docs(auditor/10.9): note effective permissions limitation for AD trusts in Azure Files SIT reports

docs/accessanalyzer/2601/connectors/activedirectory.md

@@ -39,10 +39,10 @@ Open the following ports on all domain controllers you want to scan:
 | Port | Protocol | Description |
 |------|----------|-------------|
 | 389 | TCP | LDAP |
-| 636 | TCP | LDAPS (when SSL is enabled) |
+| 636 | TCP | LDAPS (when you enable SSL) |
 | 135–139 | TCP | RPC |
 | 49152–65535 | TCP | RPC dynamic ports |
 
 ## Next steps
 
-Once requirements are met, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan.
+After you meet these requirements, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan.

docs/accessanalyzer/2601/overview/keyconcepts.md

@@ -10,7 +10,7 @@ This page defines the core terminology used throughout Access Analyzer.
 
 ## Source Groups
 
-A **source group** is a named collection of related sources that share a common service account and configuration. Sources are the individual hosts or targets within a source group — for example, the specific file servers or domain controllers that Access Analyzer connects to and scans. Source groups are created through the **Connect Source** wizard, which handles source creation, scan configuration, and scheduling in a single workflow.
+A **source group** is a named collection of related sources that share a common service account and configuration. Sources are the individual hosts or targets within a source group — for example, the specific file servers or domain controllers that Access Analyzer connects to and scans. You create source groups through the **Connect Source** wizard, which handles source creation, scan configuration, and scheduling in a single workflow.
 
 - **File Server** source groups can contain multiple servers (for example, all file servers in a department)
 - **Active Directory** source groups can contain multiple domain controllers
@@ -21,14 +21,14 @@ Source groups simplify management by letting you configure shared settings (serv
 
 ## Service Accounts
 
-A **service account** stores credentials used to authenticate with data sources and identity providers. Supported credential types include:
+A **service account** stores the credentials that Access Analyzer uses to authenticate with data sources and identity providers. Supported credential types include:
 
 - **Username / Password** — Active Directory, CIFS/SMB file shares, and local groups
 - **Client ID + Secret** — Entra ID and SharePoint Online (access scans)
 - **Client ID + Certificate** — SharePoint Online state-in-time scans. Access Analyzer generates the certificate; you upload the public key to your Azure app registration.
 - **SSH Username / Key** — Edge scanners
 
-Service accounts are managed in **Configuration** > **Service Accounts** and can be shared across multiple sources.
+Manage service accounts in **Configuration** > **Service Accounts**. You can share a service account across multiple sources.
 
 ## User Roles
 
@@ -37,27 +37,27 @@ Access Analyzer has three roles:
 | Role | Responsibilities |
 | --- | --- |
 | **Administrator** | Full access: manages system configuration (sources, scans, connectors, service accounts, application settings) and user management (create accounts, assign roles, manage users). |
-| **User Admin** | User and role management only — creates accounts, assigns roles, and pre-provisions federated users. Cannot change system configuration. |
-| **Viewer** | Read-only access to data, reports, and dashboards. Cannot make changes. |
+| **User Admin** | User and role management only — creates accounts, assigns roles, and pre-provisions federated users. Can't change system configuration. |
+| **Viewer** | Read-only access to data, reports, and dashboards. Can't make changes. |
 
 For a full walkthrough of role assignment, see the [Quick Install — Roles](/docs/accessanalyzer/2601/install/quickinstall#roles) section.
 
 ## Connectors
 
-A **connector** is the component that performs the actual work of communicating with a source. Each source type has a corresponding connector that handles:
+A **connector** is the component that communicates with a source. Each source type has a corresponding connector that handles:
 
 - **Test connection** — Validates that credentials and network connectivity are correct
 - **Access scan / sync** — Enumerates files, folders, permissions, or identities
 
-Connectors are executed as Kubernetes Jobs and managed by the Connector API.
+Connectors run as Kubernetes Jobs, and the Connector API manages them.
 
 ## Edge Scanners
 
 An **edge scanner** is a lightweight, containerized agent that Access Analyzer deploys on demand to perform distributed scanning of remote environments. Edge scanners remove the need for a traditional proxy server — they run as short-lived Kubernetes Jobs, execute their scan, and terminate. There is no persistent agent process and no manual deployment required.
 
-Edge scanners are used for **Active Directory** and **File Server** sources. Entra ID and SharePoint Online connect directly from the Access Analyzer service and do not use edge scanners.
+**Active Directory** and **File Server** sources use edge scanners. Entra ID and SharePoint Online connect directly from the Access Analyzer service and don't use edge scanners.
 
-Edge scanners are registered in **Configuration** > **Source Groups** > **Scanners** and are associated with a service account using **SSH Username / Key** credentials. Scanner labels can be used to route specific scan executions to dedicated scanner pools — for example, to isolate production scanning traffic from non-production environments.
+Register edge scanners in **Configuration** > **Source Groups** > **Scanners** and associate each one with a service account that uses **SSH Username / Key** credentials. Use scanner labels to route specific scan executions to dedicated scanner pools — for example, to isolate production scanning traffic from non-production environments.
 
