Merge pull request #2755 from MicrosoftDocs/main

learn-build-service-prod[bot] · web-flow · commit 3abf06aae81b · 2026-04-19T22:02:16.000Z
Auto Publish – main to live - 2026-04-19 22:00 UTC
diff --git a/articles/defender-for-cloud/asset-inventory.md b/articles/defender-for-cloud/asset-inventory.md
@@ -1,7 +1,7 @@
 ---
 title: Cloud asset inventory
 description: Learn about the cloud asset inventory in Microsoft Defender for Cloud and Security Exposure Management
-ms.date: 12/03/2025
+ms.date: 04/19/2026
 ms.topic: how-to
 ms.author: dlanger
 author: dlanger
@@ -181,7 +181,7 @@ securityresources
 - [Manage and respond to security alerts](manage-respond-alerts.md)
 - [Continuous export](continuous-export.md) - Export security data to SIEM, SOAR, or other tools
 - [Create custom security dashboards with Azure Workbooks](custom-dashboards-azure-workbooks.md)
-- [Enable Defender for Cloud plans](enable-enhanced-security.md)
+- [Enable Defender for Cloud plans](connect-azure-subscription.md)
 - [Connect AWS accounts](quickstart-onboard-aws.md)
 - [Connect GCP projects](quickstart-onboard-gcp.md)
 
diff --git a/articles/defender-for-cloud/concept-agentless-data-collection.md b/articles/defender-for-cloud/concept-agentless-data-collection.md
@@ -5,7 +5,7 @@ author: Elazark
 ms.author: elkrieger
 ms.service: defender-for-cloud
 ms.topic: concept-article
-ms.date: 02/19/2025
+ms.date: 04/19/2026
 ms.custom: template-concept
 #customer intent: As a user, I want to understand how agentless machine scanning works in Defender for Cloud so that I can effectively collect data from my machines.
 ---
@@ -138,4 +138,4 @@ In addition, permissions to an existing GCP KMS role are granted to support scan
 
 ## Next steps
 
-[Enable agentless machine scanning](enable-vulnerability-assessment-agentless.md).
+[Enable agentless machine scanning](enable-agentless-scanning-vms.md).
diff --git a/articles/defender-for-cloud/concept-attack-path.md b/articles/defender-for-cloud/concept-attack-path.md
@@ -2,7 +2,7 @@
 title: Investigate risks with security explorer/attack paths in Microsoft Defender for Cloud
 description: Learn about investigating risks with security explorer/attack paths in Microsoft Defender for Cloud.
 ms.topic: concept-article
-ms.date: 09/10/2025
+ms.date: 04/19/2026
 #customer intent: As a security analyst, I want to understand attack paths so that I can mitigate risks effectively.
 ---
 
@@ -59,5 +59,5 @@ Learn how to use the [cloud security explorer](how-to-manage-cloud-security-expl
 ## Next steps
 
 - [Identify and remediate attack paths](how-to-manage-attack-path.md)
-- [Enabling agentless scanning for machines](enable-vulnerability-assessment-agentless.md#enabling-agentless-scanning-for-machines)
+- [Enable agentless scanning for machines](enable-agentless-scanning-vms.md#enable-agentless-scanning-on-azure)
 - [Build a query with the cloud security explorer](how-to-manage-cloud-security-explorer.md)
diff --git a/articles/defender-for-cloud/defender-for-app-service-introduction.md b/articles/defender-for-cloud/defender-for-app-service-introduction.md
@@ -1,7 +1,7 @@
 ---
 title: Microsoft Defender for App Service - the benefits and features
 description: Learn about the capabilities of Microsoft Defender for App Service and how to enable it on your subscription.
-ms.date: 05/13/2025
+ms.date: 04/19/2026
 ms.topic: overview
 ms.author: elkrieger
 author: Elazark
@@ -80,7 +80,7 @@ For a full list of the App Service alerts, see the [Reference table of alerts](a
 In this article, you learned about Microsoft Defender for App Service.
 
