Merge pull request #12523 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to master to sync with https://github.com/MicrosoftDocs/microsoft-365-docs (branch public)

Author: Angela Fleischmann

microsoft-365/commerce/subscriptions/cancel-your-subscription.md

@@ -25,7 +25,7 @@ ms.date: 01/20/2022
 
 # Cancel your subscription
 
-You can cancel your subscription at any time in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 356 admin center</a>. However, to receive a refund, you must meet certain refund eligibility requirements. For more information, see [Understand refund eligibility](#understand-refund-eligibility).
+You can cancel your subscription at any time in the <a href="https://go.microsoft.com/fwlink/p/?linkid=2024339" target="_blank">Microsoft 365 admin center</a>. However, to receive a refund, you must meet certain refund eligibility requirements. For more information, see [Understand refund eligibility](#understand-refund-eligibility).
 
 If you have multiple subscriptions to the same product, such as Microsoft 365 Business Premium, canceling one subscription won’t impact the purchased licenses or services inside the others.
 

microsoft-365/compliance/create-info-mgmt-policies.md

@@ -97,12 +97,12 @@ Adding an information management policy to a content type makes it easy to assoc
 
    3. The **Start a workflow** option is available only if you are defining a policy for a list, library, or content type that already has a workflow associated with it. You will then be given a choice of workflows to choose from.
 
-   4. In the **Recurrence** section, select **Repeat this stage's action…**and enter how often you want the action to reoccur.
+   4. In the **Recurrence** section, select **Repeat this stage's action…**, and then enter how often you want the action to reoccur.
 
       > [!NOTE]
       >  This option is only available if the action you selected can be repeated. For example, you cannot set recurrence for the action **Permanently Delete**.
 
-   5. Chose **OK**.
+   5. Choose **OK**.
 
 8. To enable auditing for the documents and items that are subject to this policy, choose **Enable Auditing**, and then specify the events you want to audit.
 
@@ -211,7 +211,7 @@ You need at least the Manage Lists permission to change the information manageme
 
 8. The **Start a workflow** option is available only if you are defining a policy for a list, library, or content type that already has a workflow associated with it. You will then be given a choice of workflows to choose from.
 
-9. Under **Recurrence**, choose **Repeat this stage's action…**and enter how often you want the action to reoccur.
+9. Under **Recurrence**, choose **Repeat this stage's action…** and enter how often you want the action to reoccur.
 
    > [!NOTE]
    >  This option is only available if the action you selected can be repeated. For example, you cannot set recurrence for the action **Permanently Delete**.
@@ -223,7 +223,7 @@ You need at least the Manage Lists permission to change the information manageme
 
 If information management policies have already been created for your site as site collection policies, you can apply one of the policies to a content type. By doing this, you can apply the same policy to multiple content types in a site collection that do not share the same parent content type.
 
- If you want to apply policies to multiple content types in a site collection, and you have a Managed Metadata Service configured, you can use Content Type Publishing to publish out information management polices to multiple site collections. See the section [Apply a policy across site collections](#apply-a-policy-across-site-collections) for more information.
+ If you want to apply policies to multiple content types in a site collection, and you have a Managed Metadata Service configured, you can use Content Type Publishing to publish out information management policies to multiple site collections. See the section [Apply a policy across site collections](#apply-a-policy-across-site-collections) for more information.
 
 1. Navigate to the list or library that contains the content type to which you want to apply a policy.
 

microsoft-365/security/defender-endpoint/automated-investigations.md

@@ -83,6 +83,8 @@ Your organization must have Defender for Endpoint (see [Minimum requirements for
 
 Currently, AIR only supports the following OS versions:
 
+- Windows Server 2012 R2 (Preview)
+- Windows Server 2016 (Preview)
 - Windows Server 2019
 - Windows Server 2022
 - Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later

microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus.md

@@ -123,7 +123,7 @@ To do this:
 
     For this example, the file share is:
 
-    \\fileserver.fqdn\mdatp$\wdav-update
+    \\\fileserver.fqdn\mdatp$\wdav-update
 
 ### Set a scheduled task to run the PowerShell script
 

microsoft-365/security/defender-endpoint/device-discovery-faq.md

@@ -48,23 +48,23 @@ In this mode endpoints onboarded to Microsoft Defender for Endpoint can actively
 
 ## Can I control which devices perform Standard discovery?
 
-You can customize the list of devices that are used to perform Standard discovery. You can either enable Standard discovery on all the onboarded devices that also support this capability (currently Windows 10 devices only) or select a subset or subsets of your devices by specifying their device tags. In this case, all other devices will be configured to run Basic discovery only. The configuration is available in the device discovery settings page.
+You can customize the list of devices that are used to perform Standard discovery. You can either enable Standard discovery on all the onboarded devices that also support this capability (currently Windows 10 or later and Windows Server 2019 or later devices only) or select a subset or subsets of your devices by specifying their device tags. In this case, all other devices will be configured to run Basic discovery only. The configuration is available in the device discovery settings page.
 