 For configuration details and best practices, see [Overview of Scanners](/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview).
 
@@ -68,13 +68,13 @@ A **scan** defines what to analyze and how. Access Analyzer supports several sca
 - **Access scans** — Enumerate files, folders, and permissions on data sources to identify who has access to what
 - **Sensitive data scans** — Classify file contents against detection patterns to find PII, credentials, PHI, and financial records
 - **Identity sync scans** — Synchronize users, groups, and roles from IAM sources (Active Directory Inventory, Entra ID Users/Groups/Roles)
-- **Local Users and Groups scans** — Collect local account data from file servers (auto-created when an access scan is enabled)
+- **Local Users and Groups scans** — Collect local account data from file servers (Access Analyzer creates these automatically when you enable an access scan)
 
-Scans can be run on demand or scheduled with a cron expression.
+You can run scans on demand or schedule them with a cron expression.
 
 ## Scan Executions
 
-A **scan execution** is a single run of a scan — the record produced each time a scan runs. It is distinct from the scan configuration itself, which defines what to scan and on what schedule.
+A **scan execution** is a single run of a scan — the record that Access Analyzer creates each time a scan runs. It is distinct from the scan configuration itself, which defines what to scan and on what schedule.
 
 Each scan execution captures a status (such as running, completed, or failed), start and end times, duration, and result details. Execution history is visible in **Configuration** > **Source Groups** > **Scan Executions**.
 
@@ -89,31 +89,31 @@ Access Analyzer maps identities to entitlements to show effective permissions an
 
 ## Sensitive Data Patterns
 
-A **pattern** is a detection rule used during sensitive data scans. Patterns match file content against regular expressions or classification models. Built-in patterns cover:
+A **pattern** is a detection rule that Access Analyzer applies during sensitive data scans. Patterns match file content against regular expressions or classification models. Built-in patterns cover:
 
 - **PII** — Personally identifiable information (names, addresses, SSNs, etc.)
 - **Credentials** — Passwords, API keys, tokens, and connection strings
 - **PHI** — Protected health information
 - **Financial Records** — Credit card numbers, bank accounts, financial data
 
-Patterns are organized into **taxonomies** — hierarchical groups of classification rules mapped to compliance frameworks (GDPR, CCPA, HIPAA, PCI DSS, GLBA, CMMC).
+Access Analyzer organizes patterns into **taxonomies** — hierarchical groups of classification rules mapped to compliance frameworks (GDPR, CCPA, HIPAA, PCI DSS, GLBA, CMMC).
 
 ## MIP Labels
 
-**MIP labels** are Microsoft Information Protection sensitivity labels that Access Analyzer reads from scanned files and surfaces alongside sensitive data findings. They are distinct from Sensitive Data Patterns — patterns detect content through classification rules, while MIP labels are labels already applied to files by Microsoft 365 users or automated policies.
+**MIP labels** are Microsoft Information Protection sensitivity labels that Access Analyzer reads from scanned files and surfaces alongside sensitive data findings. They are distinct from Sensitive Data Patterns — patterns detect content through classification rules, while MIP labels are labels that Microsoft 365 users or automated policies have already applied to files.
 
 - **File Server sources** — Access Analyzer reads MIP labels from scanned files and can apply labels to files based on scan findings.
-- **SharePoint Online sources** — Access Analyzer reads MIP labels from native SharePoint metadata. Label application is not supported for SharePoint Online.
+- **SharePoint Online sources** — Access Analyzer reads MIP labels from native SharePoint metadata. Access Analyzer can't apply labels to SharePoint Online files.
 
-Labels are synced from your Entra ID tenant. To make labels available, an Entra ID source group must exist and its **Users, Groups and Roles** scan must have run at least once. Once synced, labels are mapped to sensitive data types in **Configuration** > **Sensitive Data**.
+Access Analyzer syncs labels from your Entra ID tenant. To make labels available, an Entra ID source group must exist and its **Users, Groups, and Roles** scan must have run at least once. After the sync completes, map labels to sensitive data types in **Configuration** > **Sensitive Data**.
 
 ## Dashboards and Reports
 
 Access Analyzer includes pre-built dashboards and reports that surface findings from your scans. They update automatically after each scan run and are accessible directly from the web interface.
 