 > [!div class="nextstepaction"]
-> [Enable enhanced protections](enable-enhanced-security.md)
+> [Enable enhanced protections](connect-azure-subscription.md)
 
 For related material, see the following articles:
 
diff --git a/articles/defender-for-cloud/defender-for-cloud-introduction.md b/articles/defender-for-cloud/defender-for-cloud-introduction.md
@@ -2,7 +2,7 @@
 title: Microsoft Defender for Cloud Overview
 description: Secure your Azure, hybrid, and multicloud resources with Microsoft Defender for Cloud. This cloud-native application protection platform (CNAPP) includes two key capabilities, cloud security posture management (CSPM) and cloud workload protection platform (CWPP). It helps protect your environments across Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and on-premises systems.
 ms.topic: overview
-ms.date: 01/01/2026
+ms.date: 04/19/2026
 ms.author: elkrieger
 author: Elazark
 #customer intent: As a security professional, I want to understand Microsoft Defender for Cloud so that I can protect my cloud resources.
@@ -79,8 +79,8 @@ Defender for Cloud includes free Foundational CSPM capabilities. Enable advanced
 | [Centralized policy management](security-policy-concept.md) | Define the security conditions that you want to maintain across your environment. The policy translates to recommendations that identify resource configurations that violate your security policy. The [Microsoft cloud security benchmark](concept-regulatory-compliance.md) is a built-in standard that applies security principles with detailed technical implementation guidance for Azure and other cloud providers (such as Amazon Web Services (AWS) and Google Cloud Platform (GCP). | [Customize a security policy](create-custom-recommendations.md) | Foundational CSPM (Free) |
 | [Secure score](secure-score-security-controls.md) | Summarize your security posture based on the security recommendations. As you remediate recommendations, your secure score improves. | [Track your secure score](secure-score-access-and-track.md) | Foundational CSPM (Free) |
 | [Multicloud coverage](plan-multicloud-security-get-started.md) | Connect to your multicloud environments by using agentless methods for CSPM insight and CWPP protection. | Connect your [Amazon AWS](quickstart-onboard-aws.md) and [Google GCP](quickstart-onboard-gcp.md) cloud resources to Defender for Cloud | Foundational CSPM (Free) |
-| [Cloud Security Posture Management (CSPM)](concept-cloud-security-posture-management.md) | Use the dashboard to see weaknesses in your security posture. | [Enable CSPM tools](enable-enhanced-security.md) | Foundational CSPM (Free) |
-| [Advanced Cloud Security Posture Management](concept-cloud-security-posture-management.md) | Get advanced tools to identify weaknesses in your security posture, including:</br>- Governance to drive actions to improve your security posture</br>- Regulatory compliance to verify compliance with security standards</br>- Cloud security explorer to build a comprehensive view of your environment | [Enable CSPM tools](enable-enhanced-security.md) | Defender CSPM |
+| [Cloud Security Posture Management (CSPM)](concept-cloud-security-posture-management.md) | Use the dashboard to see weaknesses in your security posture. | [Enable CSPM tools](connect-azure-subscription.md) | Foundational CSPM (Free) |
+| [Advanced Cloud Security Posture Management](concept-cloud-security-posture-management.md) | Get advanced tools to identify weaknesses in your security posture, including:</br>- Governance to drive actions to improve your security posture</br>- Regulatory compliance to verify compliance with security standards</br>- Cloud security explorer to build a comprehensive view of your environment | [Enable CSPM tools](connect-azure-subscription.md) | Defender CSPM |
 | [Data Security Posture Management](concept-data-security-posture.md) | Data security posture management automatically discovers datastores containing sensitive data, and helps reduce risk of data breaches. | [Enable data security posture management](data-security-posture-enable.md) | Defender CSPM or Defender for Storage |
 | [Attack path analysis](concept-attack-path.md#what-is-an-attack-path) | Model traffic on your network to identify potential risks before you implement changes to your environment. | [Build queries to analyze paths](how-to-manage-attack-path.md) | Defender CSPM                         |
 | [Cloud Security Explorer](concept-attack-path.md#what-is-cloud-security-explorer) | A map of your cloud environment that lets you build queries to find security risks. | [Build queries to find security risks](how-to-manage-cloud-security-explorer.md) | Defender CSPM                         |
@@ -139,4 +139,4 @@ For more information about Defender for Cloud and how it works, see:
 ## Next steps
 