 ## Can I exclude unmanaged devices from the device inventory list?
 
 Yes, you can apply filters to exclude unmanaged devices from the device inventory list. You can also use the onboarding status column on API queries to filter out unmanaged devices.
 
 ## Which onboarded devices can perform discovery?
 
-Onboarded devices running on Windows 10 version 1809 or later, or Windows 11 can perform discovery. Servers cannot perform discovery at this point.
+Onboarded devices running on Windows 10 version 1809 or later, Windows 11, Windows Server 2019, or Windows Server 2022 can perform discovery.
 
 ## What happens if my onboarded devices is connected to my home network, or to public access point?
 
 The discovery engine distinguishes between network events that are received in the corporate network versus outside of the corporate network. By correlating network identifiers across all tenant's clients, events are differentiated between ones that were received from private networks and corporate networks. For example, if the majority of the devices in the organization report that they are connected to the same network name, with the same default gateway and DHCP server address, it can be assumed that this network is likely a corporate network. Private network devices will not be listed in the inventory and will not be actively probed.
 
 ## What protocols are you capturing and analyzing?
 
-By default, all onboarded devices running on Windows 10 version 1809 or later, or Windows 11 are capturing and analyzing the following protocols:
+By default, all onboarded devices running on Windows 10 version 1809 or later, Windows 11, Windows Server 2019, or Windows Server 2022 are capturing and analyzing the following protocols:
 ARP, CDP, DHCP, DHCPv6, IP (headers), LLDP, LLMNR, mDNS, MNDP, NBNS, SSDP, TCP (SYN headers), UDP (headers), WSD
 
 ## Which protocols do you use for active probing in Standard discovery?

microsoft-365/security/defender-endpoint/enable-attack-surface-reduction.md

@@ -153,7 +153,7 @@ You can use Microsoft Endpoint Manager (MEM) OMA-URI to configure custom ASR rul
 
    - In **Name**, type a name for the rule.
    - In **Description**, type a brief description.
-   - In **OMA-URI**, type or paste the specific OMA-URI link for the rule that you are adding. Refer to the MEM section earlier in this article for the OMA-URI to use for this example rule. For attack surface reduction rule GUIDS, see [Per rule descriptions](attack-surface-reduction-rules-reference.md#per-rule-descriptions) in the topic: Attack surface reduction rules.
+   - In **OMA-URI**, type or paste the specific OMA-URI link for the rule that you are adding. Refer to the MDM section in this article for the OMA-URI to use for this example rule. For attack surface reduction rule GUIDS, see [Per rule descriptions](attack-surface-reduction-rules-reference.md#per-rule-descriptions) in the topic: Attack surface reduction rules.
    - In **Data type**, select **String**.
    - In **Value**, type or paste the GUID value, the \= sign and the State value with no spaces (_GUID=StateValue_). Where:
 

microsoft-365/security/defender-endpoint/images/mdatp-portal-overview.png

@@ -377,6 +377,12 @@ Download the onboarding package from Microsoft 365 Defender portal.
         ```bash
         mdatp health --field real_time_protection_enabled
         ```
+        
+      If it is not enabled, execute the following command:
+      
+       ```bash
+        mdatp config real-time-protection --value enabled
+        ```
 
     - Open a Terminal window and execute the following command:
 

microsoft-365/security/defender-endpoint/linux-install-manually.md

@@ -68,6 +68,8 @@ Delegated (work or school account)|Machine.Offboard|'Offboard machine'
 POST https://api.securitycenter.microsoft.com/api/machines/{id}/offboard
 ```
 
+The machine ID can be found in the URL when you select the device. Generally, it is a 40 digit alphanumeric number that can be found in the URL.
+
 ## Request headers
 
 Name|Type|Description

microsoft-365/security/defender-endpoint/offboard-machine-api.md

@@ -41,10 +41,7 @@ You can use <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="
 
 ## Microsoft 365 Defender
 
-When you open the portal, you'll see:
-
-- (1) Navigation pane (select the horizontal lines at the top of the navigation pane to show or hide it)
-- (2) Search, Community center, Localization, Help and support, Feedback
+When you open the portal, you'll see the Navigation pane (select the horizontal lines at the top of the navigation pane to show or hide it).
 
  ![Microsoft Defender for Endpoint portal.](images/mdatp-portal-overview.png)