Merge pull request #53419 from riswinto/main

update to replace bulleted lists

Author: prmerger-automator[bot]

learn-pr/wwl-sci/purview-data-loss-prevention-understand-plan/includes/plan-design-policies.md

@@ -20,7 +20,7 @@ DLP can run across many workloads, but enforcement shouldn't begin everywhere at
 - Where blocking would cause the most disruption
 - Where visibility is more valuable than control early on
 
-Beginning with visibility gives you behavioral insight before introducing restrictions.
+In many cases, visibility provides more value than control at the start. Observing how data moves and which actions are most common helps establish a baseline before restrictions are introduced. That insight makes it easier to introduce enforcement in places where it reduces risk without interrupting legitimate work.
 
 ## Scope policies intentionally
 

learn-pr/wwl-sci/purview-data-loss-prevention-understand-plan/includes/understand-deployment-simulation-mode.md

@@ -45,26 +45,15 @@ These reviews help ensure that enforcement decisions are based on evidence, not
 
 ## Using alerts and activity insights to validate policy behavior
 
-Simulation results appear through alerts and activity insights. These views show where and how a policy would have applied.
+Simulation results surface through alerts and activity insights, which together show where and how a policy would have applied. Alerts highlight individual events that meet policy conditions, while activity insights help reveal broader patterns across users, locations, and actions.
 
-Use this data to:
-
-- Identify false positives
-- Understand patterns of risky behavior
-- See where enforcement might interrupt legitimate workflows
-
-Using this data to refine scope and actions improves accuracy before enforcement begins.
+Reviewing both views helps clarify whether detections align with real risk or reflect normal business activity. This context is essential for understanding where enforcement might interrupt legitimate workflows and where policy logic needs refinement before actions are applied.
 
 ## Common rollout mistakes and how to avoid them
 
-Several issues appear consistently in rushed deployments:
-
-- Enforcing policies without first observing real behavior
-- Applying broad scope without piloting
-- Blocking actions before users understand expectations
-- Treating simulation as optional rather than foundational
+Problems often arise when policies are enforced before there's enough evidence to understand their effect. Broad scoping, early blocking, or treating simulation as optional can lead to false positives, user frustration, and reduced trust in DLP controls.
 
-Avoiding these mistakes leads to smoother adoption and more effective protection.
+A more deliberate approach uses simulation to observe real behavior first, adjust scope and actions based on that evidence, and introduce enforcement only when confidence is high. This reduces disruption while keeping protection aligned with actual risk.
 
 ## A recommended rollout approach