 > [!div class="nextstepaction"]
-> [Enable Microsoft Defender plans](enable-enhanced-security.md)
+> [Enable Microsoft Defender plans](connect-azure-subscription.md)
diff --git a/articles/defender-for-cloud/defender-for-resource-manager-introduction.md b/articles/defender-for-cloud/defender-for-resource-manager-introduction.md
@@ -1,7 +1,7 @@
 ---
 title: Microsoft Defender for Resource Manager - Benefits and Features
 description: Learn about the benefits and features of Microsoft Defender for Resource Manager to protect your Azure resources from potential threats.
-ms.date: 08/20/2025
+ms.date: 04/19/2026
 ms.topic: overview
 #customer intent: As a security operations team, I want to learn about the benefits and features of Microsoft Defender for Resource Manager so that I can protect the resource management layer of my Azure resources.
 ---
@@ -38,7 +38,7 @@ A full list of the alerts provided by Microsoft Defender for Resource Manager is
 In this article, you learned about Microsoft Defender for Resource Manager.
 
 > [!div class="nextstepaction"]
-> [Enable enhanced protections](enable-enhanced-security.md)
+> [Enable enhanced protections](connect-azure-subscription.md)
 
 For related material, see the following article:
 
diff --git a/articles/defender-for-cloud/defender-for-storage-classic-migrate.md b/articles/defender-for-cloud/defender-for-storage-classic-migrate.md
@@ -1,7 +1,7 @@
 ---
 title: Migrate from Defender for Storage (classic)
 description: Learn about how to migrate from Defender for Storage (classic) to the new Defender for Storage plan to take advantage of its enhanced capabilities and pricing.
-ms.date: 05/13/2025
+ms.date: 04/19/2026
 author: Elazark
 ms.author: elkrieger
 ms.topic: how-to
@@ -112,4 +112,4 @@ Get-AzPolicyAssignment -Scope "/subscriptions/{subscriptionId}"
 In this article, you learned about migrating to the new Microsoft Defender for Storage plan.
 
 > [!div class="nextstepaction"]
-> [Enable Defender for Storage](enable-enhanced-security.md)
+> [Enable Defender for Storage](connect-azure-subscription.md)
diff --git a/articles/defender-for-cloud/enable-defender-for-storage-data-sensitivity.md b/articles/defender-for-cloud/enable-defender-for-storage-data-sensitivity.md
@@ -1,7 +1,7 @@
 ---
 title: Enable sensitive data threat detection
 description: Learn how to enable and configure sensitive data threat detection in Microsoft Defender for Storage to protect your data and enhance security.
-ms.date: 07/01/2025
+ms.date: 04/19/2026
 author: Elazark
 ms.author: elkrieger
 ms.topic: how-to
@@ -41,4 +41,4 @@ You can also create and publish sensitivity labels for your tenant in Microsoft
 In this article, you learned about Microsoft Defender for Storage's sensitive data scanning.
 
