Merge branch 'main' into mdav-relnotes

denisebmsft · web-flow · commit 955aae039c9c · 2025-06-12T12:46:56.000-07:00
diff --git a/ATADocs/ata-update-1.5-migration-guide.md b/ATADocs/ata-update-1.5-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.5 migration guide
 description: Procedures to update ATA to version 1.5
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: fb65eb41-b215-4530-93a2-0b8991f4e980
 
diff --git a/ATADocs/ata-update-1.6-migration-guide.md b/ATADocs/ata-update-1.6-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.6 migration guide
 description: Procedures to update ATA to version 1.6
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 0756ef64-3aef-4a69-8981-24fa8f285c6a
 
diff --git a/ATADocs/ata-update-1.7-migration-guide.md b/ATADocs/ata-update-1.7-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.7 migration guide
 description: Procedures to update ATA to version 1.7
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 8eefcd45-7a4b-4074-ac5b-1ffc48e6654a
 
diff --git a/ATADocs/ata-update-1.8-migration-guide.md b/ATADocs/ata-update-1.8-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.8 migration guide
 description: Procedures to update ATA to version 1.8
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: e5a9718c-b22e-41f7-a614-f00fc4997682
 
diff --git a/ATADocs/ata-update-1.9-migration-guide.md b/ATADocs/ata-update-1.9-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.9 migration guide
 description: Procedures to update ATA to version 1.9
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 2946310a-8e4e-48fc-9450-fc9647efeb22
 
diff --git a/ATADocs/ata-update-1.9.1-migration-guide.md b/ATADocs/ata-update-1.9.1-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.9.1 migration guide
 description: Procedure to update ATA to version 1.9.1
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 2946310a-8e4e-48fc-9450-fc9647efeb22
 
diff --git a/ATADocs/ata-update-1.9.2-migration-guide.md b/ATADocs/ata-update-1.9.2-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.9.2 migration guide
 description: Procedure to update ATA to version 1.9.2
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 2946310a-8e4e-48fc-9450-fc9647efeb22
 
diff --git a/ATADocs/ata-update-1.9.3-migration-guide.md b/ATADocs/ata-update-1.9.3-migration-guide.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics update to 1.9.3 migration guide
 description: Procedure to update ATA to version 1.9.3
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 2946310a-8e4e-48fc-9450-fc9647efeb22
 
diff --git a/ATADocs/troubleshooting-ata-using-ata-database.md b/ATADocs/troubleshooting-ata-using-ata-database.md
@@ -4,7 +4,7 @@
 title: Troubleshooting Advanced Threat Analytics using the database
 description: Describes how you can use the ATA database to help troubleshoot issues 
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ms.service: advanced-threat-analytics
 ms.assetid: 377a3c81-5c1d-486f-8942-85249aacf560
 
diff --git a/ATADocs/troubleshooting-ata-using-logs.md b/ATADocs/troubleshooting-ata-using-logs.md
@@ -4,7 +4,7 @@
 title: Troubleshooting Advanced Threat Analytics using the logs
 description: Describes how you can use the ATA logs to troubleshoot issues
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ms.service: advanced-threat-analytics
 ms.assetid: b8ad5511-8893-4d1d-81ee-b9a86e378347
 
diff --git a/ATADocs/troubleshooting-ata-using-perf-counters.md b/ATADocs/troubleshooting-ata-using-perf-counters.md
@@ -4,7 +4,7 @@
 title: Troubleshooting Advanced Threat Analytics with performance counters
 description: Describes how you can use performance counters to troubleshoot issues with ATA
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ms.service: advanced-threat-analytics
 ms.assetid: df162a62-f273-4465-9887-94271f5000d2
 
diff --git a/ATADocs/troubleshooting-service-startup.md b/ATADocs/troubleshooting-service-startup.md
@@ -4,7 +4,7 @@
 title: Troubleshooting Advanced Threat Analytics service startup
 description: Describes how you can troubleshoot ATA startup issues
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ms.service: advanced-threat-analytics
 ms.assetid: 5a65285c-d1de-4025-9bb4-ef9c20b13cfa
 
diff --git a/ATADocs/upgrade-path.md b/ATADocs/upgrade-path.md
@@ -4,7 +4,7 @@
 title: Advanced Threat Analytics recommended upgrade path
 description: Provides instructions for upgrading your Advanced Threat Analytics (ATA) version.
 ms.date: 01/10/2023
-ms.topic: conceptual
+ms.topic: upgrade-and-migration-article
 ms.service: advanced-threat-analytics
 ms.assetid: 88720401-1fb2-4353-ad39-32bc0088f0de
 
