shows the number of active and disabled policies, and the following information for each policy:
 
 - **Policy name**
 - **Status**
 
   - **Active**:  All policy evaluation and actions are active.
-  - **Inactive**: All policy evaluation and actions are disabled.
-  - **Audit mode**: Policy evaluation is active (alerts will trigger) but policy actions are disabled.
+  - **Disabled**: All policy evaluation and actions are disabled.
 
 - **Severity**: Severity level set on any alerts triggered because of this policy being evaluated as true, which is part of the configuration of the policy.
 - **Active alerts**: Number of alerts generated by the policy that have an **In Progress** or **New** status.
@@ -74,22 +74,24 @@ You can also:
 
 1. Select **Edit**.
 
-    While you can't change the name of the policy once created, but you can change the description and policy severity as needed. When you're done, select **Next**.
+    While you can't change the name of the policy once created, you can change the description and policy severity as needed. When you're done, select **Next**.
 
 1. Choose whether you want to continue with the existing policy settings or customize them. Select **No, I'll customize the policy** to make changes, and then select **Next**.
 
-1. Choose whether this policy applies to all apps, specific apps, or all apps except the apps you select. Select **Choose apps** to select which apps to apply the policy to, and then select **Next**.
+1. Choose whether this policy applies to all apps, specific apps, or all apps except the apps you select. 
+
+1. Select **Choose apps** to select which apps to apply the policy to, and then select **Next**.
 
 1. Choose whether to modify the existing conditions of the policy. 
 
     - If you choose to modify the conditions, select **Edit or modify existing conditions for the policy** and choose which policy conditions to apply. 
     - Otherwise, select **Use existing conditions of the policy**. 
 
-    When you're done, select **Next**.
+1. When you're done, select **Next**.
 
 1. Choose whether to disable the app if it triggers the policy conditions and then select **Next**.
 
-1. Set the policy status to **Audit** mode, **Active**, or **Inactive**, as needed, and then select **Next**.
+1. Set the policy status to **Active**, or **Disabled**, as needed, and then select **Next**.
 
 1. Review your setting choices for the policy and if everything is the way you want it, select **Submit**.
 

CloudAppSecurityDocs/app-governance-detect-remediate-get-started.md

@@ -1,8 +1,9 @@
 ---
 title: Get started with app governance threat detection and remediation | Microsoft Defender for Cloud Apps
-ms.date: 05/28/2023
+ms.date: 08/31/2025
 ms.topic: overview
 description: Get started with app governance threat detection and remediation in Microsoft Defender XDR with Microsoft Defender for Cloud Apps.
+ms.reviewer: shragar456
 ---
 
 # Get started with app threat detection and remediation
@@ -13,7 +14,8 @@ To view the latest incidents associated with these alerts, go to the **App gover
 
 For example:
 
-:::image type="content" source="media/app-governance/mapg-cc-overview-alerts.png" alt-text="Screenshot of the App governance > Overview tab with the Latest alerts section highlighted." lightbox="media/app-governance/mapg-cc-overview-alerts.png":::
+:::image type="content" source="media/app-governance/app-governance-overview.png" alt-text="Screenshot that shows the App Governance overview tab." lightbox="media/app-governance/app-governance-overview.png":::
+
 
 On the **Overview** tab, the **Latest alerts** section lists the most recent alerts. You can use these recent alerts to quickly see the current app alert activity for your tenant.
 

CloudAppSecurityDocs/media/app-governance-app-policies-get-started/app-governance-app-policies.png

@@ -14,7 +14,7 @@ ms.collection:
 ms.topic: install-set-up-deploy
 ms.subservice: onboard
 search.appverid: met150
-ms.date: 04/16/2025
+ms.date: 09/07/2025
 ---
 
 # Onboard client devices running Windows or macOS to Microsoft Defender for Endpoint
@@ -37,15 +37,15 @@ To onboard client devices running Windows or macOS, follow this general process:
 
 1. Make sure to review the [Minimum requirements for Defender for Endpoint](minimum-requirements.md).
 
-2. In the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints**, and then, under **Device management**, select **Onboarding**.
+2. In the [Microsoft Defender portal](https://security.microsoft.com), go to **System** > **Settings** > **Endpoints**, and then, under **Device management**, select **Onboarding**.
 
-   :::image type="content" source="media/mde-device-onboarding-ui.png" alt-text="Screenshot showing device onboarding in the Microsoft Defender portal for Defender for Endpoint.":::
+   :::image type="content" source="media/mde-device-onboarding-ui.png" alt-text="Screenshot showing device onboarding in the Microsoft Defender portal for Defender for Endpoint." lightbox="media/mde-device-onboarding-ui.png":::
 
 3. Under **Select operating system to start onboarding process**, select the operating system for the device.
 
 4. Under **Connectivity type**, select either **Streamlined** or **Standard**. (See [prerequisites for streamlined connectivity](/defender-endpoint/configure-device-connectivity#prerequisites).)
 
-5. Under **Deployment method**, select an option. Then download the onboarding package (and installation package, if there is one available). Follow the instructions to onboard your devices. The following table lists available deployment methods:
+5. Under **Deployment method**, select an option. Then download the onboarding package (and installation package, if there's one available). Follow the instructions to onboard your devices. The following table lists available deployment methods:
 
    |Operating system | Deployment method |
    |---|---|