 > [!div class="nextstepaction"]
-> [Enable Defender for Storage](enable-enhanced-security.md)
+> [Enable Defender for Storage](connect-azure-subscription.md)
diff --git a/articles/defender-for-cloud/faq-general.yml b/articles/defender-for-cloud/faq-general.yml
@@ -164,6 +164,8 @@ sections:
           - Azure API Management APIs should be onboarded to Defender for APIs
           - Unused API endpoints should be disabled and removed from Function Apps (Preview)
           - Unused API endpoints should be disabled and removed from Logic Apps (Preview)
+          - Authentication should be enabled on API endpoints hosted in Function Apps (Preview)
+          - Authentication should be enabled on API endpoints hosted in Logic Apps (Preview)
 
       - question: |
           Are there any limitations to Defender for Cloud's identity and access protections?
diff --git a/articles/defender-for-cloud/how-to-enable-agentless-containers.md b/articles/defender-for-cloud/how-to-enable-agentless-containers.md
@@ -3,7 +3,7 @@ title: How-to enable agentless container posture
 description: Learn how to onboard agentless containers
 ms.service: defender-for-cloud
 ms.topic: how-to
-ms.date: 03/02/2026
+ms.date: 04/19/2026
 ---
 
 # Onboard agentless container posture in Defender CSPM
@@ -14,7 +14,7 @@ Agentless container posture is available for Azure, AWS, and GCP environments.
 
 ## Prerequisites
 
-- [Defender CSPM plan is enabled for your environment](enable-enhanced-security.md).
+- [Defender CSPM plan is enabled for your environment](connect-azure-subscription.md).
 
 ## How to onboard agentless container posture in Defender CSPM
 
@@ -105,7 +105,7 @@ Agentless container posture is available for Azure, AWS, and GCP environments.
 
 ## Related content
 
-- [Enable Defender CSPM](enable-enhanced-security.md)
+- [Enable Defender CSPM](connect-azure-subscription.md)
 
 - [Agentless container posture capabilities](concept-agentless-containers.md)
 
diff --git a/articles/defender-for-cloud/how-to-manage-attack-path.md b/articles/defender-for-cloud/how-to-manage-attack-path.md
@@ -4,7 +4,7 @@ author: Elazark
 ms.author: elkrieger
 description: Learn how to identify and remediate attack paths in Microsoft Defender for Cloud and enhance the security of your environment.
 ms.topic: how-to
-ms.date: 05/18/2025
+ms.date: 04/19/2026
 ms.custom: sfi-image-nochange
 zone_pivot_groups: defender-portal-experience
 #customer intent: As a security analyst, I want to learn how to identify and remediate attack paths in Microsoft Defender for Cloud so that I can enhance the security of my environment.
@@ -32,7 +32,7 @@ By default attack paths are organized by risk level. The risk level is determine
 
 ## Prerequisites
 
-- You must [enable Defender Cloud Security Posture Management (CSPM)](enable-enhanced-security.md) and have [agentless scanning](enable-vulnerability-assessment-agentless.md) enabled.
+- You must [enable Defender Cloud Security Posture Management (CSPM)](connect-azure-subscription.md) and have [agentless scanning](enable-agentless-scanning-vms.md) enabled.
 
 - **Required roles and permissions**: Security Reader, Security Admin, Reader, Contributor, or Owner.
 
diff --git a/articles/defender-for-cloud/how-to-manage-cloud-security-explorer.md b/articles/defender-for-cloud/how-to-manage-cloud-security-explorer.md
@@ -2,7 +2,7 @@
 title: Build queries with cloud security explorer
 description: Learn how to build queries with cloud security explorer in Microsoft Defender for Cloud to proactively identify security risks in your cloud environment.
 ms.topic: how-to
-ms.date: 03/31/2025
+ms.date: 04/19/2026
 ms.author: elkrieger
 author: elazark
 ai-usage: ai-assisted
@@ -20,8 +20,8 @@ Use the cloud security explorer to query security issues and environment context
 
 ## Prerequisites
 
-- You must [enable Defender Cloud Security Posture Management (CSPM)](enable-enhanced-security.md)
-  - You must [enable agentless scanning](enable-vulnerability-assessment-agentless.md).
+- You must [enable Defender Cloud Security Posture Management (CSPM)](connect-azure-subscription.md)
+  - You must [enable agentless scanning](enable-agentless-scanning-vms.md).
   
   For agentless container posture, you must enable the following extensions:
   - [K8S API access](tutorial-enable-cspm-plan.md#enable-the-components-of-the-defender-cspm-plan)
diff --git a/articles/defender-for-cloud/onboard-management-group.md b/articles/defender-for-cloud/onboard-management-group.md
@@ -2,7 +2,7 @@
 title: Onboard a management group
 description: Learn how to use a supplied Azure Policy definition to enable Microsoft Defender for Cloud for all the subscriptions in a management group.
 ms.topic: how-to
-ms.date: 07/15/2025
+ms.date: 04/19/2026
 ---
 
 # Enable Defender for Cloud on all subscriptions in a management group
@@ -92,4 +92,4 @@ There are various ways you might choose to modify the Azure Policy definition:
 Now that you onboarded an entire management group, enable the enhanced security features.
 
 > [!div class="nextstepaction"]
-> [Enable enhanced protections](enable-enhanced-security.md)
+> [Enable enhanced protections](connect-azure-subscription.md)
diff --git a/articles/defender-for-cloud/plan-defender-for-servers-scale.md b/articles/defender-for-cloud/plan-defender-for-servers-scale.md
@@ -4,7 +4,7 @@ description: Scale protection of Azure, AWS, GCP, and on-premises servers by usi
 ms.topic: concept-article
 ms.author: elkrieger
 author: Elazark
-ms.date: 02/19/2025
+ms.date: 04/19/2026
 ---
 # Scale a Defender for Servers deployment
 
@@ -64,7 +64,7 @@ You can use a policy definition to enable Defender for Servers at scale:
 
 Begin a deployment for your scenario:
 
-- [Enable a Defender for Servers plan](enable-enhanced-security.md)
+- [Enable a Defender for Servers plan](connect-azure-subscription.md)
 - [Connect an on-premises machine to Azure](quickstart-onboard-aws.md)
 - [Connect an AWS account to Defender for Cloud](quickstart-onboard-aws.md)
 - [Connect a GCP project to Defender for Cloud](quickstart-onboard-gcp.md)
diff --git a/articles/defender-for-cloud/powershell-onboarding.md b/articles/defender-for-cloud/powershell-onboarding.md
@@ -2,7 +2,7 @@
 title: Onboard with PowerShell
 description: This document walks you through the process of enabling Microsoft Defender for Cloud with PowerShell cmdlets.
 ms.topic: quickstart
-ms.date: 05/25/2025
+ms.date: 04/19/2026
 ms.custom: mode-api, devx-track-azurepowershell
 ---
 
@@ -16,7 +16,7 @@ This article provides a sample PowerShell script that can be modified and used i
 
 In this example, we'll enable Defender for Cloud on a subscription with ID: `<Subscription ID>` and apply the recommended settings that provide a high level of protection, by enabling Microsoft Defender for Cloud's enhanced security features, which provides advanced threat protection and detection capabilities:
 
-1. Enable [the enhanced security in Microsoft Defender for Cloud](enable-enhanced-security.md).
+1. Enable [the enhanced security in Microsoft Defender for Cloud](connect-azure-subscription.md).
 
 1. Set the organization’s [CISO as the security contact for Defender for Cloud alerts and notable events](configure-email-notifications.md).
 
diff --git a/articles/defender-for-cloud/quickstart-onboard-aws.md b/articles/defender-for-cloud/quickstart-onboard-aws.md
@@ -4,7 +4,7 @@ description: Defend your AWS resources with Microsoft Defender for Cloud, a guid
 author: ElazarK
 ms.author: elkrieger
 ms.topic: install-set-up-deploy
-ms.date: 01/06/2026
+ms.date: 04/19/2026
 ---
 
 # Connect AWS accounts to Microsoft Defender for Cloud
@@ -72,7 +72,7 @@ Region availability: All public AWS regions except Tel Aviv, Milan, Jakarta, Spa
 