diff --git a/ATPDocs/deploy/event-collection-overview.md b/ATPDocs/deploy/event-collection-overview.md
@@ -2,7 +2,7 @@
 title: Event collection overview | Microsoft Defender for Identity
 description: Learn about required event collection for Microsoft Defender for Identity sensors on AD FS servers, AD CS servers, Microsoft Entra Connect servers, and domain controllers.
 ms.date: 08/10/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ms.reviewer: rlitinsky
 ---
 
diff --git a/CloudAppSecurityDocs/app-governance-investigate-predefined-policies.md b/CloudAppSecurityDocs/app-governance-investigate-predefined-policies.md
@@ -12,9 +12,10 @@ App governance provides predefined app policy alerts for anomalous activities. T
 Included in this guide is general information about the conditions for triggering alerts. Because predefined policies are nondeterministic by nature, they're only triggered when there's behavior that deviates from the norm. 
 
 > [!TIP]
-> Some alerts may be in preview, so regularly review the updated alert statuses.
+> Some alerts might be in preview, so regularly review the updated alert statuses.
 >
 
+
 ## Security alert classifications
 
 Following proper investigation, all app governance alerts can be classified into one of the following activity types:
@@ -38,8 +39,12 @@ Use the following general guidelines when investigating any type of alert to gai
 
 This section provides information on each predefined policy alert, along with steps for investigation and remediation.
 
+
 ### Increase in data usage by an overprivileged or highly privileged app
 
+> [!NOTE]
+> As part of our continuous efforts to enhance Defender for Cloud apps alert accuracy we have disabled this policy. This policy will remain visible in the Defender portal in a disabled state. If you want to continue using this policy,  in the Defender portal, go to **App Governance**, and then the **Policies** page. Select the policy, and then select **Activate**.
+
 **Severity**: Medium
 
 Find apps with powerful or unused permissions that exhibit sudden increases in data usage through Graph API. Unusual changes in data usage might indicate compromise.
@@ -58,6 +63,9 @@ To determine if the alert is a true positive (TP) or a false positive (FP), revi
 
 ### Unusual activity from an app with priority account consent
 
+> [!NOTE]
+> As part of our continuous efforts to enhance Defender for Cloud apps alert accuracy we have disabled this policy. This policy will remain visible in the Defender portal in a disabled state. If you want to continue using this policy,  in the Defender portal, go to **App Governance**, and then the **Policies** page. Select the policy, and then select **Activate**.
+
 **Severity**: Medium
 
 Find unusual increases in either data usage or Graph API access errors exhibited by apps that have been given consent by a priority account.
@@ -68,7 +76,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that the increase in data usage or API access errors by an app with consent from a priority account is highly irregular or potentially malicious.
 
-  **Recommended action**: Contact priority account users about the app activities that have caused the increase in data usage or API access errors. Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Contact priority account users about the app activities that have caused the increase in data usage or API access errors. Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is intended and has a legitimate business use in the organization.
 
@@ -78,15 +86,15 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 **Severity**: Medium
 
-Consent requests from a newly created app have been rejected frequently by users. Users typically reject consent requests from apps that have exhibited unexpected behavior or arrived from an untrusted source. Apps that have low consent rates are more likely to be risky or malicious.
+Consent requests from a newly created app have been rejected frequently by users. Users typically reject consent requests from apps that exhibit unexpected behavior or arrived from an untrusted source. Apps that have low consent rates are more likely to be risky or malicious.
 
 **TP or FP?**
 
 Review all activities performed by the app, scopes granted to the app and user activity associated with the app.
 
-- **TP**: Apply this recommended action if you have confirmed that the app is from an unknown source and its activities have been highly irregular or potentially malicious.
+- **TP**: Apply this recommended action if you have confirmed that the app is from an unknown source and its activities are highly irregular or potentially malicious.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -104,7 +112,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that highly irregular, potentially malicious activities have resulted in the detected increase in OneDrive usage.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -122,7 +130,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that highly irregular, potentially malicious activities have resulted in the detected increase in SharePoint usage.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -140,7 +148,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that highly irregular, potentially malicious activities have resulted in the detected increase in Exchange usage.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -158,7 +166,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that the updates to app certificates or secrets and other app activities have been highly irregular or potentially malicious.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -174,9 +182,9 @@ An app made a large number of Graph API calls to create Exchange inbox rules. Th
 
 Review all activities performed by the app, scopes granted to the app and user activity associated with the app.
 
-- **TP**: Apply this recommended action if you have confirmed that the creation of inbox rules and other activities have been highly irregular or potentially malicious.
+- **TP**: Apply this recommended action if you have confirmed that the creation of inbox rules and other activities are highly irregular or potentially malicious.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: Apply this recommended action if you have confirmed that the detected app activity is legitimate.
 