 ### Dashboards
 
-Two summary dashboards are embedded in the Access Analyzer interface:
+The Access Analyzer interface includes two summary dashboards:
 
 | Dashboard | What it shows |
 | --- | --- |
@@ -122,7 +122,7 @@ Two summary dashboards are embedded in the Access Analyzer interface:
 
 ### Pre-built Reports
 
-Reports are organized by source type and category:
+Access Analyzer organizes reports by source type and category:
 
 | Source | Categories |
 | --- | --- |

docs/auditor/10.9/admin/monitoringplans/azurefiles.md

@@ -22,8 +22,8 @@ Create monitoring plans for Azure Files to track file and folder changes across
 1. In the **Netwrix Auditor**, go to **Home > Monitoring Plans > + Add Plan**
 2. Select **Azure Files**
 3. Configure:
- - [Audit database (SQL)](/docs/auditor/10_8/admin/settings/auditdatabase)
- - [Notifications (SMTP or Exchange Online)](/docs/auditor/10_8/admin/settings/notifications)
+ - [Audit database (SQL)](/docs/auditor/10.9/admin/settings/auditdatabase)
+ - [Notifications (SMTP or Exchange Online)](/docs/auditor/10.9/admin/settings/notifications)
  - Plan name and description
  - Select **Add item now**
 
@@ -33,7 +33,7 @@ Create monitoring plans for Azure Files to track file and folder changes across
 - Option A – Storage Account → Enter **Storage Account Name, Subscription ID, Tenant Name, Application ID, Application Secret**
 - Option B – Subscription → Enter **Subscription Name, Subscription ID, Tenant Name, Application ID, Application Secret**
 
-**Tip:** If you have multiple storage accounts, use the subscription option for easier management
+**Tip:** If you have multiple storage accounts, use the subscription option to manage them from a single monitored item
 
 
 ### Step 3: Configure Monitoring Scope and Actions
@@ -44,37 +44,37 @@ Create monitoring plans for Azure Files to track file and folder changes across
 3. Select actions:
 
    - **Changes (Success/Fail)** → Track file creation, modification, deletion, and failed attempts
-     - **Successful** - Use this option to track changes to your data. It helps to find out who made changes to your files, including their creation and deletion
-     - **Failed** - Use this option to detect suspicious activity on Azure Files. It helps to identify potential intruders who tried to modify or delete files, etc., but failed to do it
+     - **Successful** - Use this option to track changes to your data. It shows who created, modified, and deleted your files
+     - **Failed** - Use this option to detect suspicious activity on Azure Files. It helps to identify potential intruders who tried to modify or delete files but failed
 
    - **Read Access (Success/Fail)** → Track file reads and unauthorized read attempts
      - **Successful** - Show successful attempts to read files
-     - **Failed** - Use this option to track suspicious activity. Helps find out who was trying to access your private data without proper justification.Enabling this option on public shares will result in a high number of events generated on Azure Files and the amount of data written to the Long-Term Archive
+     - **Failed** - Use this option to detect unauthorized attempts to read your data. Enabling this option on public shares generates a high volume of events on Azure Files and increases the amount of data Netwrix Auditor writes to the Long-Term Archive
 
 **Note:** Enabling read access auditing on public shares may generate high event volume
 
 **Tip:** Only enable read auditing where compliance requires it (e.g., HR, Finance)
 
-4. Add exclusions → e.g., service accounts that produce excessive logs
-
-- **Monitored object types** - Select from:
+4. **Monitored object types** - Select from:
  - Files
  - Folders
  - Shares
-- **Monitored actions** - Configure which file operations to track
+5. **Monitored actions** - Configure which file operations to track
+6. **Collect data for state-in-time reports** – Enable this option to have Netwrix Auditor store periodic snapshots of your Azure Files permissions. State-in-Time reports, including permission and effective access reports, require these snapshots. See [Configuring State-in-Time Data Collection for Azure Files](/docs/auditor/10.9/configuration/azurefiles/stateintime.md) for the snapshot schedule, historical snapshot import, and optional Active Directory integration for on-premises accounts and groups.
+7. Click **Save**
+
+### Step 4: Configure Exclusions (optional)
 
-### Step 5: Test Connection
+What you can exclude depends on the monitored item type:
 
-Click **Test Connection** to verify:
-- Microsoft Entra ID authentication
-- Storage account access
-- Audit log collection
+- **Azure Subscription items** – On the item's **Scope** tab, exclude specific **storage accounts** by name so Netwrix Auditor skips them entirely for this subscription.
+- **Azure Storage Account items** – On the item's **Scope** tab, use the **Omit List** to exclude specific shares, folders, or files (Universal Naming Convention (UNC) paths). Choose **All** to exclude an object from all data collection, or **SiT** to exclude it from State-in-Time snapshots only. See [Configuring the monitoring scope (omit lists)](/docs/auditor/10.9/configuration/azurefiles/stateintime.md#configuring-the-monitoring-scope-omit-lists) for details.
 
 ## Next Steps
 
 After creating the monitoring plan:
 1. **Verify data collection** is working
-2. **[Configure reports](/docs/auditor/10_8/admin/reports/overview)** as needed
-3. **[Set up alerts](/docs/auditor/10_8/admin/alertsettings/create/)** for important events
+2. **[Configure reports](/docs/auditor/10.9/admin/reports/overview)** as needed
+3. **[Set up alerts](/docs/auditor/10.9/admin/alertsettings/create/)** for important events
 
 For configuration requirements, see [Azure Files Configuration](/docs/auditor/10.9/configuration/azurefiles/overview.md)