 ### [Defender for Servers](#tab/Defender-for-Servers)
 
-- [Microsoft Defender for Servers enabled](enable-enhanced-security.md) on your subscription.  
+- [Microsoft Defender for Servers enabled](connect-azure-subscription.md) on your subscription.  
 - An active AWS account with EC2 instances.  
 - Azure Arc for servers installed on your EC2 instances. Autoprovisioning is recommended and requires the **Owner** role on the Azure subscription.  
   Ensure that you fulfilled the [network requirements for Azure Arc](/azure/azure-arc/servers/network-requirements?tabs=azure-cloud).
diff --git a/articles/defender-for-cloud/recommendations-reference-api.md b/articles/defender-for-cloud/recommendations-reference-api.md
@@ -47,16 +47,28 @@ To learn about actions that you can take in response to these recommendations, s
 
 ### Unused API endpoints should be disabled and removed from Function Apps (Preview)
 
-**Description & related policy**: 	API endpoints that haven't received traffic for 30 days are considered unused and pose a potential security risk. These endpoints may have been left active accidentally when they should have been deprecated. Often, unused API endpoints lack the latest security updates, making them vulnerable. To prevent potential security breaches, we recommend disabling and removing these HTTP-triggered endpoints from Azure Function Apps.
+**Description & related policy**: API endpoints that haven't received traffic for 30 days are considered unused and pose a potential security risk. These endpoints may have been left active accidentally when they should have been deprecated. Often, unused API endpoints lack the latest security updates, making them vulnerable. To prevent potential security breaches, we recommend disabling and removing these HTTP-triggered endpoints from Azure Function Apps.
 
 **Severity**: Low
 
 ### Unused API endpoints should be disabled and removed from Logic Apps (Preview)
 
-**Description & related policy**: 	API endpoints that haven't received traffic for 30 days are considered unused and pose a potential security risk. These endpoints may have been left active accidentally when they should have been deprecated. Often, unused API endpoints lack the latest security updates, making them vulnerable. To prevent potential security breaches, we recommend disabling and removing these endpoints from Azure Logic Apps.
+**Description & related policy**: API endpoints that haven't received traffic for 30 days are considered unused and pose a potential security risk. These endpoints may have been left active accidentally when they should have been deprecated. Often, unused API endpoints lack the latest security updates, making them vulnerable. To prevent potential security breaches, we recommend disabling and removing these endpoints from Azure Logic Apps.
 
 **Severity**: Low
 
+### Authentication should be enabled on API endpoints hosted in Function Apps (Preview)
+
+**Description & related policy**: API endpoints published within Azure Function Apps should enforce authentication to help minimize security risk. This is crucial to prevent unauthorized access and potential data breaches. Without proper authentication, sensitive data could be exposed, compromising the security of the system.
+
+**Severity**: High
+
+### Authentication should be enabled on API endpoints hosted in Logic Apps (Preview)
+
+**Description & related policy**: API endpoints published within Azure Logic Apps should enforce authentication to help minimize security risk. This is crucial to prevent unauthorized access and potential data breaches. Without proper authentication, sensitive data could be exposed, compromising the security of the system.
+
+**Severity**: High
+
 ## API management recommendations
 
 ### API Management subscriptions shouldn't be scoped to all APIs
diff --git a/articles/defender-for-cloud/release-notes-archive.md b/articles/defender-for-cloud/release-notes-archive.md
diff --git a/articles/defender-for-cloud/remediate-server-secrets.md b/articles/defender-for-cloud/remediate-server-secrets.md
diff --git a/articles/defender-for-cloud/support-matrix-defender-for-cloud.md b/articles/defender-for-cloud/support-matrix-defender-for-cloud.md
diff --git a/articles/defender-for-cloud/tutorial-protect-resources.md b/articles/defender-for-cloud/tutorial-protect-resources.md