@@ -194,7 +202,7 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that the content searches on Exchange and other activities have been highly irregular or potentially malicious.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: If you can confirm that no unusual mail search activities were performed by the app or that the app is intended to make unusual mail search activities through Graph API.
 
@@ -212,14 +220,17 @@ Review all activities performed by the app, scopes granted to the app and user a
 
 - **TP**: Apply this recommended action if you have confirmed that the sending of email messages and other activities have been highly irregular or potentially malicious.
 
-  **Recommended action**: Temporarily disable the app, reset the password and then re-enable the app.
+  **Recommended action**: Temporarily disable the app, reset the password, and then re-enable the app.
 
 - **FP**: If you can confirm that no unusual mail send activities were performed by the app or that the app is intended to make unusual mail send activities through Graph API.
 
   **Recommended action**: Dismiss the alert.
 
 ### Access to sensitive data
 
+> [!NOTE]
+> As part of our continuous efforts to enhance Defender for Cloud apps alert accuracy we have disabled this policy. This policy will remain visible in the Defender portal in a disabled state. If you want to continue using this policy,  in the Defender portal, go to **App Governance**, and then the **Policies** page. Select the policy, and then select **Activate**.
+
 **Severity**: Medium
 
 Find apps that access sensitive data identified by specific sensitively labels.
diff --git a/CloudAppSecurityDocs/ems-cloud-app-security-govt-service-byok-troubleshoot.md b/CloudAppSecurityDocs/ems-cloud-app-security-govt-service-byok-troubleshoot.md
@@ -2,7 +2,7 @@
 title: Troubleshooting data encryption with your own key
 description: This article provides a list of problems that can prevent Defender for Cloud Apps from accessing your Azure Key Vault key used to encrypt collected data at rest.
 ms.date: 01/29/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ---
 
 
diff --git a/CloudAppSecurityDocs/general-setup.md b/CloudAppSecurityDocs/general-setup.md
@@ -36,12 +36,6 @@ For portal access requirements, see [Portal access](network-requirements.md#port
 
     * To work with Microsoft Purview Information Protection integration, you must enable the [App connector for Microsoft 365](./connect-office-365.md).
 
-> [!NOTE]
-> If you use ExpressRoute, Defender for Cloud Apps is deployed in Azure and fully integrated with [ExpressRoute](/azure/expressroute/expressroute-introduction). All interactions with the Defender for Cloud Apps apps APIs and traffic sent to Defender for Cloud Apps APIs, including upload of discovery logs, is routed via ExpressRoute for improved latency, performance, and security.
->
-> Microsoft Defender Portal usage is not included in the ExpressRoute integration.
->
-> For more information about Microsoft Peering, see [ExpressRoute circuits and routing domains](/azure/expressroute/expressroute-circuit-peerings).
 
 ## Next steps
 
diff --git a/CloudAppSecurityDocs/troubleshoot-policies.md b/CloudAppSecurityDocs/troubleshoot-policies.md
@@ -2,7 +2,7 @@
 title: Troubleshooting policies
 description: This article describes the process for troubleshooting policy creation in Defender for Cloud Apps.
 ms.date: 01/29/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ---
 # Troubleshooting Microsoft Defender for Cloud Apps policies
 
diff --git a/CloudAppSecurityDocs/troubleshooting-content-inspection.md b/CloudAppSecurityDocs/troubleshooting-content-inspection.md
@@ -2,7 +2,7 @@
 title: Troubleshooting content inspection errors 
 description: This article provides a list of content inspection statuses and their meanings.
 ms.date: 01/29/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ---
 # Troubleshooting content inspection errors
 
diff --git a/CloudAppSecurityDocs/troubleshooting-siem.md b/CloudAppSecurityDocs/troubleshooting-siem.md
@@ -2,7 +2,7 @@
 title: Troubleshooting SIEM integration 
 description: This article provides a list of possible issues when connecting your SIEM to Defender for Cloud Apps and provides resolutions for each.
 ms.date: 01/29/2023
-ms.topic: conceptual
+ms.topic: troubleshooting-general
 ---
 
 # Troubleshooting SIEM integration
diff --git a/defender-endpoint/office-365-microsoft-defender-antivirus.md b/defender-endpoint/office-365-microsoft-defender-antivirus.md
@@ -28,7 +28,7 @@ ms.date: 03/26/2025
 **Applies to:**
 - [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
 - [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
-- Microsoft Defender Antivirus
+- [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md)
 - Microsoft 365
 
 **Platforms**
diff --git a/defender-endpoint/windows-whatsnew.md b/defender-endpoint/windows-whatsnew.md
diff --git a/defender-office-365/scc-permissions.md b/defender-office-365/scc-permissions.md
