Merge pull request #5667 from MicrosoftDocs/main

[AutoPublish] main to live - 11/19 01:33 PST | 11/19 15:03 IST

Author: m365-skilling-repo-management[bot]

defender-endpoint/microsoft-defender-endpoint-android.md

@@ -56,7 +56,7 @@ This article describes how to install, configure, update, and use Defender for E
 
 - Intune Company Portal app should be downloaded from [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal) and installed for seamless onboarding. Device enrollment is required for Intune device compliance policies to be enforced.
 
-- Mobile phones and tablets running Android 8.0 and above. **(Note: Microsoft Defender is ending support for Android 8, 8.1 and 9 versions on April 30, 2025, after that device running on Android version < 10 won't be supported)**
+- Mobile phones and tablets running Android 10.0 and above. 
 
 **What does it mean devices running on unsupported Android version?** 
 

defender-for-identity/link-unlink-account-to-identity.md

@@ -66,12 +66,13 @@ Follow these steps to manually link accounts to a selected identity.
 
     :::image type="content" source="media/link-unlink-account-to-identity/accounts-observed-in-organization.png" alt-text="Screenshot that shows the accounts observed in an organization." lightbox="media/link-unlink-account-to-identity/accounts-observed-in-organization.png":::
 
-1. Select one or more accounts from the table. You must select at least one account to continue.
+1. Select the **Link** button.
 1. You can search by:
     - Display name
     - User principal name (UPN)
     - Security identifier (SID)
     - Source provider account
+1. Select one account from the table.
 1. Select **Next**.
 1. Enter a short justification comment explaining why you're linking these accounts.
 1. Your justification must:
@@ -89,7 +90,7 @@ Follow these steps to manually unlink accounts from a selected identity.
 
 1. Go to **Identity Inventory > Observed in organization**
 1. Open the **Accounts** tab.
-1. Select one or more account groups.
+1. Select one account set from the table.
 1. Select **Unlink account**.
 1. A confirmation dialog appears with the identity name.
 1. Review the message and select **Unlink accounts** to confirm.

defender-xdr/media/security-copilot-m365d-incident-summary/copilot-settings-preferences.png

@@ -83,6 +83,37 @@ To summarize an incident:
 
    :::image type="content" source="/defender/media/copilot-in-defender/incident-summary/incident-summary-options.png" alt-text="Screenshot that shows the actions available on the incident summary card.":::
 
+### Manage Copilot incident summaries settings (preview)
+
+By default, Copilot generates a summary for each incident the user opens, but you can change this setting to display incident summaries only in specific instances. You can choose to have summaries generated:
+
+- Always (for every incident opened)
+- Based on the severity level of the incident
+- On demand only
+
+To change the settings for Copilot incident summaries in Microsoft Sentinel, follow these steps:
+
+1. Go to **System** > **Settings** > **Copilot in Defender** in the Microsoft Sentinel navigation pane.
+
+    :::image type="content" source="media/security-copilot-m365d-incident-summary/copilot-settings.png" alt-text="Screenshot that shows the Copilot settings page in Microsoft Sentinel.":::
+
+1. Under **Preferences**, select **Incident Summary generation**.
+1. Select either **Auto-generate** or **Generate on demand**, depending on your preference.
+1. If you select **Auto-generate**, choose between **Always** or **Incident severity**. If you select **Incident severity**, choose the *minimum* severity level for which you want Copilot to generate incident summaries automatically.
+
+    :::image type="content" source="media/security-copilot-m365d-incident-summary/copilot-settings-preferences.png" alt-text="Screenshot that shows the Copilot settings preferences page in Microsoft Sentinel.":::
+
+1. Select **Save**.
+
+- When you select **Incident severity**, an estimate of the number of incidents of each severity level reviewed per day is displayed, along with the estimated SCU consumption.
+
+    :::image type="content" source="./media/security-copilot-m365d-incident-summary/incident-severity.png" alt-text="Screenshot that shows the approximate number of incidents of each severity level.":::
+
+- Copilot saves generated incident summaries for a week. If you select an incident whose summary is in the cache, and the incident hasn't changed significantly, the summary is automatically redisplayed at no cost regardless of the setting.
+- To generate a summary on demand for an incident that's not automatically generated, select the **Generate** button.
+
+    :::image type="content" source="media/security-copilot-m365d-incident-summary/generate-summary.png" alt-text="Screenshot that shows the Generate summary button on the incident page.":::
+
 ## Sample incident summary prompt
 
 In the Security Copilot standalone portal, you can use the following prompt to generate incident summaries: